NHIS Distributed and Then Recalled Booklets Containing Patient Names and Resident Registration Numbers

3 Cases of Name and Resident Registration Number, 6 Cases of Name and Date of Birth
Sent by Mail to Nationwide Health Screening Institutions

The National Health Insurance Service (NHIS) distributed booklets containing patients' personal information, such as names and resident registration numbers, to health screening institutions nationwide, only to realize the issue belatedly and initiate a recall.

On the 2nd, NHIS announced that it had confirmed and taken action after discovering that some patients' personal information was exposed in about 10,000 educational materials sent by mail to health screening institutions nationwide at the end of last month. NHIS produces and provides educational materials annually to health screening institutions to guide them on how to claim and receive payment for screening costs.

National Health Insurance Service Signboard [Photo by National Health Insurance Service, Yonhap News]

This year's materials were mailed to screening institutions nationwide on the afternoon of the 20th of last month. However, on the morning of the 24th, four days later, NHIS confirmed that three cases of patient names and resident registration numbers and six cases of names and dates of birth were exposed without anonymization. While explaining how to use the system for screening institutions to claim costs from NHIS, the system screen was shown as an example, revealing patients' names and resident registration numbers.

In response, NHIS requested nationwide post offices to halt deliveries to minimize the risk of further spread or misuse of personal information, sent faxes to screening institutions asking them to return the educational materials, and proceeded with recalls through its nationwide branches.

By the 1st, all materials already delivered to screening institutions were recalled. For some shipments dispatched by the post office but not yet arrived at the screening institutions, NHIS plans to track their whereabouts and proceed with recalls.

NHIS reported the personal information leakage incident to the Personal Information Protection Commission and informed the patients whose information was exposed.

The NHIS apologized deeply for causing concern to the public and stated, "We will thoroughly manage the precious personal information of the public to prevent similar incidents from occurring."