Partnered Health data theft: 22 days from discovery to patient notice
A NSW Supreme Court interim injunction bars use or publication of the data, and the company has not said how its systems were accessed.
Threat intelligence
Patient notice 15 Jul 2026
Lead source Partnered Health, Cyber incident support page
What the company has confirmed
Partnered Health says it became aware on 23 June that a malicious actor had accessed its systems, and that its investigation confirmed personal information, including health information, was taken from some clinics. The records named include contact details, Medicare and concession card numbers, and consultation notes, referral letters and pathology results.
It reported the incident to the Australian Cyber Security Centre, the OAIC and law enforcement, and asked Services Australia to monitor affected Medicare cards.
The timeline
Partnered Health lists 22 affected clinics: 17 where health information was likely taken and five under investigation. Information Age (16 July) dated the patient notice to the Wednesday, 15 July: 22 days after discovery. The company says it waited until it could give patients accurate, specific information.
The lesson for a health provider
Under the Notifiable Data Breaches scheme, an entity that suspects an eligible breach has 30 days to assess it, then notifies as soon as practicable. Twenty-two days sits inside that window. The tranche 2 exposure draft would set a 72-hour notice to the OAIC.
- Know which clinics and systems hold which records before an incident
- Keep logs that show exactly what was accessed
- Prepare patient notices and a contact centre script in advance
- Decide who can seek an injunction, and how fast
Sources
- PrimaryPartnered Health, Cyber incident support pageRetrieved 25 Oct 2026
- SecondaryInformation Age, Australian GP network hit in data breachRetrieved 25 Oct 2026
- SecondaryiTnews, Medical clinic chain Partnered Health hit by data theftRetrieved 25 Oct 2026
