Health agencies - disclosure in provision of a health service

Health agencies1 are required to comply with the National Privacy Principles (NPPs) in the Information Privacy Act 2009 (Qld) (IP Act).

Under NPP 2 an agency cannot disclose personal information2 outside the agency unless one of the exceptions applies. NPP 2(3) allows a health professional providing a health service to an individual to disclose their health information to a 'person responsible' for them, if that individual is incapable of giving or communicating consent, without breaching the privacy principles.


It is important to note that the privacy principles do not authorise the disclosure of personal information. Rather, they mean that an agency legitimately disclosing personal information under IPP 11(1) or NPP 2(1) does not breach those privacy principles and can rely on them as a defence to a privacy complaint.

In addition, the privacy principles do not override provisions of other Acts that prohibit the disclosure of personal information, for example confidentiality provisions like those contained in the Hospital and Health Boards Act 2012 or the Child Protection Act 1999.

NPP 2(3)  - disclosure in the provision of a health service

Despite subsection (1), if a health agency provides a health service to an individual, it may disclose health information about the individual to a person who is responsible for the individual if—

(a)       the individual—

(i) is physically or legally incapable of giving consent to the disclosure; or

(ii) physically cannot communicate consent to the disclosure; and

(b)       a health professional providing the health service for a health agency is satisfied that either—

(i) the disclosure is necessary to provide appropriate care or treatment of the individual; or

(ii) the disclosure is made for compassionate reasons; and

(c)       the disclosure is not contrary to any wish—

(i) expressed by the individual before the individual became unable to give or communicate consent; and

(ii) of which the health professional is aware, or of which the health professional could reasonably be expected to be aware; and

(d)       the disclosure is limited to the extent reasonable and necessary for a purpose mentioned in paragraph (b).

Responsible person

(4) For subsection (3), a person is responsible for an individual if the person is—

(a)       a parent of the individual; or

(b)       a child or sibling of the individual who a health professional believes has capacity; or

(c)       a spouse or de facto partner of the individual; or

(d)       a relative of the individual and a member of the individual’s household; or

(e)       a guardian of the individual; or

(f) a person exercising an enduring power under an enduring power of attorney made by the individual that is exercisable in relation to decisions about the individual’s health; or

(g)       a person who has sufficient personal interest in the health and welfare of the individual; or

(h)       a person nominated by the individual to be contacted in case of emergency.          

Whether someone is a 'person responsible' will depend on the nature of the relationship between the person and the individual.  Depending on the circumstances, 'a person with sufficient personal interest in the health and welfare of the individual' could include a romantic partner, someone in a close relationship or friendship with the individual, a housemate, or a companion or carer of the individual.

Relevant definitions from NPP 2(6)

child, of an individual, includes an adopted child, a stepchild and a foster-child, of the individual.

parent, of an individual, includes a step-parent, adoptive parent and a foster-parent, of the individual.

relative, of an individual, means a grandchild, uncle, aunt, nephew or niece, of the individual.

sibling, of an individual, includes a half-brother, half-sister, adoptive brother, adoptive sister, stepbrother, stepsister, foster-brother and foster-sister, of the individual.

When can disclosure occur?

A health care professional can disclose information where it is necessary as part of the individual’s health care or treatment, or on compassionate grounds, but only the necessary amount of information should be disclosed.

Disclosure necessary for an individual’s care or treatment could include an occupational therapist telling a sibling, who provides care in the home, about aspects of an individual's current physical condition, to explain how to carry out certain personal care tasks.

Disclosure for compassionate reasons could include a doctor telling an individual's partner about an individual's injuries and prognosis following a car accident.

Disclosure against the individual’s wishes

In determining whether to disclose information to a 'person responsible', a provider will also need to consider whether this would be contrary to any known wishes of the individual.

Disclosure is not permitted under NPP 2(3) where it would be contrary to wishes expressed by the individual before they lost the ability to give or communicate consent and the health service provider is, or could reasonably be expected to be, aware of these wishes.

  • 1 In this guideline, health agency includes a bound contracted service provider to a health agency.
  • 2 Any information or opinion about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.

Current as at: September 20, 2019