03 9070 9810

Leaked Medical Records: Civil Remedies Under Australian Law

The statutory tort for serious invasion of privacy provides a direct right of action for unauthorised disclosure of health information.

Book a Confidential Assessment ($770)

Max file size: 20MB

When Your Medical Records Are Shared Without Consent

If your medical records have been leaked, shared, or disclosed without your consent, you may have a civil cause of action under Australian law. Since 10 June 2025, the statutory tort for serious invasion of privacy (Schedule 2 of the Privacy Act 1988 (Cth)) has given individuals the right to claim compensation for the misuse of personal information, including private health data.

Health and medical information is among the most sensitive categories of personal data recognised in law. Its unauthorised disclosure can cause profound distress, damage professional standing, and erode trust in institutions responsible for its safekeeping. Before this legislation, Australians had limited options: a complaint to the OAIC (available only against APP entities), or an uncertain common law claim with no established precedent. The statutory tort changes that position significantly.

A fixed-fee confidential assessment with a privacy lawyer is available for $770 to review the legal pathways, potential liability, and remedies available when medical records are shared without consent.

Time limits apply. You may have as little as 12 months from the date you became aware of the disclosure to commence proceedings. Strict limitation periods apply to these claims.

Concerned About Leaked Health Information?

A fixed-fee confidential assessment ($770) will identify your strongest legal pathway and what steps to take next.

Three Pathways for Health Information Privacy Breaches

Not every pathway suits every case. The right approach depends on who disclosed your information, how they obtained it, and what outcome you are seeking.

Court proceedings representing statutory tort litigation

The Statutory Tort: Compensation Through the Courts

<p>The statutory tort for serious invasion of privacy under Schedule 2 of the Privacy Act 1988 (Cth) is a powerful remedy available for the intentional or reckless misuse of personal information, including medical records and treatment histories.</p><p>Critically, the statutory tort applies against <strong>any person or entity</strong>: doctors, hospitals, employers, insurers, former partners, or anyone else who disclosed your health information. This is broader than the OAIC complaint pathway, which only covers APP entities. You do not need to prove financial loss. The tort is actionable per se. Truth is not a defence: it does not matter whether the information disclosed was accurate.</p><p>Compensation for non-economic loss and exemplary damages is capped at the greater of $478,550 or the maximum award for non-economic loss under defamation law. The court may also grant injunctions to restrain further disclosure.</p>

Regulatory office representing OAIC complaint process

OAIC Complaint: A Regulatory Alternative

<p>If the entity that disclosed your medical records is an APP entity (broadly, private sector organisations with annual turnover exceeding $3 million, health service providers, and Commonwealth Government agencies), you may also lodge a complaint with the Office of the Australian Information Commissioner (OAIC). This pathway is free and does not require a lawyer.</p><p>The OAIC can investigate and make determinations, including orders for compensation. However, the process has recognised limitations: it is slow (often 12 months or more), outcomes are typically modest, there is no capacity for exemplary damages, and the OAIC has no jurisdiction over individuals acting in a personal capacity or small businesses below the threshold. If your medical records were leaked by a former partner or a colleague acting outside their employment, the OAIC cannot assist.</p><p>For many serious health information breaches, the statutory tort provides a stronger and more direct remedy.</p>

Legal strategy meeting representing parallel claims approach

Parallel and Combined Approaches

<p>In some cases, the strongest strategy involves pursuing more than one pathway. A statutory tort claim and an OAIC complaint are not mutually exclusive, though the interaction between the two requires careful management. Where the disclosure of medical records also damages reputation (for example, disclosure of a mental health diagnosis to your employer or industry peers), there may be an overlapping defamation claim.</p><p>We practise in both privacy and defamation law. This allows us to assess whether the facts support claims under both regimes and to advise on which combination of proceedings will produce the best outcome. A confidential initial assessment will identify which pathways are open to you and which is likely to be most effective given your circumstances.</p>

Common Scenarios: How Medical Records Are Leaked

Healthcare Providers

A GP, psychologist, or hospital staff member may disclose a diagnosis, treatment history, or mental health record to a patient's family member, employer, or insurer without the patient's consent. Under the Australian Privacy Principles (APPs), health service providers are APP entities regardless of their turnover, which means a complaint to the OAIC is available in these cases. However, where the disclosure was intentional or reckless and sufficiently serious, the statutory tort provides a direct path to civil privacy damages, including compensation well beyond what the OAIC typically awards.

Employers and Workplace Disclosure

Employers sometimes obtain medical information through pre-employment checks, workers compensation claims, or fitness-for-duty assessments. The disclosure of that information to managers, colleagues, or third parties who have no legitimate need to know it can constitute a serious invasion of privacy. The APPs contain an employee records exemption: acts and practices of an employer that relate to an employee record are exempt from the APPs. The statutory tort contains no equivalent exemption. If your employer disclosed your health information to people who had no proper reason to receive it, the statutory tort may be the only viable civil remedy.

Insurers

Health and life insurers hold detailed medical information provided during the underwriting process. Unauthorised disclosure of that information, whether to third-party assessors, affiliated companies, or former partners in the context of a disputed claim, may give rise to liability under both the APPs and the statutory tort.

Former Partners and Associates

In relationship breakdowns, former partners sometimes disclose sensitive health information (mental health diagnoses, substance use history, sexual health records) to mutual acquaintances or family members. The OAIC has no jurisdiction over individuals acting in a personal capacity. The statutory tort addresses this gap. Where the disclosure involves publication online, the principles regarding private information published without consent apply.

Evidence You Should Preserve

If you believe your medical records have been disclosed without your consent, preserving evidence is critical. Take screenshots of any online posts before they are removed. Keep copies of text messages, emails, or letters in which the information was communicated. Record the date you first became aware of the disclosure: this is when the limitation period begins to run. If you received the information verbally, make a file note of the conversation as soon as possible, including the date, time, who was present, and what was said. Do not confront the person who disclosed the information before obtaining legal advice, as this may compromise your position.

The Seriousness Threshold

Not every unauthorised disclosure of medical information will meet the threshold for the statutory tort. The invasion must be serious, and the defendant's conduct must have been intentional or reckless. An accidental inclusion of medical details in a misdirected email, while distressing, is unlikely to satisfy the fault element. However, a deliberate disclosure of a patient's HIV status to their workplace, or a former partner's calculated revelation of a mental health diagnosis on social media, is within the scope of the tort. The court considers specific factors to determine if the seriousness threshold is met.

Time Limits Apply

You may have as little as 12 months from the date you became aware of the disclosure. Do not delay in obtaining advice.

Why the Statutory Tort Matters for Health Information Breaches

The new law addresses gaps that left many Australians without an effective civil remedy for leaked medical records.

No Proof of Damage Required

The statutory tort is actionable per se. You do not need to demonstrate financial loss, psychiatric injury, or any other form of damage to establish liability. The invasion of privacy itself is the wrong.

Truth Is Not a Defence

Unlike defamation, the accuracy of the disclosed medical information is irrelevant. It does not matter whether the health records were true. The wrong is the unauthorised disclosure, not the content.

Broad Defendant Coverage

You can bring a claim against any individual, corporation, or government body. This includes people the OAIC has no jurisdiction over: former partners, neighbours, colleagues acting in a personal capacity, and small businesses.

No Employee Records Exemption

The APPs exempt employer handling of employee records. The statutory tort does not. If your employer disclosed your medical information inappropriately, the tort may be the only civil pathway available to you.

Injunctive Relief Available

Where disclosure is ongoing or threatened, the court may grant an urgent injunction to restrain further publication. This is particularly important where medical information has been posted online and continues to spread.

Available Compensation

Combined compensation for non-economic loss and exemplary damages is capped at the greater of $478,550 or the maximum award for non-economic loss under defamation law. These figures are well above what the OAIC typically orders in determinations for APP breaches.

Frequently Asked Questions: Leaked Medical Records

Yes. Since 10 June 2025, the statutory tort for serious invasion of privacy under Schedule 2 of the Privacy Act 1988 (Cth) provides a civil cause of action for the intentional or reckless misuse of personal information, including medical records. The claim is brought in a court of competent jurisdiction. You do not need to prove you suffered financial loss. Only individuals (natural persons) can bring a claim, not companies.

No. Truth is not a defence to the statutory tort. This is one of the key differences between privacy claims and defamation claims. Even if the health information shared about you was entirely accurate, the person who disclosed it without your consent may still be liable.

Potentially. A health service provider who deliberately discloses a patient's diagnosis without consent may have committed a serious invasion of privacy. However, the disclosure must have been intentional or reckless, not merely careless or accidental. If the disclosure was negligent rather than deliberate, it may not satisfy the fault element of the statutory tort, though it may still support an OAIC complaint or a negligence claim. A confidential assessment will clarify which pathway applies to your facts.

An OAIC complaint is a regulatory process. It is free, does not require a lawyer, and the OAIC can investigate and order compensation. However, it only applies against APP entities (broadly, organisations with turnover above $3 million, health service providers, and Commonwealth agencies). It does not cover individuals or most small businesses. Outcomes are typically modest and the process is slow. A court claim under the statutory tort applies against any person or entity, offers higher compensation (capped at the greater of $478,550 for non-economic loss and exemplary damages or the maximum defamation amount), and can include urgent injunctive relief. A comparison between OAIC complaints and the statutory tort provides further detail on these options.

This is an important area where the statutory tort fills a gap. The Australian Privacy Principles contain an employee records exemption, meaning the APPs generally do not apply to an employer's handling of current or former employee records. The statutory tort has no equivalent exemption. If your employer intentionally or recklessly disclosed your medical information to people with no legitimate need to know, you may have a claim under the statutory tort. Whether the employer had implied consent or a lawful basis for disclosure will be central to the analysis.

The statutory tort provides for non-economic loss and exemplary damages (capped at the greater of $478,550 or the maximum award for non-economic loss in defamation) and economic loss. As judicial awards for damages under this cause of action are still being established, courts are likely to have regard to comparable awards in defamation and UK privacy cases. The principles governing compensation and damages claims provide a framework for these awards.

The limitation period is one year from the date you became aware (or ought reasonably to have become aware) of the invasion, or three years from the date the invasion occurred, whichever expires first. A court may extend this period up to a maximum of six years from the date of the invasion in exceptional circumstances. Strict timeframes apply to these claims.

You should preserve any evidence of the disclosure: screenshots of social media posts, text messages, emails, letters, and contemporaneous notes of verbal disclosures. You will also need to establish that the information was private, that the defendant's conduct was intentional or reckless, and that the invasion was serious. You do not need to prove damage, but evidence of distress or consequences may be relevant to the quantum of compensation.

Yes. The statutory tort provides for injunctive relief. If the disclosure is ongoing or further publication is threatened, the court may grant urgent privacy injunctions where appropriate. The court must have regard to the public interest in publication when deciding whether to grant the injunction, but the sensitivity of medical information weighs heavily in the plaintiff's favour in most cases.

Confidential Initial Assessment: $770 Fixed Fee

We will review your situation, identify the strongest legal pathway, and advise on your options. All consultations are treated as strictly confidential.

Disclaimer: This content provides general information only and does not constitute legal advice. You should obtain professional advice for your specific circumstances.

Call