Data breach notification, Kerrawong Family Clinic, lost laptop
Data breach notification letter template that tells people what to do next
A data breach notification letter has to tell each affected person what happened, exactly which of their information was involved, what the organisation has done, and what they should do now, in plain words they can act on. This two page letter from a regional clinic after a laptop holding 1,240 patients' details was lost on a train covers all four.
The document, page by page
Every page as it renders and as it prints, with nothing summarised. Read the wording before you reuse it.
Section by section
What each section is for, so you can keep the ones you need and drop the rest.
- Letterhead and addressee
- Clinic ledger letterhead with ABN, the date, private and confidential, and the patient.
- Subject and opening
- A plain statement that the patient's information was on a lost laptop, and an apology.
- 1. What happened
- Laptop lost on a train on 24 September, not encrypted, 1,240 patients affected.
- 2. The information involved
- A table of what was and was not on the laptop.
- 3. What we have done
- Passwords changed, remote wipe set, OAIC notified 2 October, devices encrypted.
- 4. What we recommend you do
- Four steps against scams and to check Medicare claims.
- 5. Contact us
- Privacy officer, dedicated line and email, and the right to complain to the OAIC.
- Sign off
- The practice principal's signature block.
How to adapt this document
First, for an email compromise rather than a lost device, replace section 1 with when the account was accessed and for how long, and say whether emails were read or only possibly read, because that changes the risk. Second, if passwords or card numbers were involved, move the change your password and contact your bank steps to the top of section 4. Third, for a breach at a supplier, name the supplier in section 1 and say what the clinic has required of them, since readers will ask why their data was there.
Which law the terms follow
The letter follows Part IIIC of the Privacy Act 1988, the Notifiable Data Breaches scheme, which applies to private health service providers whatever their turnover. The statement given to individuals must include the entity's details, a description of the breach, the kinds of information involved and recommended steps. The OAIC administers the scheme, receives the statement and handles complaints. State public health services may also be covered by their state's privacy or health records law.
What makes this document work
The table shows what was not lost, too
Five rows say Yes or No: name, date of birth and mobile, Medicare number, and appointment reason were on the laptop; clinical notes and bank details were not. Telling patients what is safe matters as much as what is not, because it stops a reasonable worry turning into a flood of calls.
The advice matches the actual risk
With names, numbers and Medicare details exposed, the realistic harm is a scam call that sounds like the clinic. Section 4 says so in its first sentence, then gives four steps: be wary of anyone quoting those details, ring the clinic back on a known number, check Medicare claims, and report scams.
It owns the cause
Section 1 says plainly that the drive was not encrypted, and section 3 says every device is now encrypted and lists cannot be saved outside the records system. A letter that names its own failure and its fix is believed; one that blames a thief alone invites a complaint to the regulator.
Questions people ask
When does an Australian organisation have to notify a data breach?
Under the Notifiable Data Breaches scheme in the Privacy Act 1988, when a breach is likely to result in serious harm to someone whose personal information is involved and the harm cannot be prevented by remedial action. Health information, as here, makes serious harm more likely. The organisation must notify affected people and the OAIC.
What must a data breach notification include?
The organisation's identity and contact details, a description of the breach, the kinds of information involved, and recommendations about the steps people should take in response. This letter covers each in its own numbered section, then adds what the clinic has done and how to complain, which the scheme does not require but readers expect.
How quickly must the breach be assessed?
An organisation that suspects an eligible data breach must take reasonable steps to assess it within 30 days, and once it believes one has occurred, notify as soon as practicable. Here the laptop was lost on 24 September, the OAIC was notified on 2 October, and patients were written to on 6 October.
Should the letter apologise?
Yes, briefly and early, as this one does in its first paragraph. An apology is not an admission of every possible claim, and its absence reads as indifference. Keep it to one sentence and move straight to facts and actions, which are what readers need from the rest of the letter.
Can the notice be an email instead of a letter?
Yes. The scheme lets organisations notify people in the way they normally communicate with them, such as email, text or post. A clinic with up to date mobile numbers might send a short text pointing to this letter. Where contacting everyone directly is not practicable, the organisation publishes the statement instead.
Build your own in about a minute
The button below opens the generator with this use case already described. Change the wording to match your own, generate, then edit anything you like.
Make one like thisOther document examples
Special resolution notice template with the full wording and the 75 percent rule
A notice of special resolution has to give members the exact words of the resolution, the date, time and place of the meeting, and enough notice to decide how to vote. This one page notice for a Victorian landcare group changing three of its rules does that, explains why, and shows what 75 percent of the vote means in numbers.
Abandoned goods notice template with inventory and disposal date
An abandoned goods notice template tells a former tenant what they left behind, where it is stored, what it costs and the date after which it will be sold or disposed of. In New South Wales the notice period depends on the value of the goods, so the inventory with estimated values is what decides the deadline.
Product recall notice template for one batch of a toy
A product recall notice has to let a parent or customer identify the exact product in seconds, understand the hazard, know what to do right now, and know what they will get back. This one page notice from a toy maker recalling 1,860 wooden trucks from batch 2608 does that, and tells them where the batch number is printed.
Want the steps in the builder? Read Create a document with AI, then Document builder components. For everything this generator can do, see the document maker.
Written and checked by the OneCraft team. Last checked .