The Office of the Privacy Commissioner for Personal Data found on 30 October 2026 that the Hospital Authority breached the Personal Data (Privacy) Ordinance over a leak that exposed information on the dark web and affected 56,243 people. The regulator said the Authority had failed to take all practicable steps to protect the information and issued an enforcement notice requiring it to correct the breaches and prevent a recurrence.
The affected records came from a contractor-maintained perioperative care system used at United Christian Hospital to support operating-room nursing work. The system held surgical patients’ anaesthesia and perioperative records, as well as staff account information. Of those affected, 55,761 were patients and 482 were current or former employees of the Kowloon East Cluster.
The exposed information included patients’ names, Hong Kong identity-card numbers, sex, dates of birth, hospital registration numbers, surgical procedure details and appointment dates. Staff names and ranks or grades were also affected.
The regulator identified inadequate monitoring of contractors’ access and activity, insufficient role-based controls on the system, and weak security risk assessment and auditing. It said the sensitivity of patient information called for closer supervision and control of contractor access.
The investigation found that a contractor’s system developer exported the information without authorisation, but the Hospital Authority has not determined precisely how the export happened. Contractors had been allowed to access the system remotely or on site for maintenance after obtaining approval. The Authority accepted the findings and recommendations and says it has strengthened oversight: contractors accessing systems on site must now be accompanied by authorised hospital IT staff, with their identity, purpose, access time and equipment recorded. It also says it regularly reviews system access and contractor reports.