Kampf, A., McSherry, B., Rothschild, A., & Ogloff, J. (2010). Statutory schemes. In Confidentiality for mental health professionals (pp. 75-92). Australian Academic Press.
One of the most complex aspects of the law on confidentiality is trying to understand the variety of legislative provisions dealing with confidential information and its interplay with the common law. It is important to differentiate between the statutory schemes within Commonwealth legislation and the states’ and territories’ legislation that relate to private or confidential information. Confidentiality provisions and provisions for the disclosure of certain information can be found in legislation relating to mental health care; court proceedings; criminal investigations; the use, collection and storage of health information; guardianship; and other areas. The following broad overview of legislative requirements will focus on provisions that specifically address health information or provisions that are particularly relevant to mental health care settings. The overview will include a list of some of the relevant provisions on matters of confidentiality within federal, state and territory legislation. Although this list is not exhaustive, it provides a reference point for understanding the scope of current provisions. If there is some doubt as to which statutory provisions apply to a practical dilemma, it is important and helpful to seek professional advice from indemnity insurers and legal counsel to assist in decision-making.
The Privacy Act 1988 (Cth) evolved in response to international law developments concerning the protection of privacy. In particular, privacy issues are addressed in:
- the United Nations International Covenant on Civil and Political Rights (ICCPR) (ICCPR);
- the Organisation for Economic Cooperation and Development (OECD) Privacy Guidelines (available at OECD); and
- the Council of Europe’s Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data (Council of Europe).
An investigation into Australia’s privacy protection scheme suggested that improvements were necessary in order to comply with international standards (Law Reform Commission, 1983). In response to that finding, privacy legislation was enacted.
The Privacy Act 1988 (Cth) establishes a legal obligation for employees to keep health records confidential. It also distinguishes between two sets of principles: the Information Privacy Principles (IPP) and the National Privacy Principles (NPP). The IPP apply to federal and Australian Capital Territory government agencies, while the NPP apply to parts of the private sector and individuals. The fact that the Privacy Act establishes these two distinctive schemes to handle health information in the private and public sectors can be confusing and has attracted criticism (Office of the Privacy Commissioner, 2005, 64ff).
As the NPP provide specific rules to protect sensitive health information, this type of information is subject to stronger protection than other private information. Principle 2 of the NPP generally prohibits disclosure of personal health information beyond its primary purpose. The primary purpose is typically the diagnosis and treatment of the client or patient. But disclosure is permissible in the following circumstances:
- if it is directly related to the primary purpose and within the client’s or patient’s reasonable expectations;
- if the client or patient consents to it; or
- if disclosure is required or authorised by law.
Sensitive health information may also be disclosed in order to lessen or prevent either a serious and imminent threat to an individual’s life, health or safety, or a serious threat to public health or safety. It should be noted, however, that the NPP do not impose a duty to disclose information. Note 2 in the NPP Schedule 3.2.1 explicitly states that ‘an organisation is always entitled not to disclose personal information in the absence of a legal obligation to disclose it’.
All states and territories have also enacted specific health records and information privacy legislation. Table 6.1 sets out the main provisions in this area. The provisions in these statutes are generally more detailed than those included in mental health legislation. They are mostly based on the IPP or NPP, found in the Privacy Act 1988 (Cth). In turn, they also distinguish between the public and private service sectors and, depending on whether a mental health service is part of the public or private sector, different statutes apply in some states and territories. As the health record provisions are similar to the IPP and NPP of the Privacy Act 1988 (Cth), further elaboration will be omitted.
However, it is worth noting that all relevant provisions permit disclosure in an emergency situation when that disclosure is necessary to lessen or prevent a serious and imminent threat to the life, health or safety of a person. Confidential information may also be disclosed to lessen or prevent a serious threat to public health or public safety.
Key Points
- The Privacy Act 1988 (Cth) and health records statutes protect health records and information from disclosure.
- Exceptions to the general rule of confidentiality permit disclosure in the following circumstances:
- if disclosing confidential information is directly related to the treatment of the client or patient or within that client’s or patient’s reasonable expectations
- if the client or patient consents to disclosing confidential information;
- if disclosure serves to lessen or prevent either a serious and imminent threat to an individual’s life, health or safety, or a serious threat to public health or safety;
- if disclosure is otherwise authorised by law.
Table 6.1 Most relevant legislation on disclosure of health information
| Jurisdiction | Sector | Legislation |
|---|---|---|
| ACT |
Public Private |
Health Records (Privacy and Access) Act 1997 (ACT), Privacy Principle 10 Health Records (Privacy and Access) Act 1997 (ACT), Privacy Principle 10 |
| NSW |
Public Private |
Health Records and Information Privacy Act 2002 (NSW), Health Privacy Principle 10 Health Records and Information Privacy Act 2002 (NSW), Health Privacy Principle 10 |
| NT |
Public Private |
Information Act 2006 (NT), section 148, Information Privacy Principle 2 Privacy Act 1988 (Cth), National Privacy Principle 2 |
| Qld |
Public Private |
Information Standard 42 - Information Privacy*; Information Standard 42A - Information Privacy for the Queensland Department of Health* Privacy Act 1988 (Cth), National Privacy Principle 2 |
| SA |
Public Private |
Information Privacy Principles Instruction PC012 1992* Privacy Act 1988 (Cth), National Privacy Principle 2 |
| Tas |
Public Private |
Personal Information Protection Act 2004 (Tas), Personal Information Privacy Principle 2 Privacy Act 1988 (Cth), National Privacy Principle 2 |
| Vic |
Public Private |
Health Records Act 2001 (Vic), National Privacy Principle 2 Health Records Act 2001 (Vic), Health Privacy Principle 2 |
| WA |
Public Private |
Information Privacy Bill 2007 (WA), section 131, Information Privacy Principle 2 (now lapsed) Information Privacy Bill 2007 (WA), section 131, Information Privacy Principle 2 (now lapsed) |
Note: All legislation is referred to as it applied on 1 August 2009.
General Provisions Dealing with Confidentiality
All Australian states and territories have specific mental health legislation in place. With the exception of the Australian Capital Territory, each piece of mental health legislation incorporates specific provisions that generally protect confidentiality in mental health settings. The Mental Health (Treatment and Care) Act 1994 in the Australian Capital Territory is currently under review and it may be that a revised Act will contain confidentiality provisions.
The relevant mental health Acts in Australia use different formulations and define the scope and context of services differently. However, with the exception of the Australian Capital Territory, they essentially protect the information that a mental health professional obtains when he or she exercises functions or powers under the mental health legislation. If mental health professionals who fall under the application of the mental health legislation do not comply with these provisions, various penalties apply.
However, the relevant mental health Acts contain many exceptions and limitations to the duty to maintain confidentiality. As a general observation, it is worth noting that confidential information may be disclosed in the following situations or to the following individuals:
- with the client’s consent;
- when the disclosure is required or authorised by the mental health legislation or other legal provisions;
- to nominated carers or guardians in certain circumstances;
- for the purpose of criminal investigations or criminal proceedings; and
- for statistical analysis and research purposes, provided that there is compliance with further requirements.
Table 6.2 Provisions dealing with confidentiality in mental health legislation
| Jurisdiction and name of Act | Statement on confidentiality | Disclosure with client's consent | Disclosure pursuant to other legislation | Disclosure to carers or guardians | Disclosure for criminal investigations or proceedings | Disclosure for research |
|---|---|---|---|---|---|---|
| NSW Mental Health Act 2007 |
A person must not disclose any information obtained in connection with the administration or execution of the Act (s 189(1)) | A person may disclose information with the consent of the person from whom the information was obtained (s 189(1)(a)) | In connection with the administration or execution of the Mental Health (Forensic Provisions) Act 1990 (s 189(1(b)) | To a primary carer of a person in connection with the provision of care or treatment to the person (s 189(1)(c)) |
For the purposes of any legal proceedings arising out of the Act (s 189(1)(d)) | For a purpose referred to in health privacy principle10(1)(1)(research) under the Health Records and Information Privacy Act 2002 |
| QLD Mental Health Act 2000 |
Nobody may disclose the information, or give access to a document about another person's affairs, to anyone else (s 528(1)-(2)). Exceptions are provided for in certain circumstances (s 530). | If the person to whom the information relates agrees to the disclosure or giving of access and the person is an adult when the agreement is given (s 528(3)(d); s 529(3)(b)) | May disclose if the disclosure or giving of access is otherwise required or permitted by law (s 528(3)(c); s 529(3)(a)) or necessary to perform the person's functions under the Act (s 528(3)(b)) | |||
| SA Mental Health Act 2009 |
A person engaged or formerly engaged in the administration of this Act must not disclose personal information relating to a person obtained in the course of administration of this Act except to the extent that he or she may be authorised or required to disclose that information by the Chief Executive (s 106(1)) | May disclose information at the request, or with the consent, of the person to whom the information relates or a guardian or medical agent of the person (s 106(2)(b)) | May disclose information as required by law, or as required for the administration of the Act or a law of another State or Territory of the Commonwealth (s 106(2)(a)) | May disclose information to a relative, carer or friend of the person to whom the information relates if the disclosure is reasonably required for the treatment, care or rehabilitation of the person and there is no reason to believe that the disclosure would be contrary to the person's best interests (s 106(2)(c)) | May disclose information if it is reasonably required to lessen or prevent a serious threat to the life, health or safety of a person, or a serious threat to public health or safety (s 106(2)(e)) | May disclose information for medical or social research purposes if the research methodology has been approved by an ethics committee and there is no reason to believe that the disclosure would be contrary to the person's best interests (s 106(2)(f)) |
| Tas Mental Health Act 1996 |
A person who obtains information of a person or confidential nature about a person in the exercise of powers or functions under this Act must not disclose the information except as provided for under the Act (s 90(1)) | The information may be disclosed if the disclosure is authorised by the person to whom it relates (s 90(2)(a)) | If the disclosure is reasonably required for the care or treatment of the person to whom the information relates or for the administration of the Act (s 90(2)(b)) | |||
| Vic Mental Health Act 1986 |
A relevant person must not, except to the extent necessary to carry out functions or exercise powers, give to | May disclose if the person has given prior consent (either express or implied) (s 120A(3)(a)) | May disclose information as described in the Health Privacy Principles in the Health Records Act 2001 (s 120A(3)(ea)) | May disclose information to a guardian, family member or primary carer if the information is | May give information to a court in the course of criminal proceedings (s 120A(3)(b)) | May disclose information to the Australian Statistician (s 120A(3)(f)) |
| WA Mental Health Act 1996 |
A person must not directly or indirectly divulge any personal information obtained by reason of any function that person has, or at any time had, in the administration of the Act (s.206(1)) | May divulge personal information with the consent of the person to whom the information relates (s 206(2)(d)) | May divulge personal information in the course of duty (s 206(2)(a)), or under the Act or another law (s 206(2)(b)) | May divulge information for the purposes of the investigation of any suspected offence or the conduct of proceedings against any person for an offence (s 206)(2)(c)) |
Sub-sections 91(2)(f)-(h) of the Mental Health and Related Services Act 2005 (NT) and subsection 106(2)(e) of the Mental Health Act 2009 (SA) are the only legislative provisions that deal specifically with the disclosure of confidential information for the purpose of warning authorities about a client or patient considered to be at risk of harming others.
Sub-section 106(2)(e) of the Mental Health Act 2009 (SA) states that persons engaged in administering the Act ‘may disclose information if it is reasonably required to lessen or prevent a serious threat to the life, health or safety of a person, or a serious threat to public health or safety’. It is important to note that this gives discretion to the relevant person; it is not a mandatory requirement.
The exceptions to confidentiality in the Northern Territory are more complex. Subsections 91(2)(f)-(h) permit (that is, it is not mandatory) disclosure of confidential information to police officers and the Commissioner of Police or persons specifically nominated by the Commissioner of Police.
Confidential information may be disclosed to the Commissioner of Police if the mental health professional ‘reasonably believes’ that the client or patient ‘may harm himself or herself or represents a danger to the general community’ (ss 91(2)(g)).
Sub-section 91(2)(f) also permits a mental health professional to disclose confidential information to a police officer if:
- the person to whom the information relates is in a situation requiring immediate intervention; and
- the person: (A) is likely to cause serious harm to himself or herself or to someone else; or (B) represents a substantial danger to the general community; and
- the information is relevant to the safe resolution of the situation.
In addition, sub-section 91(2)(h) permits a mental health professional to disclose confidential information to a police officer when ‘it is required to prevent or lessen a serious or imminent threat to the life or health of the person, another person or the general community’.
Although legislative provisions enabling disclosure in the public interest exist only in South Australia and the Northern Territory at present, the latter scheme presents a staged approach, which is useful to consider in decision-making. Under the Northern Territory scheme, the more serious the risk, the more flexibility is given to a mental health professional in deciding to whom he or she may disclose confidential information. The legislation differentiates between harm, serious harm, and a serious and imminent threat to a life or to the health of a person.
The other Australian jurisdictions, however, do not specify how to deal with the disclosure of confidential information in emergency situations.
Key Points
- Mental health Acts contain provisions protecting the confidentiality of information about individuals with mental illnesses.
- Mental health Acts contain provisions providing for exceptions to the general duty to maintain confidentiality.
- The Mental Health and Related Services Act 2005 (NT) and the Mental Health Act 2009 (SA) are the only statutes that deal specifically with the disclosure of confidential information for the purpose of warning authorities about a client or patient considered to be at risk of harming others.
In addition to the mental health care and confidential information legislation, various other statutory provisions such as those in public health legislation may require the disclosure of confidential information. The most discussed issue in this regard is the mandatory reporting of child abuse.
In most Australian jurisdictions, certain professionals are under a duty to report cases of child abuse. Table 6.3 sets out the main provisions dealing with mandatory reporting. There are penalties for nondisclosure where the person concerned is mandated to disclose the information and fails to do so. As in Table 6.2, the actual language of the Act has been included wherever possible with some paraphrasing.
It should be noted that these statutes also contain provisions permitting disclosure by any person primarily on the basis of a reasonable belief that the child is being sexually or physically abused and some statutes include provisions protecting those who have disclosed information from legal liability. For example, while the Child Protection Act 1999 (Qld) does not have mandatory reporting provisions, section 22 of that Act protects individuals from liability for the notification of, or information given to, the Chief Executive of the Department of Communities about alleged harm or risk of harm.
Many of the state and territory departments responsible for the care and protection of children have the requisite forms for reporting child abuse available on their websites.
Table 6.3 Disclosure mandated in cases of child abuse
| Jurisdiction and name of Act | Who must report child abuse | When disclosure is mandatory | Who to report to |
|---|---|---|---|
| ACT Children and Young People Act 2008 Section 356 | Doctors, dentists, nurses, midwives, police officers and teachers, school counsellors (and others involved in the care of children) | The professional believes on reasonable grounds that a child or young person has experienced, or is experiencing, sexual abuse or non-accidental physical injury | The Chief Executive of ACT Health |
| NSW Children and Young Persons (Care and Protection) Act 1998 Section 27 | (a) A person who in the course of his or her professional work or other paid employment delivers health care, welfare, education, children's services, residential services or law enforcement, wholly or partly, to children; and (b) A person who holds a management position in an organisation and whose duties include direct responsibility for, or direct supervision of, the provision of health care, welfare, education, children's services, residential services or law enforcement, wholly or partly, to children' | (a) The person has reasonable grounds to suspect that a child is at risk of harm, and (b) Those grounds arise during the course of or from the person's work | The Director-General of the Department of Community Services |
| NT Care and Protection of Children Act 2007 Section 26 | Any person | The person believes, on reasonable grounds, that a child has been or is likely to be a victim of a sexual offence or otherwise has suffered or is likely to suffer harm or exploitation | The Chief Executive Officer of the Department of Health and Families A police officer |
| Qld Public Health Act 2005 Section 191 | Doctor or registered nurse | The doctor or nurse becomes aware, or reasonably suspects, during the practice of his or her profession that a child has been, is being or is likely to be harmed | The Chief Executive of the Department of Communities (Child Safety) |
| SA Children’s Protection Act 2003 Section 11 | Medical practitioners, pharmacists, nurses, dentists, psychologists, police officers, community corrections officers, social workers, teachers, ministers of religion (and certain others involved in the care of children) | a) The relevant person suspects on reasonable grounds that a child has been or is being abused or neglected; and b) the suspicion is formed in the course of the person’s work (whether paid or voluntary) or of carrying out official duties | The Department of Education and Children’s Services |
| Tas Children, Young Persons and Their Families Act 1997 Section 14 | Medical practitioners, nurses, dentists, psychologists, police officers, probation officers, teachers, child care workers | The prescribed person believes, suspects or knows, on reasonable grounds, that a child has been or is being abused or neglected or that there is a reasonable likelihood of a child being killed or abused or neglected by a person with whom the child resides | The Secretary of the Department of Health and Human Services |
| Vic Children, Youth and Families Act 2005 Section 184 | Medical practitioners, nurses, teachers, school principals, members of the police force | The relevant person forms the belief on reasonable grounds that a child is in need of protection on the basis that the child has suffered, or is likely to suffer, significant harm as a result of physical injury and the child’s parents have not protected, or are unlikely to protect, the child from harm of that type, or the child has suffered, or is likely to suffer, significant harm as a result of sexual abuse and the child’s parents have not protected, or are unlikely to protect, the child from harm of that type | The Secretary to the Department of Human Services |
| WA Children and Community Services Act 2004 Section 124B | Doctors, nurses, midwives, police officers, teachers | The relevant person believes on reasonable grounds that a child has been the subject of sexual abuse or is the subject of ongoing sexual abuse and forms the belief in the course of the person’s work | The Chief Executive Officer of the Department for Child Protection or a person approved by the Chief Executive Officer |
Key Points
- All Australian jurisdictions now have statutory provisions relating to the mandatory reporting of child abuse by certain professionals.
- Disclosure of child abuse is also permitted by any person in certain circumstances.
There are other statutes requiring the disclosure of confidential information particularly in relation to court proceedings. Each Australian jurisdiction has an Evidence Act that contains provisions enabling courts to request or compel a person to give evidence or produce documents and other statutes enable the issuing of subpoenas or summons to give evidence. Again, it is important to obtain legal advice if a court has issued documents requiring evidence in court or the disclosure of certain documents because there may be circumstances when such legal requests can be challenged.
When dealing with confidential information, the growing importance of human rights should also be considered. On a federal level, Australia does not have a bill or charter of rights, although discussion is now taking place about whether it is necessary to have one. The Australian Capital Territory and Victoria have legislative schemes in place, which provide limited protection of certain human rights (Human Rights Act 2004 (ACT); Charter of Human Rights and Responsibilities Act 2006 (Vic)).
The impact of these schemes is limited in that the human rights they enshrine are not legally enforceable and any laws that conflict with human rights standards cannot be struck down by the courts. Nevertheless, they serve as a reference point for judges in interpreting the law and as an indicator of the human rights commitment of the state or territory government that enacted the legislation. Beyond this, the human rights legislation has an important symbolic value and potential for the interpretation and application of human rights within the Australian legal framework. Thus, the Human Rights Act 2004 (ACT) and the Victorian Charter of Human Rights and Responsibilities are relevant for guiding law and policy-making as well as individual decision-making when applying the law.
An individual’s right to privacy is discussed in section 12 of the Human Rights Act 2004 (ACT) and Part 2 of the Victorian Charter of Human Rights and Responsibilities. The concept of privacy derives from the protection of autonomy and the individual freedom to choose with whom to share private information. It is a concept that is protected in international human rights documents and it is expected that it will increasingly influence law reform and the development of the common law in Australia. With Australia also having ratified the United Nations Convention on the Rights of Persons with Disabilities in July 2008, Australia has strengthened its human rights commitment in particular in the mental health area.
Key Points
- Confidentiality provisions and provisions for the disclosure of certain information can be found in many different statutes.
- Some of the most important provisions can be found in privacy and health records legislation, mental health Acts and legislation dealing with the mandatory disclosure of information regarding child abuse.
- The concept of privacy is protected in international human rights documents, and statutory exceptions are generally carefully circumscribed.
- Australian legislation mandates breaching confidentiality only in limited, clearly identified situations, such as mandatory reporting of child abuse.
