{"id":"nsw:sl-2005-0327","name":"Health Records and Information Privacy Code of Practice 2005","slug":"health-records-and-information-privacy-code-of-practice-2005","collection":"regulation","jurisdiction":"nsw","status":"in_force","isInForce":true,"actNumber":"327 of 2005","makingDate":null,"administeringDepartment":null,"currentVersion":{"id":178621,"registerId":"nsw-nsw:sl-2005-0327-current","compilationNumber":null,"startDate":"2026-04-05","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Part 1","sectionType":"part","heading":"Preliminary","content":"# Part 1 Preliminary\n\nPart 1 Preliminary\n\n**pt 1, hdg:** Ins 2010 (234), Sch 1 \\[1\\].","sortOrder":0},{"sectionNumber":"1","sectionType":"section","heading":"Name of Code","content":"#### 1 Name of Code\n\n1 Name of Code\n\n> This Code is the [Health Records and Information Privacy Code of Practice 2005](/view/html/inforce/current/sl-2005-0327).","sortOrder":1},{"sectionNumber":"2","sectionType":"section","heading":"Commencement","content":"#### 2 Commencement\n\n2 Commencement\n\n> This Code takes effect on 1 July 2005.","sortOrder":2},{"sectionNumber":"3","sectionType":"section","heading":"Definition","content":"#### 3 Definition\n\n3 Definition\n\n> > (1) In this Code:\n> > \n> > the Act means the [Health Records and Information Privacy Act 2002](/view/html/inforce/current/act-2002-071).\n> \n> > (2) Notes included in this Code do not form part of this Code.\n> \n> **cl 3:** Subst 2010 (234), Sch 1 \\[2\\].","sortOrder":3},{"sectionNumber":"Part 2","sectionType":"part","heading":"Human services","content":"# Part 2 Human services\n\nPart 2 Human services\n\n**pt 2, hdg:** Ins 2010 (234), Sch 1 \\[3\\].","sortOrder":4},{"sectionNumber":"4","sectionType":"section","heading":"Collection, use and disclosure of health information by human services agencies","content":"#### 4 Collection, use and disclosure of health information by human services agencies\n\n4 Collection, use and disclosure of health information by human services agencies\n\n> > (1) In this clause:\n> > \n> > allied agency means an agency (other than a public sector agency) that is wholly or partly funded by a human services agency and that is approved in writing by the head of that human services agency as an allied agency for the purposes of this clause.\n> > \n> > human services agency means a public sector agency that provides any one or more of the following types of services to the public:\n> > \n> > > (a) welfare services,\n> > \n> > > (b) health services,\n> > \n> > > (c) mental health services,\n> > \n> > > (d) disability services,\n> > \n> > > (e) drug and alcohol treatment services,\n> > \n> > > (f) housing and support services,\n> > \n> > > (g) education services.\n> > \n> > senior officer means a senior member of staff of a human services agency who has been nominated in writing for the purposes of this clause by the head of that agency.\n> > \n> > substantial adverse impact includes, but is not limited to, serious physical or mental harm, significant loss of benefits or other income, imprisonment, loss of housing or the loss of a carer.\n> \n> > (2) Despite the Health Privacy Principles, a human services agency (the authorised agency) may collect and use health information about an individual, and may disclose health information about the individual to another human services agency or an allied agency, if the collection, use or disclosure is in accordance with a written authorisation given by a senior officer of the authorised agency.\n> \n> > (3) An authorisation under subclause (2) must specify:\n> > \n> > > (a) the period (maximum 12 months) for which the authorisation has effect, and\n> > \n> > > (b) the classes of health information to which the authorisation is to apply (the specified information), and\n> > \n> > > (c) the human services agencies or allied agencies (if any) to whom the specified information may be disclosed (the specified agencies).\n> \n> > (4) A senior officer may give an authorisation under subclause (2) only if the officer is satisfied that:\n> > \n> > > (a) the individual to whom the specified information relates is a person to whom services are provided or proposed to be provided by a human services agency or an allied agency, and\n> > \n> > > (b) the individual (or if the individual is incapable, within the meaning of section 7 (1) of the Act, of giving consent, the individual’s authorised representative) has failed to consent to the agency collecting or using the specified information, or disclosing the specified information to the specified agencies, and\n> > \n> > > (c) there are reasonable grounds to believe that there is a risk of substantial adverse impact on the individual or some other person if collection or use of the specified information, or disclosure of the specified information to the specified agencies, does not occur, and\n> > \n> > > (d) the collection or use of the specified information, or disclosure of the specified information to the specified agencies, is likely to assist in developing or giving effect to a case management plan or service delivery plan that relates to the individual, and\n> > \n> > > (e) reasonable steps have been taken to ensure that the individual has been notified by the agency of each of the following:\n> > > \n> > > > (i) the specified information,\n> > > \n> > > > (ii) the specified agencies,\n> > > \n> > > > (iii) the period for which the authorisation is proposed to be sought to have effect.\n> > > \n> > > Note—\n> > > \n> > > Notification under this paragraph would normally be in writing. However, other notification methods may be more appropriate in the case of certain clients. For example, if the client is illiterate.","sortOrder":5},{"sectionNumber":"Part 3","sectionType":"part","heading":"Domestic Violence Intervention Court Model","content":"# Part 3 Domestic Violence Intervention Court Model\n\nPart 3 Domestic Violence Intervention Court Model\n\n**pt 3 (cll 5–9):** Ins 2010 (234), Sch 1 \\[4\\].","sortOrder":6},{"sectionNumber":"5","sectionType":"section","heading":"Definitions","content":"#### 5 Definitions\n\n5 Definitions\n\n> In this Part:\n> \n> domestic relationship has the same meaning as in the [Crimes (Domestic and Personal Violence) Act 2007](/view/html/inforce/current/act-2007-080).\n> \n> domestic violence offence has the same meaning as in the [Crimes (Domestic and Personal Violence) Act 2007](/view/html/inforce/current/act-2007-080).\n> \n> person who has been charged with an offence has the same meaning as it has in the [Law Enforcement (Powers and Responsibilities) Act 2002](/view/html/inforce/current/act-2002-103).\n> \n> scheme—see clause 6.\n> \n> victim of domestic violence means a person who has been, or who is alleged to have been, the victim of a domestic violence offence.\n> \n> **pt 3 (cll 5–9):** Ins 2010 (234), Sch 1 \\[4\\].","sortOrder":7},{"sectionNumber":"6","sectionType":"section","heading":"The scheme","content":"#### 6 The scheme\n\n6 The scheme\n\n> > (1) In this Part:\n> > \n> > scheme means the scheme known as the Domestic Violence Intervention Court Model.\n> \n> > (2) The objects of the scheme are as follows:\n> > \n> > > (a) to ensure the safety of victims of domestic violence and persons in domestic relationships with those victims,\n> > \n> > > (b) to ensure that persons who have been charged with domestic violence offences are dealt with appropriately,\n> > \n> > > (c) to prevent persons who commit domestic violence offences from re-offending,\n> > \n> > > (d) to improve the coordination of services to victims of domestic violence and persons in domestic relationships with those victims,\n> > \n> > > (e) to ensure domestic violence matters are effectively managed throughout the criminal justice process.\n> \n> **pt 3 (cll 5–9):** Ins 2010 (234), Sch 1 \\[4\\].","sortOrder":8},{"sectionNumber":"7","sectionType":"section","heading":"Persons to whom Part applies","content":"#### 7 Persons to whom Part applies\n\n7 Persons to whom Part applies\n\n> This Part applies to the following persons:\n> \n> > (a) a person who has been charged with a domestic violence offence by a police officer in the Campbelltown, Macquarie Fields or Wagga Wagga Local Area Command within the NSW Police Force,\n> \n> > (b) a person against whom proceedings for a domestic violence offence have been commenced in (or moved or adjourned to) the Local Court at Campbelltown, Junee, Temora or Wagga Wagga,\n> \n> > (c) a victim of domestic violence in respect of an offence referred to in paragraph (a) or (b),\n> \n> > (d) a person in a domestic relationship with a victim referred to in paragraph (c).\n> \n> **pt 3 (cll 5–9):** Ins 2010 (234), Sch 1 \\[4\\].","sortOrder":9},{"sectionNumber":"8","sectionType":"section","heading":"Non-compliance with certain health privacy principles","content":"#### 8 Non-compliance with certain health privacy principles\n\n8 Non-compliance with certain health privacy principles\n\n> A public sector agency, or private sector person, that participates in the scheme is not required to comply with Health Privacy Principle 1 (1), 2, 3, 4, 6, 8, 10 or 11 in respect of the collection, holding, use or disclosure of health information about a person to which this Part applies, if that collection, holding, use or disclosure is:\n> \n> > (a) for the purposes of the scheme, and\n> \n> > (b) done in accordance with the privacy procedures for the scheme that are approved by the Attorney General from time to time.\n> \n> **pt 3 (cll 5–9):** Ins 2010 (234), Sch 1 \\[4\\].","sortOrder":10},{"sectionNumber":"9","sectionType":"section","heading":"Access to health information","content":"#### 9 Access to health information\n\n9 Access to health information\n\n> > (1) A public sector agency that participates in the scheme is not required to comply with Health Privacy Principle 7 in respect of health information about a person to which this Part applies that is held for the purposes of the scheme, unless the person is a victim of domestic violence.\n> \n> > (2) A private sector person that participates in the scheme is not required to comply with Divisions 3 and 4 of Part 4 of the Act in respect of health information about a person to which this Part applies that is held for the purposes of the scheme, unless the person is a victim of domestic violence.\n> \n> **pt 3 (cll 5–9):** Ins 2010 (234), Sch 1 \\[4\\].","sortOrder":11}],"analysis":{"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"},"summary":{"complexity_score":5,"scope_assessment":{"changed":false,"description":"Based on the available metadata, there is no indication that the scope of this Code changed materially from its original intent. The 2010 amendment appears to be a refinement rather than a fundamental expansion or contraction of the Code's coverage. It remains focused on health records and information privacy in NSW as originally designed."},"complexity_factors":["Operates as a subsidiary instrument (code of practice) beneath a parent Act, requiring readers to understand both layers of law simultaneously","Health privacy law intersects with multiple other legal frameworks (medical law, data protection, administrative law, research ethics)","Exceptions and modifications to the Health Privacy Principles can be difficult to navigate without legal training","The full substantive content of the Code was not available in the provided text, limiting complete analysis","Has been in force since 2005 with a 2010 amendment, meaning practitioners must be aware of which version applies to historical events","Applies across a broad and diverse range of organisations, making applicability assessments context-dependent"],"plain_english_summary":"This NSW Code of Practice, made under the Health Records and Information Privacy Act 2002, gives practical rules for how organisations must handle personal health information. It guides application of the Health Privacy Principles across healthcare providers and private organisations (e.g., insurers, employers), and may modify rules for activities like research, law enforcement, or public health.\n\nIt protects patients’ control over sensitive medical information and enables complaints or enforcement by the NSW Privacy Commissioner."},"issue_detection":{"absurdities":[],"contradictions":[]},"kimi_summary":{"content_quality":"ok","complexity_score":4,"scope_assessment":{"changed":true,"description":"The original 2005 Code appears to have been a simpler instrument (only Part 1 and Part 2 existed originally). Part 3 was inserted in 2010, significantly expanding the Code's scope from human services information sharing to also cover criminal justice and domestic violence court proceedings. This represents a material expansion beyond the original health and welfare context into law enforcement and court administration."},"complexity_factors":["Multiple nested conditions in Part 2 (clause 4): five separate preconditions must all be satisfied before information can be shared without consent","Cross-references to three other Acts (Health Records and Information Privacy Act 2002, Crimes (Domestic and Personal Violence) Act 2007, Law Enforcement (Powers and Responsibilities) Act 2002)","Defined terms with internal conditions (e.g., 'substantial adverse impact' includes illustrative but non-exhaustive list)","Geographic and jurisdictional limitations in Part 3 (specific Local Area Commands and Local Courts only)","Asymmetric privacy protections in Part 3 (different rules apply depending on whether person is a victim vs offender/family member)","Delegated authority requiring written approvals (senior officers, Attorney General approved procedures)"],"plain_english_summary":"This Code creates special exceptions to NSW health privacy laws for two specific situations where strict privacy rules would get in the way of helping vulnerable people.\n\n**What it does:**\nNormally, the *Health Records and Information Privacy Act 2002* (NSW) sets strict rules about how government agencies and health providers can collect, use, and share your health information. This Code carves out two exceptions:\n\n**Part 2 – Human Services:**\n- Lets \"human services agencies\" (government bodies providing welfare, health, mental health, disability, drug/alcohol, housing, or education services) share a person's health information with each other or with funded partner organisations (\"allied agencies\").\n- This can only happen when:\n  - The person refuses to consent or can't consent;\n  - There's a real risk of serious harm to them or someone else (like losing housing, income, or a carer, or physical/mental harm);\n  - Sharing the info would help create a care plan for them;\n  - A senior officer gives written approval for up to 12 months; and\n  - The person has been told what information will be shared, with whom, and for how long.\n\n**Part 3 – Domestic Violence Intervention Court Model:**\n- Applies to a specific court program running in Campbelltown, Macquarie Fields, Wagga Wagga, and nearby courts.\n- Lets agencies and private organisations involved in this program ignore most health privacy rules when handling information about alleged domestic violence offenders, victims, and their family members.\n- However, **victims keep their full privacy rights** – they can still access their own records and agencies must still follow privacy rules for them.\n\n**Who it affects:**\n- People receiving services from NSW human services agencies who can't or won't consent to information sharing;\n- People involved in domestic violence cases in the specified court locations (offenders, victims, and family members);\n- Government agencies and funded non-profits working in these areas.\n\n**Why it matters:**\nThis Code tries to balance privacy with safety. It recognises that sometimes rigid privacy laws stop agencies from protecting vulnerable people – for example, when someone with a mental illness is about to lose their housing, or when courts need to coordinate services for domestic violence cases. However, it also creates significant privacy risks by allowing information sharing without consent, which is why it has strict safeguards (senior officer approval, time limits, notification requirements) and protects victims' rights specifically."},"flash_summary":{"complexity_score":6,"scope_assessment":{"changed":true,"description":"The text shows later insertions (noted Ins 2010 (234), Sch 1) that add a human services authorisation regime (Part 2, cl 4) and a Domestic Violence Intervention Court Model with targeted privacy exemptions (Part 3, clls 5–9). Those insertions expand the Code’s operational scope by creating authorisation powers, inter‑agency sharing rules and statutory exemptions to several Health Privacy Principles for scheme participants (see cl 4, cl 8 and cl 9)."},"complexity_factors":["Multiple defined categories and cross‑references to other Acts (Act; domestic relationship; domestic violence offence) — (cl 3(1); pt 3 cl 5).","Discretion vested in a nominated senior officer to grant written authorisations subject to several substantive and procedural conditions — (cl 4(2)–(4)).","Time‑limited, class‑based authorisations (maximum 12 months) that must specify classes of information and recipient agencies — (cl 4(3)).","Safety‑based threshold for overriding consent: ‘reasonable grounds’ to believe risk of substantial adverse impact — (cl 4(4)(c)).","Notification requirement to the individual or authorised representative before authorisation, with flexibility for mode of notice — (cl 4(4)(e)).","Definition and approval process for allied agencies (funding and written approval by head of agency) adds an inter‑organisational layer — (cl 4(1)).","Targeted statutory exemptions from specified Health Privacy Principles for scheme participants, subject to approved privacy procedures — (cl 8).","Different access rules for public and private sector participants and carve‑outs for victims under access provisions — (cl 9(1)–(2)).","Requirement that scheme privacy procedures be approved by the Attorney General, creating external procedural control — (cl 8(b)).","Geographically and procedurally limited application (specific local area commands and local courts listed) which narrows scope but increases complexity of applicability — (pt 3 cl 7)."],"plain_english_summary":"This Code sets rules for when NSW human services agencies and participants in a Domestic Violence Intervention Court Model can collect, use or share people’s health information. It lets senior officers authorise time‑limited sharing of specified health data (up to 12 months) without consent where there is a risk of substantial harm, and it creates limited exemptions from several Health Privacy Principles for scheme participants. Agencies make the sharing decisions and bear the compliance and administrative costs; individuals’ access and privacy protections can be reduced under the Code."}},"importantCases":[],"_links":{"self":"/api/acts/health-records-and-information-privacy-code-of-practice-2005","history":"/api/acts/health-records-and-information-privacy-code-of-practice-2005/history","analysis":"/api/acts/health-records-and-information-privacy-code-of-practice-2005/analysis","conflicts":"/api/acts/health-records-and-information-privacy-code-of-practice-2005/conflicts","importantCases":"/api/acts/health-records-and-information-privacy-code-of-practice-2005/important-cases","documents":"/api/acts/health-records-and-information-privacy-code-of-practice-2005/documents"}}