Privacy Act s 26WG

In judging whether serious harm is likely, have regard to the kinds and sensitivity of the information (health information is sensitive information), any security protection and the chance it is overcome, who has obtained or could obtain it, and the nature of the harm.