The confidential drug and alcohol test results of graduate paramedics were available for every Ambulance Victoria staff member to view under a significant breach that has been reported to the state’s privacy watchdog.
The Ambulance Victoria chief executive, Jane Miller, confirmed on Friday afternoon that the “unacceptable” breach involved 600 test results relating to a “few hundred” people, and offered her unreserved apology to those impacted.
She said the organisation was in the process of contacting people who had been affected by the breach, which included about 30 positive test results.
According to an email sent late Thursday to members of the Victorian Ambulance Union, and first reported by the Guardian, confidential spreadsheets relating to pre-employment testing of graduate paramedics in 2017 and 2018 were available on the staff intranet until the union alerted Ambulance Victoria to the problem.
In the member email, the union said the private information included the full names of graduate paramedics, when they were tested, whether the result was positive or negative, and, if positive, the substance that had been detected.
The union said it had written to Ambulance Victoria urging it to contact any affected employee including past employees about the breach, conduct an audit to determine who had accessed the files, and immediately cease all alcohol and drug screening until it could be confident the issue had been rectified.
It also said it had told Ambulance Victoria to report the breach to the Office of the Victorian Information Commissioner and other relevant authorities.
The union said it would also report the breach to the watchdog on behalf of its members, and was exploring possible legal action.
According to the email, signed by the union’s general secretary, Danny Hill, and the assistant secretary, Olga Bartasek, the union had also requested an urgent meeting with Ambulance Victoria to discuss the breach.
“This will be extremely stressful to anyone affected. Members are invited to make contact with the VAU to seek support and advice if you are advised that you are involved in this breach,” the email said.
“This is one of the biggest examples of organisational incompetence we have ever seen in AV. Employees deserve to have the highest confidence in the ability of their employer to protect their confidential information.
“AV have dismally failed this test today and will have to work very hard to regain the trust of the workforce in relation to private employee information.”
Miller said an access audit was underway to determine who had viewed the records, and an investigation was also probing how the breach occurred.
She said that it appeared the documents had been uploaded because of an “inadvertent process issue” and it remained unclear how long they had been available for.
The information contained in the documents referred to data captured between May 2017 and October 2018.
Miller said it had been removed swiftly, and that Ambulance Victoria had reported the breach to the OVIC and Victorian health complaints commissioner.
