Hong Kong regulator faults hospital authority over vendor's data export

Hong Kong regulator faults hospital authority over vendor's data export

30 October 2026: Hong Kong's Privacy Commissioner for Personal Data has served an enforcement notice on the Hospital Authority after a developer employed by an outside vendor exported, without permission, the records of 56,243 people from a nursing system at United Christian Hospital, and the data surfaced on the dark web. The commissioner, Ada Chung Lai-ling, found that a contract banning unauthorised exports was not enough: the authority kept no logs of the vendor's activity, had no role-based access control on the system and had never assessed or audited it.

A vendor-run system the hospital could not log into

The system supports nursing work in the operating theatres at United Christian Hospital, in the Kowloon East cluster, and holds anaesthetic and perioperative records of surgical patients together with staff accounts. A service provider developed it and a vendor maintained it. The authority reported the breach on 3 April 2026 after its monitoring found patient data from the system on the dark web. The vendor's employee was arrested on suspicion of access to a computer with criminal or dishonest intent; the authority still cannot say exactly how the data left the system.

The affected people were 55,761 patients and 482 current or former staff. The data included names, Hong Kong identity card numbers, dates of birth, hospital numbers, details of surgical procedures and appointment dates.

Three failures the commissioner listed

The PCPD found the authority in breach of Data Protection Principle 4(1) of the Personal Data (Privacy) Ordinance, the duty to take all practicable steps to protect personal data, and named three causes.

First, monitoring. The authority's own security policy required log review, but because the vendor maintained the system the authority kept no access or export logs, did not ask the vendor for activity reports, and its IT staff had no credentials for the servers. Nobody from the hospital accompanied vendor staff into the server room.

Second, access control. The vendor had access to every record in the database and could technically export data, and the only barrier was a contract clause requiring the authority's approval first. Relying on that clause alone, the commissioner found, "was clearly insufficient to mitigate the relevant risks".

Third, assessment and audit. Policy required a risk assessment of high-risk systems at least every two years. None had been done for this one, the 2024 internal audit left it out, and the vendor had supplied no audit reports.

What the authority has changed

The authority has notified the people affected, ended the vendor's contract, replaced its remote access platform with software that blocks file transfers and keeps full audit logs, records remote support sessions, added endpoint and data protection controls, and started a central inventory of vendor systems. The enforcement notice directs further remedies; the PCPD's statement does not give a deadline.

The commissioner's checklist for outsourced systems

The PCPD used the case to remind organisations that hold large amounts of personal data of five measures when a vendor maintains their systems: contracts with mandatory security measures, penalties for unauthorised export, audit rights and immediate incident reporting; logs and export records kept independently of the vendor; least privilege, with export functions disabled or restricted by role; administrator credentials kept by internal staff rather than handed to the vendor; and regular risk assessments and independent audit reports for high-risk outsourced systems.

Our privileged access management software category lists 16 products and our vendor management software category 13.

Related on TrustList:

• Dated obligations ahead: what falls due from October 2026 to March 2027

Sources

• PCPD: Privacy Commissioner's Office Publishes Investigation Findings on the Data Breach Incident of the United Christian Hospital, 30 October 2026