Information management relating to patients

Prior to making an informed decision about whether to provide health information, your practice’s patients should be notified about how their information may be used or disclosed, and what rights of access will apply. 

In the context of a general practice, it may be reasonable to consider an attending and willing patient as consenting unless their consent is expressly revoked. If there is any doubt, it is best to obtain the patient’s express consent (by a signed admittance form, for example). 

When a patient first attends their consulting GP, it is suitable to take a full patient medical history where clinically appropriate.

Health information from third parties

While GPs obtain most health information directly from the patient (and should do so wherever practical), they will receive some health information from third parties, such as guardians or other health professionals involved in the patient’s care.

Where personal information is received without the GP soliciting it, GPs should determine whether or not they could have ordinarily collected the information. If not, the information should be destroyed or de-identified. 

In many situations, such as where GPs collect a family medical history from a patient, it may not be possible to obtain each family member’s consent. GPs can collect a patient’s family, social or medical health information when necessary to provide them with healthcare services, however will need to be careful during any disclosure of that material (refer to Refusing access below).²

Notification obligations

Patients need to be made aware of the potential use and disclosure of their health information. Extensive prescribed notification requirements apply to the collection of health information.

It is not necessary to notify your practice’s patients if their health information is being collected during recurring consultations, as it is clearly apparent. It is not necessary to notify patients if their health information will need to be disclosed when referring to a specialist. 

However, there are various aspects of collection that are not so straightforward. For example, the organisation ultimately collecting and holding the information may not be obvious, particularly in incorporated practices with sophisticated administration and complex corporate structures. 

For those items that are prescribed but not obvious or covered during a consultation, more formal notification requirements will be needed. 

The notification requirements have administrative implications for incorporated practices, practices with operating services trusts and practices using cloud computing. 

It is recommended practices ensure their patient information/consent forms are updated to account for this prescribed notification. Where necessary, your practice should secure renewed consent from its patients.

Privacy notices

Your practice should consider whether a privacy notice (also known as a ‘collection notice’ or ‘APP 5 Notice’) addressing the prescribed notification matters in a predetermined format and medium would be an appropriate medium for notifying your patients. 

Such notices may include information about:

• disclosure within a multidisciplinary medical team
• disclosure to colleagues as part of case management
• use and disclosure in medical research
• disclosure for practitioner continuing professional development purposes or for quality improvement activities
• the process for disclosure to other specialists. 

The practice can always choose whether to provide additional information about how a patient’s health information may be used. This will assist in managing the patient’s expectations, promoting trust as well as increasing the likelihood that further uses of that patient’s health information will constitute secondary use (refer to Section 2.3. Use and disclosure of health information). 

It is recommended to use practice information notices for this purpose. This information may also be considered for inclusion in your general practice’s collection notice and incorporated into your practice’s privacy policy (for more information on privacy policies. 

When used appropriately, these notices will assist patients to understand how their health information is used and disclosed. 

Use for primary and secondary purposes 

When dealing with health information, your practice must determine whether the intended use or disclosure is for a primary purpose (the purpose for collection) or a secondary purpose (which must be directly related). 

Health information is usually collected for providing particular healthcare services (this is the primary purpose). Your practice can use or disclose health information for the primary purpose. 

In certain circumstances, your practice can choose to use health information for another ‘secondary’ purpose if the patient consents, or the patient would reasonably expect that use or disclosure, which is directly related to their healthcare.

Where there is doubt as to patient expectations, consent should be sought. It is often much simpler to gain a patient’s consent than to balance their belief of reasonable expectations, or justify it if investigated. 

A practice relying on ‘reasonable expectations’ must consider these expectations from the perspective of an average patient with no particular medical knowledge. The patient’s age, cultural background and medical history should be considered. Whether the intended use or disclosure was ever notified to the patient is also relevant.

Use or disclosure in the practice setting

In the practice setting, patients will generally expect their health information to be used for a wide variety of activities that are directly related to the healthcare services they have received. 

These may include:

• providing information about treatments
• being treated by a person other than their treating GP, such as a specialist or during admission to hospital
• internal assessment practices, such as to assess the feasibility of particular treatments
• management, funding, complaint-handling, planning, evaluation and accreditation activities
• disclosure to experts or lawyers (for legal opinions), insurers or medical defence organisations to report adverse incidents or for the defence of legal proceedings
• disclosure to clinical supervisors.⁹ 

Some practices may use or disclose health information for medical research or for quality assessment or clinical audit activities. As these are not uniformly expected by patients, practices should limit their use or disclosure except where consent is obtained. In any event, consent is often a key component to human clinical trial ethical approval (for more information, refer to Section 3.8. Health research).

Use for business practices

It is reasonably expected for your practice to use health information for a secondary purpose relating to the general practice business. 

For more information, refer to Chapter 3. Information management relating to general practice, and specifically Section 3.1. The business of general practice.

Use for training and education purposes

Patients are often not aware that their health information may be used for GPs’ training and education purposes. 

Without consent, it may be unreasonable for GPs to expect patients to permit their health information to be used in such circumstances. However, this expectation may be influenced by the nature of the training activity. For example, filming a family therapy session is highly likely to require express consent. In contrast, GPs are more likely to rely on implied consent for activities more closely linked to the provision of healthcare services, such as reflective discussion with peers or for training registrars. 

In the absence of consent, health information should be de-identified before it is used for training or educational purposes, or quality assurance or audit exercises. 

GPs should consider whether to include consent for training and education purposes on their patient registration forms to avoid this becoming an issue. 

Your practice is encouraged to include information about these activities and clinical audits in your practice policy on managing health information. If a practice intends to use de-identified information, it is still worth notifying patients of this in your privacy notice.

Limiting disclosure

Where health information must be disclosed to a third party, your practice must consider what information is relevant for the proposed purpose. Patients will reasonably expect the disclosure of only the necessary subset of their health information, along with third-party access restrictions. 

For example, a referring GP may not be justified in forwarding a copy of a patient’s complete medical record or other health information to another medical practitioner if that health information does not relate to the condition for which the referral is being made. Prior to disclosing any health information, your practice should carefully examine its authority for disclosure and seek advice where necessary (refer to Section 2.3.6. Subpoenas and disclosure required by law). 

Subpoenas and disclosure required by law

GPs are obliged to disclose health information in certain circumstances, including for mandatory reporting purposes – such as to colleagues, or regarding communicable diseases or child abuse. 

GPs may also receive demands for medical files as part of legal proceedings. These requests may arise where a patient is suing the GP or another organisation (such as an insurer) and the medical records are relevant. 

In such circumstances, a subpoena or discovery order is an exception permitting disclosure. Practices should closely examine the scope of any subpoena or discovery order. These orders may request all or only part of a patient’s medical record although, generally, court rules require only those records that are reasonably necessary and relevant to the proceeding. Appropriate legal advice should be sought where necessary.

What is reasonably necessary is assessed on a case-by-case basis. If a GP deems it inappropriate to provide a patient’s complete health information despite a subpoena, they may have to justify this decision to the court. 

GPs may charge reasonable administration charges for the production of these documents. The Australian Medical Association establishes a schedule of professional fees for this.¹⁰

Transfers of medical records

Privacy legislation does not expressly cover the transfer of medical files between practices, such as during the sale of a practice. However, the Australian Privacy Commissioner has indicated this may require patient consent obtained by both the vendor and purchaser. Professional advice should be sought to ensure transferring patients’ records is done in accordance with the relevant laws (for more information, refer to Section 3.2. Sale or closure of a practice).

Information transferred overseas

It is particularly important to consider privacy implications in transferring health information outside Australia, as some countries have little or no privacy standards. Once personal information is disclosed in an unregulated manner, it is very difficult to regain control over it. 

The need for protection extends to the use of overseas data storage as well as processing of patient information overseas, such as through the use of transcription and reporting services. 

It is recommended to seek patient consent before transferring health information outside Australia (note that alerting patients to this possibility is a requirement of privacy policies. Refer to Section 2.4. Privacy policies). However, consent is not strictly necessary in circumstances where reasonable steps have been taken to ensure the overseas recipient does not breach the privacy of that individual, or where the practice believes the overseas recipient is subject to a privacy scheme or law protecting the information in a manner similar to Australia.

External privacy policies

Your practice should maintain a clearly expressed privacy policy that is freely available in printed or electronic form. For example, display a printed copy at the practice reception desk or in waiting areas, or publish an electronic copy on the practice website. 
The privacy policy’s content will depend on each practice’s processes and structure and the record-keeping system used. 

Your practice’s privacy policy will enable the practice to better manage patient enquiries or complaints concerning their health information. 

The RACGP has developed a privacy policy template. It is important to adapt this template to ensure its relevance to your practice. The template is available at www.racgp.org.au/ehealth/privacy

Internal privacy procedures

It is strongly recommended your practice has documented internal privacy procedures. Such procedures should include information about: 

• the collection of health information, ensuring it is conducted in a discreet manner protecting the information from unauthorised access
• obtaining a patient’s consent to the use or disclosure of health information by practice employees (including doctors, locums, registrars and other authorised healthcare service providers)
• obtaining the patient’s consent to the use or disclosure of health information for the purposes of medical research, quality assurance and improvement (where relevant) • providing patients with access to their health information
• de-identifying health information • ensuring health information is appropriately disclosed where authorised
• classifying health information, to ensure disclosure is limited to that authorised
• ensuring protection against unauthorised access across each medium the practice employs  (eg hard copy or electronic records, verbal disclosures)
• ensuring protection against any loss of data
• retention of individual medical records to satisfy health record law requirements  (refer to Section 3.3.3. Retention and destruction of medical records). 

Your practice’s internal procedures should include information about privacy and confidentiality training. All staff handling health information must be aware of and comply with the practice’s internal procedures. 

It is recommended to nominate one person who will be responsible for overseeing the implementation and operation of the privacy policy and to be the point of contact for privacy concerns.

The nature of general practice and the provision of healthcare do not easily accommodate the notions of anonymity and pseudonymity. Medical histories are required and identities need to be confirmed before a GP can make a diagnosis or prescribe medications. GPs are obliged by law to report communicable diseases and child abuse.

These circumstances should be explained to the patient. 

A patient may experience detriment in their treatment if they choose to remain anonymous. This should also be explained to the patient. 

Where practical, offering the option of anonymity and pseudonymity should be integrated into usual practice. A telephone service for general or referral advice or providing general assistance (for basic information or on issues such as quitting smoking or mental health) are examples of when anonymity or pseudonymity may be used.

Scope of access

The scope of a patient’s access rights is quite broad and encompasses all of a patient’s personal information. A patient’s medical record includes all information created by the treating GP(s) or received from other practitioners, and usually exists in both electronic and hard copy documents. Therefore, such requests will affect information held on the practice’s administrative system as well as in the medical record. 

Your practice must be able to identify those records containing another patient’s personal information, or have the capacity to search relevant medical records where necessary. This commonly occurs in the family setting.

Managing access

Some state legislation requires access requests be made in writing. In any event, it may be preferable to request the patient to put it in writing. 

Some requests may involve collating a significant amount of information. A written request will permit greater clarity on the information being sought. A written request also provides a record of the request. 

Where a patient is provided with access to their medical record, it may be desirable for the usual treating GP to be available to clarify its contents and to discuss any concerns with the patient. 

Alternatively, it may be appropriate to refer the patient to the original author of a record (such as when health information is received from a specialist). 

In some circumstances, GPs may discharge their obligation to provide access to health information by arranging for the patient to obtain the information from an intermediary, such as a referring doctor. This might be the preferred option for a pathologist, for example, who has had no direct contact with the patient. In all cases, however, the intermediary must be mutually agreed upon. 

Some states only allow the use of intermediaries where there is a serious threat to the life or health of the requesting patient.

Manner of access

Requests will usually be for access to a patient’s entire medical record. However, requests for particular information may be received by email, phone or in person. 

A practice may not be comfortable in providing entire medical records (although they may choose to do so); however, merely being uncomfortable or asserting proprietary rights is not a valid ground for refusal. The privacy laws require access as requested, where reasonable and practical, or in a mutually agreed way if not reasonable or practical. 

A practice may not be comfortable in providing entire medical records (although they may choose to do so); however, merely being uncomfortable or asserting proprietary rights is not a valid ground for refusal. The privacy laws require access as requested, where reasonable and practical, or in a mutually agreed way if not reasonable or practical. 

In many cases, patient requests for access to health information may be satisfied by way of an up-to-date summary containing all relevant material. However, this may prove more administratively burdensome, and in any event a patient will retain their right to access their full medical record. Another alternative is to provide access to a patient’s medical files in a room at the practice.

Refusing access

It is recommended that your practice is familiar with the grounds on which it may refuse to provide access, when and where necessary, and therefore can defer to the appropriate provision when required. 

In particular, your practice should consider the risk of distress to other patients. For example, practices may consider refusing access when: 

• that access would lead to significant distress or lead to self-harm or harm to another person³
• the health information of another patient is contained within the medical record
• the requesting patient’s information was disclosed by another patient in confidence
• the possibility of domestic abuse or child abuse exists. 

If a GP is considering refusing access, they should obtain professional advice. 

When third-party patient records are involved in the request for access, the practice may consider approaching the affected patient for their consent. It is not recommended practices attempt to de-identify third-party information for this purpose as it is unlikely to be effective. However, practices may delete or make unreadable the relevant information from the file prior to providing access.

Access fees

Your practice can charge a fee for providing a patient access to their personal information, but not for merely requesting access. You should therefore only consider imposing fees (if at all) after the request is made. 

A practice may levy reasonable fees to cover the cost of:

• administration for file searching, collating, etc
• copying or printing records
• postage or courier fees
• facilitating access with intermediaries. Your practice may wish to consider the patient’s individual circumstances and their capacity to pay prior to determining and/or waiving access fees. 

Practices should keep in mind the potential to align a patient’s access request with a consultation, or being compensated through reasonable administrative fees. Appropriate legal advice should be sought to determine where this is allowable and practical within the context of the practice.

Policy on access

It is recommended your practice develops and implements a policy covering patient record access. Such a policy would have information about:

• how and to whom requests for access should be made
• the process for identity verification
• how access will be granted
• response times
• whether access fees will apply, and in what circumstances (if any) these charges will be waived.

This information may be incorporated into your practice’s privacy policy (refer to Section 2.4. Privacy policies).