Ambulance Victoria

Summary

Ambulance Victoria was made aware on 11 May 2023 that documents containing confidential drug and alcohol testing results of approximately 600 job applicants were accessible to all Ambulance Victoria employees on the organisation's intranet. The documents, which related to testing conducted between May 2017 and October 2018, included first names, last names, test dates, results, and where applicable, the class of drug detected. The breach occurred due to an error that made the documents accessible internally, though they were not available outside the organisation.

What Happened

On Thursday, 11 May 2023, Ambulance Victoria became aware that confidential documents containing personal information of some current and prospective employees were accessible to other AV employees on the AV intranet. The documents appear to have been made accessible by error, rather than through malicious action or external cyber attack.

The confidential drug and alcohol test results of graduate paramedics had been viewable by every Ambulance Victoria staff member. Chief Executive Jane Miller confirmed the breach involved 600 test results relating to "a few hundred" people (some individuals had multiple tests).

An investigation showed the documents had been accessed only a handful of times in the past six months. The documents were not directly accessible to anyone outside the organisation, and there was no evidence of them being shared outside Ambulance Victoria.

Impact on Individuals

The breach affected approximately 600 job applicants who underwent alcohol and other drug testing between May 2017 and October 2018. The documents contained:

• First name and last name
• Date of test
• Results (negative or non-negative, indicating further testing was required)
• Where applicable, the class of drug detected
• Whether Ambulance Victoria standards were met or further laboratory results were required

The exposure of drug and alcohol testing results is highly sensitive and represents a significant privacy violation. Even negative test results can be embarrassing if disclosed, whilst non-negative results or positive detections could damage professional reputations and career prospects for paramedics and job applicants.

The breach affected current employees as well as individuals who applied for positions but may not have been hired, meaning some affected individuals may have moved on to other careers in healthcare or emergency services where this information could cause reputational harm.

Organisational Response

Ambulance Victoria self-reported the matter to both the Office of the Victorian Information Commissioner and the Health Complaints Commissioner, demonstrating transparency in addressing the breach.

The organisation apologised for the incident and worked to contact affected individuals to notify them of the exposure. AV removed the documents from the accessible intranet location and implemented measures to prevent similar errors in future.

The limited evidence of access (only a handful of times in six months) and the fact that documents were not accessible outside the organisation reduced the potential harm, though the highly sensitive nature of the data meant the breach still represented a serious privacy violation for affected paramedics and applicants.