Health agencies - disclosure in provision of a health service


Health agencies are required to comply with the National Privacy Principles (NPPs) set out in the Information Privacy Act 2009 (Qld) (IP Act). 

NPP 2 provides that personal information may only be used for the purpose for which it was obtained and not for any other purpose, unless one of the exceptions applies. NPP 2 also provides that personal information must not be disclosed outside the health agency unless one of the exceptions applies.

Definitions for NPP 2

NPP 2 (6) In this section—

child, of an individual, includes an adopted child, a stepchild and a foster-child, of the individual.

enforcement body means an enforcement body within the meaning of the Privacy Act 1988 (Cth).

parent, of an individual, includes a step-parent, adoptive parent and a foster-parent, of the individual.

relative, of an individual, means a grandchild, uncle, aunt, nephew or niece, of the individual.

sibling, of an individual, includes a half-brother, half-sister, adoptive brother, adoptive sister, stepbrother, stepsister, foster-brother and foster-sister, of the individual.

NPP 2(3) - disclosure in the provision of a health service

Despite subsection (1), if a health agency provides a health service to an individual, it may disclose health information about the individual to a person who is responsible for the individual if—

(a) the individual—
(i) is physically or legally incapable of giving consent to the disclosure; or
(ii) physically can not communicate consent to the disclosure; and

(b) a health professional providing the health service for a health agency is satisfied that either—
(i) the disclosure is necessary to provide appropriate care or treatment of the individual; or
(ii) the disclosure is made for compassionate reasons; and

(c) the disclosure is not contrary to any wish—
(i) expressed by the individual before the individual became unable to give or communicate consent; and
(ii) of which the health professional is aware, or of which the health professional could reasonably be expected to be aware; and

(d) the disclosure is limited to the extent reasonable and necessary for a purpose mentioned in paragraph (b).

These provisions allow for the disclosure of health information by a health professional providing the health service to a 'person responsible' for an individual (including a partner, family member, carer, guardian or close friend), if that individual is incapable of giving or communicating consent. 

Responsible person

(4) For subsection (3), a person is responsible for an individual if the person is—

(a) a parent of the individual; or

(b) a child or sibling of the individual who a health professional believes has capacity; or

(c) a spouse or de facto partner of the individual; or

(d) a relative of the individual and a member of the individual’s household; or

(e) a guardian of the individual; or

(f) a person exercising an enduring power under an enduring power of attorney made by the individual that is exercisable in relation to decisions about the individual’s health; or

(g) a person who has sufficient personal interest in the health and welfare of the individual; or

(h) a person nominated by the individual to be contacted in case of emergency. 

Professional judgment will assist when deciding if someone is a 'person responsible' - the nature of the relationship between the person and the individual is an important consideration. Depending on the circumstances, 'a person with sufficient personal interest in the health and welfare of the individual' may include a same-sex partner, someone in a close relationship or friendship with the individual, or a companion or carer of the individual. 

NPP 2 does not specify that a parent must be a 'custodial parent'. This allows flexibility in judgement when determining to whom to disclose information.

When disclosure can occur

Disclosure can occur:

  • because it is necessary for the provision of appropriate care or treatment to the individual
  • for compassionate reasons.  

The disclosure should be limited to the information that is reasonable and necessary to achieve either of the above purposes. 

Disclosure cannot occur if this is contrary to wishes expressed by the individual before losing the ability to give or communicate consent, and the health service provider is aware, or could reasonably be expected to be aware, of these wishes. 

A disclosure necessary for care or treatment could include an occupational therapist telling a sibling, who provides care in the home, about aspects of an individual's current physical condition. The information might cover limitations to the individual's physical and cognitive abilities, in order to explain how to carry out certain personal care tasks. 

A disclosure for compassionate reasons could include a doctor telling an individual's partner about the extent of the individual's injuries and their prognosis following a car accident. 

In determining whether to disclose information to a 'person responsible', a provider will need to consider whether this would be contrary to any known wishes of the individual (previously expressed), whether it is necessary for care and treatment or is for compassionate reasons.

Disclosure of information to a 'person responsible' does not, in itself, represent an entitlement for that person to make health care or medical treatment decisions for the individual.

Where an individual has no one to act on their behalf, a health service provider may need to decide how best to use and disclose the individual's health information, to ensure they gain necessary treatment, care and services. 

Health service providers' professional and ethical obligations and standards of accepted practice are likely to offer guidance in these circumstances. However, this principle does not provide the basis for disclosure to other service providers, organisations or professional carers.

Current as at: August 26, 2014