On 6 July 2026 the Office of the Australian Information Commissioner published its data breach figures for the 2025 calendar year, and one sector sat at the top of the list again. Health service providers reported more data breaches than any other industry in Australia. Ten days later, a network of more than 60 general practice clinics confirmed that patient records had been taken in a cyber attack. Two stories, three weeks apart, pointing at the same thing: the health information Australia’s care system runs on is valuable, exposed, and somebody’s job to protect.

That somebody is, more and more often, a trained documentation professional. If you are looking at a career in healthcare documentation, this is worth understanding, because privacy is not a side topic in this work. It is a core part of the role.

The Office of the Australian Information Commissioner, usually shortened to the OAIC, runs the Notifiable Data Breaches scheme. Organisations covered by the Privacy Act 1988 must tell the regulator and the affected people when a breach is likely to cause serious harm, so its figures are one of the better views we have of what is going wrong. The picture for 2025, published on 6 July 2026, was the busiest since the scheme began in 2018:

• 1,205 data breaches were notified across all sectors, up 8 per cent on the 1,112 reported in 2024.
• Health service providers reported the most of any sector, with 225 notifications, or 19 per cent of the national total.
• 716 of the 1,205 notifications came from malicious or criminal attack rather than accident.

Australian Privacy Commissioner Carly Kind described the threat to Australian organisations as “substantial and rising year on year”.

The general practice case reported in mid July 2026 shows the shape of it. Partnered Health, which operates a network of more than 60 clinics, said it became aware on 23 June 2026 that a malicious actor had accessed some of its data. It confirmed that 21 clinics across New South Wales, Victoria, Queensland and the Australian Capital Territory may have been affected, and reported the incident to the OAIC, the Australian Cyber Security Centre and law enforcement. Public reporting described the exposed information as including names, dates of birth, addresses and contact details, Medicare numbers, private health insurance and concession card details, and clinical material such as consultation notes, referral letters and pathology and diagnostic results.

Read that list again from a documentation point of view. It is not a list of database fields, it is a list of documents. Consultation notes, referral letters and reports are exactly the records a healthcare documentation specialist produces, checks and files. The security question and the documentation question are the same question.

It is tempting to file data breaches under technology and move on. Firewalls matter, and they are not the documentation team’s call. But much of what protects health information is decided in the daily handling of records, and that is documentation work:

• Right patient, right record. A report filed to the wrong patient is both a clinical risk and a privacy breach. Careful checking at the point of documentation prevents both.
• Only what is needed, only to who needs it. Knowing who may see a record, and what can be released to an insurer or another practice, is a judgement records staff make constantly.
• Secure handling of work in progress. Audio files and draft letters are real health information with the protection often stripped off. Home based and contract work raises the stakes here, not lowers them.
• Accurate, complete, contemporaneous records. When something goes wrong, the record is the evidence. Poor documentation turns a manageable incident into an unprovable one.
• Knowing what to do in the first hour. Spotting that an email went to the wrong address and escalating it immediately is often the difference between a contained incident and a notifiable one.

None of that is a technology control. All of it is trained behaviour, and it is much of why employers value people who have been taught the privacy and medico legal side of records rather than picking it up as they go. It is the same discipline that makes someone good at the day to day documentation role in the first place.

You do not need to be a lawyer to work with health records, but you do need to know the shape of the rules, because health information gets stricter treatment than ordinary personal information under Australian privacy law. The parts worth knowing early:

• The Notifiable Data Breaches scheme. Under the Privacy Act 1988, an organisation suspecting an eligible data breach must take all reasonable steps to assess it within 30 days. If serious harm is likely, both the affected individuals and the OAIC must be told.
• Health records are kept for years. Retention rules vary by state and territory. In New South Wales, Victoria and the Australian Capital Territory, privacy law generally requires a provider to keep records for seven years, or for a child until they turn 25.
• More information is shared by design. From 1 July 2026, under the Australian Digital Health Agency’s share by default reforms, written pathology and diagnostic imaging reports go to My Health Record by default unless an exception applies. That makes disciplined handling more important, not less.

The obligations sit on the organisation, but they are met or missed by individuals doing ordinary tasks properly.

Healthcare documentation is usually pictured as typing, and typing is part of it. But the qualification is built around a wider job: producing, checking and safeguarding the health information the care system runs on. Privacy sits in the middle of that, alongside clinical terminology, editing and the growing work of reviewing what AI tools produce.

The 11288NAT Diploma of Healthcare Documentation is designed around that scope. It covers the Australian health system and how records move through it, privacy, ethics and medico legal responsibilities, advanced clinical terminology, producing and editing healthcare documentation, and the emerging area of AI in healthcare documentation, where a qualified human checks what the software drafted.

Graduates work in roles including medical records and health information officer positions, AI documentation review, documentation and transcription services, in house roles in practices and hospitals, and independent contracting from home. It is also a stepping stone toward the HLT50321 Diploma of Clinical Coding for people who enjoy the classification side of health information, a move a lot of documentation professionals make. Career changers are welcome, because the course teaches the role from the ground up and assumes no medical or nursing background.

Australian health care will keep generating more records and sharing them more widely. There is room for people who know how health information should be handled.

The 11288NAT Diploma of Healthcare Documentation teaches the full scope of the role, from clinical terminology and document production through to the privacy and medico legal responsibilities that come with it. It is 100 per cent online, self paced over 12 months, with daily intakes.

Explore the 11288NAT Diploma of Healthcare Documentation to see the units, fees and how to enrol, or read our guide to getting started in healthcare documentation.

Sources: OAIC Notifiable Data Breaches statistics for 2025 (published 6 July 2026) and NDB scheme guidance; Australian Digital Health Agency share by default reforms; public reporting of the Partnered Health cyber incident, July 2026.

TalentMed Pty Ltd is a Registered Training Organisation, RTO 22151.