The Office of the Privacy Commissioner has found that a primary school breached privacy principle 5 by displaying a child's Medical Action Plan (MAP) in the school's staffroom.

MAPs are developed by schools to inform staff how to respond to children who may require urgent medical attention. The child had high needs and the MAP included sensitive medical information regarding their toileting.

In a case note, the Office says the parents were informed the school would display the MAP in the school’s staff room after their child brought home an unsealed letter and copy of the MAP they had been given.

"The parents were concerned with the way the school delivered the information, which they believed should have been enclosed in an envelope or marked as confidential. They worried their child’s dignity could have been compromised if the medical information was viewed by their child’s classmates.

"They were additionally concerned with the placement of the MAP in the school’s staffroom. They said pupils regularly entered the room and could have easily viewed the MAP, which they said would have caused their child to experience bullying. The parents complained to the school and the board of trustees."

The case note says the school responded that it did not believe they had breached the child’s privacy but removed the MAP from the staffroom and subsequently reviewed the way children’s medical information was accessed and shared by staff. The school later expressed regret to the parents.

The parents lodged a privacy complaint. The Privacy Commissioner says its investigation concluded that the school had breached principle 5 of the Privacy Act 1993. This says that agencies should take reasonable steps to ensure that personal information they hold is protected by reasonable security safeguards in the circumstances to protect against loss, unauthorised access or use.

"Given the extremely sensitive nature of the child’s medical condition, we did not believe the staffroom was the appropriate location to display the MAP. Although the staffroom was predominantly accessed by school staff, it was reasonable to assume that children or other adults may enter it," the Privacy Commissioner says.

"We acknowledge the importance of having that information available to staff responsible for the child’s health and safety, but that it was still important to ensure the information was only available to those with a need to know. The display in the staff room meant the info was subject to wider distribution that was necessary."