Source: Privacy Commissioner
Rule 11 of the Health Information Privacy Code (HIPC) allows you to disclose health information if it is necessary to prevent or lessen a serious threat to the life or health of any person, or public health or safety (the serious threat exception). In each case, there are requirements that must be met for the serious threat exception to apply. If another piece of legislation requires or allows you to share the health information in question you should rely on that legislation rather than Rule 11.
Step 1: Have you received authorisation to share this information?
Authorisation means that the person whose health information it is has agreed that you can share the information. Authorisation can also be given by the individual’s representative if the individual is dead or unable to exercise their rights under the HIPC (e.g. due to a cognitive impairment which impacts decision making or very young age).
You should give the person as much information as possible about what information you will share, who you will share it with, and why.
If you receive authorisation, then you can share the information under Rule 11(1)(b), which permits disclosure when it is authorised by the individual or their representative.
If you don’t have authorisation, go to step 2.
Step 2: Is it reasonably practical to seek authorisation?
For the serious threat to life and health exception to apply, you need to have reasonable grounds to believe that it is not desirable or not practicable to get authorisation from the individual concerned. For example, if you have reasonable grounds to believe that seeking authorisation could increase the threat.
If it is reasonable for you to seek authorisation, you need to do so. If you ask for authorisation, but the individual does not authorise you to disclose the information, you need to consider why it was not given and whether it is appropriate to continue through the steps.
If it is not reasonably practical to seek authorisation, go to step 3.
Step 3: Is there a serious threat to the life or health of a person?
The serious threat exception applies to serious threats to:
- The life or health of the person whose information it is.
- The life or health of any other person.
- Public health or public safety.
When considering whether there is a serious threat, you need to use your clinical judgement to assess the likelihood of the threat occurring, the seriousness of the threat and the harm that could eventuate, and the imminence of the threat.
If the threat does not meet the “serious threat” threshold, you cannot rely on this exception.
If there is a serious threat, continue to step 4.
Step 4: Is the disclosure to someone who can help lessen or prevent the threat?
You can only disclose health information under the serious threat exception if you are sharing the information with someone who can help lessen or prevent the threat.
You can share only as much information as is needed to prevent or lessen the threat. You should record your decision making about who to share with and how much information to share.
The case note: Police were right to disclose mental health information is an example of how the serious threat exception could work in practice.
Download the content on this page in one document (opens to PDF, 350KB).
