FOI 27-3429 – Review of 10% Sample MBS and PBS Data Decryption

Written by Claude Haiku 5.5 from the extracted text on 23 Oct 2026. It can miss or misread redacted and scanned pages. Check the source before relying on it.

This Protiviti internal audit, dated October 2016 and released under FOI 27-3429, reviews the re-identification of a 10% sample of linkable MBS and PBS patient claims data. The dataset was published on data.gov.au on 1 August 2016, and on 8 September 2016 University of Melbourne researchers decrypted the Service Provider Number from the 2014 MBS data. About 1,500 downloads occurred before access was suspended. The review identifies four root causes: untested encryption, unsettled data governance, no documented Deputy Secretary approval, and weak project and risk management. It rates two recommendations high risk and two medium, and it notes that a July 2016 ministerial brief had said patients could not be re-identified. The document contains no drug efficacy, safety or PBS listing data.