Skip to content
Cart Notification help

In-depth topic course

Privacy, Health Records and My Health Record in Australian Practice

The Privacy Act, State Health Records Laws and Handling Patient Information Well

  • 3 CPD hoursEstimated learning time
  • 20-question assessmentPass mark 80%
  • Online, self-pacedStart any time
  • CertificateFor your CPD records

Written for

Topics

About this course

Every practitioner handles health information all day: forms, referrals, results, phone calls, emails, photographs, and now AI scribes and automatic uploads to My Health Record. Most privacy problems in health care do not come from hackers. They come from ordinary routines that nobody stopped to question: a voicemail that mentions a diagnosis, a spreadsheet sent to the wrong address, a relative given an update without the patient's agreement, or a record opened out of curiosity.

Australian privacy law is also changing quickly. The Privacy Act was amended in 2024, a statutory tort for serious invasions of privacy began in June 2025, Queensland's public sector privacy principles changed in July 2025, Western Australia's new privacy Act began in July 2026, and from 1 July 2026 most pathology and imaging reports are uploaded to My Health Record by default, so patients may see results before you have spoken to them.

This health privacy course brings it together in one practical place. You will work through collection, disclosure, security, data breaches, retention, access and correction, and My Health Record, with Australian scenarios, decision tables, scripts and a quick-reference guide you can use with your team.

Written and reviewed by

Written by

Dr Hannah Whitmore PhD, MSc, RN

Nursing Education & Professional Practice

Reviewed by (legal reviewer)

Professor James Ellington LLB, LLM, PhD

Healthcare Law, Ethics & Professional Regulation

Reviewed by (editorial team)

Editorial Team Member

Healthcare ethics, professional conduct, patient safety and evidence-based education.

Last reviewed

Our authors and reviewers check course content for accuracy and currency. Completing a course does not guarantee any particular outcome with Ahpra, a National Board, a tribunal or an employer.

Who this course is for

  • Registered health practitioners in any profession, in private practice, community services or hospitals
  • Practice owners, principals and practice managers responsible for privacy policies and data breach responses
  • Practitioners who work across states or between public and private settings and need to know which laws apply
  • Clinicians considering or already using AI scribes, cloud software or online booking platforms
  • Practitioners who order pathology or imaging and want to prepare patients for share by default
  • Anyone who wants a clear refresher on confidentiality, records and My Health Record obligations

What you’ll learn

  • Know which laws apply

    Identify the Commonwealth, state and territory privacy and health records laws that govern your setting, including recent reforms.

  • Share information confidently and lawfully

    Apply APP 6, permitted exceptions and professional confidentiality to requests from families, insurers, employers, lawyers and police.

  • Respond well when things go wrong

    Contain and assess data breaches, notify where required, correct records properly and handle privacy complaints openly.

  • Use My Health Record within the rules

    View records only for care, use emergency access correctly, notify contraventions and prepare patients for share by default.

Learning objectives

  • Identify which Commonwealth, state and territory privacy laws apply to your practice setting.
  • Collect health information lawfully, with appropriate notice and consent, including for recordings and AI scribes.
  • Decide when health information may be used or disclosed, applying APP 6 and professional confidentiality.
  • Apply reasonable security measures and respond to data breaches under the Notifiable Data Breaches scheme.
  • Apply state retention requirements and plan for practice closure or transfer of records.
  • Respond to requests for access and correction within the law.
  • Use My Health Record lawfully, including emergency access, breach notification and share by default.
  • Recognise and prevent everyday privacy risks, including curiosity access, and respond well to privacy complaints.

Scenarios covered

Practice situations you reason through, step by step, in the course.

  • A worried relative on the phone

    How to respond warmly to a caller seeking an update without confirming information the patient has not agreed to share.

  • A police request without a warrant

    What the enforcement exception permits, why it does not compel disclosure, and how to document your decision.

  • An email sent to the wrong address

    Containing the breach, assessing serious harm within 30 days and deciding whether to notify the OAIC and the patients involved.

  • A patient with an unpaid account asks for her records

    Responding to an access request within a reasonable time, without excessive fees and without linking it to the debt.

  • A CT report the patient may see first

    Explaining share by default when ordering tests, and agreeing how results will be followed up.

  • A colleague tempted to look up a celebrity

    Why curiosity access is unauthorised, how audit logs work and what to do if it has already happened.

Course contents

7 sections, 28 lessons, then the final assessment.

  1. Section 1: The Privacy Landscape for Australian Health Practitioners4 lessons
    • 1.1 Why Health Information Is Different
    • 1.2 The Privacy Act 1988 and the Australian Privacy Principles
    • 1.3 State and Territory Privacy and Health Records Laws
    • 1.4 Professional Duties and the Changing Legal Picture
  2. Section 2: Collecting Health Information Lawfully4 lessons
    • 2.1 Necessity and Consent: APP 3 in Practice
    • 2.2 Telling People: Collection Notices and Privacy Policies
    • 2.3 Information From Third Parties and Unsolicited Information
    • 2.4 Anonymity, Identifiers and Sensitive Services
  3. Section 3: Using and Disclosing Information: APP 6 and Confidentiality4 lessons
    • 3.1 Primary Purpose, Secondary Purpose and Reasonable Expectations
    • 3.2 Permitted Exceptions: When You May or Must Disclose
    • 3.3 Families, Carers and Responsible Persons
    • 3.4 Requests From Insurers, Employers, Lawyers and Police
  4. Section 4: Security, Data Breaches and Retention4 lessons
    • 4.1 Reasonable Steps to Secure Information
    • 4.2 The Notifiable Data Breaches Scheme
    • 4.3 Retention, Destruction and Practice Transitions
    • 4.4 Cloud Services, Overseas Vendors and Artificial Intelligence
  5. Section 5: Access to and Correction of Health Records4 lessons
    • 5.1 The Right of Access Under APP 12
    • 5.2 When Access May Be Refused or Limited
    • 5.3 Correcting Records Without Altering Them
    • 5.4 Requests on Behalf of Others and Transfers of Care
  6. Section 6: My Health Record: Access, Uploads and Obligations4 lessons
    • 6.1 How the My Health Record System Works
    • 6.2 Authorised Viewing and the Limits on Use
    • 6.3 Emergency Access and Breach Notification
    • 6.4 Uploading Information and Share by Default
  7. Section 7: Privacy in Everyday Practice4 lessons
    • 7.1 Reception, Waiting Rooms and Conversations
    • 7.2 Phones, Email, Messaging Apps and Personal Devices
    • 7.3 Curiosity Access and Inappropriate Use of Records
    • 7.4 Privacy Complaints and Building a Privacy-Aware Practice
  8. Final assessment and written reflection20 questions

Assessment and certificate

  1. Work through the course

    Study each section at your own pace, including the case illustrations and apply-it questions.

  2. Pass the assessment

    20 scenario-based questions. You need 16 correct (80%) to pass.

  3. Write your reflection

    A short written reflection on how the learning applies to your own practice.

  4. Download your certificate

    Shows your name, the course, the date and 3 CPD hours. Anyone can check it on our verification page.

What you keep for your CPD records

  • A certificate of completion recording approximately 3 hours of learning, to file with your CPD record
  • A written reflective account based on three privacy-specific prompts
  • A quick-reference guide covering collection, disclosure, security, breaches, retention, access and My Health Record
  • Decision tables and checklists you can adapt for your practice's privacy procedures and staff training

How certificates and CPD records workVerify a certificate

Primary sources

The course is built on these official documents. Check them for the current version.

Questions about this course

Is this course recognised by Ahpra or a National Board?

No. This is independent education. It is not accredited by Ahpra, not approved by any National Board and not endorsed by any professional body; National Boards do not accredit individual CPD courses. Record the time you actually spend against your own CPD plan and decide whether the learning is relevant to your practice.

Does the Privacy Act apply to small practices?

Yes. The small business exemption does not apply to organisations that provide a health service and hold health information, so every private practice, including a sole practitioner, must comply with the Australian Privacy Principles.

Which privacy law applies in my state?

Private providers everywhere are bound by the Privacy Act. In Victoria, NSW and the ACT, state health records laws apply as well. Public hospitals and services follow state or territory public sector privacy laws, which recently changed in Queensland and Western Australia. The course includes a table showing which laws apply where.

How long do I need to keep patient records?

The Privacy Act does not set a fixed period. In Victoria, NSW and the ACT, adult records must generally be kept for at least seven years after the last service, and records collected while the patient was a child until they turn 25. Public sector records follow state disposal schedules. Check your insurer's advice too.

Can a patient see their records if they owe the practice money?

Yes. Under the Privacy Act an unpaid account is not a ground for refusing access, and any fee for giving access must not be excessive. Refusal is allowed only on narrow grounds, such as a serious threat to someone's life, health or safety.

What changed with My Health Record on 1 July 2026?

Under share by default laws, most written pathology and diagnostic imaging reports must be uploaded to My Health Record within 24 hours. Some reports are visible to patients straight away and others after five days, so patients may see results before follow-up. Patients can ask that reports not be uploaded.

Can I use an AI scribe in consultations?

Possibly, if you understand how the tool handles data, tell patients about it, obtain their informed consent, respect refusals and review every note before finalising it. Ahpra and the OAIC have both published guidance. The course covers the practical steps.

Will this course satisfy a condition or undertaking on my registration?

Not automatically. Only Ahpra or your National Board can decide whether a course meets a condition or undertaking. If you have one, check with Ahpra or your Board, and your lawyer or professional indemnity insurer, before you enrol for that purpose.

Save with a program that includes this course