23 March 2023

UPDATE: ‘We want assurances’: Government pushed on whether patient data breaches have occurred elsewhere

| Claire Fenwicke
Join the conversation
Jeremy Hanson

Deputy Liberals Leader Jeremy Hanson said revelations regarding a union’s alleged involvement in a breach of patient privacy have raised even more questions. Photo: Claire Fenwicke.

UPDATED 3:45 pm: Health Minister Rachel Stephen-Smith has told the Legislative Assembly that there’s “absolutely no evidence” breaches of private patient data have occurred in any other area of Canberra Health Services.

Deputy Liberals Leader Jeremy Hanson demanded more answers about the extent of the breach after it was revealed on Thursday (23 March) that the records of 13 people accessing mental health services had been sent to the Australian Nursing and Midwifery Federation’s ACT branch.

Mr Hanson said it had been extremely difficult to find out exactly what had gone wrong.

“It is a possibility that if sensitive patient data has been provided in one area of health, it could well have been provided in other areas of health, and I want to seek assurances on behalf of the community that that hasn’t happened,” he said.

“I’m certainly not alleging that that has happened, but we want assurances that it hasn’t.

“And if it has, it needs to be promptly investigated.”

Mr Hanson also questioned Mental Health Minister Emma Davidson’s timeline about the events surrounding the breach, including why she chose to get in contact with the accused union.

“Her first response was to approach the alleged perpetrator, to get in contact with the union … which is pretty extraordinary in itself,” he said.

“We need to understand now how the government is going to manage that relationship [with the union] going forward.

“If this was any other organisation, it’s likely that that relationship between Health and that organisation would be cancelled or suspended. Is that going to happen with the union?”

READ ALSO ACT introduces Australia-first legislation to outlaw ‘inappropriate’ interventions on intersex people

Ms Davidson was further pressed on her knowledge and her actions during Questions Without Notice in the Legislative Assembly, as was the Health Minister.

It was revealed Ms Stephen-Smith was specifically advised about the breach on 13 February, and her office was notified a few days earlier.

She accused the Canberra Liberals of scare tactics to suggest a similar breach could have occurred anywhere else across Health.

“There is absolutely no evidence that this has occurred in any other area of the health system,” Ms Stephen-Smith said.

“The recent implementation of the Digital Health Record has resulted in a step change in the security of health records and the traceability of any access to those records, any downloading and sharing of those records.”

Ms Davidson also defended her decision to request a meeting with the secretary of the ANMF ACT branch, as well as the CHS CEO, when she found out about the breach.

“I wanted to particularly better understand what their organisations were doing to comply with their legal obligations and I also wanted to address the distrust issue that this breach has created,” she said.

“I believe it is entirely appropriate, when a breach of this nature has occurred, to be asking people how they are going to comply with their legal obligations and cooperate with any external investigations that might be ongoing.”

She also explained it had taken so long to fully contact all those impacted by the breach, from the time it was discovered to the time it took to understand whose data had been emailed and to what extent, because of the protection processes in place.

“It takes some time to prepare for a patient disclosure process of this nature, and to make sure all the right things are in place to be able to answer any questions that people may have and make sure the appropriate supports are there for them,” Ms Davidson said.

Patients began to be informed about the data breach on 6 March, the same day the all-staff email was sent to about 8000 Canberra Health Services employees by CHS CEO Dave Peffer.

Emma Davidson in the Legislative Assembly

Mental Health Minister Emma Davidson provided the update to the Legislative Assembly. Photo: Michelle Kroll.

11 am: A nursing and midwifery union has been identified as the external organisation to whom the private details of 13 mental health patients were emailed without their knowledge or consent.

But they were also shared with other private email accounts, which remain unknown.

Mental Health Minister Emma Davidson updated the Legislative Assembly on the issue during the sitting of the Assembly on Thursday (23 March).

She said she had been unable to provide further information until late yesterday.

“Now that the families and patients involved have received more of these details, I’m able to provide an update,” Ms Davidson said.

She outlined that Canberra Health Services (CHS) had discovered a “potential breach” in early February and that she was verbally told about this on 8 February.

“An audit was undertaken to determine the breadth of the breach, which uncovered significant and sustained breaches of the Health Records Privacy and Access Act 1997, and the Privacy Act 1988,” Ms Davidson said.

“This took some time, but by 27 February, we had a fairly clear understanding of the number of patients and staff involved.”

READ ALSO Army helicopter ditches in Jervis Bay during special forces training

She named the external industrial partner as the Australian Nursing and Midwifery Foundation’s (ANMF) ACT branch but said the patient’s health records had also been shared with “other private email accounts”.

“CHS immediately notified and referred the breach to the relevant authorities, including ACT Policing, the ACT Integrity Commission, the ACT Human Rights Commission through the ACT Health Services Commissioner, the Australian Information Commissioner and the Australian Health Practitioners Regulation Agency,” Ms Davidson said.

“CHS formally advised the industrial partner [ANMF ACT branch] of the breach as soon as its extent was determined.”

Ms Davidson continued that on 28 February, she contacted both CHS CEO Dave Peffer and the ANMF ACT branch secretary regarding her concerns about the impact on patients and staff and requested a meeting.

“I particularly wanted to understand what the organisations were doing to comply with legal obligations,” she said.

READ ALSO ACT’s parking infringement system is a case study in systemic inequality

While she had received a response “within hours” from Mr Peffer, Ms Davidson said she didn’t hear from the ANMF until 1 March, when the union’s lawyers declined the meeting and requested all future correspondence be sent to them.

Since this matter became public on Tuesday (21 March), one CHS staff member has been terminated and two others suspended, with their cases referred to the Public Sector Standards Commissioner for an independent investigation.

Ms Davidson said CHS had assured her that she will receive further updates as they come to hand.

“This is all of the information that I am able to share at this point in time. I will provide further updates when I can,” she said.

Join the conversation

All Comments
  • All Comments
  • Website Comments

Where is the Canberra Liberals’ health spokesperson Leanne Castley on this? Shouldn’t she be fronting the media for the opposition’s health related issues? Instead we have the deputy opposition leader, the irritable old Jeremy Hanson, stomping around the assembly with furrowed brows, fronting up to the media and doing her job for her. Heads would fly if deputy Labor leader Yvette Berry or Greens Rebecca Vassarotti stepped in to face the media for their ministerial colleagues.

Has there been a reshuffle in the party or is Ms Castley just not up to the job of shadow health minister?

It appears to me that Ms Castley has been relegated to the background and is now the gofer, tasked with the job of interrogating government ministers with silly and frivolous health questions during question time.

The Liberals leader, Elizabeth Lee seems to be missing in action and experiencing the same predicament. She asks the obligatory two questions in the Assembly each day, looking very stern but then disappearing not to be seen again. Except only when heard squealing and giggling in the background at the silly and inane interjections from her deputy. She couldn’t even be bothered to attend assembly sittings on Thursday.

Then there is the unnerving, mind numbingly dull Ed Cocks! Seemingly working in tandem with Mr Hanson and stepping in at opportune moments during question time to take over and repair any of the embarrassment displayed by his colleagues!

Just who leads and controls the Canberra Liberals?

“UPDATED 3:45 pm: Health Minister Rachel Stephen-Smith has told the Legislative Assembly that there’s “absolutely no evidence” breaches of private patient data have occurred in any other area of Canberra Health Services.”

Either she runs the tightest ship in the nation, extremely unlikely, or she had no idea.

She said no evidence. which means all the ‘evidence is no longer there’, doesn’t mean it hasn’t happened. She just told everyone to clean up.

Truth needs to come out how it happened so the public can determine if the same sorts of issues are likely to be occuring elsewhere. No details means they can’ t be sure its not.

One of the major problems with getting in bed with the union is that you have to sleep there.

Bob the impala2:39 pm 24 Mar 23

In good news for gooterz, the lack of evidence that he makes any sense does not mean it might not be found in his past, somewhere, though unknown to him.

No-one seems to have asked why the breach occurred. What was the reason that it was considered appropriate to send mental health records to another organisation? Why wasn’t consent sought?

These are serious questions that need to be asked to find out why this happened, as well as to highlight potential issues or situations that might arise again, unless the problem is understood fully and addressed appropriately.

Clearly, someone thought this was appropriate action, so why did they think that? And how do we address the issues that led to this action so that there is no recurrence?

Daily Digest

Want the best Canberra news delivered daily? Every day we package the most popular Riotact stories and send them straight to your inbox. Sign-up now for trusted local news that will never be behind a paywall.

By submitting your email address you are agreeing to Region Group's terms and conditions and privacy policy.