Confidentiality and privacy

The practitioner has ethical and legal duties to protect patient privacy and keeps patient information in confidence unless release is required or authorised by law or needed for emergency care. Good practice means the practitioner: (a) seeks informed consent before disclosing information and documents it formally where possible; (b) provides surroundings that allow private consultations, including in shared spaces or group work; (c) never accesses records without professional involvement in the person's care or other authority; (d) makes sure all staff respect confidentiality and do not discuss patients outside a professional context; (e) knows and applies the privacy and health records legislation of the relevant state or territory to information in every format, electronic included; (f) seeks advice about disclosure of genetic information, given its complexity; (g) does not transmit, share, reproduce or post anyone's information or images, even unnamed or unidentified, without first obtaining written informed consent (Ahpra's social media guidance applies); (h) recognises and helps with a patient's right to access their records and promptly facilitates transfer when the patient asks, under local policy; and (i) arranges transfer or management of all health records under privacy and health records law when closing or relocating a practice.

• Signed or recorded patient consent before information was disclosed to third parties
• Staff confidentiality agreements and privacy training records
• Electronic record access audit log reviewed for access without a care relationship
• Written consent held for any patient image or case posted or published, including de-identified cases
• Register of patient access and transfer requests with response dates

• Case photos shared on social media or messaging groups without written consent
• No review of record access logs
• Consultation rooms where conversations can be overheard
• Transfer requests left unanswered for weeks