Australia National Standard for Health Assessment of Rail Safety Workers 2024 2.6.6: Managing health information: comply with the Australian Privacy Principles and health records law; collect only information needed to assess fitness for duty and tell workers why, what is stored and where, their right of access, who may receive it and whether collection is required by law; use and disclose only for assessing and managing fitness or a directly related purpose, so the operator receives functional capacity and required controls and not diagnoses unless the worker consents; obtain voluntary, informed, specific and current consent before any third-party disclosure, including contact with treating doctors and recording consultations; restrict access to invoices and records that reveal conditions and keep them out of personnel files; allow Chief Medical Officer and auditor access under confidentiality; transfer reports between operators only with informed consent and after confirming the assessment level and attributes match; keep records secure, retained as the law requires, and arrange transfer of a departing practitioner's records; notify eligible data breaches; share interstate only where privacy law is similar

What does 2.6.6 require?

In administering assessments the rail transport operator and the Authorised Health Professional must comply with the Australian Privacy Principles and manage and store health records under the relevant health records legislation, including archiving, retention and destruction (some jurisdictions require at least seven years). The primary purpose of the assessments is to assess and manage rail safety workers' fitness for duty, so only information necessary for that is collected, the operator cannot ask the Authorised Health Professional to collect irrelevant information, and the worker is told why information is collected, what will be stored and where, that they can access it, to whom it may be disclosed and whether collection is required by law, as set out on the Worker Notification and Health Questionnaire. Information is used and disclosed only for the primary purpose or a directly related purpose the worker would reasonably expect, unless the worker consents: the operator needs to know how a condition might affect the job and what controls are needed, not usually the diagnosis, and the Authorised Health Professional reports only work capacity unless the worker allows more. Contact with the worker's general practitioner or specialist to clarify health status, and any recording of a consultation, requires the worker's written consent, which must be voluntary, informed, specific, current and given with capacity. Within the operator, layers of disclosure are managed so that diagnoses revealed through job modification discussions or invoices for tests are seen only by those who need them and never filed in the general personnel file. A Chief Medical Officer or an external auditor may obtain clinical records to assure quality or assist management, under assured confidentiality. A report may be transferred to another operator only with the worker's informed consent, and the receiving operator confirms that the assessment level and the specific health attributes required by the original operator equal or exceed those its tasks require, remembering that practical test results do not transfer. Records are kept current, protected from loss and unauthorised access and may be scanned; a repository accessible only to health professionals, the Chief Medical Officer and authorised personnel may be kept for continuity; when a practice ceases, records may be required to transfer to the Chief Medical Officer or another Authorised Health Professional. Workers access their records through the Authorised Health Professional. Interstate transfers occur only where privacy laws are similar, and eligible data breaches are notified under the Notifiable Data Breaches scheme.