Checklist · Confidentiality & client information
Data breach checklist for medical records
Checklist for a suspected breach of medical records on a plaintiff injury file, setting out the assessment, the 30-day steps and the notification sections. It does not decide eligibility or send a notice.
- Kind
- Checklist. Steps or checks to work through and tick off.
- Where it applies
- Australia, Victoria, Queensland, New South Wales
- AI use
- Yellow You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at
- 23 October 2026
- Status
- Maintained. Checked on 23 October 2026 against the 5 authorities it cites, for 4 jurisdictions.
- Version
- 1
- Source
- Written for this library
When to use it
Use when a plaintiff firm suspects that medical records it holds were accessed, disclosed or lost without authority. It supports the lawyer's assessment under the Notifiable Data Breaches scheme. It does not replace the AI data incident steps where the incident is a tool, and those steps do not replace this assessment.
Used for these tasks
- Assess a suspected breach of client personal information under the notifiable data breach scheme
- Check the safeguards for client personal information the practice holds
Each task page says how far AI may help with the task and what the lawyer must review.
How AI may be used
The tool can record the facts the lawyer supplies and set out the sections. The lawyer decides suspicion, belief, serious harm, remedial action and whether anyone is notified.
AI may
- List the records and the kinds of information from facts the lawyer has entered
- Set out sections 26WE, 26WF, 26WH, 26WK and 26WL as questions with blank answers
- Remind the file that an AI-tool incident also uses the AI data incident steps
AI must not
- Must not decide that there are reasonable grounds to suspect or to believe
- Must not decide that serious harm is likely because the records are medical records
- Must not treat remedial action as having removed the breach
- Must not prepare the statement to the Commissioner or notify any person
The lawyer checks
- Whether the scheme applies to this practice is decided before the assessment is treated as required
- The serious-harm and remedial-action answers are the lawyer's, made after sections 26WE and 26WF are read
- No notice leaves the firm until the lawyer has decided that sections 26WK and 26WL require it
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Read the full text
The full text is available after you log in. It is free. When you log in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Confidentiality & client information
- AI confidentiality rules for staff (short form of the firm AI policy)
- Collection notice for health information on a personal injury claim
- Information barrier protocol for one matter
- Waiver of a concurrent conflict of interest (United States)
- Checklist before any file on a matter goes into a tool
- Staff and contractor AI confidentiality undertaking and acknowledgement
- Protocol before using a self-learning generative AI tool (United States)
- AI vendor confidentiality and privilege questions (short form of the vendor due-diligence questionnaire)
- Inventory of systems that can see client material
- File retention and destruction schedule
- Staff undertaking on unapproved generative AI tools (United States)
- Engagement clause: client authority for AI processing of confidential information (rider to the AI engagement clauses)
- Letter transferring a personal injury file to a new firm
- Comparison of a provider's terms on storage, training and subprocessors
- Check before using a hypothetical in a generative AI tool (United States)
- AI data incident steps (confidentiality short form of the AI incident response procedure)
- Confidentiality undertaking for an external reviewer or expert
All precedents for Confidentiality & client information · Tasks and AI use in this area