A paramedic is believed to be behind the social media leak of graphic emergency-room images of a Sydney Harbour shark attack victim, NSW Ambulance has confirmed.
Lauren O'Neill was badly wounded when a shark bit her on the leg while she was swimming near a jetty at Elizabeth Bay, in Sydney's eastern suburbs, on Monday evening.
Neighbours helped pull the 29-year-old to safety and stemmed the bleeding before she underwent major surgery at St Vincent's Hospital.
Images emerged on Thursday of Ms O'Neill's bloodied leg, taken while she was in the emergency department.
NSW Ambulance released a statement confirming it had apologised to Ms O'Neill and her family for any distress caused.
"We spoke with Ms O'Neill's family this afternoon and informed them that we believe a NSW Ambulance staff member was responsible for the breach of her privacy," a spokesperson said.
"NSW Ambulance takes its patient privacy obligations very seriously and is continuing to investigate this breach to determine the full details of the incident."
Multiple investigations were launched following the photo leak.
The NSW Department of Primary Industries (DPI) earlier confirmed NSW Police provided it with six images for scientists to identify the species of shark responsible for the attack.
A department spokesperson said the images were stored securely and had not been shared with anyone apart from a few select specialists.
"NSW DPI takes every effort to protect privacy in any situation, and especially as a matter of respect and concern for the welfare of a person who has suffered a shark attack," the spokesperson said.
Agriculture Minister Tara Moriarty said it was "extremely disappointing" that a young woman's privacy had been breached.
"I would like to thank our scientists in the Department of Primary Industries for their work in determining the species of shark and assisting emergency services during the incident," she said.
NSW Police confirmed it was aware of a photo that was distributed and officers were "conducting inquiries".
Earlier, St Vincent's apologised to Ms O'Neill for the breach of her privacy.
"St Vincent's takes patient privacy obligations extremely seriously and is investigating this issue as a matter of priority," a spokesman for the hospital said.
"We have engaged with the patient and we have sincerely apologised for any part St Vincent's played in the photos being taken."
Health staff regularly take images of patients' conditions for clinical care, staff education and forensic purposes.
But the taking of such images requires the prior consent of a patient, except when essential for clinical care, and staff are required to maintain the security of sensitive information.
Ms O'Neill on Wednesday asked for privacy after thanking medical staff and all who had come to her aid.
"(Lauren) wishes to thank her heroic and very kind neighbours for the critical assistance they provided her," a statement issued on her behalf said.
"She would also like to thank the public for their outpouring of support and kindness and, as she turns to focusing on her recovery, asks that her privacy and that of her family be respected."
The avid kayaker and swimmer remains in recovery at St Vincent's Hospital, where she was rushed for surgery following the attack.
