320,000 Patient Prescription Records Leaked...Mass Referral of Medical Staff from Major Hospitals and Pharmaceutical Company Officials

To Prove Sales Performance
200,000 Sensitive Personal Data Leaked
"Victims Can Claim Compensation"

National Police Agency, National Investigation Headquarters.

[Asia Economy Reporter Lee Gwan-ju] Officials from a large general hospital and pharmaceutical companies who leaked sensitive information, including prescription records of 200,000 patients, have been collectively sent to the prosecution.

The Police Agency's Major Crime Investigation Division announced on the 22nd that a total of 50 people, including 27 officials from 17 large hospitals and pharmaceutical sales representatives, were sent to the prosecution on charges of violating the Personal Information Protection Act.

According to the police, they are suspected of leaking about 326,000 prescription records (approximately 200,000 patients) containing sensitive information of patients who were prescribed drugs produced and sold by pharmaceutical companies.

The leaked electronic prescription data was confirmed to contain patients' personal information such as name, date of birth, age, height, weight, diagnosis, prescribed drugs, and medical department. In particular, some hospitals reportedly recorded medical information that could significantly infringe on personal privacy, such as severe illnesses or psychiatric hospital admissions.

Police investigations revealed that this personal information leak was carried out for the purpose of proving pharmaceutical sales performance. Hospitals failed to take measures to secure the stability of personal information, and pharmaceutical companies neglected their duty of care and supervision to protect personal information.

The police began investigating after detecting signs of patient information leakage while investigating JW Pharmaceutical's rebate allegations in December last year. In cooperation with the Personal Information Protection Commission, the police are implementing corrective measures and notifying general hospitals where patient medical records were leaked about personal information protection standards to establish supplementary systems for each hospital.

A police official stated, "For victims of information leakage, notification procedures will be conducted through the leaking hospitals by written or other methods," adding, "Victims can claim damages against the leaking hospitals under the Personal Information Protection Act through the Personal Information Dispute Mediation Committee or the courts, and can also proceed with class-action lawsuits."