HSE to notify 100,000 patients over cyberattack data breach

The Department of Health spent €1m in 2021 reviewing IT processes following the cyberattack and the HSE incurred costs of €51m in its immediate response. Picture: PA

The HSE has sent 32,000 letters to patients whose data was breached during the cyberattack on its network in 2021, but only 220 people have responded.

HSE chief information officer Fran Thompson said about 100,000 notifications will be issued. Addressing the matter at a meeting of the Public Accounts Committee (PAC), he said: “They will be complete by April 2023. The latest figure I have is over 32,000 notification letters have been issued.” 

People can then access an online portal or telephone a support desk to find out how precisely they were affected.

“To date, about 220 people have requested further information,” he said.

Department of Health assistant secretary for health infrastructure Derek Tierney said: “We have not received any pre-litigation action letters yet." 

He pointed to six unrelated cyberattack cases pending in the EU, saying: “There will be a period of time to see how the European court rules on this as well.” 

The department spent €1m during 2021 reviewing IT processes following the cyberattack. 

“The HSE incurred costs of €51m in its immediate response to the attack," said Mr Watt.

Fine Gael TD Colm Burke was told University Maternity Hospital Limerick and The Coombe maternity hospital are the only additions planned regarding digital records. Picture: Gareth Chaney/ Collins

Speculation was also heard that the new children’s hospital may not take patients until 2025. This emerged during discussion on a 2018 decision involving the Department of Public Expenditure and Reform (DPER) appearing to link a national roll-out of digital records with installation in the new hospital.

The committee heard four maternity hospitals out of 19 have digital records, and Fine Gael TD Colm Burke was told University Maternity Hospital Limerick and The Coombe maternity hospital are the only additions planned.

“We have no allocation for a full national roll-out and that is the engagement that has to take place," said Mr Tierney.
However, DPER representative Eoin Dormer argued: “Ultimately I suppose the Department [of Health] is responsible for policy on EHRs [electronic health records] our department advises and [provides] our views and our feedback on the cost of these issues.” 

Mr Thompson defended work on the hospital, saying IT installation would not delay the opening. During this discussion, Green Party health spokeswoman Neasa Hourigan said: “If we go back to the timeline, let's say being optimistic, that’s the HSE’s words last week, that we are talking substantial completion sometime next year.

“Then maybe six to eight months, if we are being a little bit conservative, that brings us into 2025 for commissioning to be largely complete. The hospital would open around then, and then we are adding on let’s say three to four months for everything to turn on and talk to each other in terms of computers.” 

She concluded: “So now we are mid-to-third quarter 2025.” 

This was not disputed.