[2026 National Assembly Audit] National University Hospitals Exposed Patients' and Employees' Full Names for 3 Years

Personal information exposed in 122 publicly released audit documents from Chungnam, Kyungpook and Chungbuk National University Hospitals
Names of 543 patients and employees exposed at Kyungpook National University Hospital alone

Chungnam National University Hospital, Kyungpook National University Hospital and Chungbuk National University Hospital had made documents from their internal audits publicly available for more than three years without properly removing patients' and employees' real names and health information, it has emerged.

On Oct. 8, Rep. Lee Sohee of the People Power Party said during the National Assembly Health and Welfare Committee's audit of national university hospitals that patients' and employees' real names and health information had been exposed for an extended period in documents released from the hospitals' internal audits. The documents could be downloaded from the Public Audit Portal, operated by the Board of Audit and Inspection, without logging in.

Lee Sohee, a People Power Party lawmaker on the National Assembly Health and Welfare Committee. Office of Rep. Lee Sohee

An inspection by Rep. Lee's office of publicly released internal audit documents from national university hospitals posted on the Public Audit Portal found 122 documents in which personal information had been covered in black but the underlying text had not actually been deleted: 55 from Chungnam National University Hospital, 51 from Kyungpook National University Hospital and 16 from Chungbuk National University Hospital. In 11 of those documents, including seven from Kyungpook National University Hospital and four from Chungnam National University Hospital, patients' identities or health information remained visible.

The oldest document was posted in April 2023 and remained publicly available for about three years and five months, until Oct. 3, when Rep. Lee's office alerted the hospital to the problem. Copying the text covered in black or checking it in another way revealed the underlying text.

During the audit, Rep. Lee showed a video revealing text beneath blacked-out boxes and said, "The black boxes weren't redactions; they were effectively showing where the sensitive information was." The president of Kyungpook National University Hospital said he understood that the hospital had "not deleted" the sensitive information and had only placed redaction marks over it. Asked whether there had been a review process before publication, he replied, "There were shortcomings in that regard."

A total of 543 names were exposed in documents released by Kyungpook National University Hospital. The information included the names and patient numbers of 34 patients who underwent genomic testing for breast cancer, as well as records of exposure to infections involving 211 employees. The employee-related records included 197 cases of tuberculosis exposure and cases involving exposure to human immunodeficiency virus (HIV). Rep. Lee's office clarified that the HIV-related information concerned exposure, not confirmed infections.

"Until our office raised the issue on Oct. 3, anyone could download the documents," Rep. Lee said. "The names of 543 people were exposed at just one hospital, Kyungpook National University Hospital, and we don't know how many people downloaded them."

She also raised concerns about notifying those affected. Rep. Lee said Kyungpook National University Hospital had also been sanctioned by the Personal Information Protection Commission in January 2026 after delaying notification of a personal information breach. In a written response submitted to the National Assembly, the hospital acknowledged its error and said it would notify those affected. Asked whether all 543 people would be notified, the hospital president replied, "That's my understanding."

In a publicly released audit report on its patient safety reporting system, Chungnam National University Hospital had left visible the names of patients involved in 96 patient safety incidents, details of the incidents, such as medication errors and falls, and the names and employee numbers of staff who reported them. "A report auditing patient safety has become a document that discourages patient safety reporting," Rep. Lee said. Asked whether he understood the seriousness of the problem, the hospital president replied, "I do."

Rep. Lee said Chungnam National University Hospital had become aware of the issue in 2024 but had not amended documents that were already posted, arguing that this was "a structural problem, not the mistake of a single employee." She called on the presidents of Chungnam National University Hospital, Kyungpook National University Hospital and Chungbuk National University Hospital to submit written reports on the results of notifications to those affected, measures to protect reporting employees and steps to prevent a recurrence.

After the audit was suspended for a recess, Rep. Lee said, "In 2021, evidence emerged that a North Korean hacking group had breached Seoul National University Hospital and stolen information on more than 810,000 patients. In January this year, Kangwon National University Hospital and Chonnam National University Hospital were also hit by ransomware attacks. Patient information is more sensitive than any other personal information, yet the hospitals effectively made information sought by hackers public themselves, without any hacking required." She added, "National university hospitals are places where people entrust their safety at their most vulnerable moments. They must also be institutions patients can trust with their information. I will press for answers on measures to prevent a recurrence and pursue legislation to strengthen oversight."

This content was produced with the assistance of AI translation services.