Royal Darwin Hospital privacy breach — pregnant women's medical records posted to Instagram by 'medical observer'
Severity: high · Patch status: no-fix-needed · Since 2026-10-28
A 'medical observer' at Royal Darwin Hospital shared pregnant women's confidential medical information in a post visible to roughly 28,000 Instagram followers. The Northern Territory health department initially claimed only five patients were affected, but backtracked after the ABC contacted multiple women impacted by the breach. The department has not confirmed the full number of affected patients. The breach involved misuse of access to patient records rather than a technical vulnerability, so no software fix applies; the incident raises questions about insider access controls and social media policies at NT Health facilities.
What to do
- Review and tighten insider access controls and audit logging for patient records at NT Health facilities
- Enforce and audit social media and confidentiality policies for staff and observers
- Notify and support affected patients and offer identity/privacy protections
- Investigate how the observer accessed and shared the data and assess disciplinary and legal action
- Review third-party/observer onboarding and supervision procedures
Sources
All live incidents on Threat Watch
