Form · Health & Medical Law
Eligible data breach assessment record
Record for deciding whether a loss of, or unauthorised access to, personal information is an eligible data breach that must be notified. The officer makes the decision.
- Kind
- Form. A form to complete, or a guide to completing an official one.
- Where it applies
- Commonwealth
- AI use
- Red You write the text. The tool writes nothing into the document. Where permitted, it may check, clarify or collect data, and anything it checks or collects is verified.
- Law stated as at
- 22 October 2026
- Status
- Maintained. Checked on 22 October 2026 against the authority it cites, for Commonwealth.
- Version
- 1
- Source
- Written for this library
When to use it
Use when a health service or other APP entity suspects personal information it holds has been lost or accessed or disclosed without authority, including health information.
Used for these tasks
Each task page says how far AI may help with the task and what the lawyer must review.
How AI may be used
The tool lists systems, dates and document titles from the incident log, and it does not decide serious harm or draft the statement to the Commissioner or to patients.
AI may
- Enter the date the entity became aware of the grounds for suspicion, from the incident log.
- List the kinds of information involved, using the labels in the log, including whether health information is included.
- Calculate the date 30 calendar days after that awareness date, for the officer to check.
AI must not
- Do not decide that serious harm is likely, or that remedial action has prevented it.
- Do not draft the statement to the Commissioner or the notice to individuals.
- Do not put patient information into a public tool.
The lawyer checks
- Apply the three criteria on the OAIC page, from the viewpoint of a reasonable person in the entity's position.
- Section 26WH(2), as the OAIC states it: the assessment must be reasonable and expeditious, and all reasonable steps must be taken to complete it within 30 calendar days.
- Notify the Commissioner and individuals as soon as practicable only if the officer believes there has been an eligible data breach. State privacy laws were not opened.
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Official form
Open the official form. Always use the current version from the issuer.
Read the full text
The full text is available after you log in. It is free. When you log in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Health & Medical Law
- Practitioner's response to an Ahpra notification or proposed immediate action
- Patient authority to release health records to the patient's lawyer
- HIPAA business associate agreement checklist
- Letter of instruction to an independent medical expert on breach of duty and causation (medical negligence)
- Patient information and consent form for AI scribes and AI-assisted care
- Therapeutic goods advertisement review checklist
- Notice of privacy practices review
- Request for access to health records (patient or authorised representative), with state and NZ variants
- Regulated health service advertising review
- Responding to a subpoena for medical records: health service checklist and production schedule (NSW courts)
- HIPAA use and disclosure limits checklist
- Advance care directive (Victoria): instructions note, completion and witnessing checklist, and decision-maker map
- Memo: is this AI tool regulated software as a medical device?
- Human research ethics submission readiness checklist
- Business associate subcontractor assurance checklist
- Open disclosure follow-up letter after an adverse event (health service)
- Memo assessing a mandatory notification obligation under the National Law
All precedents for Health & Medical Law · Tasks and AI use in this area