St. Luke’s probes data breach in mobile app

MANILA, Philippines — St. Luke’s Medical Center and the National Privacy Commission (NPC) are investigating a cybersecurity incident involving the hospital network’s mobile application that may have compromised personal information.

NPC spokesperson and Deputy Privacy Commissioner Jose Belarmino II confirmed that the commission received a personal data breach notification from the hospital network on Oct. 30.

READ: NPC warns: Misuse or leak of SALN data violates privacy law

The NPC is now reviewing the incident.

St. Luke’s stated that a third-party service provider operated the application, which they have since taken offline, isolated, and secured.

St. Luke’s said it has also tapped independent cybersecurity experts to conduct a comprehensive forensic investigation.

“We sincerely apologize for any concern or inconvenience this may cause. We remain deeply committed to safeguarding the data of the people we serve,” said St. Luke’s, which operates hospitals in Quezon City and Taguig. 

The data breach may have affected an unclear number of individuals.

St. Luke’s assured patients that its Electronic Medical Record system, which stores patient information used by hospital personnel, remained unaffected. The hospital confirmed that other clinical systems also did not get involved in the incident.

READ: Privacy commission sets eyes on data aggregators again amid text scams

The hospital said it will begin contacting individuals whose personal information may have been compromised.

“We encourage the public to be cautious of any communication asking for personal information and to verify the legitimacy of requests before sharing anything,” St. Luke’s said. “St. Luke’s will not reach out on its own to verify or collect personal information.” /pai