---
title: "Data breach checklist for medical records"
url: "https://ailawframework.com/precedents/confidentiality-and-client-information/firm-medical-records-breach-checklist"
type: "precedent"
site: "AI Law Framework"
id: "a51-firm-medical-records-breach-checklist"
area_id: "A51"
kind: "checklist"
ai_level: "yellow"
version: 1
task_ids: ["A51-MA20261022-1", "A51-MA20261022-11"]
law_stated_as_at: "2026-10-23"
---

# Data breach checklist for medical records

> Checklist for a suspected breach of medical records on a plaintiff injury file, setting out the assessment, the 30-day steps and the notification sections. It does not decide eligibility or send a notice.

Canonical page: https://ailawframework.com/precedents/confidentiality-and-client-information/firm-medical-records-breach-checklist  
Law stated as at: 2026-10-23

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

- Kind: Checklist. Steps or checks to work through and tick off.
- Practice area: [Confidentiality & client information](https://ailawframework.com/precedents/confidentiality-and-client-information.md)
- Jurisdictions: Australia, Victoria, Queensland, New South Wales
- AI level: Yellow. You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at: 2026-10-23
- Status: Maintained. Checked on 2026-10-23 against the 5 authorities it cites, for 4 jurisdictions.

## When to use it

Use when a plaintiff firm suspects that medical records it holds were accessed, disclosed or lost without authority. It supports the lawyer's assessment under the Notifiable Data Breaches scheme. It does not replace the AI data incident steps where the incident is a tool, and those steps do not replace this assessment.

## Used for these tasks

- [Assess a suspected breach of client personal information under the notifiable data breach scheme](https://ailawframework.com/obligations/confidentiality-and-client-information/assess-a-suspected-breach-of-client-personal-information-under-the-notif.md)
- [Check the safeguards for client personal information the practice holds](https://ailawframework.com/obligations/confidentiality-and-client-information/check-the-safeguards-for-client-personal-information-the-practice-holds.md)

## How AI may be used

The tool can record the facts the lawyer supplies and set out the sections. The lawyer decides suspicion, belief, serious harm, remedial action and whether anyone is notified.

**AI may:**

- List the records and the kinds of information from facts the lawyer has entered
- Set out sections 26WE, 26WF, 26WH, 26WK and 26WL as questions with blank answers
- Remind the file that an AI-tool incident also uses the AI data incident steps

**AI must not:**

- Must not decide that there are reasonable grounds to suspect or to believe
- Must not decide that serious harm is likely because the records are medical records
- Must not treat remedial action as having removed the breach
- Must not prepare the statement to the Commissioner or notify any person

**The lawyer checks:**

- Whether the scheme applies to this practice is decided before the assessment is treated as required
- The serious-harm and remedial-action answers are the lawyer's, made after sections 26WE and 26WF are read
- No notice leaves the firm until the lawyer has decided that sections 26WK and 26WL require it

## Authorities

- [Privacy Act 1988 (Cth) s 26WE, eligible data breach, AustLII compilation](https://classic.austlii.edu.au/au/legis/cth/consol_act/pa1988108/s26we.html)
- [Privacy Act 1988 (Cth) s 26WF, remedial action, AustLII compilation](https://classic.austlii.edu.au/au/legis/cth/consol_act/pa1988108/s26wf.html)
- [Privacy Act 1988 (Cth) s 26WH, assessment of a suspected eligible data breach, AustLII compilation](https://classic.austlii.edu.au/au/legis/cth/consol_act/pa1988108/s26wh.html)
- [Privacy Act 1988 (Cth) s 26WK, statement about an eligible data breach, AustLII compilation](https://classic.austlii.edu.au/au/legis/cth/consol_act/pa1988108/s26wk.html)
- [Privacy Act 1988 (Cth) s 26WL, notification of an eligible data breach, AustLII compilation](https://classic.austlii.edu.au/au/legis/cth/consol_act/pa1988108/s26wl.html)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/confidentiality-and-client-information/firm-medical-records-breach-checklist and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*