Hospital breach: when patients must be notified

Overview

After unauthorized copying of a hospital family-planning registry, the NPC denied the hospital’s request to avoid notifying affected patients. It ordered notification, proof of notice and additional remedial measures. This is an order on a breach-notification request, not a general finding of liability for every aspect of the incident.

Practice implications

Parao Law practice guidance

For physicians

If a registry or chart extract is lost or copied without authority, report it immediately through the hospital’s incident process. Preserve what is known about affected patients and data fields, stop further access and help the privacy team identify patients who may need notice. A confidentiality agreement alone does not replace a response plan.

For lawyers

Apply the breach-notification criteria to the actual data, access and risk of serious harm. Preserve the investigation and evidence of safeguards, document any exemption request, and plan workable patient notification. Missing contact details alone did not justify withholding notice in this case.