Information sharing, confidentiality and privacy of health information
Health information must not be disclosed without the person’s consent, unless specific exceptions apply (see Chapter 9.1: Health and the law).
-
The MHW Act introduces a number of new information sharing principles and provisions (pt 17.1) that are intended to strengthen consumer autonomy, better engage families, carers and supporters and allow for a more integrated approach to service delivery:
The disclosure, use or collection of personal or health information about a person receiving mental health and wellbeing services should be directed at:
enhancing a person’s ability to access, understand and self-manage their information;
improving the person’s experience of engaging with the mental health and wellbeing system;
supporting the person to transition between services or levels of care;
supporting the provision of safe, integrated, high-quality, care and support;
where appropriate, supporting families, carers and supporters to fulfil their role (s 722).
Dignity of person paramount principle – A person’s dignity is to be upheld, including by ensuring information is recorded accurately and respectfully (s 723).
Aboriginal and Torres Strait Islander information principle – The health and personal information of Aboriginal and Torres Strait Islander people is to be treated in a manner that promotes self-determination and is culturally safe, acknowledging connections to family, kin and community (s 724).
Accuracy of information principle:
Information relating to a person receiving mental health and wellbeing services that is recorded or shared is to be accurate, relevant and up to date;
any person or provider that makes a decision, performs a function or exercises a power related to the disclosure, use or collection of health
or personal information must give proper consideration to the information sharing principle (s 726).
Accessibility of information principle – Information is to be provided (as far as reasonably practicable) to people in an accessible format that acknowledges the needs of people having regard to their age, disability, neurodiversity, culture, language, communication, religion, ethnicity, sex, gender identity, and/or sexual orientation (s 725).
-
As a general rule, consumer consent is required for the sharing of health and personal information and consumers are able to withdraw this consent at any time (s 729).
-
The MHW Act requires and authorises the disclosure of personal and health information in a range of circumstances. However, this information must not be disclosed if the person disclosing it reasonably believes that by doing so there is a risk that someone may be subjected to family violence or other serious harm (s 31).
This applies even if the MHW Act otherwise requires disclosure, or if the person the information is about has consented.
A mental health and wellbeing service provider is not required to disclose information to family, a carer or a supporter, despite consent being given, if the disclosure:
poses a threat to the life or health of any person;
could unreasonably impact on the privacy of other persons;
is unlawful;
is inconsistent with a requirement or authorisation by or under law;
may prejudice an investigation of unlawful activity;
may prejudice a law enforcement function by or on behalf of law enforcement agency; or
is likely to cause damage to the security of Australia in the course of a law enforcement agency performing a function (s 732).
As a result of the MHW Act, providers have a positive duty to share some or all of a person’s health information with their family, a carer or a supporter, after the consumer has been admitted or discharged from an inpatient service, with the consumer’s permission (s 722).
A consumer’s information can be shared with specified service providers where reasonably necessary to assist in referrals or ensure integrated services are provided to the consumer, unless the consumer elects not to have that information shared (s 733).
-
There are a number of exceptions to consent-based sharing of health information:
1 Electronic health information system
A person who is employed or engaged by a mental health and wellbeing service provider may enter a person’s health information into the electronic health information system (CMI/ODS) without consumer consent (s 727).
Information about a consumer held in the electronic health information system may also be accessed by providers, without a consumer’s consent, for the purpose of providing services to a consumer.
2 Disclosure to facilitate service provision
Health information may be disclosed without consent if:
reasonably required by another mental health and wellbeing service provider or a health service provider to provide health services to the person;
made to a psychiatrist giving a second psychiatric opinion. Such disclosure includes providing access to a consumer’s clinical records or discussing a consumer’s treatment with the psychiatrist giving the second psychiatric opinion (s 730).
3 Disclosures to parents, families, carers, supporters and others
Health information can be disclosed to people associated with a consumer without the consumer’s consent in certain circumstances including:
in general terms to family, a carer or supporter of a consumer as long as the disclosure is not contrary
to the views and preferences expressed by the consumer (s 730(2)(f));
to a parent if the consumer is under 16 years of age or the Secretary of the DFFH with parental responsibility of the child under a relevant child protection order (ss 730(2)(h)–(i));
to a guardian of the person if the disclosure is reasonably required in connection with the performance of a duty or the exercise of a power by the guardian (s 730(2)(n)); and
to a support person (within the meaning of the Medical Treatment Planning and Decisions Act 2016 (Vic)) of the person to whom the health information relates (s 730(2)(p)).
4 Disclosure to lessen or prevent a serious threat
Health information may be disclosed where it is reasonably necessary to lessen or prevent a serious threat to a person’s life, health, safety or welfare, or a serious threat to public health, public safety or public welfare (s 730(2)(c)(ii)).
Any such disclosure must be in accordance with any guidelines issued by the Health Complaints Commissioner under the Health Records Act 2001 (Vic) (‘HR Act’) (s 730(2)(f)(i)).
5 Emergency Service providers
Health information may be shared with Ambulance Victoria where it is for the purposes of the provision of an emergency service or performing a function under the MHW Act (s 734).
6 Disclosure permitted/required under law
Health information may be disclosed without consent (s 730) if the disclosure is:
reasonably necessary for a mental health and wellbeing service provider to perform functions or exercise powers under the MHW Act or any other Act;
permitted by any Act other than the HR Act;
permitted by and is in accordance with certain Health Privacy Principles (HPP) established under the HR Act: HPP 2.1 which permits the disclosure of information for the primary purpose for which the information was collected;
HPP 2.2(a) which permits disclosure of information for a secondary purpose if the secondary purpose is directly related to the primary purpose and the consumer would reasonably expect the service to disclose the information for the secondary purpose;
HPP 2.5 which permits the disclosure of information, to the extent reasonably necessary for specified purposes, if a consumer is suspected to be or is dead, is suspected to be missing or is missing or is involved in an accident or other misadventure and is incapable of consenting to the disclosure;
HPP 2.2(f) which relates to the funding, management etc. of the health services, HPP 2.2(g) which relates to research in the public interest and HPP 2.2(k) which relates to the establishment of a legal defence.
7 Other
Certain health information of a person receiving mental health and wellbeing services may also be shared with the:
Chief Psychiatrist (including if the person has died and the death is a reportable death) (s 741); and
Justice Secretary, Health Secretary and the Chief Commissioner of Police following the death of any security patient who receives treatment from a designated mental health service (s 742).
-
The MHW Act introduces health information statements (pt 17.2) to support the autonomy and agency of people using mental health and wellbeing services in relation to the information that is held about them.
A health information statement is a written comment and/or opinion on information held about the person by a mental health and wellbeing service provider.
A person can give a provider a health information statement if they have applied to have information held about them amended or corrected under the Freedom of Information Act 1982 (Cth) or HPP 6 and the provider refuses to amend or correct the information.
If the provider refuses to amend or correct the information, the provider must advise the person in writing of the reasons for that refusal.
The provider must also inform the person in writing that they may within 12 months make a health information statement.
A health information statement given by the person to the mental health and wellbeing service provider must be in writing.
The provider must accept the health information statement unless it does not relate to the subject of the initial request.
The provider must include the health information statement on the person’s health information record.
Information sharing, confidentiality and privacy of health information
Chapter: 8.4: Mental illness
Contributor: Kate Windmill, Director of Legal Practice, Mental Health Legal Centre
Current as of: 1 September 2024
Law Handbook Page: 759
Next Section: Mental health and human rights
