Use and disclosure of health information

Use and disclosure of health information

When dealing with health information, your practice must decide if the intended use or disclosure is for a primary purpose (for collection) or a secondary purpose (directly related).

Health information is usually collected for providing healthcare services (the primary purpose). Your practice can use or disclose health information for the primary purpose.

If the patient consents, or would reasonably expect the use or disclosure, your practice can choose to use health information for another ‘secondary’ purpose. If a patient’s health information is de-identified, you and your practice need to decide whether it is appropriate to release this data at the request of an external organisation. The Guiding principles for managing requests for the secondary use of de-identified general practice data provides decision-making support and a checklist.

If a patient’s understanding and expectations are not clear, express consent should be obtained.

A practice relying on ‘reasonable expectations’ must consider these from the perspective of a patient with no specific medical knowledge. The patient’s age, cultural background and medical history should also be considered. Whether the intended use or disclosure was notified to the patient is also important.

Topics in this module:

• Use for primary and secondary purposes
• Use or disclosure in the practice setting
• Use for business practices
• Use for training and education purposes
• Limiting disclosure
• Subpoenas and disclosure required by law
• Information transferred overseas
• Privacy policies
• Patient access to medical records
• Correction of health information