Allied Health NDIS Audit Checklist: worksheet
Ahpra shared Code of conduct. Edition held: Shared Code of conduct, June 2022, in effect from 29 June 2022; checked current on 30 September 2026 (Ahpra code page read 30 September 2026: a review of the codes is under way, no revised version published).
Under review, not in force: A review of the shared code is under way; the June 2022 code stays in effect until a revised one is published.
Standards library: https://compliance.theartofservice.com/frameworks/ahpra-shared-code-of-conduct-2022. Page: https://allied-health-ndis-audit-checklist.theartofservice.com/rules/ahpra-code-of-conduct/3-3-confidentiality-and-privacy/
| Ref | Requirement (our statement of the clause) | Evidence an auditor or the regulator asks for | Common gap to check | Held (yes, partly, no, not applicable) | Where it is kept | Owner | Last reviewed | Next review |
|---|---|---|---|---|---|---|---|---|
| 3.3 | The practitioner has ethical and legal duties to protect patient privacy and keeps patient information in confidence unless release is required or authorised by law or needed for emergency care. Good practice means the practitioner: (a) seeks informed consent before disclosing information and documents it formally where possible; (b) provides surroundings that allow private consultations, including in shared spaces or group work; (c) never accesses records without professional involvement in the person's care or other authority; (d) makes sure all staff respect confidentiality and do not discuss patients outside a professional context; (e) knows and applies the privacy and health records legislation of the relevant state or territory to information in every format, electronic included; (f) seeks advice about disclosure of genetic information, given its complexity; (g) does not transmit, share, reproduce or post anyone's information or images, even unnamed or unidentified, without first obtaining written informed consent (Ahpra's social media guidance applies); (h) recognises and helps with a patient's right to access their records and promptly facilitates transfer when the patient asks, under local policy; and (i) arranges transfer or management of all health records under privacy and health records law when closing or relocating a practice. Source: https://www.ahpra.gov.au/Resources/Code-of-conduct/Shared-Code-of-conduct.aspx | Signed or recorded patient consent before information was disclosed to third parties; Staff confidentiality agreements and privacy training records; Electronic record access audit log reviewed for access without a care relationship; Written consent held for any patient image or case posted or published, including de-identified cases; Register of patient access and transfer requests with response dates | Case photos shared on social media or messaging groups without written consent; No review of record access logs; Consultation rooms where conversations can be overheard; Transfer requests left unanswered for weeks | ☐ yes ☐ partly ☐ no ☐ n/a |
Completing this worksheet records what your practice holds and where. It does not make a practice compliant or ready for audit, and it is not legal advice.