The health secretary was caught on a live microphone admitting he was unaware of a data breach involving confidential patient information at his own GP practice until asked about it at a virtual conference.
Babylon Health, a telemedicine company that enables people to have GP consultations over video chat, admitted to the breach on Tuesday night. A software error in the company’s app had led to patients being presented with recordings of other users’ consultations with their doctors. At least three patients were affected, the company said, and none of them had viewed the videos.
Speaking at the virtual CogX festival, the health secretary, Matt Hancock, said he was unaware of the data breach, but that it did not affect his views on the value of private partnerships within the NHS. “What I care about is getting results,” Hancock said, “when companies will come and help in the middle of a pandemic. The honest truth is there is no way we would be able to deal with this without the support of the tech companies.”
After the panel had ended, the audio of Hancock’s conversation with his interviewer, the Telegraph’s Harry de Quetteville, continued to broadcast.
“[The] Babylon thing, I should have [known],” Hancock could be heard saying, “especially since they’re my GP.” After De Quetteville told him that the breach meant that someone may have been given access to his medical consultations, Hancock joked: “Honestly, they know more about my bunion than anybody.” The audio of the broadcast then cut off.
A spokesperson for the Information Commissioner’s Office (ICO) told the Guardian: “Babylon Health contacted the ICO regarding an incident and advice was provided.
“People’s medical data is highly sensitive information, not only do people expect it to be handled carefully and securely, organisations also have a responsibility under the law. When a data incident occurs, we would expect an organisation to consider whether it is appropriate to contact the people affected, and to consider whether there are steps that can be taken to protect them from any potential adverse effects.”
Niamh Muldoon, the senior director of trust and security at OneLogin, said that the breach remained a serious cause for concern.
“By allowing members of the public’s GP sessions to become public, they potentially revealed among the most sensitive information available about an individual’s health, which could in turn be leveraged by further cybercriminals using the information for social engineering campaigns.”
