Case study two

Our office was notified by Ahpra about an eligible data breach that occurred because of human error by an Ahpra staff member. Ahpra advised the following:

• An Ahpra staff member had sent a notice of an investigation to the practitioner who was the subject of a notification and this notice included the name of the notifier. The notifier had requested that their identity remain confidential.
• Ahpra was contacted by the notifier who said they were concerned that the practitioner had learned their name.
• Ahpra reviewed the matter and discovered the data breach.
• Ahpra contacted the practitioner to request that they delete the notice of investigation and the practitioner agreed.
• Ahpra contacted the notifier to inform them of the details of the breach.
• Ahpra scheduled training for its staff about checking the relevant information on its case management system, particularly when reviewing newly assigned investigations.

The Commissioner provided guidance to Ahpra about managing data breaches of this kind. The Commissioner noted that the same type of privacy breaches had continued to occur and that Ahpra had previously advised that remedial action in the form of staff training had been provided. The Commissioner suggested that Ahpra consider whether there are issues at a systems level that need to be addressed to avoid breaches continuing to occur. Our office continues to monitor this issue.