Assess a suspected data breach of patient information and decide whether to notify
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- From the incident report, the systems affected and the data involved, record the date the practice became aware, calculate the 30-day assessment deadline, list the kinds of health and personal information involved and the individuals affected, and set out the facts relevant to serious harm and to any remedial action taken.
- What the lawyer must review
- The lawyer decides whether the breach is likely to result in serious harm, whether remedial action prevented that, whether and how to notify individuals and the Commissioner, and settles the statement and notices.
- Written for / version
- US
Open a jurisdiction version of this task to see which instruments apply: US
Who does what
| Role | What they do |
|---|---|
| Assistance | From the incident report, the systems affected and the data involved, record the date the practice became aware, calculate the 30-day assessment deadline, list the kinds of health and personal information involved and the individuals affected, and set out the facts relevant to serious harm and to any remedial action taken. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Confirm patient health information goes only into a tool the practice has approved for health records, de-identified where the task allows, and that the output discloses no patient detail beyond what the recipient needs.
- Confirm the awareness date from the incident record.
- Check the list of information types against the affected systems, not assumptions.
- Record the serious-harm reasoning before any decision not to notify.
Forms and precedents for this task
| Form or precedent | Kind | AI use | Summary |
|---|---|---|---|
| Eligible data breach assessment record | Form | AI use Red | Record for deciding whether a loss of, or unauthorised access to, personal information is an eligible data breach that must be notified. |
Signed-in accounts can read the full text of each one. All precedents.
Sources
- OAIC, Data breach preparation and response, Part 4: Notifiable Data Breach (NDB) scheme · 2026-10-18
These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.