# Software bug at firm left NHS data 'vulnerable to hackers'

6 days ago

Ben Morris, Editor, Technology of Business

The NHS is "looking into" allegations that patient data was left vulnerable to hacking due to a software flaw at a private medical services company.

The flaw was found last November at Medefer, which handles 1,500 NHS patient referrals a month in England.

The software engineer who discovered the flaw believes the problem had existed for at least six years.

Medefer says there is no evidence the flaw had been in place that long and stressed that patient data has not been compromised.

The flaw was fixed a few days after being discovered.

In late February the company commissioned an external security agency to undertake a review of its data management systems.

An NHS spokesperson said: "We are looking into the concerns raised about Medefer and will take further action if appropriate."

Medefer's system allows patients to book virtual appointments with doctors, and gives those clinicians access to the appropriate patient data.

However, the software bug, discovered in November, made Medefer's internal patient record system vulnerable to hackers, the engineer said.

The software engineer, who does not want to be named, was shocked by what he uncovered.

"When I found it, I just thought 'no, it can't be'."

The problem was in bits of software called APIs (application programming interfaces), which allow different computer systems to talk to each other.

The engineer says that at Medefer those APIs were not properly secured, and could potentially have been accessed by outsiders, who would have been able to see patient information.

He said it was unlikely that patient information was taken from Medefer, but that without a full investigation, the company could not have known for sure.

"I've worked in organisations where, if something like this happened, the whole system would be taken down immediately," he said.

On discovering the flaw the engineer told the company that an external cybersecurity expert should be brought in to investigate the problem, which he says the company did not do.

Medefer says the external security agency has confirmed that it has found no evidence of any breach of data and that all the company's data systems were currently secure.

It says the process of investigating and fixing the API flaw was "extremely open".

Medefer said it had reported the issue to the ICO (Information Commissioner's Office) and the CQC (Care Quality Commission), "in the interests of transparency", and that the ICO had confirmed there is no further action to be taken as there is no evidence of a breach.

The engineer, who had been contracted in October to test for flaws in the company's software, left the company in January.

In a statement Dr Bahman Nedjat-Shokouhi, founder and CEO of Medefer, said: "There is no evidence of any patient data breach from our systems."

He confirmed that the flaw had been discovered in November and a fix was developed in 48 hours.

"The external security agency has asserted that the allegation that this flaw could have provided access to large amounts of patients' data is categorically false."

The security agency will complete its review later this week.

Dr Nedjat-Shokouhi added: "We take our duties to patients and the NHS very seriously. We hold regular external security audits of our systems by independent external security agencies, undertaken on multiple occasions every year."

---

## Related

### Car sharing switches to electric to boost appeal
2 days ago

### Man Utd co-owner's firm recalls SUVs over risk of doors flying open
2 days ago (Business)

### US tech firms feel pinch from China tariffs
3 days ago (US & Canada)

---

## More

### Warning notice served on NHS ambulance service
1 hr ago

The CQC says there have been multiple failures, including staffing levels and call wait times.
1 hr ago (England)

### 'My sister's kidney gave me a fabulous life'
6 hrs ago (Stoke & Staffordshire)

### Stress, burnout and hope: NHS workers speak out
9 hrs ago (London)

### Cornwall man sent cancer diagnosis text by mistake
9 hrs ago

### Few may mourn NHS England's demise, but what comes next is uncertain
16 hrs ago (Health)
```