Privacy and Confidentiality Concerns: Your Legal and Professional Duties Explained

Health information is sensitive information and attracts the strictest rules in Australian privacy law. When something goes wrong with it, a practitioner can be accountable in two systems at once.

• Privacy law. The Privacy Act 1988 and the Australian Privacy Principles bind every private health service provider, regardless of turnover. Victoria, New South Wales and the ACT also have health records laws, and public sector services generally follow state or territory law. The Office of the Australian Information Commissioner (OAIC), or a state commissioner, investigates.
• Professional regulation. Every National Board code, including the shared Code of conduct, Good medical practice, the nursing and midwifery codes and the Psychology Board's code, requires you to protect privacy and confidentiality, keep accurate and secure records, and give people access to their own information. A Board can act on a breach of those duties as a conduct matter.

The two overlap but are not identical. The professional duty of confidentiality can cover information that is not technically personal information under the Privacy Act, such as what a patient tells you about a third party, and it continues after a patient dies. Equally, the law permits some disclosures, for example to lessen a serious threat, that still need careful professional judgement.

Most privacy breaches in health care do not come from hackers. They come from ordinary routines nobody questioned: a voicemail that mentions a diagnosis, a spreadsheet sent to the wrong address, a relative given an update the patient had not agreed to, or a record opened out of curiosity.

When a privacy matter reaches Ahpra, the Board is not deciding whether the Privacy Act was breached in a technical sense. It is asking whether your conduct fell below the professional standard in your code and whether there is an ongoing risk to the public. Factors that tend to matter include:

• Intent and pattern. A single misdirected email handled openly is very different from repeated deliberate access to records without a clinical reason.
• Honesty afterwards. Altering a record after a complaint, or giving an inaccurate account of access that audit logs contradict, can turn a manageable concern into a finding about honesty. Corrections should always be made by dated addendum, never by overwriting.
• Harm to the person. Health information breaches are more likely to cause serious harm, including psychological, financial and reputational harm.
• What has changed. Whether you and your practice have identified the cause and fixed the system, not only apologised.

Possible outcomes follow the usual range, from no further action through cautions, undertakings and conditions to referral to a panel or tribunal for serious matters such as sustained unauthorised access. Separately, the OAIC or the System Operator may take their own action. The process stages are explained on our notification help page. Records-related concerns overlap heavily with this one; see also records and documentation concerns.

Patients have a right to access their health information. Respond within a reasonable time, which the OAIC treats as usually no more than 30 calendar days, without excessive charges and regardless of any unpaid account. Grounds for refusal are narrow; consider giving access through an intermediary rather than refusing, and redact only what is genuinely necessary.

If a patient asks for a correction you agree with, add a dated addendum and leave the original visible. If you decline, attach the patient's statement to the record. Check the authority of parents, guardians, executors and lawyers, and any court orders, before releasing information to them.

Retention and practice changes

In Victoria, NSW and the ACT, adult records must generally be kept for at least seven years after the last service, and records of children until they turn 25; check other legal and insurer requirements where you work. Plan for practice closure or sale and for the death or incapacity of a sole practitioner, so records remain secure and accessible.

My Health Record

View a record only to provide health care to that patient. Emergency access is for serious threats only, must be documented and is notified to the System Operator. From 1 July 2026 most pathology and diagnostic imaging reports are uploaded by default, so patients may see results before you have discussed them. Tell patients this when you order tests and agree how results will be followed up.

Where a privacy concern is under assessment, what helps most is evidence that you understand exactly what went wrong and that the routine has changed. Targeted education can support that, along with practical evidence such as a revised verification procedure, an access audit, a staff training record or a corrected privacy policy that describes your real systems.

Be specific when you explain your learning. "I completed a privacy course" says little. "I now verify every caller using two identifiers before discussing any patient, and our practice has switched referrals to secure messaging" says much more. Our reflective statement template can help you structure that account. No course can guarantee any regulatory outcome, and if you are subject to a condition or undertaking, check with Ahpra or your Board before relying on a particular course.

A police request without a warrant

Police ask by phone for a patient's recent attendance details. The enforcement exception may permit disclosure, but it does not compel it. Ask for the request in writing, consider what is reasonably necessary, seek advice if unsure, and document your decision and reasons.

An email sent to the wrong address

A staff member emails a list of patients and their test results to the wrong recipient. Contain the breach, assess serious harm within 30 days and decide whether the OAIC and the patients must be notified. Then change the process that allowed it.

A colleague tempted to look up a celebrity

A well-known person is admitted, and a colleague suggests having a look. Curiosity access is unauthorised use of health information, visible in audit logs and treated as a conduct issue. If it has already happened, the right course is to stop, seek advice and be honest about it.

A patient with an unpaid account asks for her records

The practice wants payment first. Access cannot be linked to a debt. Provide access within a reasonable time and without excessive charges, and pursue the account separately.