The Department of Health has offered an enforceable undertaking that it will do better in complying with privacy principles in response to an investigation that found it had inadvertently breached the Privacy Act when it released a sample of data for research purposes in 2016.

University of Melbourne researchers discovered that the identities of doctors could be decrypted from the data set, which involved MBS and PBS billing records. The dataset was removed from the internet but the same researchers also later discovered that patients could potentially be identified too.