UODO will inspect MyDr after the leak of data of nearly 19 million Poles
A leak at one software provider may affect about 12,000 medical facilities. Each of them is responsible for its patients’ data as the controller.
The President of the Personal Data Protection Office (UODO) will carry out an inspection at MyDr, from which patient data was leaked. MyDr provides software to medical facilities. The inspection was announced on Thursday, 13 August, by the office’s deputy spokesperson Łukasz Kuligowski. A day earlier, the Ministry of Digital Affairs confirmed a cyberattack in which a database of more than 2 TB was stolen.
The database contained first names, surnames, PESEL numbers, phone numbers, and email addresses. It also included health data: notes from medical visits and information about prescriptions and medications. Estimates of the number of affected people vary depending on the source, from 18.8 million to nearly 19 million people. UODO, citing media reports, speaks of about 12,000 healthcare entities. The office notes that the full scale of the breach is not yet known.
Inspectors will check the technical and organizational measures applied by the company, as well as its risk analysis.
They will also determine whether those safeguards were regularly tested against changing threats.
MyDr is a data processor. The clinics and practices that entrusted it with patient data remain the controller. Prawo.pl reminds readers of the controller’s obligations under the GDPR (the EU General Data Protection Regulation). The controller has 72 hours to report the breach to UODO, counted from the moment it learns about it from the processor. In the event of high risk, it must also notify patients without undue delay. Patients may claim compensation from the controller under Article 82 of the GDPR.
Deputy Prime Minister and Digital Affairs Minister Krzysztof Gawkowski assured on Thursday that the stolen data had not been put up for sale. He urged people to place a restriction on their PESEL number. Information about leaks is available on the website bezpiecznedane.gov.pl. The District Prosecutor’s Office in Warsaw is supervising the investigation conducted by the Central Bureau for Combating Cybercrime. The perpetrators face up to three years in prison.
A company that entrusts customer data to an external provider still has the controller’s obligations, including the duty to report a breach.