The Department of Health announced today that it has referred to law enforcement agencies the case of a Dental House Officer (DHO) suspected of gaining unauthorised access to patients' medical records.

The department revealed that an enquiry from a member of the public had been referred it by the Electronic Health Record Registration Office. The enquiry was prompted by an SMS notification about his electronic health records being accessed by a healthcare officer from the department despite the fact he had not used any of the department’s services recently. 

Preliminary investigations by the department revealed that a DHO employed under non-civil service terms had repeatedly accessed the electronic medical records of 16 individuals without their consent. None of the individuals were the DHO’s patients, but he claimed to know them. 

The department has reported the case to the Office of the Privacy Commissioner for Personal Data, the Commissioner for Electronic Health Record and the Dental Council of Hong Kong, and has notified the individuals affected. The DHO has been suspended from duty.

To prevent similar incidents from reoccurring, the department said it will review and optimise internal system security measures.

It has also reminded all staff and healthcare personnel to strictly observe internal guidelines on information technology security and the use of eHealth.

The department said it attaches great importance to the conduct and integrity of its staff, including contract staff. It elaborated that in cases where employees are suspected of misconduct, thorough investigations will be conducted, with all cases being impartially.