APP 6: sharing client information with other practitioners and the NDIS

Use or disclose personal information only for the primary purpose it was collected for, unless the person consents or an exception in APP 6.2 applies.

• A record of the purpose of collection and of each disclosure made, with its basis

• Reports sent to third parties with no recorded basis

For health and other sensitive information, a secondary use or disclosure without consent needs a purpose directly related to the primary purpose that the person would reasonably expect, such as a report to the referring doctor or another treating practitioner in the client's care team.

• Client consent or a recorded reasonable-expectation basis for reports to referrers and care teams

• Information shared with schools, employers or family without consent or a recorded basis

A use or disclosure required or authorised by or under an Australian law is permitted, for example notifying the NDIS Commission of a reportable incident under the NDIS incident rules, or a mandatory notification under the National Law.

• A list of disclosures the practice makes under a law, each with the law named

• Staff unsure which disclosures the law requires, delaying a notice

A use or disclosure is also permitted where a permitted general situation (s 16A, for example lessening a serious threat to life, health or safety) or a permitted health situation (s 16B) exists.

• A procedure for disclosures in a serious threat situation, with who decides and how it is recorded

• No record kept of an urgent disclosure made to protect someone

Where information is used or disclosed because it is reasonably necessary for an enforcement related activity (APP 6.2(e)), make a written note of it.

• Written notes of any disclosure to an enforcement body

• Police requests answered with no written note