Brisbane Medical Clinic Took Three Months to Notify Patients of Data Breach

A Queensland medical practice has come under scrutiny after revealing it delayed notifying patients of a significant data breach by nearly three months, raising fresh concerns about cybersecurity practices in the Australian healthcare sector.

GO2 Health, a general practice clinic in Everton Park in Brisbane's north, confirmed that its main email inbox was compromised through a phishing attack in April this year. However, patients affected by the breach were not informed until 16 July—almost three months after the initial incident.

Delayed Response Triggers Expert Calls for Regulation

The lengthy gap between the breach discovery and patient notification has prompted cybersecurity experts to renew calls for mandatory notification timeframes in Australia's healthcare industry. Currently, no federal requirement mandates how quickly medical practitioners must alert patients to data breaches, creating a regulatory vacuum that has left patients vulnerable.

A clinic spokesperson acknowledged the breach affected patient information stored within the compromised mailbox. "Our investigation did ultimately identify that some data within the mailbox may have been accessed, including some patients' Department of Veteran's Affairs ID Numbers and other information that patients may have provided," the statement read.

The clinic stated it engaged cybersecurity experts to contain the breach and notified affected staff members on 24 April, the same day the breach was discovered.

Part of Broader Healthcare Vulnerability Trend

The GO2 Health breach comes less than a week after Partnered Health—another Australian healthcare provider—announced a major data breach affecting thousands of patients. The back-to-back incidents underscore increasing vulnerabilities within Australia's medical infrastructure, which has become an increasingly attractive target for cybercriminals seeking valuable personal and health information.

The lengthy gap between breach discovery and patient notification has prompted fresh calls for mandatory notification timeframes in Australia's healthcare industry.

Phishing attacks—where attackers trick staff into revealing credentials or clicking malicious links—remain one of the most common methods for gaining initial access to medical systems. The GO2 Health incident highlights how email accounts, often the gateway to broader network access, represent a critical security vulnerability.

Regulatory Gaps Leave Patients Unprotected

Unlike data protection frameworks in other sectors, Australia's healthcare industry lacks specific mandatory notification requirements. The Privacy Act contains general notification obligations, but does not specify timeframes for medical organisations to inform affected individuals of breaches.

Privacy advocates have stressed that delays in notification prevent patients from taking protective measures, such as monitoring financial accounts or placing fraud alerts with credit agencies. A three-month delay significantly reduces patients' ability to detect and respond to identity theft or fraudulent activity resulting from compromised information.

GO2 Health operates across Queensland, providing general practice and specialist veteran care services. The clinic has not disclosed the total number of patients affected by the breach.

Growing Pressure for National Standards

The incident adds momentum to discussions within regulatory circles about implementing mandatory breach notification standards aligned with international best practice. Countries including the United States and members of the European Union require notification within specific timeframes—typically 30 to 60 days.

The Office of the Australian Information Commissioner (OAIC) has previously flagged healthcare as a sector requiring enhanced cybersecurity vigilance, but has stopped short of recommending specific regulatory amendments.

Source: ABC News