**Update: 29 July, 2026**
Thank you for your patience while we’ve been working through the security incident involving our online booking platform, HotDoc.
As an update, an independent cyber security team is investigating the incident and the early findings confirm that a Qualitas HotDoc user account was logged into by an unknown third party. That access was used to send the spam text message some of you received.
Qualitas Health’s own IT environment, including our clinical and practice management systems, is separate from the HotDoc platform and has not been affected.
Following a review of the HotDoc platform, we feel confident that we can turn online booking back on — so you can once again book appointments through HotDoc.
We’ll keep investigating what specific information within HotDoc has been accessed so we can notify anyone affected. We’ll continue to post updates here as we learn more.
If you have any questions, please call Qualitas Medical Practice North Ryde on 02 9805 1588. Thank you again for your understanding and support.
**Original statement: published 20 July, 2026**
Qualitas Health is responding to a security incident involving HotDoc, the third party online booking platform used by Qualitas Medical Practice North Ryde. We are aware that some patients of the North Ryde practice have received a spam SMS as a result of this incident, and we sincerely apologise for the distress and inconvenience this has caused.
What happened
On Friday, 16 July 2026, an unknown third party gained unauthorised access to a number of HotDoc user accounts, including one associated with Qualitas Medical Practice North Ryde. This access was used to send an unsolicited SMS to some patients of the practice. We understand this incident is not isolated to Qualitas Health and has affected a number of medical practice groups across Australia that use the same booking platform.
The unauthorised access has been removed and the incident has been contained, with HotDoc assuring security measures have been increased to prevent future breaches.
You can read more on HotDoc’s commitment to Security & Privacy: https://practices.hotdoc.com.au/security/
What this means for our systems
Qualitas Health’s own IT environment, including our clinical and practice management systems, is separate from the HotDoc platform and has not been affected. All of our practices are open and operating as usual, and there has been no disruption to patient care.
Importantly, the booking platform does not hold sensitive information being your health information. The information held within the platform is generally limited to details used to make and manage appointments, such as name, date of birth, mobile number and appointment history.
What we are doing
We are working directly with HotDoc and independent cyber security specialists to establish precisely what information was accessed. Any patient whose personal information is confirmed to have been affected will be contacted directly by the practice.
As a precaution, we are also reviewing security settings and access controls across all third party platforms used by our practices.
What you should do
The most likely risk from this incident is follow up scam messages or calls. We encourage all patients to take the following precautions:
- Do not click links in any SMS or email you were not expecting, even if it appears to come from your practice. Delete the message and report it to Scamwatch.
- Qualitas Health and our practices will never ask you for your password, payment details or Medicare card number by SMS.
- If you receive a message about an appointment you did not make, do not respond. Contact your practice directly on its usual phone number to check.
- Be cautious of unexpected phone calls requesting personal information or remote access to your devices.
- Enable multi factor authentication on your online accounts where available, and use strong, unique passwords.
- Monitor your accounts for unusual activity and contact your bank immediately if you notice anything suspicious.
Support and further information
If you have questions or concerns, please contact us:
- Phone: QMP North Ryde on 02 9805 1588 during practice hours
- Email: [email protected]
Free, confidential support is also available from IDCARE, Australia’s national identity and cyber support service, on 1800 595 160 or at idcare.org.
Additional guidance:
- Scamwatch: https://www.scamwatch.gov.au/stop-check-protect/help-to-spot-and-avoid-scams
- Australian Cyber Security Centre: cyber.gov.au/learn-basics
- Act Now, Stay Secure: https://www.actnowstaysecure.gov.au/
- Office of the Australian Information Commissioner: https://www.oaic.gov.au/privacy/your-privacy-rights/data-breaches/Identity-fraud
- ID Support NSW:https://www.nsw.gov.au/departments-and-agencies/id-support-nsw/be-prepared
If you need an interpreter, please call TIS National on 131 450 and ask to be connected to your practice.
Updates
We will publish updates on this page as the investigation progresses. We take the privacy and security of our patients’ information extremely seriously, and we thank our patients for their patience while we work through this with the platform provider and the relevant authorities.
