Australian Capital Territory Numbered Acts Australian Capital Territory Numbered Acts5. Subject to this Act, the following Privacy Principles have the force of law:
THE PRIVACY PRINCIPLES
1. A collector shall not collect personal health information for inclusion in a health record or in a generally available publication unless—
(a) the information is collected for a lawful purpose that is directly related to a function or activity of the collector; and
(b) the collection of the information is necessary for or directly related to that purpose.
2. A collector shall not collect personal health information by unlawful or unfair means.
3. Where personal health information or health records are required to be collected by someone as part of his or her employment for the management, funding or quality of a health service received by the consumer, then that person is allowed access to the information only for those purposes, unless these Principles otherwise provide.
1. Subject to clause 2 of this Principle, where—
(a) a collector collects personal health information for inclusion in a health record or in a generally available publication; and
(b) the information is solicited by the collector from the consumer concerned;
the collector shall take such steps (if any) as are reasonable in the circumstances to ensure that, before the information is collected or, if that is not practicable, as soon as practicable after the information is collected, the consumer is generally aware of—
(c) the purpose for which the information is being collected;
(d) if the collection of the information is required or authorised by law—the fact that the collection of the information is so required or authorised;
(e) unless it is obvious from the circumstances of any health service provided—the identity of all members of the treating team who will have access to the consumer's personal health information;
(f) the identity of any person to whom, or agency to which, the collector would, in accordance with the collector's usual practice, disclose the information for inclusion in a health record or in a generally available publication; and
(g) if it is, to the knowledge of the collector, the usual practice of any such person or agency to pass on such information to other persons or agencies—the identity of each of those other persons or agencies.
2. The collector is not required to notify the consumer of the identity of individuals, or classes of individuals, who are employed by the collector and who are required for the management, funding or quality of the health service received by the consumer to handle health records or personal health information as part of their employment.
Where—
(a) a collector collects personal health information about a consumer for inclusion in a record or in a generally available publication; and
(b) the information is solicited by the collector;
the collector shall take such steps (if any) as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is collected—
(c) the information is relevant, up to date and accurate; and
(d) the collection of the information does not intrude to an unreasonable extent upon the personal affairs of the consumer.
A record-keeper who has possession or control of a health record shall ensure that—
(a) the record is protected, by such security safeguards as are reasonable in the circumstances, against—
(i) loss;
(ii) unauthorised access, use, modification or disclosure; and
(iii) other misuse; and
(b) if the record is given to another person—everything reasonably within the power of the record-keeper is done to prevent unauthorised use or disclosure of any information contained in the record.
1. A record-keeper who has possession or control of health records shall, subject to clause 2 of this Principle, take such steps as are reasonable in the circumstances to enable any consumer to ascertain—
(a) whether the record-keeper has possession or control of any health records, or personal health information, relating to the consumer; and
(b) if so—
(i) the nature of the records or information;
(ii) the main purposes for which the records are, or the information is, used; and
(iii) the steps that the person should take if the person wishes to obtain access to the records or the information.
2. A record-keeper is not required to give a person information if, under a law of the Territory (including this Act) or a law of the Commonwealth, the record-keeper is required or authorised to refuse to give that information to the person.
1. A health service provider who is a member of a treating team may have access to the personal health information of a consumer so far as is reasonably necessary for the provision by that provider of a health service to that consumer.
2. If a person reasonably requires access, for the purpose of the management, funding or quality of a health service received, or being received, by a consumer, to personal health information relating to the consumer, the person may have such access, without the consent of the consumer, to the extent reasonably necessary for that purpose.
3. Except where required or authorised by—
(a) a law of the Territory;
(b) a law of the Commonwealth; or
(c) an order of a court of competent jurisdiction;
a person or agency shall not require a consumer, whether directly or indirectly, to obtain or grant access to any health record relating to the consumer.
1. A person shall not delete information from a health record, even where it is later found or claimed to be inaccurate, unless the deletion is part of a program of archival destruction.
2. A record-keeper who has possession or control of a health record shall take such steps, by way of making appropriate corrections and additions as are reasonable in the circumstances, to ensure that the record is—
(a) up to date and accurate; and
(b) relevant to the purpose for which the information was collected or is to be used and to any other purpose that is directly related to that purpose.
3. Where—
(a) the record-keeper of a health record is not willing to amend that record, by making a correction or an addition, in accordance with a request by the consumer concerned; and
(b) no decision or recommendation to the effect that the record should be amended wholly or partly in accordance with that request is pending, or has been made, under a law of the Territory (including this Act) or a law of the Commonwealth;
the record-keeper shall, if the consumer gives to the record-keeper a written statement concerning the requested correction or addition, take such steps as are reasonable in the circumstances to include the statement in the record.
4. Where the record-keeper accepts the need to amend the health record but—
(a) the record-keeper considers it likely that leaving incorrect information on a health record, even if corrected, could cause harm to the consumer or result in incorrect health care treatment or assistance being provided;
(b) the form in which the record is held makes correction impossible; or
(c) the corrections required are sufficiently complex or numerous for a real possibility of confusion or error to arise in relation to interpreting or reading the record if it were to be so amended;
the record-keeper shall place the incorrect information on a record which is not generally available to the consumer's treating practitioner or treating team, and to which access is restricted, and take such steps as are reasonable in the circumstances to ensure that only the corrected copy is generally available to the practitioner or treating team.
1. A record-keeper who has possession or control of a health record shall not use personal health information in that record without taking such steps (if any) as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is up to date and accurate.
2. Where a person gives information in confidence to a health service provider about a consumer, the provider shall—
(a) encourage the person to waive the requirement of confidentiality; and
(b) if the information remains confidential—
(i) record the information only if it is likely to assist in the treatment or care of the consumer; and
(ii) take such steps (if any) as are reasonable in the circumstances to ensure that the information is accurate and not misleading.
1. Except where personal health information is being shared between members of a treating team to the extent necessary to improve or maintain the consumer's health or to manage a disability of the consumer, a record-keeper who has possession or control of a health record that was obtained for a particular purpose shall not use the information for any other purpose unless—
(a) the consumer has consented to use of the information for that other purpose;
(b) the record-keeper believes on reasonable grounds that use of the information for that other purpose is necessary to prevent or lessen a significant risk to the life or physical, mental or emotional health of the consumer or another person;
(c) use of the information for that other purpose is required or authorised by—
(i) a law of the Territory;
(ii) a law of the Commonwealth; or
(iii) an order of a court of competent jurisdiction;
(d) the purpose for which the information is used is directly related to the purpose for which the information was obtained; or
(e) the use of the information is related to the management, funding or quality of the health service received by the consumer.
2. In relation to the sharing of information among a treating team, unless it is obvious from the circumstances or context of the health service, the person in charge of the treating team shall inform the consumer of the identity of all members of the treating team who will have access to the consumer's personal health information.
3. The treating team leader is not required to notify the consumer of the identity of individuals, or of classes of individuals, who are required for the management, funding or quality of the health service received by the consumer to handle health records or personal health information.
1. Except where personal health information is being shared between members of a treating team only to the extent necessary to improve or maintain the consumer's health or manage a disability of the consumer, a record-keeper who has possession or control of a health record shall not disclose the information to a person or agency (other than the consumer) unless—
(a) the consumer is reasonably likely to have been aware, or made aware under Principle 2, that information of that kind is usually passed to that person or agency;
(b) the consumer has consented to the disclosure;
(c) the record-keeper believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent risk to the life or physical, mental or emotional health of the consumer or of another person;
(d) the disclosure is required or authorised by—
(i) a law of the Territory (including this Act);
(ii) a law of the Commonwealth; or
(iii) an order of a court of competent jurisdiction; or
(e) the disclosure of the information is necessary for the management, funding or quality of the health service received by the consumer.
2. In relation to the sharing of information among the treating team, unless it is obvious from the circumstances and context of the health service, the person in charge of the treating team shall inform the consumer about the identity of all members of the treating team who will have access to the consumer's personal health information.
3. The treating team leader is not required to notify the consumer of the identity of individuals or of classes of individuals, who are required for the management, funding or quality of the health service received by the consumer, to handle health records or personal health information.
4. A person, body or agency to whom information is disclosed under clause 1 of this Principle shall not use or disclose the information for a purpose other than the purpose for which the information was given to the person, body or agency.
5. Where there is an emergency and a consumer is unable to give or withhold consent to the disclosure of personal health information, the treating health service provider may discuss relevant personal health information with an immediate family member of the consumer to the extent that it is reasonable and necessary to do so for the proper treatment of the consumer.
1. This Principle applies if the practice of a health service provider (in this Principle called the “provider”) is, or is proposed to be—
(a) sold or otherwise transferred; or
(b) closed down.
2. The provider or, if the provider is deceased, the legal representatives of the provider, shall—
(a) publish a notice in a newspaper circulating in the locality of the practice stating that—
(i) the practice has been, or is about to be, transferred or closed down (as the case may be); and
(ii) the health records of the practice, other than those returned to a consumer or passed on to a nominated practitioner at the consumer's request, will be transferred to a specified person (being a person to whom paragraph 3 (a) or (b) of this Principle applies) at a specified address; and
(b) take such other steps as are practicable to inform every such consumer—
(i) that the practice has been, or is about to be, transferred or closed down (as the case may be); and
(ii) about the arrangements (as stated in the notice under paragraph (a)) for dealing with those health records.
3. Not earlier than 21 days after giving notice in accordance with clause 2 of this Principle, the person or persons giving the notice shall transfer each health record held by, or on behalf of, the practice—
(a) to the health service provider (if any) who takes over the practice;
(b) to a competent record-keeper for safe storage in the Territory (until such time, if any, as the record is destroyed as part of a program of archival destruction); or
(c) to the consumer to whom the record relates or to a practitioner nominated by that consumer.
4. Subject to the restriction stated in clause 3 of this Principle, a person shall comply with the requirements of this Principle as soon as practicable.
5. Despite any other provision of these Principles, a person who transfers a health record in accordance with this Principle does not, by so doing, contravene these Principles.
1. Where—
(a) a consumer transfers from one health service provider to another; or
(b) a health service provider transfers from one practice to another and a consumer continues to see the provider;
the record-keeper shall, on request, provide the consumer's health record, or a copy or written summary of it—
(c) if paragraph (a) applies—to the health service provider to whom the consumer has transferred; or
(d) if paragraph (b) applies—to the relevant health service provider.
2. The amount of a fee that is chargeable for providing, in accordance with clause 1 of this Principle, a copy of a health record, or a written summary of a health record, is—
(a) if the Minister determines, under section 34, a fee for the purposes of this Principle—an amount not exceeding the amount of the fee so determined; or
(b) in any other case—nil.