The Confidential File on the Shared Printer
You work in the records area of a community health service. At 3:40 pm on Friday, a colleague, Dan, asks you to print a 30-page report for a Monday board meeting and leaves for the weekend before collecting it. When you go to the printer, you find Dan's report sitting in the output tray - and underneath it, a second document that is clearly a client's medical history, including a name, address and diagnosis. The printer is in a corridor used by staff, volunteers and visitors. The health service's privacy policy says personal information must be stored securely, accessed only by staff who need it, and that suspected breaches must be reported to the privacy officer immediately. Dan is a popular senior staff member and you are three months into a traineeship. The privacy officer has already left for the day; her mobile number is on the staff contact list.
1. What should you do in the next ten minutes, and why does each step matter? (6 marks)
Read the worked answer
Immediate actions, in order:
- Secure the documents. Pick up both documents straight away so they are not left in a public corridor. The medical history must be removed from open view immediately; every minute it sits there increases the risk of unauthorised access.
- Do not read further than necessary. You have already seen the client's name and diagnosis; do not study, copy or discuss the contents. The policy is 'access only what you need', and unnecessary reading is itself a privacy problem.
- Separate and secure. Place the medical history in a sealed envelope or folder marked confidential and give it to the privacy officer or the duty manager, not back into an open tray. Deliver Dan's board report to his desk or a secure location so the Monday meeting is not disrupted.
- Report the suspected breach now. The policy requires immediate reporting. The privacy officer has gone home, but her mobile is listed, so call or text her with the facts: what document, where found, who may have seen it, what you have done. If she cannot be reached, escalate to the duty manager. Reporting is not dobbing - it is the required control that lets the organisation assess and contain the risk.
- Record what happened. Note the time, location and actions taken while it is fresh, because the privacy officer will need an accurate account.
Why it matters: a privacy breach can harm the client, trigger mandatory notification obligations and damage the service's reputation. Delay or silence turns a containable incident into a serious one.
2. Dan returns on Monday and asks why you 'made a fuss'. Explain how you would respond, and identify one change to prevent recurrence. (4 marks)
Read the worked answer
Response to Dan: stay calm, private and factual. Speak to him away from others rather than in the corridor. Explain that you found a client document in the printer and that the policy required you to secure it and report it to the privacy officer - you were following procedure, not judging him. Avoid accusation and avoid sharing the client's details with him; he does not need to know the contents. Acknowledge his pressure (the board report) and note that the same rule protects him: if his own information were left in a tray, he would want it handled this way. If he remains upset, refer the matter to the privacy officer or manager rather than arguing.
Prevention: introduce 'secure print' (PIN-release printing) so documents only print when the person is at the machine, and/or a sign at the printer reminding staff to collect jobs immediately. Either change removes the root cause - documents sitting unattended in a shared space - rather than just blaming an individual.