In June 2026, the Partnered Health breach exposed the personal information of thousands of Australians [1]. It was a blunt reminder that health records are just as exposed to cyber crime as other forms of private data. What’s worse is that data breaches in Allied Health in Australia don’t just threaten large hospital networks. Any practice holding health information can be captured under the Notifiable Data Breaches scheme, whatever its size or turnover.
So what actually happens when a breach hits your practice? In those first few hours, three questions matter most: what you must do immediately to contain the damage, whether your practice falls under the scheme's obligations, and how to notify affected clients lawfully and with some care for how they'll take the news. This guide walks through each one, translating the Privacy Act 1988 into simple operational steps you can act on under pressure. Let's start with the moment you suspect something has gone wrong.
What counts as a data breach under Australian privacy law?
A data breach happens when personal information your practice holds is accessed, disclosed, or lost without authorisation. Under the Privacy Act 1988, that definition captures far more than a dramatic cyberattack. Most breaches in Allied Health are quiet, everyday events. The Privacy Act recognises three types of acts as a data breach:
- Unauthorised access: This is when Someone views client information they shouldn't. For example, a former employee logging into your practice management software
- Unauthorised disclosure: This is when information goes to the wrong recipient. This could be emailing a client's progress notes to another client, or attaching the wrong assessment to a report
- Loss: This is when information is misplaced in circumstances where unauthorised access is likely. This could be a stolen laptop holding clinical notes, or a lost USB drive with Medicare numbers
Ransomware locking your clinical records also qualifies, because the attacker has accessed the information along the way. However, not every incident becomes a notifiable one. A misdirected email you recall within seconds, before anyone opens it, may be a privacy incident rather than an eligible data breach. The difference matters, because only eligible data breaches trigger formal notification duties.
Does the Notifiable Data Breaches scheme apply to your practice?
Yes. If you hold health information, the Notifiable Data Breaches scheme applies to you regardless of your turnover. The general rule under the Privacy Act is that entities with an annual turnover of $3 million or more are covered. Small practice owners below that threshold often assume they’re off the hook. They're not. Health service providers are captured no matter how small, because they handle sensitive health information. A solo physiotherapist, a two-person occupational therapy practice, and a large multidisciplinary group all carry the same core obligations.
Physiotherapists, occupational therapists, speech pathologists, and psychologists are all health service providers under the Privacy Act. If you assess, treat, or record client health information, you're in. No exceptions are made for being a small practice or a new one.
There's also a second layer. If your practice connects to My Health Record, breaches involving that system carry a separate notification duty to the Australian Digital Health Agency, on top of your obligations to the Office of the Australian Information Commissioner (OAIC). The two run in parallel, so you can't satisfy one and forget the other.
This all matters because healthcare has been Australia's most-breached sector in every OAIC report since the scheme launched in 2018, accounting for roughly 18 to 20 percent of all notifications [10].
Your step-by-step data breach response plan for Allied Health
When you discover a breach, work through five stages in order: contain, assess, notify, recover, and review. To keep this concrete, let's follow a scenario in which a former employee has accessed your practice management system using credentials that were never disabled after they left.
Stage 1: Contain
Your primary goal at this stage is to act fast to stop further damage. Do do this, work methodically through the following steps:
- Isolate affected systems: Disconnect compromised devices or accounts from your network so the exposure can't spread
- Disable compromised credentials: In our scenario, immediately revoke the former employee's login and reset any shared passwords they may have known
- Secure physical documents: If paper files or devices are involved, lock them away
- Preserve all evidence: Keep logs, audit trails, emails, and screenshots. Don't delete or tidy anything before it's documented. Your access logs will show exactly which client records the former employee opened, and that's central to the next stage
Stage 2: Assess
Start a formal internal assessment as soon as you become aware of a suspected breach. The Privacy Act gives you a maximum of 30 days to complete this assessment and decide whether the breach is eligible under the serious harm test.
In our scenario, you'd review the access logs to establish which records were viewed, how sensitive they were, and whether the former employee has any reason or means to misuse them. If they opened mental health assessments or Medicare numbers, the risk of serious harm rises sharply.
Stage 3: Notify
If your assessment concludes the breach is eligible, you have two notifications to make. Notify the OAIC using its online Notifiable Data Breaches form, and notify the affected clients. Both are covered in detail below. If serious harm is clearly likely, don't wait out the 30 days, notify right away.
Stage 4: Recover
At this stage, you’re working to restore and strengthen your systems. Reset all credentials, patch whatever vulnerability allowed the access, and review your offboarding process so departing staff lose access on their last day, not three weeks later. Confirm your systems are clean before returning to normal operations.
Stage 5: Review
Document the incident from discovery to resolution. Update your breach response plan with anything you learned, and brief your team. In our scenario, the obvious fix is a mandatory checklist that disables every account the moment an employee leaves.
The 30-day window is your outer limit for assessment, not a licence to wait. The clock starts the moment you become aware something may have gone wrong.
The Serious Harm test to assess whether a breach is eligible
An eligible data breach meets two conditions. First, there's been unauthorised access to, disclosure of, or loss of personal information. Second, a reasonable person would conclude the breach is likely to result in serious harm to one or more individuals. Serious harm can take several forms including:
- Physical harm: For example if a client's location is exposed in a family violence context
- Psychological harm: particularly where mental health records are involved
- Financial harm: such as identity theft using Medicare numbers or bank details
- Reputational harm: where sensitive diagnoses become public
Your assessment should weigh a few things: how sensitive the information is, who accessed it, whether it was encrypted, and how easily it could be misused. Encrypted data an attacker can't read may not meet the serious harm threshold. A spreadsheet of unencrypted mental health notes almost certainly does.
This is where the judgement gets genuinely uncomfortable. The serious harm test isn't a tick-box, and two reasonable clinicians can look at the same incident and land in different places. When you're not sure, treat the risk as real and move quickly. You have up to 30 days to complete this assessment, but the OAIC's guidance is clear that if serious harm is likely, you notify without delay rather than using the full window.
How to report a data breach to the OAIC
If your assessment confirms an eligible data breach, you notify the OAIC through its online Notifiable Data Breaches form. This is the required channel, and it's designed to be completed by the practice itself. Your notification must include:
- Your practice's name and contact details
- A description of the breach, including how it happened
- The kinds of information involved, for example names, Medicare numbers, or clinical notes
- The number of individuals affected, if known
- The steps you recommend affected individuals take to protect themselves
The 30-day clock starts when you first become aware of a suspected breach, not once you've confirmed it's eligible. Delaying the assessment doesn't delay the deadline. If you conclude serious harm is likely before 30 days pass, notify straight away.
How to notify patients of a data breach in Australia
Once you've determined a breach is eligible, you must notify affected clients as soon as practicable. There are two methods:
Direct notification is preferred. Contact affected individuals directly by email, letter, phone, or in person. This is the standard approach where you have current contact details.
Substitute notification applies only when direct contact isn't reasonably practicable. You publish a statement on your website and take reasonable steps to publicise it, which may include the media.
A clear notification must include these four things:
- What happened in plain language
- What information was involved
- What your practice is doing in response
- What clients can do to protect themselves, such as monitoring bank statements, watching for suspicious contact, or updating passwords
Write with care. Your clients handed you sensitive information because they trusted you with it, so a calm, honest, jargon-free tone matters. Acknowledge the situation, take responsibility, and give them practical next steps. This is the moment that either preserves or damages a relationship you've spent years building.
If the breach involves My Health Record, remember your separate duty to notify the Australian Digital Health Agency alongside your OAIC and client notifications.
Common causes of data breaches and how to reduce your risk
Most breaches in Allied Health trace back to a handful of causes:
- Phishing emails that trick staff into handing over login details
- Ransomware attacks that lock clinical records until a payment is demanded
- Accidental disclosure which is usually an email or document sent to the wrong recipient
- Lost or stolen devices holding client information
- Third-party vulnerabilities including weaknesses in the software you rely on
The Partnered Health breach in June 2026 is a sobering reference point. A ransomware incident exposed the personal information of thousands of Australians across 21 clinics [4], and it showed that even health-focused organisations sit squarely in attackers' sights. You can cut your risk with a few disciplined habits:
- Encrypt sensitive data
- Apply strict access controls so staff only see what they need
- Switch on multi-factor authentication everywhere.
- Run regular staff training
Human error remains one of the biggest causes of breaches, so the training genuinely pays off. Most of the incidents discussed in practitioner circles weren't sophisticated hacks. They were someone clicking a link they shouldn't have, or a login that never got switched off.
Your practice management software matters too. Look for a platform that offers encryption, detailed audit logs, role-based access, and multi-factor authentication as standard. splose is built with these protections in mind, so client data stays secure by default rather than by afterthought.
Penalties for failing to report a data breach in Australia
Failing to meet your obligations under the Notifiable Data Breaches scheme carries real consequences. The OAIC has enforcement powers under the Privacy Act, and the 2022 amendments lifted civil penalties significantly. For serious or repeated breaches, the maximum court-imposed civil penalties for large organisations is up to $50 million. Penalties for smaller health providers are proportionate, but the scheme applies all the same. In October 2025, a healthcare company received Australia's first civil penalty under the scheme, a signal that the regulator is prepared to act [10].
The financial penalty isn't the only cost. Non-compliance can trigger a regulatory investigation, damage your reputation, and erode the client trust your practice runs on. Meeting your obligations is far cheaper than the alternative, and it protects the relationships at the heart of your work.
Build a breach response plan before an incident strikes
The practices that respond well are the ones that are prepared before anything goes wrong. A data breach response plan turns a stressful scramble into a set of clear steps you’re already familiar with. As a guide, every Allied Health practice should have:
- A designated privacy officer or response lead who owns the process
- A documented internal assessment procedure so the 30-day clock is managed from day one
- Pre-drafted patient notification templates you can adapt quickly rather than write from scratch under pressure
- A list of key contacts including the OAIC, the Australian Digital Health Agency, your IT vendor, legal counsel, and your insurer
- A staff training schedule so your team recognises phishing and reports incidents early
A documented plan cuts your response time and lowers the chance of missing an obligation. It also means the whole team knows their role, rather than everyone turning to look at one person mid-crisis.
splose supports this work by keeping secure, auditable records, so if you ever need to establish what was accessed and when, the evidence is there and ready.
Responding to a data breach with confidence
A data breach is one of the most stressful operational events your practice will ever face. Yet a clear framework (Contain, assess, notify, recover, review) makes compliance achievable. The best time to prepare is before anything goes wrong. We recommend booking an hour to draft or review your response plan with your team. This may seem like additional admin, but a simple review today can turn tomorrow’s panic into a manageable process.
