The facts
The PCPD said its investigation into an April data leak at the United Christian Hospital found the Hospital Authority had not taken all practicable steps required by the privacy ordinance and issued an enforcement notice. [1][2]
The watchdog cited insufficient oversight of contractor access and activity, a lack of role-based access controls on a contractor-managed system, and inadequate security risk assessments and audits. [1][2][4]
Hospital Authority figures reported by RTHK put the affected total above 56,000, including more than 55,000 patients and 482 current or former staff in the Kowloon East Cluster. [2][3]
The affected information included patient names, Hong Kong identity-card numbers, sex, birth dates, hospital registration numbers, surgery details and appointment dates; staff names and job titles were also involved. [2][3]
The Authority accepted the findings and recommendations and said it would take follow-up action. RTHK reported that police had arrested a contractor employee in connection with the April leak. [2][3]
Relevant context
The original leak was detected on 3 April during maintenance work involving a contractor’s system, according to the Hospital Authority’s response. [3]
Still unconfirmed
- The regulator’s public page was accessible but returned no readable text in the page viewer; the findings above are cross-checked against RTHK and 881903 reporting and the Authority response.
- The sources reviewed do not establish whether the stolen data was subsequently used for fraud or other misuse.
Sources
References support the numbered facts above. Source checks: 2 Nov 2026, 02:15 UTC.
The PCPD’s official statement and the Authority’s response pages were opened but not readable in the web viewer. The precise findings and enforcement action are reported in RTHK’s opened article and independently echoed by Commercial Radio 881903; the original April event is also supported by the Authority’s earlier statement.
- Investigation findings on the Hospital Authority patient-data breach
Hong Kong Office of the Privacy Commissioner for Personal Data · Primary source · 30 Oct 2026
Official regulator statement page opened; the page viewer exposed no readable text, so the finding is attributed to direct RTHK and 881903 reports.
- Privacy commissioner finds Hospital Authority failures caused United Christian Hospital data leak
RTHK · Reporting · 30 Oct 2026
Full article opened; it reports the regulator’s findings, enforcement notice, affected groups and data categories.
- Hospital Authority response to PCPD investigation findings
Hong Kong Hospital Authority / Information Services Department · Primary source · 30 Oct 2026
Official response page opened; page viewer returned no readable lines. RTHK reports the Authority accepted the findings.
- Privacy commissioner rules Hospital Authority breached data ordinance
Commercial Radio Hong Kong (881903) · Reporting · 30 Oct 2026
Independent Hong Kong radio report found in current search; the site’s JavaScript-only page was not readable in the page viewer. It independently lists the three regulator-identified failures.