Ambulance Victoria investigating ‘unfortunate’ data breach

Ambulance Victoria has been slammed after paramedics reportedly found confidential data about their colleagues on the agency’s internal website.

Ambulance Victoria has begun an urgent investigation into another privacy breach, after staff reportedly discovered confidential data about their colleagues, including medical information, on the agency’s internal website.

A Victorian Ambulance Union bulletin sent to members on Monday, and seen by the Herald Sun, alerted paramedics to the error and slammed the agency’s “stunning level of incompetence and negligence in protecting confidential staff information”.

It says the breach – the second in just three months – contained “significant amounts” of information including applications for several jobs, medical information and Covid tests results and HR information.

Ambulance Victoria chief executive Jane Miller confirmed they were told on Monday about the files, which she described as “working documents to support clinical operations”, but did not specify what information they held.

She said they restricted access to crucial staff, would contract a third-party to complete “a thorough audit” and on Tuesday self-reported to the Office of the Victorian Information Commissioner and the Health Complaints Commissioner.

Ambulance Victoria is investigating the breach. Picture: Wayne Taylor

“Our initial investigations suggest that access restrictions were inadvertently and mistakenly lifted in one section of our intranet site and that a small number of files were opened,” she said.

The union bulletin says members told the union they also found managers’ notes, management handover reports, business cases, ambulance performance data and reports on Ambulance Victoria medication trends on the intranet.

“Just three months ago AV informed staff that they are ‘committed to protecting the privacy of personal and health information, taking every step possible to make sure this does not happen again’,” the bulletin says.

“This is a harmful and embarrassing failure to deliver on this commitment.”

It comes after employees found 42 spreadsheets with the results of pre-employment drug and alcohol testing on the agency’s intranet in May.

At the time, the Victorian Ambulance Union said the leak was “alarming”.

Monday’s bulletin says, like last time, the agency “only became aware of this breach when informed by the VAU”.

It says the union had asked the agency to “immediately” restrict or remove the information, and notify staff of the breach.

Ms Miller said a technical team was still reviewing files to “determine the nature of the access”.

“I trust the integrity of our people, and this information has not been accessed outside our organisation,” she said.

“Regardless, this is unfortunate and regrettable, and we are taking significant measures to strengthen access control, as well as to clearly understand the details of this issue.

“I have met with the Victorian Ambulance Union this morning and briefed them on our approach.”