Jorge's story

Jorge, a practitioner, contacted our office about Ahpra’s investigation of a notification about him. Jorge said that Ahpra had emailed his workplace’s general email address seeking clinical records related to its investigation.

Jorge told us he believed that Ahpra had breached his privacy by sending the information request to his workplace in this manner because all his colleagues could access that email account.

What we found

The information request that Ahpra sent to Jorge’s workplace did not explicitly identify him as the practitioner under investigation. However, we found that Jorge was still reasonably identifiable from the information included in the email sent to his workplace.

We found that Ahpra had not breached Jorge’s privacy. This is because Ahpra is authorised to make information requests while investigating a notification. However, we found there were reasonable steps Ahpra could have taken to reduce the risk of unnecessarily disclosing Jorge’s personal information when gathering information during its investigation.

Complaint outcome

Although we found Ahpra had not breached Jorge’s privacy, his complaint helped our office identify improvements to Ahpra’s processes. We provided feedback to Ahpra that it should send information requests to specific people, rather than shared email addresses. We also provided feedback about improving its guidelines to ensure staff actively seek to protect each person’s privacy.

Ahpra agreed with our office’s feedback and informed us it had begun reviewing its work instructions for staff.