Psychology Board of Australia Code of Conduct for Psychologists (2025) 3.3: 3.3 Privacy and confidentiality

Psychologists have ethical and legal duties to protect client privacy; clients can expect their information to be kept secure and confidential unless the law requires or authorises release or an emergency service needs it (the Australian Privacy Principles guide practical application). To protect privacy and confidentiality the psychologist should: (a) seek informed consent for information handling, namely (i) explain at the outset, and later as needed, where confidentiality ends and how information is likely to be used to clients and, where relevant, associated parties, (ii) before collecting information, tell clients how it will be stored, recorded and used, (iii) before disclosing it, explain to clients what is to be disclosed and why, (iv) get consent before using information gained in one role or relationship in another, (v) before gathering information from associated parties, tell the client what will be gathered, why, and how it will be stored, recorded and used, and (vi) get the associated party's own consent on the same explanation; (b) document the outcome of consent or agreement where possible; (c) provide surroundings that allow private consultations, especially with several people or in shared space, and otherwise consider sections 1.2 and 4.2; (d) collect only the personal information reasonably needed for the requested service and open records only when providing a service or otherwise authorised; (e) make sure staff and colleagues respect client privacy and do not discuss clients outside service needs; (f) know and apply state and territory privacy and health records law to information in every format, electronic included; (g) know that personal information in their care that is accessed or disclosed without authority may trigger legal obligations (the OAIC is the reference); (h) never disclose, transmit, share, reproduce or post anyone's information or images, even unnamed, without prior written informed consent; (i) recognise clients' right, with exceptions, to see their records and help them get access where legislation or local policy entitles them; and (j) on closing or moving a work setting, arrange for records to be transferred or managed in line with privacy and health records law.