9 NPP9 - Sensitive information

(1) A health agency must not collect sensitive information about an individual (the relevant individual) unless—

(a) the relevant individual has consented; or

(b) the collection is required by law; or

(c) the collection is necessary to prevent or lessen a serious threat to the life, health, safety or welfare of an individual, and the relevant individual—

(i) is physically or legally incapable of giving consent to the collection; or

(ii) physically can not communicate consent to the collection; or

(d) the collection is necessary for the establishment, exercise or defence of a legal or equitable claim; or

(e) the information is a family medical history, social medical history or other relevant information about any individual, that is collected for the purpose of providing any person, whether or not the relevant individual, with a health service, and is collected by a health agency from—

(i) the person who is to receive or is receiving the service; or

(ii) a parent of the relevant individual; or

(iii) a child or sibling of the relevant individual if a health professional believes the child or sibling has capacity; or

(iv) a spouse or de facto partner of the relevant individual; or

(v) a relative of the relevant individual if the relative is a member of the relevant individual's household; or

(vi) a guardian of the relevant individual; or (vii) a person exercising a power under an enduring power of attorney made by the relevant individual that is exercisable in relation to decisions about the relevant individual's health; or

(viii)a person who has sufficient personal interest in the health and welfare of the relevant individual; or

(ix) a person nominated by the relevant individual to be contacted in case of emergency.

(2) Despite subsection (1), a health agency may collect health information about an individual if the information is necessary to provide a health service to the individual and—

(a) the individual would reasonably expect the health agency to collect the information for that purpose; or

(b) the information is collected as authorised or required by law.

(3) Despite subsection (1), a health agency may collect health information about an individual if—

(a) the collection is necessary for any of the following purposes—

(i) research relevant to public health or public safety;

(ii) the compilation or analysis of statistics relevant to public health or public safety;

(iii) the management, funding or monitoring of a health service; and

(b) the purpose can not be served by the collection of information that does not identify the individual or from which the individual's identity can not reasonably be ascertained; and

(c) it is impracticable for the health agency to seek the individual's consent to the collection; and

(d) the information is collected—

(i) as authorised or required by law; or

(ii) by a designated person with the approval of the relevant chief executive; or

Note—
A relevant chief executive could delegate the power to approve the collection of information by a designated person.

(iii) in accordance with guidelines approved by the chief executive of the health department for the purposes of this subparagraph.

(4) If a health agency collects health information about an individual in accordance with subsection (3), the health agency must, before it discloses the personal information, take reasonable steps to ensure that the individual the subject of the personal information can no longer, and can not in the future, be identified from the personal information.