Health agencies1 must have policies regarding their management of personal information and these policies must be available upon request.
Where an individual specifically requests, a health agency must also take reasonable steps to let the individual know what sort of personal information the agency holds, for what purposes and how the agency collects, holds, uses and discloses that information.2
In addition to the right of access and amendment under chapter 3 of the Information Privacy Act 2009 (Qld) (IP Act),3 National Privacy Principles (NPPs) 6 and 7 provide that where a health agency has control of a document containing personal information about an individual, it must:
then the health agency must, if the individual asks, take all reasonable steps to attach to the document any statement provided by the individual concerning their requested amendment. 4
Under NPP 8, a health agency must allow individuals the option of not identifying themselves when entering into transactions with the agency, wherever this is lawful and practicable.
Current as at: July 9, 2012