Is he satisfied, if at all, that Canopy Health’s decision to notify some patients approximately six months after identifying unauthorised access to its systems meets the Government’s expectations for protecting patient privacy where the provider delivers publicly funded health services; if so, why?

Answer

I am advised that privacy notifications must comply with the legislative requirements of the Privacy Act 2020, which includes consideration of a range of factors that can take time. Responsibility for managing privacy notifications rests with the party involved in the breach, which in this case was Canopy Health. I also am advised that Canopy Health engaged with and received guidance from the Office of the Privacy Commissioner in connection with its privacy notification process.