3.1 Privacy, Confidentiality & Patient Rights

3.1 Privacy, Confidentiality & Patient Rights

Quick Answer: Treat dispensing records, counselling conversations, and My Health Record access as confidential health information. Disclose without consent only when the law requires it, when there is a serious threat to life, health or safety, or when another narrow Privacy Act exception clearly applies — not because a relative, friend, or casual police enquiry asks.

Privacy and confidentiality sit inside Standard 1.3 Practise within applicable legal framework. Intern Written items rarely ask you to recite statute section numbers. They ask what a safe, lawful pharmacist would do when someone wants information that is not theirs to take.

Why privacy is a registration issue

A pharmacy holds some of the most sensitive personal information a person can generate: diagnoses inferred from medicines, mental-health therapy, sexual and reproductive health, substance-use treatment, and full dispensing histories. Misuse damages trust, can cause discrimination or family conflict, and can trigger Privacy Act complaints, professional notifications to Ahpra/Pharmacy Board, employment discipline, and civil claims.

Confidentiality is also a professional ethic under Pharmacy Board codes — even where a technical privacy exemption might exist, the pharmacist must still choose the least invasive lawful option and document the decision.

Privacy Act and APP-style concepts (exam level)

The Commonwealth Privacy Act 1988 and the Australian Privacy Principles (APPs) frame how many health service providers handle personal information. At exam level, map pharmacy practice to these practical APP themes rather than memorising full APP text:

Personal information identifies or could identify a person. Sensitive information includes health information and is subject to stricter collection and use rules. Dispensing history, dose administration aids (DAA) charts, clinical notes, and My Health Record extracts are all sensitive health information.

State and territory health records laws may also apply in public hospital and some community settings. For Intern Written purposes, apply the most protective practical standard: need-to-know access, secure storage, and documented lawful disclosure.

When personal health information may be disclosed

Default rule: do not disclose health information to third parties without the patient’s informed consent (or the authority of a lawful substitute decision-maker).

Recognised pathways that may justify disclosure without the patient’s prior consent include:

1. Patient consent — express (written/verbal, documented) or, in limited cases, implied from the circumstances of care (e.g. sharing necessary details with the treating GP when the patient presents a script for review). Implied consent is narrow; never stretch it to family gossip.
2. Required or authorised by law — for example, statutory reporting of certain notifiable diseases, court orders, mandatory notification duties under National Law in defined circumstances, or specific drugs-and-poisons record inspection powers held by authorised officers.
3. Serious threat — disclosure reasonably necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety, where it is unreasonable or impracticable to obtain consent.
4. Other narrow APP exceptions — e.g. certain law-enforcement related disclosures under tightly defined conditions; suspected unlawful activity or serious misconduct investigations within organisations; research with ethics approval and de-identification where required. These are not open-ended “police asked nicely” rules.

When in doubt: pause, seek senior pharmacist or organisational privacy advice, disclose the minimum necessary, and document what was disclosed, to whom, why, and under which pathway.

Family members without authority

An adult child, spouse, carer, or neighbour is not automatically entitled to a patient’s dispensing history, even if they “always pick up Mum’s tablets.”

Exam approach:

• Verify the patient’s identity and any authorised representative status (enduring power of attorney for personal/health matters where recognised, guardianship order, or explicit patient authority on file).
• If the patient has capacity, obtain the patient’s consent before discussing details. Prefer speaking with the patient privately first.
• Carers may need practical information to assist administration (e.g. “give one at night with food”) if the patient has authorised this, but that is not the same as handing over a full printout of controlled-medicine history.
• For delivery or collection, confirm the person is the nominated collector and only provide the medicines and labelling information needed for safe use — not a conversational review of diagnoses.

Scenario — adult son requests Mum’s dispensing history

Mum is not present. Son says he is “looking after her meds” and wants a 12-month history printout, including antidepressants and opioids.

What the pharmacist should do: Decline to release the full history without Mum’s consent or clear legal authority. Offer options: Mum can attend or phone to consent; Mum can authorise the son in writing/on file; if Mum lacks capacity, request evidence of substitute decision-making authority. Do not confirm or deny specific sensitive medicines to the son in the meantime. Document the request and refusal.

Police and other third-party requests

Police, insurers, employers, schools, and journalists have no general right to browse pharmacy records.

Scenario — police request without warrant vs mandatory reporting

• Without warrant/order: Officer asks whether a named person is on methadone. Refuse disclosure of health information. Be courteous, do not obstruct lawful investigation process, but do not volunteer clinical facts. Seek managerial/legal advice if pressure continues.
• Mandatory reporting context: If legislation requires a report (e.g. certain public health notifications or child-protection duties where applicable), the duty to report can override ordinary confidentiality. Follow the statute’s content, timing, and recipient rules. Mandatory reporting is not a free pass to answer every police question about every patient.

My Health Record — high-level pharmacist duties

The My Health Record system holds shared health information that authorised healthcare providers may access for care. Pharmacist duties at exam level:

• Access only when involved in the patient’s care and for a legitimate clinical purpose (e.g. checking allergies, current medicines, discharge summaries before dispensing or MedsCheck-type review).
• Use individual provider credentials; never share logins; log out of shared terminals.
• Do not open records out of curiosity, for training without proper authority, or after care has ended without a continuing clinical reason.
• Minimise downloads/printouts; store any extracts with the same security as other health records.
• If a patient has restricted access controls or has opted out, respect system flags and explain alternative information sources.
• Report suspected unauthorised access through organisational and system channels.

Misuse of My Health Record is both a privacy breach and a professional conduct issue.

Confidentiality during counselling

Counselling is a clinical act, not a public performance.

• Move sensitive discussions away from the open queue when possible; lower voice; avoid naming the medicine loudly if others can overhear.
• Do not discuss Patient A’s therapy with Patient B “because they know each other.”
• Phone counselling: confirm identity before discussing details; beware of open-plan workplaces and speakerphones.
• Interpreters and carers present with the patient: still limit content to what is needed; the patient can ask them to step out for intimate topics.
• Dose administration aids assembled in view of other customers should not display other patients’ names or regimens visibly.

Social media, photography, and modern traps

Common professionalism failures:

• Photographing prescriptions, labels, or patients for “study,” “memes,” or social media — even with faces blurred, other identifiers may remain.
• Posting de-identified-sounding stories that are still recognisable in a small community.
• Tagging the pharmacy location with a clinical anecdote.
• Using personal phones to store images of scripts instead of approved clinical systems.
• Live-streaming or recording in the dispensary without organisational approval and patient consent.

Rule of thumb: If you would not write it on a postcard addressed to the patient and their whole suburb, do not post it. Use approved channels for clinical photography (e.g. wound images) only with consent and secure storage.

Minors and capacity (high level)

Capacity is decision-specific and time-specific. An adult may have capacity for simple decisions but not complex ones; capacity can fluctuate with delirium, intoxication, or mental illness.

For minors:

• Parents/guardians usually consent for young children.
• Mature minors may, depending on jurisdiction and circumstances, consent to their own treatment if they understand the nature and consequences (sometimes discussed as Gillick-type maturity). Sensitive supplies (e.g. emergency contraception, sexual health) require careful, private assessment and local protocol knowledge.
• Do not automatically disclose a mature minor’s confidential supply to parents without considering the minor’s capacity, best interests, mandatory reporting duties, and organisational policy.
• When capacity is unclear, seek senior advice, involve appropriate decision-makers, and document the assessment.

Exam decision framework

When a stem involves privacy, work through:

1. Whose information is it?
2. Does the requester have consent or legal authority?
3. Is there a legal requirement or serious threat exception?
4. What is the minimum necessary disclosure?
5. How will I document and, if needed, escalate?

Prefer options that protect confidentiality while remaining collaborative (offer the patient a call-back, invite formal process, provide non-identifying general information about pharmacy policy).

Common Intern Written distractors

• Releasing history to a relative “to help adherence” without consent.
• Confirming a controlled medicine to police over the counter without a legal instrument when no mandatory pathway applies.
• Refusing all communication with a carer even when the patient is present and clearly wants the carer involved.
• Browsing My Health Record for a neighbour “just to practise.”
• Loud counselling of HIV, methadone, or mental-health medicines at a busy counter when a private area is available.

Protecting privacy is not obstructionism — it is core to patient-centred, lawful pharmacy practice and is examined as such.