Privacy, disclosure and child reporting

The Privacy Framework: Privacy Act 1988 & Medical Records Custody

In Australian clinical practice, patient privacy and medical confidentiality are governed by a complex matrix of Commonwealth and state privacy legislation, common law fiduciary principles, and professional regulatory codes.

The Commonwealth Privacy Act 1988 & APPs

The Commonwealth Privacy Act 1988 regulates the collection, handling, storage, and dissemination of personal information. The Act contains 13 Australian Privacy Principles (APPs), which apply to all private health service providers, medical practices, private hospitals, and Commonwealth agencies. State and territory public health services are regulated by equivalent state privacy statutes (e.g., the Health Records Act 2001 [Vic], the Health Records and Information Privacy Act 2002 [NSW], and the Information Privacy Act 2009 [Qld]).

• Health Information as Sensitive Information: Under APP guidelines, health data is categorized as "sensitive information," attracting the highest statutory protection. Sensitive health data cannot be collected or disclosed without individual consent unless a specific legislative exception applies.
• Storage and Security (APP 11): Healthcare entities are legally obligated to take reasonable steps to protect health records from misuse, interference, loss, unauthorized access, modification, or disclosure.

Medical Records Custody vs. Patient Right of Access

A common area of confusion in medical practice involves the legal ownership of physical and electronic medical charts:

• Ownership of the Record: In the landmark High Court decision Breen v Williams (1996) 186 CLR 71, the court established that the physical or electronic health record (the paper chart, software database, digital imaging, and pathology reports) is the property of the medical practitioner, practice, or hospital facility that compiled it.

• Patient Right of Access (APP 12): Although the healthcare provider owns the physical record, APP 12 and corresponding state health records legislation grant the patient an enforceable statutory right of access to inspect and receive copies of their health information.

• Grounds for Denying Access: A healthcare provider may only refuse access in strictly circumscribed statutory circumstances, such as:

  • Where providing access would pose a serious threat to the life, health, or safety of any individual (including the patient themselves).
  • Where providing access would have an unreasonable impact on the privacy of other individuals.
  • Where the information relates to existing or anticipated legal proceedings between the entity and the individual and would be protected by legal professional privilege.

• Physical/Digital File Ownership: Legal Reality: Owned by the medical practice, clinic, or hospital; Governing Authority: Breen v Williams (1996) HCA

• Information Inside the File: Legal Reality: Patient holds statutory right to inspect and obtain copies; Governing Authority: APP 12 / State Health Records Acts

• Access limitations: Legal Reality: Apply the specific statutory exceptions, explain any refusal and consider alternative access; Governing Authority: APP 12 and the applicable state framework

• Transferring Medical Files: Legal Reality: Clinic may charge reasonable administrative fee for copying; Governing Authority: Medical Board of Australia Guidelines

• Deceased Patient Records: Legal Reality: Confidentiality survives death; access governed by state law; Governing Authority: State health records and probate legislation

---

Exceptions to Confidentiality: The Clinical & Legal Matrix

While medical confidentiality is a cornerstone of the doctor-patient relationship, it is not absolute. Under Australian law, confidential information may—or must—be disclosed under five recognized exceptions:

1. Express Patient Consent: The patient (or their authorized legal surrogate) provides informed verbal or written consent to share health details (e.g., specialist referrals, life insurance reports, or worker's compensation disclosures).
2. Mandated by Specific Statute: Reporting is legally required by parliament, overriding confidentiality (e.g., child protection reporting, notifiable communicable diseases, coronial inquiries).
3. Compelled by Legal Process: Production of records compelled by a court subpoena, search warrant, or statutory summons.
4. Public Interest Defense (Serious Threat): Disclosing information to prevent or lessen a serious threat to an individual's life, health, or safety, or to public safety.
5. Medical Defense and Quality Assurance: Disclosing records to medical defense organizations (MDOs) in response to legal claims, or participating in statutory quality assurance committees.

---

Mandatory Child Protection Reporting

• Child-protection duties: Doctors have reporting duties across Australia, but reportable categories, ages and suspicion/belief thresholds differ by jurisdiction. Check the local Act and child-protection pathway. Proof is not required before reporting at the statutory threshold, and consent is not needed for a lawful mandatory report. Protect immediate safety while seeking specialist advice.

Doctors have child-protection reporting duties, but other designated professions, reportable categories and thresholds differ by state/territory. Use the local legislation rather than a single national list.

Statutory Grounds for Mandatory Reporting

A mandatory notification must be lodged when a healthcare worker forms a reasonable suspicion or reasonable belief that a child (typically aged under 16 or 18, depending on the jurisdiction) is in need of protection due to:

• Physical Abuse: Non-accidental trauma, including unexplained fractures (especially long-bone or rib fractures in non-ambulant infants), subdural hematomas, patterned bruising, human bite marks, or immersion burns.
• Sexual Abuse or Exploitation: Any sexual contact, grooming, or exposure to sexual activity.
• Severe Emotional or Psychological Harm: Severe psychological maltreatment or chronic exposure to severe domestic and family violence.
• Severe Neglect: Chronic failure to provide essential medical care, nutrition, clothing, shelter, hygiene, or supervision, resulting in significant impairment of physical health, development, or emotional well-being.

Key Clinical Principles for the Practitioner

• Threshold of Suspicion: The law requires "reasonable suspicion" or "reasonable belief" based on clinical observations, injury patterns, or history. The doctor is not required to prove the abuse conclusively or conduct a forensic investigation; investigative responsibility rests exclusively with child protection statutory agencies and the police.
• Reporter protections: Good-faith statutory reports generally receive legal protections. Their scope depends on the jurisdiction and lawful reporting conditions; avoid promising absolute immunity from every conceivable liability.
• Parental Consent: Parental consent is NOT required before making a child protection report. While clinicians should generally be transparent with families, they should refrain from notifying parents if doing so would place the child, the clinician, or staff at immediate risk of violent harm, or if it might lead to destruction of evidence.

---

Primary references (checked 7 October 2026): Austroads driving fitness; OAIC privacy guidance.