Sensitive patient records were leaked to the nurses' union in the ACT, Mental Health Minister Emma Davidson has told the Legislative Assembly.
Ms Davidson said she was notified on February 8 about the data breach, which is now the subject of police and integrity commission investigations.
"An audit was undertaken to determine the breadth of the breach which uncovered significant and sustained breaches of the Health Records Privacy and Access Act 1997 and the Privacy Act 1988, this took some time," Ms Davidson said.
"But by 27 February, we had a pretty clear understanding of the number of patients and staff involved. The breach identified that the personal health information of 13 [Canberra Health Services] patients had been shared with an industrial partner and other private email accounts.
"And that industrial partner was the ANMF ACT branch."
Health authorities have already sacked one staff member allegedly involved in leaking the information, and another two have been stood down, pending an investigation.
The leak was revealed publicly by The Canberra Times on Tuesday, more than a fortnight after Canberra Health Services staff were notified in an email and affected patients were told of the breach.
Ms Davidson said the Australian Nurses and Midwives Federation ACT branch had declined a request for a meeting.
"I emailed the CEO of [Canberra Health Services] and the ANMF ACT branch secretary to express my concerns about the impact on patients and on staff who are trying to create a safe workplace and high quality of care," she said.
Canberra Health Services chief executive Dave Peffer confirmed on Wednesday afternoon that three staff had faced consequences over the breach.
Mr Peffer said one staff member had been terminated and two others were stood down and referred to the public sector standards commissioner.
Mr Peffer has said whole clinical records had been "deliberately emailed" outside of the organisation to an "industrial partner" over a period of years. He said the organisation became aware of the breaches in the weeks before he sent an all staff email on March 6 about the situation.
Health authorities had previously declined to say who the "industrial partner" the information was allegedly shared with.
Opposition health spokeswoman Leanne Castley had earlier questioned why the minister had not informed the public of the serious data breach sooner.
"I believe the moment the minister found out about this she needed to give Canberra an update and explain what has happened," she said.
"I'm surprised it has taken this long for us to find out about this."
Ms Davidson on Thursday said Canberra Health Services staff complete mandatory training on how to handle personal health information, which includes access rules, how records can be shared and how to securely store and destroy records.
The Mental Health Minister said she would continue to update the Assembly when she was able to.
"As you can see from the information that I've shared with you today about training and support provided to staff, staff are very clear about their responsibilities in relation to patient privacy," she said.
More to come.
