From RNZ
Waikato District Health Board continues to be in the grip of a massive cyber attack and says its key focus is on cancer patients receiving radiation treatment.
A high level Government team, the Officials Committee for Domestic and External Security Co-ordination, met last night.
On the hospital floor, the key focus is on cancer patients receiving radiation treatment.
High-tech equipment has been rendered useless by the cyber attack, and the DHB fears that could compromise their condition.
Some patients requiring radiation treatment are being sent to Tauranga and Wellington, accompanied by clinical staff from Waikato to help ensure continuity of their treatment.
Any patient with cancer could die. Now could they die because of this? I think it's speculative.
The option of sending any patients to Australia is seen as a last resort, but cannot be ruled out.
Clinical director of radiation oncology Cristian Hartopeanu said they are 100 per cent reliant on computer technology and when the crash happened a week ago, they were in darkness.
They could not access any data on patients.
He said patients already receiving treatment have been identified and are being sent to the other centres, but new patients due for their first appointment can not all be identified at this stage.
"We have approximately 100 that we are confident that we have identified. They will be our next wave of priority to relocate them to other centres, so they can start their treatment. These were not people that had started but they would have been in the pipeline after they have seen us."
Hartopeanu said it is a slow process identifying these patients but he is confident they will.
"We are going through papers and we find the paper we think it could be then we check with the clinician, do you remember that three weeks ago you might have seen this person. It sounds primitive in the computer era, but we look at them and then there are some checks."
He said it is not an ideal situation for patients.
"It can go from very small compromise, a medium one and potentially a very high one."
Hartopeanu said interruption in treatment can compromise the outcome.
"Any patient with cancer could die. Now could they die because of this? I think it's speculative."
He is working on the premise it may be another month before systems are back up and running.
Cancer Society medical director Chris Jackson said patients who are being transferred to other parts of the country for treatment are feeling stressed.
"The impacts on patients are considerable being moved away from their home base. Fortunately the chemo treatments have proceeded but the uncertainty will be very stressful for patients and their families at this time.
"The ability to communicate directly with patients also is going to be impacted by the cyber attack and so I think people have noted they haven't had as much information as they would like, but it is very difficult in this environment."
Since the attack, three patients have been transferred to Auckland DHB for urgent care, and 15 clinically prioritised patients have been seen in private hospitals in Tauranga and Wellington.
Jackson said this is necessary, but there is not a lot of spare capacity in the public sector.
"The other centres around New Zealand are working extra to help support these patients because we all know this is just so important that people have the treatment that they need and that happens in a timely manner, so the sector is pulling together, but there is not a huge amount of slack in the system."
Jackson said the Cancer Society is working hard to support the patients and their families with accommodation and travel in areas where they need to go.
Waikato DHB chief executive Kevin Snee said there is still no definitive timeframe around getting the system back online.
"The recovery period could last for months, but the incident itself we should be in a better position to comment over the next few days on when we are likely to have things back up and running, but it's certainly going to run into next week."
Health Minister Andrew Little said the crisis response to the ransomware attack has been stepped up with the Ministry of Health increasing its resourcing of the dedicated response team.
Privacy Commissioner John Edwards is warning DHBs to address any security failings identified in a Ministry of Health stocktake of health IT systems in 2020.
Edwards said his office has been notified of the Waikato DHB ransomware breach and is monitoring the situation closely while providing advisory support.
"We are aware that some patient, staff, contractor and other personal information has been distributed to news media organisations by unknown individuals.
"Our expectation is that the DHB would notify and offer support to the individuals identified in that information without delay. We would also expect that the DHB would be actively monitoring for potential host sites on the Dark Web or elsewhere."
Edwards said his office is not investigating to determine any liability at this stage but if a DHB is found not to have taken adequate security measures to protect its information systems, it could be liable to any staff member, contractor or patient who suffers harm as a result.
"We understand from media reports that other DHBs may be aware of security vulnerabilities in their systems as a result of the audit undertaken last year.
"Our expectation would be that they should have taken, and if they have not should now take, steps to act on any deficiencies in security.
"If we find that any DHB does not have adequate security, we may issue compliance notices under the Privacy Act 2020, and if necessary, follow up with prosecutions," Edwards said.
Call for greater transparency on where insurers get their information from.