The File Left on the Printer
Tomasz is a support worker at a community health service. At 4:50 pm on Friday he prints a client summary for a case meeting. The printer jams, so he leaves the document in the output tray and goes to help a colleague. On Monday morning, a volunteer named Aisha finds the two-page summary in the tray. It contains the client's name, date of birth, mental health diagnosis, medication list, and a note that the client is 'under investigation for suspected child neglect'. Aisha brings it to Tomasz, who thanks her and puts it in his bag to shred later. At lunch, Tomasz tells two colleagues about the neglect note because 'it's a small team and they should know'.
1. Identify each privacy breach in this scenario and explain why it matters.
Read the worked answer
Breaches:
- Leaving the document unattended - client information was accessible to anyone passing the printer, including volunteers and visitors. Printing should be collected immediately or held at the device.
- Unsecured storage - placing the document in a personal bag rather than a secure shredding bin or locked drawer creates further risk of loss.
- Disclosure to Aisha - even though Aisha found it, Tomasz should have retrieved it without discussing its contents and reported the incident; Aisha should be told only what she needs to know.
- Sharing with colleagues - telling two colleagues about the neglect note is a secondary disclosure to people with no need to know. 'Small team' is not a lawful basis for sharing sensitive information.
- Failure to report the incident - a privacy breach involving sensitive health and child protection information should be reported immediately through the organisation's incident process so the risk can be assessed and, where required, the client notified.
Why it matters: The information is sensitive health information and includes an unproven suspicion about child neglect. Disclosure could expose the client to stigma, harm the therapeutic relationship, prejudice the investigation, and breach privacy law and the organisation's policies. The client may be entitled to be told about a serious breach. Tomasz's obligations include collecting output promptly, storing records securely, sharing only on a need-to-know basis, and reporting incidents honestly.
2. What should Tomasz do now, and what should the organisation do in response?
Read the worked answer
Tomasz should: retrieve the document from his bag, place it in a secure confidential waste bin, and report the incident through the organisation's privacy incident process the same day. He should tell his manager what was disclosed, to whom, and when, and cooperate with any risk assessment. He should not attempt to 'fix' the matter by asking colleagues to forget it, and he should not contact the client without guidance from his manager.
The organisation should: record the incident, assess the likelihood and severity of harm, contain the breach (confirm the document is destroyed, ask Aisha and the colleagues not to further disclose), and consider whether the client should be notified and what support to offer. It should review why printing was possible without collection, consider swipe-release printing, a locked output tray, or a rule that sensitive documents are collected immediately. It should provide refresher training on confidentiality and need-to-know for all staff and volunteers, and clarify that volunteers must hand found documents directly to a supervisor without reading them.
Key principle: A breach is managed by containment, assessment, notification where appropriate, and system improvement - not by concealment. Tomasz's honesty in reporting is the right instinct even though his earlier handling was poor.