Auckland University law professor Bill Hodge said if the contact details of patients had been used to send them an invite for something unrelated to their medical care, then it could constitute a breach of the Privacy Act.