This article is intended to provide general advice only. The contents do not constitute legal advice and should not be relied upon as such. Readers should seek specific expert and legal advice in relation to the information provided in this article.
This fact sheet addresses some of the frequently asked questions regarding privacy law obligations for medical practitioners and practices under the Privacy Act 1988 (Cth) (Privacy Act). Further information on privacy law can be sought from the AMA Victoria Privacy Law Information Kit, or by viewing the other fact sheets available on the AMA Victoria website.
Q1: I have received a request from lawyers dealing with a patient's claim to provide a copy of a patient's entire medical record. The request is accompanied by a written and signed consent from the patient. The medical record contains information which is not relevant to the patient's claim and which the patient may not wish to be released. Do I have to provide the complete record?
Generally, patient records can only be disclosed to third parties where the patient has provided consent. Under the Privacy Act 1988 (Cth) and the Health Records Act 2001 (Vic) consent can be express or implied. The four main elements to consent are:
the individual must be adequately informed before giving the consent
it is given voluntarily
the consent is current and specific
the individual has the capacity to understand and communicate their consent.
In the scenario outlined above, in many cases the patient may not be fully informed of the nature of the consent they have provided or its implications. If you suspect that this is the case, you are entitled to withhold the medical record and clarify with the patient about which part or their record the patient consents to being disclosed.
Alternatively, you may choose to redact the medical record and release only the information that you consider relevant to the patient's claim and in regards to which you consider the patient has provided consent to release.
Q2: I have a signed patient consent from 2 years ago. Is this still valid?
An express or implied patient consent does not have a fixed expiry date.
However, the consent must be current and specific to the present circumstances. If there has been a material change in circumstances, a new consent will be required from the patient. If the circumstances have not changed, then a consent provided previously will most likely still be valid.
There is no requirement for the consent to be in writing, it may be verbal or implied from the patient's conduct. However, in the event that the medical practitioner ever had to prove that they had a valid consent, it is best to have the consent in written form (and signed) and stored on the patient's medical record.
Q3: Do I have to get consent from both parents prior to releasing the child's information to a third party?
Technically either parent can consent on their child's behalf for medical treatment or collection, use or disclosure of the child's personal information. Each parent is obliged, however, to act in the child's best interests.
If you are aware of marital breakdown between a child's parents or if you suspect that each parent may have differing opinions about was is in the child's best interests, it is best practice to obtain consent of both parents prior to treatment of the child or dealing with the child's personal information.
Alternatively, you may wish to get each parent to sign a document that states that the child's medical record will be shared with both parents and that either parent is independently able to provide consent to medical treatment and associated collection, use or disclosure of the child's personal information.
If there is an order from the court revoking parental rights, that parent is no longer able to provide consent on behalf of the child.
Q4: Do I have to get the patient's consent prior to disclosing their information to other doctors involved in their treatment, for example, other doctors for referral?
The disclosure of information to other doctors or members of a patients treating team is a directly related secondary purpose where the main purpose of collection was the provision of clinical care. In this instance, consent would not be required if it is related to the primary purpose of providing clinical care.
Every patient who presents for treatment is required to sign a patient consent form which provides express consent to the medical practitioner (and practice) to collect, use and disclose the patient's personal information in the ways outlined in the patient consent form.
An adequately drafted patient consent form will state that the patient's information may be disclosed to third parties involved in the treatment of the patient, including other medical practitioners for referral, colleagues for professional opinion, pathologists, radiologists, hospitals, anaesthetists etc.
Where this has occurred, the patient has provided consent to disclosure of their personal information to third parties involved in their healthcare and no further consent is required.
If you seek to deal with a patient's personal information in a way that is not listed in the patient consent form or practice/practitioner privacy policy, it is best practice to obtain specific consent from the patient for that use and record the consent on the patient's medical record.
Q5: Can I send patient information via email? Do emails have to be encrypted?
Both the Privacy Act 1988 (Cth) and Privacy and Data Protection Act 2014 (Vic) require organisations to take reasonable steps to protect personal information. What amounts to 'reasonable steps' is an objective assessment having regards to the circumstances. While the Act does not specifically state that encryption of personal information sent via email is required, this may fall within the scope of what is deemed 'reasonable steps' taken to protect personal information.
It is important to remember that the GP Accreditation Standards do require that organisations encrypt any personal information sent via email. As a matter of best practice, therefore, we recommend that all personal information contained in email form is encrypted.
Q6: A letter from the patient's specialist says 'not to be released to third parties'. Does this mean I cannot disclose it as part of the medical record?
Once the letter from the specialist has been received and is stored on the patient's file, it becomes part of the patient's medical record.
Where a medical record is required to be disclosed by law, for example, when requested by a patient under the Privacy Act 1988 (Cth) or the Health Records Act 2001 (Vic), or when subpoenaed by a court, the medical practitioner is under an obligation to disclose that record - including the specialist's letter.
As a matter of best practice and courtesy you may wish to inform the specialist that their letter has been disclosed to the third party.