Protecting privacy, information and data

“My Health Record” is an online summary of health information of individuals which can be accessed by hospital and medical practitioners. Patients and their doctors are able to add notes and entries to the record and patients are able to set access controls to restrict who can and can’t see their personal information. At the end of 2018 a My Health Record was created for every Australian.

Under Queensland law, a person may record a conversation which they are a party to provided that the recording is not by means of a device attached to a phone. Consequently, it is not illegal for a healthcare professional to record what is said during a consultation, though good practice would normally require that consent be obtained before recording any conversation that takes place in a clinical setting.

The law on this issue differs from State to State but typically, medical practitioners are required to keep records of a patient for the longer of either seven years from a patient’s 18th birthday or seven years from the last treatment or consultation.

In clinical private practices, medical records will generally belong to the entity that owns the medical practice rather than the individual doctor. The records are not those of the patient. Despite a patient generally having a right to access their records, that does not change rules relating to ownership.

Under Queensland law, anything revealed to a treating practitioner during a consultation is to remain confidential unless there is a statutory obligation on the doctor to report the information or where there is a serious threat to the life, health or safety of the patient or someone else.

Certain health conditions (such as some sexually transmitted diseases) must be reported, likewise where is reasonably believed to exist a risk of harm to a child or someone else.

Under the Australian Privacy Principles, an individual has a right to access personal information held by a healthcare provider unless one of the exceptions applies.  Access can be refused on grounds that include a concern about a serious threat to the life, health or safety of an individual or member of the public, if access would have an unreasonable impact on the privacy of others, if the information relates to current or anticipated legal proceedings or unlawful activity or misconduct is suspected.

Under Australian Privacy Principle 13, if an entity to which the legislation applies holds personal information about an individual, the entity must take steps to correct or amend the information if the information is inaccurate, out of date, incomplete, irrelevant or misleading.

Where public sector organisations are concerned, legislation can prohibit the amendment of records and in those circumstances an addendum or notation to be viewed alongside the records might be the appropriate mechanism to deal with the inaccuracy.

Medical records relating to a patient should not ordinarily be disclosed to a third party without the patient’s express (and recent) consent, unless in the circumstances it would reasonably be anticipated that a patient would expect the disclosure to take place.  For example, a medical specialist would ordinarily anticipate that their patient would expect a report following a consultation to be sent back to the General Practitioner who referred them.

Where however, the relationship is further removed, such as an allied health professional sending a report to another allied health professional or specialist (where their involvement is only peripherally associated with the relevant treatment regime), the disclosure may not be “reasonably anticipated”.  In those circumstances, prudent practice requires that the allied health professional obtain patient consent before sending any record or report to another practitioner who is not an immediate part of the treating team.

Where a data breach occurs, it may be necessary for the person or entity breaching the data to comply with the Notifiable Data Breach Scheme under the Privacy Act 1988 (CTH). The scheme applies to Australian Government agencies and any business or not for profit organisation that has an annual turnover of more than $3 million.

Any private sector health service provider will be bound by the scheme irrespective of their turnover. Similarly, any business that trades in personal information or is a credit reporting body must also comply. A data breach must be assessed within 30 days as to whether or not it is “notifiable”. A breach is notifiable if there is unauthorised access or loss of personal information and the breach is likely to result in serious harm to one or more individuals.

If that is the case and the business is unable to prevent the likely risk of harm with remedial action, then it must be notified.

Travis Schultz & Partners have specialist No Win / No Fee lawyers who will help you understand your rights and pursue a claim on your behalf.

The below links contain further information about us.

Our lower fee promise

Meet the team

Causes we support

Lawyers Travis Schultz and Michael Callow are accredited specialists in personal injury law, each with more than 25 years’ experience. Together with the Travis Schultz & Partners team, they service clients across Queensland with offices on the Sunshine Coast, Brisbane and the Gold Coast. Contact us today for a free case review.