Canterbury District Health Board last night began issuing apologies to patients after a coding error in a local medical appointment system allowed hundreds of people booking appointments to receive a Covid-19 vaccine to potentially view the details of others.
The system, which was available for use from 8am Friday, was taken down that same night after the discovery was made by "a member of the public with strong technical skills", the Ministry of Health said yesterday in a statement.
The Canterbury DHB today confirmed the details of 714 individuals who had registered with the system were potentially able to be viewed. The figure is two fewer than what was reported yesterday.
The details included name, gender, age, and NHI number but no personal health information.
The Canterbury DHB rang 50 people last night apologising for the incident and informing them of the actions now being undertaken, the Ministry of Health said in a statement today.
"The key concern of many of those contacted was that their booked vaccinations would go ahead as planned – which they will. This process of contacting individuals continues today," the health ministry said.
Names, ages and NHI numbers of more than 700 people were visible.
"Where individuals are unable to be contacted by phone, the DHB will be making contact through email."
The ministry said a "relatively small number of people were understandably upset" following Friday's discovery.
"Again, the DHB has apologised and has also explained that the appointment system remains offline until the issue is rectified and the system thoroughly tested."
At this stage, the booking issue is limited to the Canterbury DHB and to household members of frontline border workers at that DHB who had been invited to make appointments to be vaccinated, the ministry said.
Several other DHBs are now considering similar interim public booking systems.
"They will now wait for the issues identified with the system to be rectified and checked before deciding whether to proceed."
The ministry said the Hutt Valley and Capital & Coast DHBs are using a different version of the booking system used in Canterbury, but access is password protected and only available to DHB staff on their internal network.
While the DHBs were not planning to use the public facing website prior to the incident, a review is now underway into the security of their internal system.
No other DHBs are using the system for making Covid-19 vaccination appointments.
"At this stage, there is no evidence of any malicious breach, access to this information or sharing of it further and the DHB is investigating further," the ministry said.
Individuals with questions or concerns about the booking system coding error should in the first instance ring Healthline on 0800 358 5453.
No calls from anyone affected by the incident have been made to Healthline as of 11am today.
A national booking system, using different software to Canterbury’s interim booking system and using a different IT approach, is currently being developed by the Ministry of Health to support scaling of the vaccine programme.
SHARE ME