Privacy and confidentiality

Psychologists have ethical and legal duties to protect client privacy; clients can expect their information to be kept secure and confidential unless the law requires or authorises release or an emergency service needs it (the Australian Privacy Principles guide practical application). To protect privacy and confidentiality the psychologist should: (a) seek informed consent for information handling, namely (i) explain at the outset, and later as needed, where confidentiality ends and how information is likely to be used to clients and, where relevant, associated parties, (ii) before collecting information, tell clients how it will be stored, recorded and used, (iii) before disclosing it, explain to clients what is to be disclosed and why, (iv) get consent before using information gained in one role or relationship in another, (v) before gathering information from associated parties, tell the client what will be gathered, why, and how it will be stored, recorded and used, and (vi) get the associated party's own consent on the same explanation; (b) document the outcome of consent or agreement where possible; (c) provide surroundings that allow private consultations, especially with several people or in shared space, and otherwise consider sections 1.2 and 4.2; (d) collect only the personal information reasonably needed for the requested service and open records only when providing a service or otherwise authorised; (e) make sure staff and colleagues respect client privacy and do not discuss clients outside service needs; (f) know and apply state and territory privacy and health records law to information in every format, electronic included; (g) know that personal information in their care that is accessed or disclosed without authority may trigger legal obligations (the OAIC is the reference); (h) never disclose, transmit, share, reproduce or post anyone's information or images, even unnamed, without prior written informed consent; (i) recognise clients' right, with exceptions, to see their records and help them get access where legislation or local policy entitles them; and (j) on closing or moving a work setting, arrange for records to be transferred or managed in line with privacy and health records law.

• Privacy collection notice and signed consent covering confidentiality limits, recording, storage, use and disclosure
• Signed client consent for each disclosure to a third party, including use of de-identified case material in supervision or online
• Records system access log and role-based access settings
• Data breach response plan aligned to the Notifiable Data Breaches scheme, with any breach assessments made
• Log of client record access requests and responses

• Case material shared in supervision or on social media without written consent
• Collateral information gathered from family or schools with no consent from the client or the informant
• Rooms or telehealth set-ups where sessions can be overheard
• No plan for records on closure of the practice