The AHPRA email breach: your rights and options

What the breach actually disclosed

On the facts as reported, the list did not just expose email addresses. It told every recipient that every other named person was connected with a health-related notification. Under the Privacy Act 1988 (Cth), information from which a person's health status can reasonably be inferred is health information, the most protected category of personal information in Australian law.

Your rights, in short

• The Privacy Act applies to AHPRA, but complaints go to a specialist regulator: the National Health Practitioner Privacy Commissioner, a role held by the National Health Practitioner Ombudsman (NHPO), not the OAIC.
• Compensation is real but evidence-dependent. In the closest comparable case, a mass-disclosure breach by a Commonwealth agency, the regulator set compensation bands from $500 to more than $20,000 per person, according to the harm each person could evidence.
• A group complaint is possible. The law allows one representative complaint on behalf of everyone affected. It has been done successfully before.
• If you believe you were included on the list in error, you may have additional and quite different rights, including in defamation. These carry short deadlines and a mandatory pre-litigation step, so early advice matters.

What you can do now, in five steps

1. Keep the email. Keep the original and any follow-up or recall emails. Do not forward them to anyone.
2. Record the impact. Keep contemporaneous notes of distress, any medical or psychological consultations, and any professional consequences. Compensation follows evidence.
3. Complain to AHPRA in writing. This creates the procedural foundation.
4. Escalate to the NHPO in its Privacy Commissioner capacity if you are not satisfied. Complaints are best made within 12 months.
5. Get advice early if you were wrongly included on the list. Defamation deadlines are short and run from the date the email was sent.

If you were included on the list in error

Reports indicate the list was not confined to practitioners with notifications. If you have no notification, impairment or restriction and you still received the invitation, your position differs from the rest of the group, and in some respects it is more urgent.

• The message said something untrue about you. It conveyed that meaning to a large group of your professional peers. That raises a defamation question, not only a privacy one.
• There is a step you must take first. Before starting a defamation proceeding you must serve a concerns notice on the publisher and allow time for a response. This step is mandatory and cannot be skipped.
• The time limit is short. A defamation action generally must be commenced within one year of publication, and extensions are limited. The clock started when the email was sent.
• Work out your own date early. The limitation rules differ between states and territories, and there may be more than one publication in question. Do not assume a single deadline applies to you.

Whether any claim succeeds depends on your own circumstances and on the defences available to the publisher. This page cannot tell you that. If you think you were included in error, get advice quickly.

Where we can help

Hamilton Bailey acts for health practitioners in regulatory, privacy and commercial matters. For practitioners affected by this breach we offer a fixed-fee initial review: we assess your position, explain your realistic options and their costs, and you decide what, if anything, to do next. No obligation follows.

We are also assessing interest in a representative (group) complaint on behalf of affected practitioners. You can register confidential interest here: Register confidential interest.