The real cost of a privacy breach

Privacy breaches carry real consequences. From fines and professional sanctions to media scrutiny and loss of employment, the impact can be serious for you, your practice and your colleagues. These real-world cases show what can go wrong and why it is important to understand your privacy obligations and equip yourself with the right information to make informed decisions and avoid these risks.

Ruanne Brell, BA LLB (Hons), Senior Legal Adviser, Advocacy, Education and Research, Avant

Wednesday, 6 August 2025

A privacy breach doesn’t just put you at risk. It can damage your reputation, your career and if you work in or run a practice, the practice’s standing too. These impacts aren’t felt only at the individual level but can also affect your colleagues, especially in group or multidisciplinary settings where reputational harm can spread quickly.

And these consequences aren’t hypothetical. They’ve happened.

In one case, a doctor discovered a swastika tattoo on an unconscious patient. Distressed by the image, they took a photo and shared it with colleagues via a messaging app. There was no clinical reason and no consent. The regulator found this was a clear breach of the patient’s privacy and amounted to professional misconduct. The doctor was fined $10,000 and resigned from their public hospital role. The incident also attracted significant media scrutiny.

In another case, a psychologist refused to give a patient access to their clinical records, providing shifting and unconvincing reasons including that the patient had stolen them. The Privacy Commissioner found this was a serious breach of the patient’s rights and ordered the psychologist to pay $5,000 in compensation and aggravated damages. See Psychologist fined $5000 for failing to give patient access to their clinical records

Even before any formal action is taken, the reputational consequences can be serious. In the high-profile “mushroom case,” a rural doctor who treated the victims of the fatal mushroom poisoning spoke publicly to the media about Erin Patterson, the woman found guilty of three murders. His comments described personal interactions with her, which raised concerns about patient privacy and professional boundaries. While no regulatory outcome has been made public, the incident led to national media coverage, regulatory complaints, reported contract termination and growing public scrutiny. Mushroom, media and medical ethics: where is the line on patient privacy?

These examples show that breaching privacy can result in:

Professional misconduct findings
Fines and compensation payouts
Reputational damage - for you, your practice and potentially your colleagues
Workplace consequences - such as loss of contracts or termination of employment

At Avant, we understand these risks. That’s why we’ve developed resources to help you and your practice understand privacy obligations, respond to requests appropriately and avoid common pitfalls. Equip yourself with the right information to make confident decisions. We’re here to help.

More information

For medico-legal advice, please contact us here, or call 1800 128 268, 24/7 in emergencies.

The case discussed in this article is based on a real case. Certain information has been de-identified to preserve privacy and confidentiality.

IMPORTANT: This publication is not comprehensive and does not constitute legal or medical advice. You should seek legal or other professional advice before relying on any content, and practise proper clinical decision making with regard to the individual circumstances. Persons implementing any recommendations contained in this publication must exercise their own independent skill or judgement or seek appropriate professional advice relevant to their own particular practice. Compliance with any recommendations will not in any way guarantee discharge of the duty of care owed to patients and others coming into contact with the health professional or practice. Avant is not responsible to you or anyone else for any loss suffered in connection with the use of this information. Information is only current at the date initially published.