SIRA issues letter of censure to icare

SIRA has issued a letter of censure to icare after it disclosed the personal and health information of injured workers, resulting in a breach of section 243(1) of the Workplace Injury Management and Workers Compensation Act 1998 (1998 Act).

On 6 May 2022, icare acting on behalf of the Nominal Insurer inadvertently emailed 1,450 cost of claims reports to approximately 570 incorrect recipients.

These cost of claims reports disclosed the personal and health information of around 192,000 injured workers.

The breach was caused by an incorrect transcription of employer email addresses and policy numbers in a spreadsheet before the cost of claims reports were sent out as an email attachment via a distribution list.

icare became aware of the incident on 10 May 2022 and advised SIRA verbally on 13 May 2022.

Under section 243(1) of the 1998 Act, it is an offence to disclose an injured worker’s information, obtained under the legislation, unless it occurs in an exempt circumstance.

icare has accepted the breach and has advised SIRA of the steps taken to remediate the incident, including contacting the email recipients to confirm the claims reports had been deleted or were inaccessible to them, and writing to the affected workers.