The HSE has paused the issuing of plastic medical cards, European Health Insurance Cards (EHIC), GP visit cards, drugs payment scheme cards, and long-term illness cards following a cyber-attack on the systems of an external provider of card-printing services.
The HSE said its systems were not compromised but it is understood that a small number of HSE records were accessed.
Earlier, the HSE said it had reported the incident to the Data Protection Commission and was assessing the “need to notify individuals whose data may have been impacted”.
A spokesperson for the Data Protection Commission said it has received a breach notification.
“The breach is currently being assessed,” the spokesperson said.
The Irish Patients’ Association said regardless of the number of records involved in the data breach, every patient whose information was accessed deserves to know.
“Outsourcing a service does not outsource responsibility,” said Stephen McMahon, Chairman, Irish Patients’ Association.
“The HSE remains accountable for protecting patients’ personal information, regardless of who provides the service.
“The HSE says healthcare services have not been affected, which is reassuring.
“Now it must be equally transparent about what happened, what data was involved, and what steps are being taken to prevent it happening again,” Mr McMahon said.
The HSE said that applicants for cards will receive a letter confirming their eligibility for the relevant scheme, which can be used as proof of eligibility as needed.
“Provisional Replacement Certificates providing the same entitlement to healthcare while abroad are being provided instead of plastic EHIC cards,” the HSE said.
“EHIC cards for adults are available through the HSE Health App which can be downloaded through the App Store and Google Play,” it added.
According to the HSE, all service providers, including GPs and pharmacies, normally use a digital channel to verify eligibility for any scheme, and as a result, there is no impact on access to healthcare services.
The HSE said the processing of applications for medical cards, and other health service schemes, is managed directly by the HSE and people’s eligibility is not affected.
“There is no impact on access to healthcare services, applications for medical cards, EHIC cards and other health service schemes are being processing as normal,” a spokesperson said.
The HSE said that once it was alerted by the external provider, its cyber security protocols were immediately activated.
“The HSE takes all breaches of data protection seriously and manages all breaches in line with data protection legislation and HSE policy,” a spokesperson said.
Details of the cyber-attack were first reported by RTÉ Raidió na Gaeltachta.