Friendly Print preview

PRIVACY QUESTIONS & ANSWERS

Does complying with the Privacy legislation mean that we can only collect information with the person's consent?

No. It can be collected if it is necessary for an organisation's functions or activities.

Compliance means that:

• You can only collect personal information that is necessary and relevant for a legitimate function or activity

• When you collect information from and about individuals, we need to be open with them about why it is being collected and to whom it might be disclosed*

• The information should be handled in accordance with the person's expectations*

• If, later on, it is to be handled for other purposes that are not in accordance with their expectations, you need to seek their consent to use or disclose it for these other purposes; otherwise, you can seek to rely upon the authority of law or upon one of the public interest exceptions in the Health Privacy Principles.

• * So, medical information being disclosed to a specialist consultant prior to their consultation with the specialist would be within most people's normal expectations.

Access to records:

The Health Records Act gives consumers a right to ACCESS their personal health record, not a right to physically take them away. The explanatory notes to the Act set out in plainer language the type of access that is available under the Act:

“Section 28 of the Act specifies the ways in which a right of access may be exercised under this Act. Where the information is collected after commencement of the Act (that is, AFTER 1 July 2002), the right may be exercised by:

• inspection of the information;

• obtaining a copy (or, with the agreement of the organisation concerned, an accurate summary); and

• viewing the information and receiving an explanation if the organisation is a health service provider (or in any other case, with the agreement of the organisation).

• Where the information is collected before commencement of the Act (that is, BEFORE 1 July 2002), the individual is entitled to receive an accurate summary of that information. The other forms of access outlined above are only available with the agreement of the individual and the organisation.”