Case study one

Our office was notified by Ahpra about an eligible data breach. Ahpra explained the following:

• An Ahpra staff member had mistakenly sent the name of a notifier to the health practitioner who was the subject of the notification. The notifier had said that they did not wish for their name to be disclosed to the practitioner.
• Numerous attempts were made by Ahpra to contact the practitioner by email and phone to request that they delete the email, but a response was not received from the practitioner.
• The notifier contacted Ahpra to express concern that the practitioner had sought to contact them, and they felt that the disclosure of their identity to the practitioner posed a threat to their wellbeing.
• The Ahpra staff member immediately notified the police and the police detailed how the matter would be managed.

We sought more information from Ahpra about whether the practitioner had responded and Ahpra’s review of the circumstances that led to the incident. We also requested clarification about how Ahpra had contacted the notifier, and whether the appropriate information had been provided. In response, Ahpra advised that:

• the practitioner had not responded to or engaged with Ahpra in relation to the data breach
• the notifier had provided information about police action in relation to the matter
• Ahpra had completed and documented its review of the matter as a Serious Incident
• the staff member’s error appeared to be due to misreading information
• the staff member had apologised to the notifier formally and advised that they had the right to make a complaint to our office, and provided details about how to contact us
• the staff member’s future release of personal information would be supervised and guided
• the staff member’s team had been made aware of the incident to remind them to be mindful of the issue.

We considered the information provided and decided that Ahpra had taken appropriate action to respond to the eligible data breach. We were satisfied that:

• Ahpra had appropriately notified affected individuals as required
• Ahpra undertook a review of the circumstances that gave rise to the inadvertent release of information
• Ahpra had taken reasonable steps to mitigate the impact of the breach on the individuals at risk of serious harm and to minimise the likelihood of a similar breach occurring again.