The AHPRA email breach: your rights and options

On 29 July 2026, AHPRA sent a webinar invitation to 136 doctors, nurses and other health practitioners with the recipient list visible to everyone who received it. Because the invitation was addressed to practitioners with health notifications or restrictions relating to alcohol or substance misuse, every recipient could see, and was seen by, the whole cohort.

If you received that email, the law treats what happened to you as more than an administrative slip. This page explains your position in plain terms.

What the breach actually disclosed

The list did not just expose email addresses. It told every recipient that every other named person was connected with a health-related notification. Under the Privacy Act 1988 (Cth), information from which a person's health status can reasonably be inferred is health information, the most protected category of personal information in Australian law.

Your rights, in short

  • The Privacy Act applies to AHPRA, but complaints go to a specialist regulator: the National Health Practitioner Privacy Commissioner, a role held by the National Health Practitioner Ombudsman (NHPO), not the OAIC.
  • Compensation is real but evidence-dependent. In the closest comparable case, a mass-disclosure breach by a Commonwealth agency, the regulator set compensation bands from $500 to more than $20,000 per person, according to the harm each person could evidence.
  • A group complaint is possible. The law allows one representative complaint on behalf of everyone affected. It has been done successfully before.
  • If you believe you were included on the list in error, you may have additional and quite different rights, including in defamation. These carry short deadlines and a mandatory pre-litigation step, so early advice matters.

What you can do now, in five steps

  1. Keep the email. Keep the original and any follow-up or recall emails. Do not forward them to anyone.
  2. Record the impact. Keep contemporaneous notes of distress, any medical or psychological consultations, and any professional consequences. Compensation follows evidence.
  3. Complain to AHPRA in writing. This creates the procedural foundation.
  4. Escalate to the NHPO in its Privacy Commissioner capacity if you are not satisfied. Complaints are best made within 12 months.
  5. Get advice early if you were wrongly included on the list. Defamation deadlines are short and run from 29 July 2026.

Where we can help

Hamilton Bailey Law acts for health practitioners in regulatory, privacy and commercial matters. For practitioners affected by this breach we offer a fixed-fee initial review: we assess your position, explain your realistic options and their costs, and you decide what, if anything, to do next. No obligation follows.

We are also assessing interest in a representative (group) complaint on behalf of affected practitioners. You can register confidential interest here: Register confidential interest.

Telephone (08) 5122 6500 or email lw@hamiltonbailey.com.
Hamilton Bailey Law, 147 Pirie Street, Adelaide SA 5000.

This page is general information, not legal advice, and does not create a solicitor-client relationship. Your situation depends on its own facts. Nothing on this page should be taken as a guarantee of any outcome or amount.