Tasmania Police called in after ambulance patient details published online - ABC News
The private details of every Tasmanian who has called an ambulance since November last year have been published online by a third party in a list still updating each time paramedics are dispatched.
Key points:
Ambulance Tasmania uses a paging system in initial communications between the dispatch team and paramedics on the ground
Pager messages dating back to November have been uploaded to a website, which is still live and continually updating
The health union has described the data dump as "horrific"
The breach of Ambulance Tasmania's paging system has been described as "horrific" by the Health and Community Services Union, which has suggested the data dump could leave the Government open to litigation.
Pager messages include patients' personal details and condition as well as the address of the incident.
Information made public also includes a patient's HIV status, gender and age, raising concerns it could lead to discrimination or stigmatisation.
"It's unbelievable," state secretary Tim Jacobson said.
"If I were a patient I'd be upset, I'd be concerned, and I would want to know immediately both what the Government has done about closing off this but also what the Government's now doing or likely to do to address any real breaches of privacy for those patients."
Tasmanian ambulance in motion.
The website runs to more than 26,000 pages long of pager messages between emergency services.(Supplied: YouTube/Tasmania Emergency Photography)
According to internal training materials, Ambulance Tasmania's paging system is the primary method of initial communications between the agency's communications centre and paramedics on the ground.
The website is more than 26,000 pages long and also details call-outs within the Tasmania Fire Service. It provides brief details on incidents, including mental health call-outs.
University of Tasmania privacy expert Joel Scanlan said most patients would expect their data would be kept private.
"I don't think it's overly surprising, we've seen a few similar paging systems have similar breaches," he said.
"It's a situation where the infrastructure we have has not caught up to the expectations we have around our data."
The Tasmanian Government has committed more than half a billion dollars to upgrading the state's ailing emergency communications network.
In December, acting premier Jeremy Rockliff announced Telstra had been awarded the contract to deliver the Tasmanian Government Radio Network, or TasGRN.
Joel Scanlan smiles at the camera.
Joel Scanlan is not surprised by the data breach.(ABC News: Laura Beavis)
One action identified within the TasGRN project was the so-called Paging Project, which aimed to "replace critical end-of-life equipment and restore the paging network to a fit-for-purpose state".
It is unclear if the breach is connected to the Paging Project changeover.
Mr Jacobson said the breach went to broader issues within Ambulance Tasmania.
In 2019, a report from consultancy firm IPM Consulting found more than half of the 39 work health and safety requirements that were assessed were non-compliant with Australian and New Zealand standards, and another 13 were only partially compliant.
"This breach tells an absolute story about the internal management systems and processes that are in place in Tasmania's most critical services," he said.
Data upload 'referred to police'
In answer to the ABC's questions, a Tasmanian Government spokesperson said: "Enquiries are currently being undertaken as to the legal basis of the site."
"The site has gone off-line and work is being undertaken with the Australian Cyber Security Centre (ACSC) to pursue shutdown should it re-emerge."
In a statement on Friday afternoon, Health Minister Sarah Courtney said she was "very concerned to hear that the sensitive information of some Tasmanians had been posted to a website".
"After a discussion with the secretary of the Department of Health, Kathrine Morgan-Wicks, the matter of how this data interception from the Fire and Ambulance paging system has occurred has been referred to Tasmania Police.
"Appropriate steps have been taken by Ambulance Tasmania to limit the transmission of personal information via the paging system, balanced against the need to ensure patient and staff safety in responding to incidents is paramount."
Ms Courtney said it was her "understanding that access to the site has been blocked".
"This is an extremely concerning matter that will be further investigated, however I would like to reassure the Tasmanian Community that it is safe to call 000 in an emergency and we have taken steps to safely respond to this situation.
"I understand this may be distressing for those affected and I can assure Tasmanians that the Government is taking this matter incredibly seriously and I will take all necessary steps to protect the privacy of our patients."
Key points:
Ambulance Tasmania uses a paging system in initial communications between the dispatch team and paramedics on the ground
Pager messages dating back to November have been uploaded to a website, which is still live and continually updating
The health union has described the data dump as "horrific"
The breach of Ambulance Tasmania's paging system has been described as "horrific" by the Health and Community Services Union, which has suggested the data dump could leave the Government open to litigation.
Pager messages include patients' personal details and condition as well as the address of the incident.
Information made public also includes a patient's HIV status, gender and age, raising concerns it could lead to discrimination or stigmatisation.
"It's unbelievable," state secretary Tim Jacobson said.
"If I were a patient I'd be upset, I'd be concerned, and I would want to know immediately both what the Government has done about closing off this but also what the Government's now doing or likely to do to address any real breaches of privacy for those patients."
Tasmanian ambulance in motion.
The website runs to more than 26,000 pages long of pager messages between emergency services.(Supplied: YouTube/Tasmania Emergency Photography)
According to internal training materials, Ambulance Tasmania's paging system is the primary method of initial communications between the agency's communications centre and paramedics on the ground.
The website is more than 26,000 pages long and also details call-outs within the Tasmania Fire Service. It provides brief details on incidents, including mental health call-outs.
University of Tasmania privacy expert Joel Scanlan said most patients would expect their data would be kept private.
"I don't think it's overly surprising, we've seen a few similar paging systems have similar breaches," he said.
"It's a situation where the infrastructure we have has not caught up to the expectations we have around our data."
The Tasmanian Government has committed more than half a billion dollars to upgrading the state's ailing emergency communications network.
In December, acting premier Jeremy Rockliff announced Telstra had been awarded the contract to deliver the Tasmanian Government Radio Network, or TasGRN.
Joel Scanlan smiles at the camera.
Joel Scanlan is not surprised by the data breach.(ABC News: Laura Beavis)
One action identified within the TasGRN project was the so-called Paging Project, which aimed to "replace critical end-of-life equipment and restore the paging network to a fit-for-purpose state".
It is unclear if the breach is connected to the Paging Project changeover.
Mr Jacobson said the breach went to broader issues within Ambulance Tasmania.
In 2019, a report from consultancy firm IPM Consulting found more than half of the 39 work health and safety requirements that were assessed were non-compliant with Australian and New Zealand standards, and another 13 were only partially compliant.
"This breach tells an absolute story about the internal management systems and processes that are in place in Tasmania's most critical services," he said.
Data upload 'referred to police'
In answer to the ABC's questions, a Tasmanian Government spokesperson said: "Enquiries are currently being undertaken as to the legal basis of the site."
"The site has gone off-line and work is being undertaken with the Australian Cyber Security Centre (ACSC) to pursue shutdown should it re-emerge."
In a statement on Friday afternoon, Health Minister Sarah Courtney said she was "very concerned to hear that the sensitive information of some Tasmanians had been posted to a website".
"After a discussion with the secretary of the Department of Health, Kathrine Morgan-Wicks, the matter of how this data interception from the Fire and Ambulance paging system has occurred has been referred to Tasmania Police.
"Appropriate steps have been taken by Ambulance Tasmania to limit the transmission of personal information via the paging system, balanced against the need to ensure patient and staff safety in responding to incidents is paramount."
Ms Courtney said it was her "understanding that access to the site has been blocked".
"This is an extremely concerning matter that will be further investigated, however I would like to reassure the Tasmanian Community that it is safe to call 000 in an emergency and we have taken steps to safely respond to this situation.
"I understand this may be distressing for those affected and I can assure Tasmanians that the Government is taking this matter incredibly seriously and I will take all necessary steps to protect the privacy of our patients."
