This Article

This initiative forms part of our ongoing commitment to safeguard patient, staff and organisational information to reduce the risk of unauthorised disclosure or data loss. 

These tools help identify and prevent sensitive data, such as patient demographics, Medicare numbers, driver's licence details and other protected health information, from being inadvertently or inappropriately shared outside of authorised systems. The technology may monitor activities such as information being uploaded to websites, transferred to removable media (such as USB devices), printed, or otherwise moved outside approved AWH environments. Where potentially sensitive information is detected, users may receive a notification or prompt requiring confirmation or a business justification before proceeding. 

What does this mean for staff? 

For most staff, there will be little to no change to day-to-day work practices. If a DLP alert is triggered, you may be asked to confirm the business purpose for transferring information or review whether the action is appropriate before continuing. 

The purpose of these tools is not to monitor productivity or performance. Their function is to help protect patient information, support compliance obligations, and reduce the risk of accidental or unauthorised disclosure of sensitive data. 

Privacy, Monitoring and Compliance 

AWH's existing IT Acceptable Use Policy already advises staff that AWH monitors the use of its information systems and technology resources. 

What information is recorded when a DLP event occurs? 

When sensitive information is detected being transferred through an unauthorised or monitored channel, AWH's Data Loss Prevention systems may record information necessary to investigate and manage potential security risks. This may include: 

• The staff member's user account and computer name. 

• The date and time the activity occurred. 

• The policy or rule that was triggered. 

• The type of sensitive information detected (for example, patient information, Medicare numbers, driver's licence numbers or other protected health information). 

• Details of the file involved, such as the file name, location and type. 

• The destination of the information, such as a website, cloud service, printer or USB storage device. 

• The application used to perform the action (for example, a web browser, email client or business application). 

• Whether the activity was allowed, blocked or overridden. 

• Any business justification entered by the user where a warning or approval prompt is presented. 

Where required to support investigation of a potential privacy, security or compliance incident, the system may also retain limited evidentiary information directly related to the event, including: 

• A screenshot of the application or screen at the time the alert was generated. 

• Information relating to the file or content that triggered the alert. 

• Technical details associated with the transfer, upload, print or copy attempt. 

• Audit logs showing the sequence of actions associated with the event. 

This information is collected solely for cyber security, privacy protection, regulatory compliance and incident investigation purposes. The technology is designed to help protect patient, staff and organisational information. 

Why are we implementing this? 

The introduction of DLP technology will help AWH: 

• Better protect patient privacy and confidential information. 

• Reduce the risk of data breaches and accidental disclosures. 

• Meet healthcare, privacy and cyber security obligations. 

• Improve our ability to detect, investigate and respond to security incidents. 

• Support a safer and more secure digital environment for staff and patients. 

Thank you for your continued commitment to protecting the information entrusted to AWH.