If you work in a small practice or medical centre, there’s every chance you may not have received many requests for personal information from patients. The starting point is to know that the Privacy Act gives people the right to make a request for information that is about them.

Under the Privacy Act, your practice is legally obligated to respond to that request within 20 working days and to provide the information requested, although the law does allow reasons for withholding the information.

Giving access to information can take several forms. It can mean:

• giving a copy of a document
• giving a reasonable opportunity to look at a document, or listen to or view a recording
• giving a summary of the information
• providing a transcript
• giving the information orally – depending on the requester’s preference.

Pointers for responding to a complaint

Failing to respond to a request for personal information can result in a complaint from the requester to the Privacy Commissioner. We hope this never happens to you but in case it does, here are some pointers on how best to engage with us.

1. Talk to us and to tell us what you know about the complaint and the information that’s requested. Our aim is to try and resolve the matter to the satisfaction of both parties – the complainant and the respondent (your practice). We are not advocates for the complainant.
2. Observe is timeliness. Respond as promptly as you can to our requests for information. No one wins in a protracted complaints dispute. If a complaint drags on, it can become stressful, tiring and expensive for your practice and the complainant. There are many benefits in resolving a complaint to prevent it becoming a case before the Human Rights Review Tribunal.
3. Our goal is to resolve, not to punish. We’re here to mediate and we do this in a number of ways. One of the techniques we use is to call conferences between both parties, but we’d rather keep things less formal  and resolve them quickly, without a situation escalating.

Tell us in confidence

1. In order for us to review your decision to withhold information from a requester, we will almost always need to see the information.
2. When you send us the information, what we are doing is reviewing it to see if we agree with your reasons for not handing it over to the requester.
3. We are not allowed to disclose the information that is being reviewed and we do not disclose the information.

However, when you give us information to review, it will help us if you can tell us clearly what information is being withheld and the reasons why your practice wants to withhold it.

Disclosing information about a child to a non-custodial parent

One example is whether to disclose information about a child to a non-custodial parent. While section 22 of the Health Act permits parents and guardians to request their child’s health information, a health agency, such as a GP, can withhold health information where:

• the child does not want the information to be disclosed
• it would not be in the child's best interests to disclose the information
• one of the other withholding grounds in the Privacy Act applies.

Image credit: Blue and silver stethoscope via Pexels

health, Health Information Privacy Code, complaints

Back