PL-53-Data Breach Response Plan

Introduction

In the event that Holistic Healthcare Management Services experiences a data breach or suspects that one has occurred, this Data Breach Response Plan outlines the procedures and establishes clear lines of authority for Holistic Healthcare Management Services staff.

A data breach is defined as the unauthorised access, disclosure, or loss of personal information. Under the Notifiable Data Breaches (NDB) scheme, Holistic Healthcare Management Services is required to notify the Office of the Australian Information Commissioner (OAIC) if a data breach is likely to result in serious harm to an individual whose personal information is involved.

This response plan addresses instances of unauthorised use, modification, interference with, or loss of personal information held by Holistic Healthcare Management Services. It acknowledges that data breaches can arise from various factors and affect different types of personal information, resulting in a range of potential harms to individuals and entities.

The aim of this response plan is to enable Holistic Healthcare Management Services to contain, assess, and respond to data breaches quickly, mitigate potential harm to affected individuals, and ensure compliance with the NDB scheme. The initial 24 hours following the discovery of a data breach are critical to Holistic Healthcare Management Services’s response.

To achieve these goals, the plan includes contact details for the appropriate staff to be informed in the event of a data breach, clarifies the roles and responsibilities of staff, and documents processes to assist Holistic Healthcare Management Services staff in responding to a data breach effectively.

Responding to a Data Breach & Data Breach Flow

The appropriate response to data breaches involves a case-by-case approach that requires an assessment of the associated risks to determine the suitable course of action. In certain instances, the response team may need to involve external experts such as IT specialists, data forensics experts, or human resources advisers, depending on the breach’s nature.

To mitigate potential harm to individuals, data breach officers should ideally undertake steps 1, 2, and 3 simultaneously or in quick succession (refer to the OAIC’s Part 3: Responding to data breaches – four key steps). Throughout the process, officers should also consider what remedial action can be taken.

Step 1: Identify the breach

A suspected data breach may be discovered by any Holistic Healthcare Management Services staff member or contractor or Holistic Healthcare Management Services may be otherwise alerted (for example, by a member of the public or the media).

If a staff member becomes aware of or is notified of a data breach, they must immediately inform their supervisor or line manager, who will then promptly notify the Privacy Officer. In cases where a manager or supervisor suspects a data breach, they may report it directly to the Privacy Officer.

Staff must record and advise their supervisor or line manager of the following:

• the time and date the suspected breach was discovered,
• the type of personal information involved,
• the cause and extent of the breach, and
• the context of the affected information and the breach.

Step 2: Contain the breach and notify the Privacy Officer

When a data breach occurs, it is crucial for the supervisor or line manager to act swiftly and effectively and take certain steps. First, they should work to understand, assess, and contain the breach. Once these initial steps are taken, they must inform the Privacy Officer of the breach or suspected breach and provide all relevant facts necessary for an initial assessment of the potential data breach and its severity. This notification must take place within the first hour of becoming aware of the situation.

The Privacy Officer will then take charge of coordinating any immediate actions needed to contain the breach. Depending on the nature of the incident, this could include contacting unintended recipients to delete sensitive emails or requesting the removal of information from a website.

It is recommended that the supervisor or line manager first contact the Privacy Officer by phone as soon as possible after taking initial containment actions, followed by a detailed email as soon as is reasonably practical. This notification must occur on the same working day that the breach was identified and initial action was taken.

Review, Testing, Records & Training

• Review the incident: Conduct a post-breach review, prepare a report, implement strategies to address data handling weaknesses, and update policies, procedures, or staff training practices if necessary.
• Testing this plan: The Data Breach Response Team must conduct annual drills to simulate hypothetical data breaches, evaluate readiness, and report results to the Governing Body.
• Records Management: Documents created by the team must be saved in the assigned folder, and internal handling of personal information will be reviewed quarterly during Senior Management Team meetings.
• Training and Policy Updates: The HR Manager ensures staff receive necessary additional training, while the Privacy Officer reviews and updates data protection policies.