Proof vaccine portal is open to abuse
Our reporter tested the HSE booking system by posing as a health worker and was offered a vaccine
THE Irish Mail on Sunday has received an appointment for vaccination by falsely posing as a health care worker on the HSE’s vaccination portal.
The health authority’s online booking platform is so prone to abuse that an MoS reporter was able to secure an appointment even after previously warning the HSE how easily non-healthcare workers could exploit loop holes.
Crucially, a text confirming the appointment made by this newspaper asked the MoS journalist to bring three things – photo ID, proof of PPS and the phone which the text message was sent to. They were not asked to bring work ID along to the appointment.
As such, had the reporter used their real name and real PPS to get a vaccination appointment – they would be in a position to attend at the clinic and test the robustness of the validation protocols there.
The MoS cancelled the appointment yesterday and informed the HSE about the situation – so as to make sure we had no adverse operational impact on the rollout of the highly sought-after vaccine.
These revelations are sure to leave HSE bosses red-faced as they come just days after our sister paper, the Irish Daily Mail, revealed that double booking of HSE workers contributed to the vaccination debacle at Dublin’s private Beacon Hospital in which leftover vaccines were given to teachers and staff at one of the country’s most exclusive private schools.
The jabs were given to staff and teachers at St Gerard’s school in Bray after the Beacon’s CEO Michael Cullen personally telephoned the school – where annual fees are €7,420 – to offer the staff vaccines.
The incident is just the latest in a series of queue jumping and leapfrogging gaffes which have beset the health authority since its vaccination programme was launched at the end of December.
The security weaknesses of the entire HSE booking system exposed by the MoS today is sure to mount further pressure on both the health authority’s boss Paul Reid and Health Minister Stephen Donnelly.
In order to test the checks and balances within the HSE’s online booking system, an MoS reporter logged into the health authority’s computer portal last month.
They were given an appointment to get a Covid-19 vaccine after submitting their own PPS number with the name of a fictitious healthcare worker based in Co. Kildare.
This appointment at the Citywest vaccination centre was issued SIX weeks after the MoS first alerted the HSE that its lax booking system was not able to identify bogus healthcare workers and it was also incapable of rejecting incorrect PPS numbers.
The MoS flagged the weaknesses in the online booking system last month after the same reporter gave their own name and used the PPS number of a relative.
Nevertheless the reporter received a text message on Friday confirming they had an appointment for a vaccine even though they had applied using a fictitious name but using their own PPS number.
Despite the name of the supposed healthcare worker clearly not matching the PPS number given, the reporter posing as a healthcare worker was still asked to bring the phone on which they received this text, photo ID and proof of their
‘We were not asked to bring work ID’
PPS number to the vaccine centre.
Significantly, there was no request made to bring work identification with them to the appointment which was scheduled for tomorrow.
This weekend, the MoS again contacted the HSE to highlight how easily its vaccine booking system could be exploited.
And we also notified the health authority that the reporter had cancelled the appointment they had been given using a fictitious name so that a deserving healthcare worker could rightfully get the time slot for the life-saving vaccine which is in such scarce supply across the country.
A spokeswoman for the HSE said: ‘The portal was designed to be easy and straightforward for health service staff to use. It’s designed to allow health service staff to register quickly and effectively.
‘Validation then takes place at the vaccination site when people go for their vaccination appointments. Health service staff are asked to show ID such as a work ID card to prove their identity. Only when this validation has taken place do health service staff receive a vaccine.’
However, this statement does not explain why the text message confirmation does not mention a work ID – and crucially does not insist that only those with work ID will be vaccinated when they turn up at a given centre.
‘Validation takes place at vaccination centre’