7 steps to avoiding a human data breach

According to the most recent Notifiable Data Breaches Report released by the Office of the Australian Information Commissioner (OAIC), while malicious or criminal attacks accounted for the majority (69%) of all notifiable data breaches, human error continues to play a significant role. Between July and December 2024, 29% of breaches across all sectors were due to human error.  Health service providers were the largest source of notifications, reporting 20% of all data breaches.  

The most common mistake was sending personal information to the wrong email recipient. Other common errors included failure to use the BCC function and failure to properly redact information.

We’ve reviewed the OAIC report and calls to the Avant’s medico-legal advisory service about data breaches and have identified the following key learnings.

1. Check before pressing send

The most common human error in the July–December 2024 Notifiable Data Breaches report was personal information sent to the wrong email recipient, with this accounting for 42% of all human error breaches across all sectors.

This was also high on the list of reasons for members calling us for advice and is the source of considerable angst. It is an easy error to make if you are emailing or texting patients.

2. Check before mailing

We also had a number of calls where information was mailed to incorrect addresses or information intended for several recipients (such as recall letters) was included in one envelope.

While many practices are cautious about sending sensitive information electronically, it is important also to check you have robust procedures in place for mailing information.

3. Beware the autocorrect

Another emerging theme was the perils of auto text. This can be a problem in both email programs and word processing software, which may default to including recently or frequently used addresses.

This can contribute to the problem of information being sent to the incorrect address.

It could also lead to patient information in reports or referral letters being sent to the wrong provider.

4. Secure patient information

Laptops, USBs, logbooks, or physical files lost or stolen from homes, cars or public transport accounted for another significant group of calls.

While it is not possible to completely guard against theft, precautions can help – these include having protocols for when and how patient information can be taken out of the practice, password protection and encrypting files, remote access precautions and locking devices.

Protocols for ensuring devices can be remotely located or wiped and ensuring regular and secure back-ups not linked to your system will mean you can wipe devices without loss of data.

Where the loss or theft involved physical files, these were often found discarded, so it is equally important to report this to police.

5. Lock unattended devices

Reported data breaches also occurred when phones were left unlocked or with no password protection and computers left logged on and unattended.

Check the security settings on office computers and have appropriate controls on any devices that have access to patient information files.

6. Closed unused browser and application windows

Having multiple patient files open and flicking through them might be convenient, however, there have been reported cases where this has led to medication errors.

It was also resulted in the wrong patient information being inserted into referrals or pathology requests.

7. Be prepared

All these errors have the potential to lead to patient harm, as well as regulatory action and reputational damage.

The good news is that many of these breaches are preventable. In our experience the time taken to avoid a data breach is definitely preferable to the time and stress of having to respond to a breach.

Final suggestions

Review your privacy procedures and make sure that everyone in your practice, including temporary staff and contractors, understands their responsibilities.

You need a data breach response plan. Whether or not you have to report a data breach to the OAIC, you will need to be able to respond promptly and document what steps you have taken.

Even the most secure systems can be vulnerable to human error. Remind staff about the need for secure passwords and the dangers of phishing and other scams to gain access to your systems.

If you are not sure who is asking for information, always check.

Avant collection - Cyber: what you need to know

For medico-legal advice, please contact us here, or call 1800 128 268, 24/7 in emergencies.