Under Australia’s privacy legislation, GPs must obtain informed consent from the patient before sharing information with other healthcare providers or other third-party organisations. There are exceptions to this rule, including where there is a serious threat to life, health or safety, or where GPs are legally required to provide information under a court order or subpoena. For further information, visit the RACGP website for advice on Managing third party and patient requests for a patient’s medical record.
One of the key areas where general practice data is shared is to My Health Record. GPs and their practice teams need to be aware of the consent requirements when uploading patient information to the My Health Record through key documents like shared health summaries and event summaries. If a patient has a My Health Record, there is generally no requirement for GPs to obtain consent each time they upload clinical information. Under the My Health Records Act 2012, all registered healthcare providers are authorised to share information to the My Health Record system, with two exceptions:
- Where the patient instructs the healthcare provider not to upload the information. Patients may request that certain information or documents are not uploaded to My Health Record and the healthcare provider must comply with the request.
- Where state-based privacy laws apply. Healthcare providers must comply with State and Territory laws pertaining to consent and the disclosure of sensitive information (such as human immunodeficiency virus (HIV) results). Relevant laws apply in New South Wales, Queensland, and the Australian Capital Territory.