Datatime

Datatime is an Australian-based contractor that provides data processing services for medical research, specifically handling personal and health-related information collected through surveys. The organisation works with research institutes to manage, store, and analyse survey responses, which may include demographic details, contact information, Medicare numbers, and sensitive health data such as medical histories, mental health status, and medication records. Its responsibilities encompass ensuring the integrity and confidentiality of the data while it resides in its systems prior to scheduled deletion or transfer to the sponsoring organisation. In this capacity, Datatime acts as an intermediary that enables large‑scale health studies to collect and utilise participant information.

A known incident occurred on 2022-11-01 when Datatime’s servers were targeted in a cyber attack while it was processing medical survey data for a major Australian skin cancer study. The breach compromised personal identifiers including names, addresses, and Medicare numbers, and potentially exposed medical survey responses from over 1,000 participants. Attackers infiltrated the servers holding the data before its scheduled deletion, temporarily locking Datatime out of its systems and exfiltrating data samples. Following the incident, the affiliated research institute notified the affected individuals privately but drew criticism for not issuing a public disclosure while continuing to recruit for other studies. Participants expressed significant distress over the possible exposure of highly personal health details, such as mental health status and medication histories. The episode highlighted a gap in Australia’s breach disclosure framework, demonstrating that organisations are not legally required to announce such events publicly even when sensitive information is at risk. These facts underscore Datatime’s specialisation in handling highly confidential health data and the associated security and regulatory challenges inherent to that role. No explicit details regarding Datatime’s ownership, parent company, or subsidiary structure are available in the supplied sources.