A new audit, tabled in Parliament, examines the controls over the COVID-19 contact registration system, finding that while there had been problems, these had now been fixed through legislation.
The audit aimed to gain assurance that the integrity, availability and confidentiality of information generated by, or stored on, SafeWA and related systems was appropriate.
Tabling the SafeWA – Application Audit Report, Auditor General, Caroline Spencer said while WA Health successfully delivered the SafeWA contact registration system under significant time pressure, the audit found that personal information collected through SafeWA had been used for purposes other than COVID-19 public health contact tracing.
“During the audit, the State Government introduced legislation to prevent this happening in the future and to align with the publicly-stated purpose that data is only being used for COVID-19 contact tracing,” Ms Spencer said.
“WA Health has addressed weaknesses identified in SafeWA related to log retention and change management and in the front-end web application used by WA Health contact tracers and the developer’s help desk staff.”
She said the process had a weak password policy and inconsistent use of multi-factor authentication.
Ms Spencer said people expected that their information collected through SafeWA, and other Government systems, would be safe and used in line with stated objectives.
‘There is limited public information about the access and use of information collected by other Government entities as part of contact-tracing efforts,” she said.
“Transparency around the use of personal information improves public awareness and trust in Government processes and will go a long way to ensure the success of contact tracing or other systems.”
The Auditor General said the PHOCUS system, which aggregated multiple sources of information for contract tracing, including SafeWA venue registration data, would be examined in a separate audit.
The Auditor General’s 19-page Report can be accessed at this PS News link.
