Police Bust Alleged Hacking Ring Said to Have Targeted Public Hospitals in Guangzhou

(Guangzhou) — Police have busted a group of alleged hackers accused of stealing data from public hospitals in Guangzhou, and have also detained several pharmaceutical company representatives who allegedly paid the hacking suspects.

The hackers breached hospitals’ drug sales databases, including information on which doctors prescribed what medicines, and sold this information to pharmaceutical sales representatives who used the figures to bribe doctors, several local law enforcement officials told Caixin. Photocopies of the arrest warrants for over a dozen alleged hackers obtained by Caixin confirmed the charge.

Guangzhou police had detained several pharmaceutical sales reps and employees in charge of drug and medical equipment procurement at a few public hospitals on Monday and Tuesday, the sources briefed on the crackdown said. They didn’t reveal how many hospitals were affected, the volume of data stolen, or how long the hacking has been going on for. Guangzhou police didn’t respond to Caixin’s questions on Wednesday about the number of people detained.

“Panic could be felt in the WeChat messaging group for pharmaceutical sales representatives in Guangzhou because news about a fresh detention broke every few hours” over two days, said a member of the group who wished to remain anonymous.

Cash-strapped public hospitals in China have relied on profits from drug sales to shore up their bottom lines, and doctors’ incentives are tied to revenue from drugs. This has created a situation that has encouraged pharmaceutical sales representatives to bribe physicians to prescribe more expensive drugs and larger doses.

Sales teams had earlier tapped staff with access to hospital computer systems for information that could help them target physicians and other medics who are most likely to prescribe the company’s drugs, several pharmaceutical sales representatives told Caixin.

But now the practice of paying hackers or third-party software developers contracted by hospitals to break into hospitals’ computer systems has become more widespread, said one who asked not to be named. Leaked information includes such details as the quantity of a certain drug prescribed by a doctor at a specific hospital each month and is usually sold for about 800 yuan ($116) to 2,000 yuan per month, he said.

A string of scandals where pharmaceutical companies, including multinationals such as GlaxoSmithKline and Eli Lilly, were found to be offering kickbacks to doctors in the past has shed light on the extent of corruption at Chinese hospitals.

It has pushed up the retail prices of drugs. One medicine that is sold for about 100 yuan per box at some public hospitals in Guangzhou costs only 20 to 30 yuan to produce, according to a salesperson from a drug company in the southern Chinese city.

A large chunk of the markup, or about 50 yuan in this case, is used as “public relations expenditure” by sales teams to bribe doctors, hospital pharmacists and technicians overseeing medical devices, said the source, who wished to remain anonymous.

“Physicians have more influence and usually get at least 10% of the proceeds from the sale of drugs,” he said.

Widespread corruption and allowing public hospitals to profit from drug sales has led to soaring medical bills and been a source of public discontent for years.

That prompted the municipal government in Beijing to issue new rules in March, eliminating the markup on drugs sold at public hospitals, while easing price controls on some premium services for in-patient care to cover any shortfall in revenue. The Chinese capital was among the first in the country to introduce such sweeping reforms.

But to nip the problem in the bud, analysts said, the government must increase funding for public hospitals. At present, government funding covers only 10% of a health facility’s expenditure on average.

Lack of competition and transparency at state hospitals due to strict government controls was also partly to blame for the widespread corruption, said Zhu Hengpeng, a public policy researcher at the Chinese Academy of Social Sciences.

Chinese hospitals should give doctors the flexibility to change employers instead of tying them to a hospital the way civil servants are bound to a certain agency, Zhu said in an earlier commentary published by Caixin. This would motivate them to be more efficient and help reduce corruption, he said.

Plugging the Leaks

The sale of medical records, patient information and hospital drug sales data for a few hundred yuan has also raised concerns over privacy and data security.

The Supreme People’s Court and the state prosecutor’s office on Tuesday released a series of legal interpretations on the country’s criminal code and the 2016 Network Security Law in an effort to fight the abuse of private information. The top court has further clarified what constitutes a violation of privacy.

According to the new interpretation, it is a serious crime to illegally access or sell “50 different data items” about an individual’s travel itinerary, private correspondence, credit history or property ownership. It is also a crime to illegally access “500 data items” about an individual’s medical history. The Supreme Court did not offer details about what constitutes a “data item.”

It is also a criminal offense to disseminate information such as an individual’s name, ID number and photos and other private details published by internet vigilantes, according to the document.

Contact reporter Li Rongde (rongdeli@caixin.com)