Audit of PathWest’s Laboratory Information System reveals open access to West Australians’ medical tests

Thousands of West Australians’ sensitive medical information collected by PathWest was put at significant risk of “unauthorised and inappropriate” access, an alarming new report has revealed. But the shock findings were only tabled in Parliament after PathWest was allowed time to fix the problem. An audit of PathWest’s Laboratory Information System identified major weaknesses, which Auditor General Caroline Spencer said “put the confidentiality and integrity” of drug, cancer and infection tests at risk of “unauthorised and inappropriate” access. PathWest operates the sole forensic laboratory in WA and carried out 13.6 million tests in 2023-24, including 20,000 tests for the coroner and police. “We found encryption was not used to protect the sensitive information stored in (software) or sent across the health network, and weak encryption was used when test results were downloaded by external parties, such as general practitioners,” Ms Spencer said. “The findings highlight critical vulnerabilities in how this sensitive data was secured, accessed and shared.” Ms Spencer said it was in the public interest to delay publishing the report, until “critical system vulnerabilities” were addressed. “Western Australians should feel confident their sensitive medical information is secure and protected and these findings show PathWest was not meeting that expectation,” she said. “My Office recently reviewed PathWest’s remediation work and its plans to remediate remaining weaknesses by today. “I am now comfortable these efforts have reduced a significant amount of risk.” Premier Roger Cook called the report an important reminder of securing sensitive medical information, but was assured the risk had since been reduced. “Obviously we expect all our health service providers to manage the very highest level of standards when it comes to privacy and the protection of patients,” he said in Monday. “PathWest has now addressed almost all of the audit findings and is on track to address the remaining findings in the coming weeks. “Some of it comes down to data security and encryption, and those issues are being addressed in the appropriate way, through the technology that’s available. “The other is to maintain a culture of privacy and confidentiality and that’s another important reminder.” But Shadow Health Minister Libby Mettam questioned whether a lack of Ministerial oversight was to blame for not detecting the risk sooner. “Patient privacy and data protection must be treated as fundamental priorities,” she said. “Yet this independent audit reveals major breaches and incompetence in yet another corner of the health portfolio. “It raises deeply concerning questions about the integrity of a system that continues to lurch from one crisis to the next, overseen by a revolving door of Health Ministers.” The report found that PathWest’s information system ran on unsupported software and hardware, resulting in an “elevated” risk of compromise by “threat actors”. Staff and vendor access was also not properly controlled, with more than 40 of the 259 staff who left in the year before the audit still able to access the system. Eight former staff used their system access after leaving, with the report noting that it was difficult to determine if any access was inappropriate.