3 Answers

A procedures manual and rules, both in hard copy and available online, should be available for review. Anyone responsible for the information in question should have confidential status. Log books should be set up with recording of any activity logged in by whoever handles the records. You might also have any sharing of information something that requires two signatures (which would be an alpha or numeric code, thereby maintaining confidentiality and accessibility of the information).

A breach of confidentiality and or the privacy act, contact the relevant or authority involved, if this is a serious situation resulting in the detrimental sharing or misuse of personal information I would suggest you contact the ombudsman if the information is damming or could potentially cause hardship 

Contact the agency and ask to speak to a supervisor in regards to filing a complaint.