Privacy and managing health information in general practice

Patient consent

Inferred or express consent

Last revised: 24 May 2023

Inferred or express consent

Verbal or written consent might be:
  • express – when a patient signs or clearly expresses their agreement
  • inferred (or ‘implied’) – where the circumstances imply the patient has consented.

Express consent should be sought wherever practical and/or where significant clinical risk is possible (eg before a procedure or surgery). A signed form is an example of express consent, but an informed and well-documented discussion with a patient might equally comply with this requirement.

Inferred consent should only be used when express consent cannot be obtained. GPs must not overestimate the scope of inferred consent. For example, it is reasonable to infer a patient’s consent to their records being collected and used during repeat consultations. However, this consent would not necessarily extend to the disclosure of that information to third parties; for example, sharing health summaries within referral letters to other medical professionals.

GPs should also be wary of taking silence or a lack of objection as an indicator of consent; if there is any doubt, GPs should obtain express consent.

It is recommended consent conversations are thoroughly documented, within a patient’s medical record. Problems might arise if a patient does not understand the potential uses of their health information. Where GPs must establish implied consent, comprehensive consultation notes are essential. These notes should include the information provided, the nature of the discussion and the patient’s response.

  Consent in group practices

  • In group practices that allocate GPs to see patients based on availability, a patient’s health information will be disclosed to and used by whichever GP sees the patient.
  • New patients must be made aware of this rolling or rotating use of GPs. Patients should be made aware of the consulting GP when booking their appointment. It is reasonable to infer consent to the use and disclosure of the patient’s health information in this context if the patient does not otherwise object to seeing the allocated GP.


  1. Australian Government, Office of the Australian Information Commissioner. Australian Privacy Principles quick reference. 2014 [Accessed 7 November 2022].
  2. National Health and Medical Research Council, Australian Research Council, Australian Vice-Chancellors’ Committee. National statement on ethical conduct in human research (2007) (updated 2018). 2018 [Accessed 16 January 2023].
  3. Commonwealth of Australia. Privacy Act 1988.1988 [Accessed 7 November 2022].
  4. Australian Government, Office of the Australian Information Commissioner. Australian Privacy Principles guidelines: Privacy Act 1988. 2015 [Accessed 16 January 2023].
  5. Australian Government, Attorney-General. Parliament approves Government’s privacy penalty bill. 2022 [Accessed 16 January 2023].
  6. Medical Board of Australia, AHPRA. Good medical practice: A code of conduct for doctors in Australia. 2020 [Accessed 16 January 2023].
  7. Australian Government, Office of the Australian Information Commissioner. Business resource. Chapter 9: Research. 2019 [Accessed 16 January 2023].
  8. Australian Government, Office of the Australian Information Commissioner. Chapter 5: APP 5 – Notification of the collection of personal information. 2019 [Accessed 8 November 2022].
  9. Australian Medical Association. Frequently asked questions – Fees. [date unknown] [Accessed 8 November 2022].
  10. Australian Government, Office of the Australian Information Commissioner. Privacy for organisations: Trading in personal information. [date unknown] [Accessed 16 January 2023].
  11. National Health and Medical Research Council. Use and disclosure of genetic information to a patient’s genetic relatives under Section 95AA of the Privacy Act 1988 (Cth) – Guidelines for health practitioners in the private sector. 2014 [Accessed 16 January 2023].