People in South Australia need real answers and real responses to yet another data breach.

The SA Ambulance Service has disclosed that the personal details of 28,000 patients have been stolen.¹

Those details include people’s name, date of birth, age, address, and in some cases, their pension number and health notes.

Juanita Fernando, chair of the Australian Privacy Foundation’s (APF’s) Health Committee said, “That’s prime fodder for identity theft and something we all need to take seriously.”

The Ambulance Service says the data was on a storage device that was stolen from a consultancy firm in July. The consultants had apparently held the data since the early 2000s.

There’s no indication that the device was encrypted – a basic security precaution.

Neither is there any indication that a proper risk assessment occurred before the Ambulance Service handed over the sensitive personal details about lots of South Australians to the consultants.

Fernando continued, “If you use an ambulance you should be able to have confidence that your private data will not end up in the hands of a consultant and disappear ten years later.”

She added, “Those people had no control over the data. The first they knew about the problem was reading it on the ABC website.”

The APF calls on the Ambulance Service to provide full disclosure of what has gone wrong. It is insufficient for the Service to say it “regrets” the theft.¹

The Foundation calls on the Service to immediately take steps to prevent similar problems.

Fernando concluded, “South Australians are entitled to solutions, not regrets and excuses.”

Media Contacts for Australian Privacy Foundation board members:

References

1. ABC News. SA Ambulance Service patients’ personal information stolen from consultancy firm, 10 November 2021. https://www.abc.net.au/news/2021-11-10/sa-ambulance-service-data-stolen/100608028