Medicare details sold on the darknet were not obtained through hacking but by a “bad person doing a bad thing from a legitimate channel,” a Senate inquiry has heard.

Guardian Australia revealed in July that Medicare card details were offered for sale on a darknet auction site and that the vendor, provided with a journalist’s name and date of birth, was able to produce the requested Medicare number for a fee of 0.0089 bitcoin, or US$22.

Another journalist at SBS repeated the experiment.

Speaking at a Senate committee hearing into circumstances in which Medicare information has been compromised on Friday, Department of Human Services deputy secretary Caroline Edwards said she was confident the information had been accessed lawfully by a person at a medical service, who then used the information illegally by selling it online.

“It was legitimate access to medicare numbers being used illegitimately,” Edwards said. “Happened to go through to the dark web, apparently, but we understand the vulnerability was a more traditional vulnerability, bad person doing a bad thing from a legitimate channel.”

The Australian federal police has not completed its investigation of the security breach, but Edwards said it were confident the information was not accessed overseas. “We’re clear that this was not a cybersecurity breach,” she said.

“We have always dealt with a situation where somebody steals 1,000 files at the local medical practice and goes and sells it down the pub. This is more akin to that circumstance.”

Edwards said the department identified 165 people whose records may have been accessed illegally but did not find any evidence of false Medicare claims. Those 165 were notified and issued with new Medicare cards, but she added it was not necessarily connected to matters being investigated by the AFP.

The darknet vendor told Guardian Australia they had sold the details of at least 75 Medicare cardholders, but the department said it had not confirmed that figure from its own systems.

Medicare details can be accessed through the Health Professional Online Services (Hpos) scheme, which is run by the department of human services. It is set up to allow authorised users to search for a person’s Medicare details using their name, date of birth, and, if there are multiple results, their home suburb.

Edwards said there were 163,000 authorised points of access to the Hpos scheme. The system keeps a log of all actions, which means that if a person knew roughly when their Medicare details were illegally accessed it would be possible to trace it back to a particular access point.

The ability to purchase Medicare details on the darknet raised concerns about the security of Australia’s new My Health Record system, which will be rolled out on an opt-out basis to all Australians eligible for a Medicare card by the end of next year.

The system is a digital repository of all the health information and records of registered patients. A Medicare number is one of five bits of personal information required to access the system, along with a person’s name, date of birth, gender and individual reference number.

Australian Digital Health Agency chief executive Tim Kelsey rejected a suggestion by Greens Senator Richard di Natale that there was a direct link between obtaining Medicare details and potentially going on to obtain confidential medical records.

Even if you had all the required information, Kelsey said, you would still need access to the software provided to authorised medical services and one of two forms of two-step verification.

“You would have to have someone imitating you in your office, physically,” he said. “Obviously it’s never happened.”

Online privacy advocates Paul Power, from E-Health Policy Australia, and software engineer Dr Robert Merkel, told the committee it was impossible to ensure the security of either the Hpos or My Health Record systems, because of the number of points of access.

Power said the legitimate concerns of doctors and other healthcare providers that the scheme be easy to use and not restrict access to information and informed health care, particularly for vulnerable people who may not have the IT literacy to protect their own information or access to identification documents, had taken precedence over designing a secure system.

“Serious security and privacy concerns for My Health Records are inevitable,” Merkel said.

Merkel also criticised claims by both the government and the Royal Australian College of General Practitioners about the security of both the medicare system and security protocols used by GPs themselves, saying it was “not world class.”

“Their system did not detect the access that was reported in The Guardian, so clearly it’s less than perfect.” he said.