Misaddressed annual-exam results and breach duties

Overview

A MediCard clinic emailed employees’ annual physical examination results to unintended recipients without its stated encryption and password safeguards. In the consolidated breach matter, the NPC rejected MediCard’s low-risk rationale for not notifying affected employees and directed a compliance check, although it closed the breach proceedings.

Practice implications

Parao Law practice guidance

For physicians

Treat annual-exam reports as sensitive even when sent within one employer’s workforce. Verify each recipient, use approved secure delivery, and report a misdirected email promptly. Help identify exactly which results went to whom; asking recipients to delete an email does not by itself resolve notification duties.

For lawyers

Map the employer and clinic’s controller roles and their separate response obligations. Assess serious-harm risk and notification with evidence, not an unsupported “internal recipient” assumption. Document containment, affected persons, timing and corrective controls; the resolution criticized the provider’s delayed notice.