Providers urged to be vigilant over client data

An experienced aged care lawyer is warning service providers of their legal risk ahead of incoming changes to privacy legislation.

An experienced aged care lawyer is warning service providers of their legal risk ahead of incoming changes to privacy legislation.

Aged care providers may be at legal risk unless they are “vigilant and aware of the latest computer and privacy threats to them and their residents,” said Craig Subocz, a senior associate at Russell Kennedy Lawyers.

Mr Subocz will discuss privacy and security breaches in health and aged care in a seminar on 30 November and webinar on 1 December in light of incoming requirements to report data breaches to affected individuals and the Privacy Commissioner.

Craig Subocz

“From February 2018, you have a statutory obligation to report a data breach. This poses a real risk to your standing if handled incorrectly,” Mr Subocz told Australian Ageing Agenda.

Mr Subocz is calling on providers to start taking steps now to prepare for the new obligation.

“Prevention is better than cure and all services should assess and update privacy policies, review contracts with key suppliers, train staff, and develop and test data breach planning,” he said.

The Privacy Act 1988 regulates the handling of personal information, which is deemed as capable of identifying a person, regardless of whether the information is true or not.

Most aged care providers must comply with the Privacy Act as their annual turnover exceeds $3 million and/or they provide a health service.

The Act mandates compliance with 13 Australian privacy principles, which deal with collection, use, disclosure, accuracy, security and disposal of personal information including sensitive information.

The new reporting obligations are contained in the Privacy Amendment (Notifiable Data Breaches) Act 2017 and must be adhered to from 23 February 2018.

“In judging if notification is required, it is important to take remedial action to prevent serious harm to any affected individual before the individual suffers the harm,” Mr Subocz said.

Personal information is handled, used and disclosed every day and it is the responsibility of aged care organisations to protect it, he said.

Case studies

In the webinar, Mr Subocz will present three case studies of personal information being inadvertently disclosed or threatened and show how aged care services could also fall foul of new requirements.

The first involves disclosure of an individual’s health information to the police by a doctor which the Privacy Commissioner found to be an interference with the patient’s privacy.

“This scenario could easily apply in aged care – for example in the case of a relative seeking information about a resident,” Mr Subocz said.

The second case involves an Australian Red Cross Blood Service’s (ARC) contractor’s employee uploading the ARC’s database of 550,000 blood donor records to a publicly available website.

Although it was the result of a one-off human error and not authorised by ARC, it was found that the ARC had failed to take reasonable steps to protect personal information or to destroy or de-identify information when no longer needed.

“Aged care services need to regularly check and review their records management, storage and disposal, and those of any external contractor,” Mr Subocz said.

The final case involves the disruption of an entire hospital network by WannaCry ransomware exploiting vulnerabilities in Microsoft Windows.

It raised the questions about easy-to-guess passwords, failures in regularly upgrading software when patches are available, and maintaining current cyber-protection software, such as anti-spyware, anti-virus and firewalls.

“This is also important when considering or using external cloud-based systems for data storage,” Mr Subocz said.

Information on the seminar and webinar is available here.

Comment below to have your say on this story

Send us your news and tip-offs to 

Subscribe to Australian Ageing Agenda magazine and sign up to the AAA newsletter

Tags: data, data-breach, information-security, privacy, privacy-act, Russell Kennedy Lawyers, slider,

1 thought on “Providers urged to be vigilant over client data

  1. Not only are there legal risks associated with breaches in privacy, but there are also financial risks, particularly when the breach is caused through a Cyber attack.

    Aged care providers need to ensure they have policies and procedures in place to identify their cyber risks, protect their assets and to detect and understand the threats. In addition, they must have response processes, enabling them to recover from a breach.

    One way to reduce or transfer your risk is to purchase Cyber insurance. Having
    recognized that cyber risk cannot be eliminated; companies must be prepared for
    a cyber attack. The challenge with cyber risk is that it has the potential to be a tail risk to data, reputation, or the ability to do business. The magnitude of a potential, sudden loss
    forces firms to scrutinize their ability to withstand such impact, and after rigorous analysis, part of the solution almost always involves looking to insurance as a way of
    transferring the risk away.

Leave a Reply

Your email address will not be published. Required fields are marked *