Thank you for completing our survey
The 'privacy in practice feedback' survey included questions to test your knowledge about privacy obligations. Here are the answers to those questions:
| Question/statement | Answer |
| 1) I don’t need the patient’s consent to share information about the patient’s condition with another doctor within the treating team. | True. This is because sharing the information is directly related to the reasons why you obtained the information (for example, to provide healthcare to the patient), and so you do not need the patient’s specific consent. |
| 2) I can share a patient’s health information with their family whenever I believe it directly supports the patient’s care, even without the patient’s consent. | False. You must have the patient’s consent to share health information with their family, unless an exception applies such as that you consider there is a serious risk to the patient or someone else’s life, health or safety. In that situation, you should seek advice before disclosing any information. |
| 3) I received a telephone call from the police requesting information about my patient. I am obliged to provide this information to the police, even without the patient’s consent. | False. A verbal request is not sufficient to override the patient’s privacy and confidentiality and allow you to provide information to the police. The police should have the patient’s consent or a warrant, summons or other court order before you can provide information – unless an exception applies. |
| 4) If a child’s parents are separated, both parents can access their child’s medical records - unless a court order says otherwise. | True. Both parents have equal rights to request access to their child’s medical records unless there is a court order to the contrary (or the child is sufficiently mature to make their own healthcare decisions). If you’re unsure, you can ask the parents if there is any court order and obtain a copy if so. |
| 5) Information in a child's medical record that could pose a serious threat to the child or others can be withheld from a parent requesting access. | True. This information can be withheld, based on the exemption under privacy legislation where providing information poses a serious threat to the life, health or safety of the child (or someone else). |
| 6) The duty of confidentiality owed to a patient ends upon their death. | False. The duty of confidentiality continues after a patient’s death. Health information should be protected in the same way as when the patient was alive, including keeping the records secure and maintaining confidentiality. |
| 7) An immediate family member can always access a deceased patient's full medical records without any restrictions. | False. Generally, the executor or administrator of a patient’s estate has the authority to request access to a deceased patient’s medical records. |
| 8) A doctor working at a hospital receives a subpoena requesting a patient’s medical records. What should the doctor do? | Pass the subpoena on to the appropriate person in the hospital, such as the executive director of medical services or the legal team. The records relating to hospital treatment are owned and controlled by the hospital, not individual doctors, and so responding to the subpoena should be handled by the hospital. |
| 9) A doctor in private practice receives a subpoena requesting a patient’s medical records. What should the doctor do? | Discuss the subpoena with your practice manager and seek legal advice if unsure before responding. In a group practice, the medical records will usually be owned and controlled by the practice, not individual doctors, and so responding to the subpoena should be handled by the practice. If you are in sole practice, or know that you individually own the records, you can respond to the subpoena. |
| 10) One of the changes to the Privacy Act allows the OAIC (Office of the Australian Information Commissioner) to issue fines for lower level privacy breaches. | True. Compliance notices can be issued requiring individuals and organisations to fix breaches of the Australia Privacy Principles, such as not having a compliant privacy policy or failing to take reasonable steps to protect patient information. Infringement notices can be issued for failure to comply, with fines of up to $66,000 per contravention. Previously compliance action was focused on ‘serious and repeated’ privacy breaches. |
To see our educational resources on privacy, please visit Privacy in Practice: what you need to know - Avant.
If you wish to access this page at another time, please copy or bookmark this URL: https://avant.org.au/privacy-in-practice-feedback-survey-answers