Site Changes

On 1 November 2010 the Office of the Privacy Commissioner was integrated into the Office of the Australian Information Commissioner and a new website established at www.oaic.gov.au.

Note 1: Major changes to the Privacy Act 1988 will come into effect in March 2014. Agencies, businesses and not for profits need to start preparing for these changes. For more information go to our privacy law reform page at www.oaic.gov.au
Note 2: From 12 March 2013 content is no longer being added to, or amended, on this site, consequently some information may be out of date. For new privacy content visit the www.oaic.gov.au website.

I am responsible for someone who lacks capacity to make decisions. Can their doctor share their health information with me?

Yes, if a patient is not able to consent because of a temporary or permanent mental incapacity, the Privacy Act allows such disclosures for the purpose of the patient's care or for compassionate reasons. However it must not go against any wishes the patient may have expressed when they were able to.

The Privacy Act recognises that family and carers may need such information to be shared, where they are responsible for decisions about the patient's care or treatment.

The decision to share information is up to the provider. This is different from a legal representative accessing information on the patient's behalf (see ‘Related FAQs' below).

However, there are some limits on when and how a provider may share the patient's health information when they cannot give consent (under NPP 2.4). These are:

the patient must be physically or legally incapable of giving consent
the disclosure must be necessary for the patient's care or treatment, or for compassionate reasons (in the health service provider's opinion)
the disclosure cannot go against the patient's known wishes
no more information should be shared than what is necessary for the patient's care, treatment or for compassionate reasons.

The provider can't disclose the patient's information to just anyone. NPP 2.5 and 2.6 state who the provider can share their information with in these circumstances:

the patient's spouse, de facto, or someone they are in an intimate relationship with
the patient's parent
the patient's children (if they are 18 or older)
the patient's guardian
a relative in the patient's household (if they are 18 or older) or
a person with an ‘enduring power of attorney' for health decisions (a legal document that allows someone to handle certain affairs even if the patient loses mental capacity)
someone the patient has nominated as an emergency contact.

Example of a disclosure necessary for care or treatment

An elderly man has been suffering from dementia for several years and has now been diagnosed with high blood pressure. When he visits his doctor, the doctor realises that the patient has been forgetting to take his medication. The patient is unable to consent to his doctor disclosing his health information to anyone else. However the patient had listed his wife as an emergency contact when he first visited the practice, and his wife now accompanies him whenever he visits the doctor. His doctor tells the patient's wife what medication her husband needs to take, and when he needs to take it. His doctor also talks to the patient's wife about what activities he cannot do, such as driving a car and operating power tools. This is allowed under the Privacy Act.

Is a health service provider required to give a representative of an individual access to that individual's medical records?