News
‘A warning to us all’: What does the Medicare hack mean for GPs?
Amid revelations an OpenAI agent gained access to Medicare data, GPs are urged to be on high alert, particularly around the ‘sensitive data that our patients entrust us with’.
Prime Minister Anthony Albanese at the United Nations General Assembly in New York, announcing an AI agent had hacked Medicare. (Image: AAP/Mick Tsikas)
GPs have expressed their alarm – and the need to reinforce cyber security – after the Prime Minister revealed an OpenAI agent gained unauthorised access to the Services Australia website.
The Federal Government has announced a ‘forensic investigation’ backed by the Australian Signals Directorate into the access of Services Australia’s online reports portal in June.
OpenAI reportedly detected the breach in August, then emailed Services Australia via a public email address on 10 September.
Announcing the incident in New York on Wednesday, Prime Minister Anthony Albanese said he was informed last weekend and had expressed Australia’s ‘extreme concern’ to the CEO of OpenAI Sam Altman.
The online reports portal allowed users to analyse MBS and Pharmaceutical Benefits Scheme data by specific item numbers but has been inaccessible since last week.
Dr Sean Stevens, Chair of Specific Interests Digital Health and Innovation, stressed the importance of doctors and the public being able to trust new and evolving technology.
‘If these reports are accurate, the fact that an AI agent will have infiltrated Medicare and Medicare data without human oversight, is very, very concerning and really goes to the point that you have to have a human in the loop,’ he told newsGP.
‘The AI companies themselves are calling for regulation.
‘Unfortunately, it’s beyond any one national government. It really needs an international solution.’
OpenAI agents reportedly accessed both public and non-public information, as well as writing files to the internal Services Australia server.
Prime Minister Albanese said the Australian Institute of Health and Welfare and the Victorian Department of Health may also have been affected, along with the New South Wales Bureau of Crime Statistics and Research.
He said there is currently ‘no evidence that any individuals have been impacted’, nor of any broader compromise to the Services Australia network.
Dr Stevens, when asked if he felt there could be any knock-on effects to patient trust in new and evolving technology, said it is ‘somewhat reassuring’ to note there is no evidence individual data has been breached.
‘I’m sure that the government and the authorities will be improving and enhancing the protections for this highly sensitive data,’ he said.
However, Dr Stevens, who works as a clinical adviser to AI scribe Lyrebird, also described the incident as ‘a wake-up call’, urging GPs to ‘do everything you can to protect the data and not retaining any data that you don’t absolutely need to’.
‘These agents are only going to get exponentially better,’ he said.
‘We all need to have a very high degree of concern and precaution around the sensitive data that our patients entrust us with.
‘It is one of the bedrocks of trust between a patient and their doctor, and I think that we need to take this very, very seriously.’
The subject of cyber security was addressed in a high alert published by the Australian Signals Directorate on Thursday, aimed at ‘all Australian organisations with public-facing websites or applications’ and recommending action within 48 hours.
It advised Australian organisations to take the following steps:
- apply strong authentication, access controls, and network segmentation
- ensure vulnerabilities are identified and remediated promptly
- monitor systems for unusual activity and review security logs regularly
- apply patches to your systems as soon as practicable
- test controls and incident response procedures against AI-enabled threat scenarios.
Describing the OpenAI breach of Services Australia, it said an ‘AI agent independently identified vulnerabilities and attempted to progress actions without direct human authorisation to ensure it was able to complete the activity it was assigned’.
‘There is no indication that this activity represents a broader threat or malicious targeting against Australia.
‘However, this highlights the importance of secure AI deployment practices and maintaining strong cyber security fundamentals.’
It was a message echoed by RACGP President Dr Michael Wright, who described the breach as ‘a warning to us all’.
‘It just highlights how important it is we’re aware of the need to keep personal information safe – and health information is particularly sensitive,’ he told
newsGP.
He said the college is closely following the investigation.
‘The Prime Minister said that there’s currently no evidence that personal Medicare information was accessed and that’s reassuring,’ he said.
‘We will continue to engage with the Government to make sure GPs and our patients are properly informed about any risks if we find anything out further.’
The Services Australia online reports portal is no longer in use and instead directs users to a collection of spreadsheets hosted by the
data.gov.au website with MBS and PBS item details.
Log in below to join the conversation.
cyber security MBS Medicare PBS
newsGP weekly poll
Have you ever found out that a patient has previously failed to disclose their use of GLP-1 medicines to you as their usual GP?