Thousands of Australians may have been affected by a major privacy breach as the country’s biggest medical appointment booking app, HealthEngine, has been exposed for selling patient information to law firms.
If you’ve ever booked a doctors appointment online (and let’s be real, that’s how we’re all doing it), you’ve probably used HealthEngine before. So, it’s a little terrifying to think that your private information may have been given to third parties without your consent.
The Australian Competition and Consumer Commission (ACCC) launched legal action against HealthEngine after accusing the company of misleading conduct.
It was revealed by the ABC last year that HealthEngine has been giving private client information to third party law firms that were attempting to find personal injury clients. A leaked Slater and Gordon email revealed the “pilot program” that provided a daily list of potential clients that had given their health information to the booking app.
Approximately 135,000 users allegedly had their information sold to the law firm according to ACCC accusations.
“Patients were misled into thinking their information would stay with HealthEngine but, instead, their information was sold off to insurance brokers,” ACCC chairman Rod Sims said.
Private information such as names, phone numbers, emails and date of births were all allegedly sold as part of the program. The exact figure that HealthEngine allegedly earned from the data breach is unknown.
If found guilty, HealthEngine will face a $1.1 million fine per breach, but it is currently unknown how many breaches the ACCC is alleging took place. Considering the company reported a $13 million loss in 2017/18, these fines could be detrimental to the business.
“HealthEngine is confident that no adverse health outcomes were created and that personal information was not shared with referral partners unless the individual had expressly requested to be contacted,” Marcus Tan, Chief Executive of HealthEngine said.
The company also allegedly refused to post any negative reviews and edited approximately 3000 customer testimonials to avoid potentially bad comments.
“Front desk was excellent. The appointment made through HealthEngine didn’t show up at the practice even though I had the email confirming it. The receptionist fitted us in so we had a 20 min wait. They said HealthEngine often does this. Maybe that could be fixed to avoid confusion?” The original comment read, however only “Front desk was excellent”, was posted.
If this is found to be true, HealthEngine could be fined by the ACCC for their deceptive practices that allegedly took place between March 2015 and March 2018. Approximately 17,000 reviews were allegedly deleted during this time, with 3000 more being edited.
“The ACCC considers that the alleged conduct by HealthEngine is particularly egregious because patients would have visited doctors at their time of need based on manipulated reviews that did not accurately reflect the experience of other patients.”
Obviously doctoring reviews to make them sound positive is incredibly misleading, and the ACCC are not taking these allegations lightly. If caught, HealthEngine will face massive repercussions.
“Businesses who are not upfront with how they will use consumer data may risk breaching the Australian Consumer Law and face action from the ACCC,” Mr Sims said.
Court proceedings are currently underway, with the Australian Consumer Watchdog seeking penalties as well as an order that requires HealthEngine to contact affected customers and explain how they can attempt to reclaim their personal information.
“Our rapid growth over the years has sometimes outpaced our systems and processes and we sincerely apologise if that has meant we have not always met the high expectations of us,” Dr Tan admits.
Maybe this is a sign that we shouldn’t rely on apps to book our appointments for us? I think I might just give my doctor a call next time I need a check up!
