Health information is sensitive information under the Privacy Act 1988 (Cth), which carries a higher collection threshold than ordinary personal information and reaches every organisation that provides a health service, whatever its turnover. New South Wales, Victoria and the Australian Capital Territory add their own health records statutes on top.
The small business exemption
The Privacy Act 1988 (Cth) exempts most businesses with an annual turnover of A$3 million or less, but section 6D(4)(b) removes that exemption for an organisation that provides a health service and holds health information.
Consent to record a consult
Audio of a consult is health information about an identifiable patient from the moment it is recorded, whether or not it is ever turned into text, and the Australian Privacy Principles class it with genetic and biometric information.
Consent to collect sensitive information has to be current, specific and informed, and the patient free to decline. Consent given on a registration form at first attendance does not describe a collection method introduced afterwards.
Spoken consent at the start of the consult covers what is being recorded, what it becomes, who reviews the output, and that declining does not change the care on offer. Record that it was given and when.
State health records law
New South Wales, Victoria and the Australian Capital Territory have their own health records statutes covering private sector practices: the Health Records and Information Privacy Act 2002 (NSW), the Health Records Act 2001 (Vic) and the Health Records (Privacy and Access) Act 1997 (ACT).
Each also fixes a retention period: seven years from the last occasion of service, or, for a patient who was under 18 at the time, until that patient turns 25.
My Health Record
A note signed into the practice's own clinical record is not uploaded to My Health Record by that act. Upload is a separate step from the practice's clinical software.
Notifiable data breaches
Part IIIC of the Privacy Act requires an entity to complete its assessment of a suspected eligible data breach within 30 days of becoming aware of it. An eligible data breach is unauthorised access to, unauthorised disclosure of, or loss of personal information likely to result in serious harm. The entity notifies the Commissioner and the affected individuals.
The practice holds the health information and is the entity that notifies, so the contract should name who runs the assessment and how quickly the vendor reports an incident.
The draft, the audio and the record
A draft becomes the clinical record when a clinician has read it, corrected it and signed it. Ahpra's record-keeping expectations and the Medicare Benefits Schedule requirement for contemporaneous, clinically relevant notes apply to the signed note.
The audio is a separate holding with its own retention period, access list and disposal date.
Questions for a documentation vendor
A practice stays accountable under the Privacy Act for health information a vendor holds on its behalf, so the answers belong in the contract.
- Where audio, transcripts and drafts are stored, where the backups are held, and how long audio is kept after the note is signed.
- Which of the vendor's staff can read identifiable content, on what grounds, and whether that access is logged.
- Whether consult content is used to train models, and whether that commitment is in the contract or in a policy the vendor can change.
- What is exported and what is deleted when the practice ends the contract, and on what schedule.
aurii's handling of consult data
aurii drafts notes and letters from a recorded consult. Patient records and backups are held in Australian regions of Microsoft Azure.
A practice writing its own collection notice has to describe that step and the storage behind it. aurii's handling of personal information is mapped to each Australian Privacy Principle.
This article is general information only, not clinical, legal or financial advice, and practices should seek advice specific to their own circumstances.
