The Instagram Post
Priya is an intern in a small-town pharmacy. After a long shift she posts a photo to her private Instagram story. The photo shows a dispensing tray with a box of clozapine, a patient's partially visible address label and a wristband with the patient's first name and NHI number partly covered. The caption reads: 'How do you even mix these up?!' Her account has 180 followers, including two pharmacy colleagues. Within six hours a colleague screenshots the story and sends it to the preceptor. Two people in town have already messaged Priya to ask if it is 'that patient from the community centre'. Priya deletes the post and asks whether she can just apologise and move on. The pharmacy has a social media policy that requires immediate reporting of privacy breaches.
1. What professional and legal obligations does Priya have after posting the image?
Read the worked answer
Priya has breached patient confidentiality. The image contains identifying details, and in a small town even a partial name, NHI fragment and medicine may be enough to identify the patient. The Health and Disability Code of Consumers' Rights and the Privacy Act create obligations to protect patient information and to respond properly to a breach. Priya should report the post immediately to her preceptor and the pharmacy's privacy officer, as the social media policy requires. She should preserve evidence, including the screenshot and anything she knows about who viewed or shared the post, and she should not ask colleagues to delete messages to hide what happened. She should cooperate with the pharmacy's privacy breach assessment and any need to notify the patient or the Privacy Commissioner. She should also consider self-reporting to PCNZ, because a confidentiality breach of this kind can raise a conduct issue. An apology is necessary but is not a substitute for reporting and remediation.
2. Does deleting the post resolve the issue? What should Priya and the pharmacy do next?
Read the worked answer
Deleting the post limits further spread but does not resolve the issue. At least one colleague has screenshotted it, two people have already identified the patient, and the image may have been saved or forwarded. Priya and the pharmacy should establish who received or shared the image, ask those people to delete it without destroying their own records of the breach, and document the timeline. The privacy officer should assess the likelihood of harm, decide whether the patient must be told, and provide an apology and explanation. The pharmacy should review why an intern had access to a personal phone in a dispensing area and reinforce its social media policy. Priya should write a reflective statement showing insight into the effect on the patient and the profession. Concealment or minimisation would be an aggravating factor; prompt reporting, honesty and cooperation are mitigating factors.
3. What factors would PCNZ consider if this were notified as a conduct matter?
Read the worked answer
PCNZ would consider the nature and seriousness of the breach, the vulnerability of the patient, whether the patient was identifiable, how widely the image spread, and whether Priya acted deliberately or impulsively. It would look at her insight and remorse, whether she reported promptly once challenged, whether she tried to conceal the post, and what she has learned. It would also consider her previous conduct, the pharmacy's policies and supervision, and any remediation such as privacy training or a reflective assignment. A single impulsive post with early disclosure and genuine insight may lead to a conduct process with censure, conditions or education rather than deregistration. A post that mocked a patient, exposed sensitive medicine, or was followed by deletion and denial would be viewed more seriously. The central question is whether Priya can be trusted with patient information and whether the public would be protected by conditions or monitoring.