A Notifiable Data Breach Practice Security

The RACGP worked with the Office of the Australian Information Commissioner to raise awareness of privacy concerns and boost the significance of securing personal information as well as the general practice patient data during the Privacy Awareness Week.
 
The RACGP’s webinars are created to help general practice teams and GPs understand the NDB program and their responsibilities for evaluating and responding to possible data breaches.
 
According to Dr. Penny Burns that the NDB scheme is a logical way to manage patient data as the use of technology is increasing. It is very important to have a high level of standards to guard personal data.
Most of the data breaches in healthcare happen because of a malicious attack or human error when personal information is accessed by an unauthorised party, communicated to an unauthorised party, or is lost.

However, not all data infringements are notifiable. The NDB criteria are as follows:

• The general practice institution that has not been able to stop the risk of serious harm with the corrective plan.
• The breach has to result in serious harm to one or more individuals (emotional, financial, psychological, physical, or reputation).

Practices need to be aware of the following scenarios:

• Patients left their examination results at a cafe or on a train.
• Mistakenly passed to or emailed to the wrong person a referral letter to a specialist.
• Accessing a patient’s information without authorisation by staff.
• Information accessed by a hacker.
• A staff left their laptop on a train.

Dr. Burns outlined the first step to know that a data breach has happened and advised practices refer to their medical protection organisations for further assistance.

She also concluded that applying sound information security, data protection measures, and processes by providing staff training will help secure practices from the risk of a data infringement to build the trust of patients with their GPs.

You can check the NDB scheme here: http://bit.ly/generalpractice-informationsecurity.