Use and disclosure of health information

Use and disclosure of health information

When dealing with health information, your practice must decide if the intended use or disclosure is for a primary purpose (for collection) or a secondary purpose (directly related).

Health information is usually collected for providing healthcare services (the primary purpose). Your practice can use or disclose health information for the primary purpose.

If the patient consents, or would reasonably expect the use or disclosure, your practice can choose to use health information for another ‘secondary’ purpose. If a patient’s health information is de-identified, you and your practice need to decide whether it is appropriate to release this data at the request of an external organisation.

The RACGP has developed a decision-support guide, which outlines the key principles for secondary use of general practice data by third parties. It includes a checklist for third parties which general practices can provide to entities requesting data for their consideration.

If a patient’s understanding and expectations are not clear, express consent should be obtained.

A practice relying on ‘reasonable expectations’ must consider these from the perspective of a patient with no specific medical knowledge. The patient’s age, cultural background and medical history should also be considered. Whether the intended use or disclosure was notified to the patient is also important.

You can access more information on topics in this section via the links below:

• Use for primary and secondary purposes
• Use or disclosure in the practice setting
• Use for business practices
• Use for training and education purposes
• Limiting disclosure
• Subpoenas and disclosure required by law
• Information transferred overseas
• Privacy policies
• Patient access to medical records
• Correction of health information