NT Health backtracks on claim only five patients impacted by privacy breach

The Northern Territory health department has backtracked on its claim only five patients were affected by a privacy breach that led to pregnant women's confidential medical information being shared to 28,000 followers on Instagram by a "medical observer".

The admission comes after the ABC earlier this week contacted multiple women it had identified as affected by the breach, with four confirming it was the first they had heard of it, despite the incident occurring two weeks ago. 

The photos and videos posted by Neda Mogharehabed — an overseas-trained doctor who was visiting Royal Darwin Hospital (RDH) from October 12 to 14 — featured patient names, ID numbers, medical conditions and other highly sensitive information.

NT Health said the content had been removed from Dr Mogharehabed's account and that she was no longer linked with the department.

On Monday, Health Minister Steve Edgington issued a statement saying NT Health had contacted "all five affected patients".

However, the ABC had already identified about a dozen people who were exposed, and sought clarification from the health department about whether it would also inform the others — to which a spokesperson repeated that only "five individuals were determined to be identified".

After this statement, four affected patients confirmed to the ABC they had not been informed of the privacy breach by NT Health.

While none of these patients felt comfortable being named in the media, three provided the ABC with statements expressing their "disappointment" and "distress".

"I am furious that I had to find out by a journalist investigating instead of NT Health who should be proactively contacting mums who they even suspect may have had their privacy compromised," one mother wrote.

Another said: "More than two weeks passed [since my appointment] before I found out [about the privacy breach] through the media, rather than directly from the hospital responsible for protecting my personal information."

A third told the ABC: "At a time when we should be focusing on our newborn and enjoying these first precious days together, we are instead dealing with fear, distress and uncertainty over the breach of our privacy". 

After further questions from the ABC — and at least one complaint from an affected patient who was not informed of the breach — NT Health issued another statement on Tuesday afternoon.

"As part of continued investigations into the patient information breach, NT Health sought specialist ICT assistance to unlock files that could not previously be opened. This has identified the information of a further seven patients," NT Health deputy chief executive of regional health services Fiona Renshaw said.

"NT Health is contacting these patients today to explain what happened, apologise and offer support."

In a statement to the ABC, Dr Mogharehabed said she "cannot confirm how these images were posted" and that she took "patient privacy seriously".

Concerns over singular maternity service

Two of the affected patients noted in their statements to the ABC that RDH offers the "only maternity service in Darwin".

Local maternity care advocate Sophia Emberson-Bain said RDH's privacy breach was yet another blow for expectant Darwin mothers.

"You've essentially only got one place to turn to, and that is the place that has breached your trust," Ms Emberson-Bain said.

The advocate also raised concerns about the timeliness of NT Health's response.

"I think the sensible thing to have done would have been to contact those 12 women immediately, but also just in case other women are affected, contact everybody who would have seen that medical observer," she said.

In a letter sent by RDH management to a handful of the affected patients last Friday, the organisation noted it was first made aware of the social media posts on October 15.

But in a statement to the media earlier this week, NT Health said it learned of the breach "on the afternoon of 14 October".

However, the ABC has since received evidence that an email was sent to NT Health's legal team detailing the posts on the morning of October 13.