Ahpra Shared Code of Conduct (2022) 3.3: 3.3 Confidentiality and privacy

The practitioner has ethical and legal duties to protect patient privacy and keeps patient information in confidence unless release is required or authorised by law or needed for emergency care. Good practice means the practitioner: (a) seeks informed consent before disclosing information and documents it formally where possible; (b) provides surroundings that allow private consultations, including in shared spaces or group work; (c) never accesses records without professional involvement in the person's care or other authority; (d) makes sure all staff respect confidentiality and do not discuss patients outside a professional context; (e) knows and applies the privacy and health records legislation of the relevant state or territory to information in every format, electronic included; (f) seeks advice about disclosure of genetic information, given its complexity; (g) does not transmit, share, reproduce or post anyone's information or images, even unnamed or unidentified, without first obtaining written informed consent (Ahpra's social media guidance applies); (h) recognises and helps with a patient's right to access their records and promptly facilitates transfer when the patient asks, under local policy; and (i) arranges transfer or management of all health records under privacy and health records law when closing or relocating a practice.