Use and disclosure of health information
Last revised: 24 May 2023
It is important to consider the privacy implications of transferring health information outside Australia, as some countries may not offer adequate privacy protections. Once personal information is disclosed in an unregulated way, it can be difficult to regain control over it. This includes the use of overseas data storage and processing of patient information, such as transcription and reporting services.
Under the Privacy and Other Legislation Amendment Act 2024, the Australian Government may approve a whitelist of countries or binding schemes that provide substantially similar privacy protections to Australia’s. Transfers to entities in these jurisdictions may not require additional safeguards.
Where no whitelist applies, organisations must take reasonable steps, including implementing technical and organisational measures to ensure patient information is safe.
It is recommended patient consent is obtained before transferring health information outside Australia. Privacy policies must inform patients their information may be disclosed overseas. Consent is not strictly required if the organisation takes reasonable steps to ensure the overseas recipient will protect the information in line with Australian privacy standards. This includes situations where the recipient is subject to a privacy law or scheme that offers comparable protection.
Did you know you can now log your CPD with a click of a button?
Advertising