Australia RACGP Standards for General Practices (5th edition) C6.3: Confidentiality and privacy of health information: patients are told how the practice manages their personal health information and how to access it; the practice transfers information in response to valid requests in a timely, authorised and secure way; and only authorised team members can reach health records, prescription pads and other official documents

What does C6.3 require?

Privacy is a legal duty under the Privacy Act and the Australian Privacy Principles as well as a professional one. The practice publishes a privacy policy describing what information it collects, why, how it is stored, who may see it and how it may be disclosed, and tells patients how they can ask for access to or correction of their record. When a valid request arrives, from the patient, another provider or someone with lawful authority, the practice verifies it, transfers only the relevant information, uses a secure method and acts without undue delay. Access to records, prescription pads, referral pads and similar documents is restricted to team members who need it, and staff sign confidentiality agreements.