Patient data stolen in the Hospital Authority’s Kowloon East Cluster: access during contractor maintenance also needs tight control

30 October 2026

The incident and the later investigation

In a press release on 30 October 2026, the Hospital Authority said it noted that the Office of the Privacy Commissioner for Personal Data had completed its investigation and published a report that day. The report concerned a suspected incident in April in the Kowloon East Cluster, in which patient data was stolen and unlawfully uploaded to a third-party platform. The Authority accepted the findings and recommendations, and said it would follow them up.

The Authority said its routine monitoring had detected the suspected incident in April. It described the matter as an isolated case involving the management of data access by a contractor during maintenance of a peripheral clinical system, which led to some patient data being stolen. The Authority had reported the matter to the police and the Privacy Commissioner. The police later arrested a contractor employee on suspicion of access to a computer with dishonest intent. The cluster had notified the affected patients and staff through various channels and had apologised.

What was tightened afterwards

The Authority said it had strengthened oversight of contractors. These measures included requiring authorised hospital IT staff to accompany contractor personnel who access a system on site, and keeping a record of identity, purpose, time and equipment brought in or out; auditing data-access logs regularly; setting access rights by function and allowing data to be exported only in approved cases; and carrying out independent security risk assessments in line with its information security policy.

What this means for smaller firms

Even outside a hospital, many companies ask outside technicians or suppliers to log into their systems for repair or updates. Access that is too wide, unaccompanied work, and no record of who took data out, and when, can also lead to a leak.

Firms can start by checking who approves and accompanies an outside login, what data that person can see, whether data can be copied or exported, and whether access is taken back as soon as the work is finished.

This article is based on public reports and official statements. It is for general reference only, and is not legal advice. If you would like to discuss your own systems or security arrangements, please contact us.

Back to the blog