The Act rests on a small set of core legal concepts that determine scope and operation.

• Health information. Defined comprehensively to include information or an opinion about physical, mental or psychological health, disability, expressed wishes about future health services, information about services provided or to be provided, personal information collected to provide health services, donation‑related information and genetic information predictive of health, provided such information is also personal information (s 3(1), definition of "health information"). The definition also allows classes of health information or documents to be prescribed as exempt.
• Organisation. An organisation to which the Act applies can be a public sector organisation (s 10) or a private sector organisation (s 11) that is a health service provider or that collects, holds or uses health information. The Act lists the public bodies covered and enables the Governor in Council to declare additional bodies subject to the Act (s 10).
• Health Privacy Principles (HPPs). The HPPs provide the substantive privacy rules. They are located in Schedule 1 and cover collection (HPP 1), use and disclosure (HPP 2), data quality (HPP 3), data security and retention (HPP 4), openness (HPP 5), access and correction (HPP 6), identifiers (HPP 7), anonymity (HPP 8), transborder data flows (HPP 9), transfer/closure of practice (HPP 10) and making information available to another provider (HPP 11) (Sch 1).
• Right of access. Individuals have a statutory right to access health information about themselves held by health service providers and other organisations, subject to specified exceptions and procedures (s 25; Sch 1 HPP 6).
• Complaints and enforcement architecture. The Health Complaints Commissioner is the primary decision maker for complaints, conciliation and investigations (Part 6, ss 45-66, 87). The Tribunal (VCAT) hears matters referred by the Commissioner, accepts referrals by complainants or respondents, and may make orders including compensation up to specified monetary limits (ss 74-78).
• Exemptions and inter‑Act relationships. The Act contains express exemptions for personal or household affairs (s 13), judicial and quasi‑judicial functions (s 14), Royal Commissions and inquiries (s 14A), various statutory information sharing schemes (ss 14B-14F), publicly available information (s 15) and operations under the Freedom of Information Act (s 16). It declares that other Acts prevail where inconsistent (s 7).
• Administrative discretion over guidelines and exemptions. The Health Complaints Commissioner may issue or approve guidelines that affect how HPPs operate, including the ability in limited circumstances to lessen a privacy protection if the Commissioner is satisfied the public interest in the guideline substantially outweighs privacy (s 22(5)). The Commissioner may also grant limited transitional exemptions in particular circumstances (s 21(4)-(6)).

These concepts interact: for example, the right of access (s 25; HPP 6) is qualified by specific exceptions in both Part 5 and HPP 6, the collection rules (HPP 1) only apply to information collected after a specified commencement for some subclauses (s 20), and the Commissioner’s guidelines can alter the practical application of several HPP subparagraphs (s 22). The Act treats enforcement as largely administrative and tribunal‑based rather than by private tort claims (s 8).

The Act identifies classes of persons and bodies that are regulated, and those that are not.

• Public sector organisations. The Act applies to Ministers, Parliamentary Secretaries, members of Parliament, public sector agencies and Councils, bodies established for public purposes, courts and tribunals, Victoria Police and specified hospitals and other bodies declared by Governor in Council, to the extent they are health service providers or collect, hold or use health information (s 10(1), (2), (3)). The Governor in Council may declare additional bodies by Order (s 10(2)). Notably, agencies within the meaning of the Commonwealth Privacy Act 1988 are excluded from application (s 10(5)).
• Private sector organisations. Natural persons, corporations, partnerships, trusts and other unincorporated bodies that are health service providers or that collect, hold or use health information fall within the Act (s 11). Again, entities covered by the Commonwealth Privacy Act are excluded (s 11(4)).
• Health service providers. The Act defines "health service" broadly (s 3(1)), and a "health service provider" is an organisation that provides a health service in Victoria (s 3(1)). The HPPs and Part 5 access provisions specifically address duties and powers of health service providers, for example HPP 4.2 on retention and HPP 11 on making information available to another provider.
• Individuals and authorised representatives. Individuals have rights of access and correction (s 25; Sch 1 HPP 6). Where the individual is incapable, authorised representatives (defined in s 85(6)) may act in certain circumstances (s 85(1)-(6)). Children and persons with impairments may complain under special rules that allow others to bring complaints on their behalf (s 47).
• Third party recipients and researchers. HPP 2 permits use or disclosure to third parties for secondary purposes in a limited set of circumstances (Sch 1 HPP 2.2); research use is specifically addressed with conditional gateways and guideline dependency (Sch 1 HPP 1.1(e), 2.2(g)).
• Outsourced service providers. State contracts do not absolve the outsourcing organisation; acts or practices by outsourced service providers may be taken to have been done by the outsourcing organisation if enforcement against the outsourced provider is not available under the Act (s 12(1)). Section 92(1) (protection from liability) does not apply to an outsourced service provider acting within a State contract (s 12(2)).
• The Crown. The Act binds the Crown in right of Victoria (s 9(1)); however it provides that nothing makes the Crown in any capacity liable to be prosecuted for an offence (s 9(2)).
• News media and public registers. The Act provides carve outs for news media acting in the course of news activities (s 17) and for generally available publications or public registers (s 15), subject to qualifications where the information was obtained in contravention of the Act.
• Law enforcement and specified statutory information sharing bodies. A range of information sharing regimes are carved in or out by specific provisions (ss 14B-14F). HPPs may not apply or apply in modified form to collection or use done under these other Acts.

Who decides: organisations must comply with HPPs and the Part 5 access procedures. The Health Complaints Commissioner decides on complaints, issues guidelines and may serve compliance notices (ss 22, 45, 64, 66, 87). Complainants or respondents may require referral to the Tribunal under specified timeframes (ss 51(5), 57(1), 63(3), 65(1)). Prosecutors for offences may be a police officer, the Health Complaints Commissioner or a person authorised by the Commissioner (s 94).

Who pays: organisations bear the operational costs of compliance, including recordkeeping, responding to access requests within 45 days (s 34(2)), taking reasonable steps for data quality (HPP 3.1) and security (HPP 4.1). Organisations may charge prescribed maximum fees for providing access in some circumstances (s 32), but the Act disallows fees in particular contexts such as access by persons to mental health records held after provision of mental health and wellbeing services (s 32(2A)). The regulations may prescribe maximum fees and retention periods (s 100).

The Act places specific duties on organisations and confers rights on individuals. The duties are primarily framed through the HPPs and Part 5 access rules.

• Duty not to interfere with privacy. Organisations must not do acts or engage in practices that amount to an interference with privacy, defined as breach of Part 5 or an HPP, breach of HPP 7 in relation to an identifier, or failure to provide access (s 21 and s 18). Subsection 21(2) provides a defence where compliance would contravene other law.
• Collection rules. HPP 1 requires organisations to collect health information only when necessary for functions or activities and only when at least one lawful basis applies: consent, legal authorisation, necessity to provide health services to incapable persons, specified disclosures, research in the public interest subject to Commissioner guidelines, preventing serious threats, law enforcement necessity, legal claims, or prescribed circumstances (Sch 1 HPP 1.1). HPP 1.2 requires lawful and fair means; 1.3 prefers collection from the individual where practicable; and 1.4-1.5 require reasonable steps to ensure individuals are informed about identity, purposes, disclosure recipients, legal requirements and consequences of not providing information.
• Use and disclosure limits. HPP 2.1 permits use and disclosure for the primary purpose. HPP 2.2 sets exhaustive secondary purpose gateways where use or disclosure is permitted, including directly related and reasonably expected uses, consent, legal authorisation, necessity for further health services, funding, management and research under conditions and guidelines (Sch 1 HPP 2.2). Disclosure in suspected unlawful activity or for law enforcement functions is permitted with recordkeeping obligations (HPP 2.3).
• Data quality, security and retention. HPP 3.1 requires reasonable steps to ensure accuracy, completeness, currency and relevance. HPP 4.1 requires reasonable steps to protect health information from misuse, loss and unauthorised access. HPP 4.2 prohibits deletion of health information by a health service provider except under prescribed conditions or after specified retention periods (child records until age 25 or seven years after last service, whichever is later) and subject to the regulations (Sch 1 HPP 4.2-4.3).
• Openness and notice. Organisations must publish a document setting out policies and steps for access (HPP 5.1) and must, on request, notify individuals whether they hold health information and the nature and uses of that information (HPP 5.2).
• Access and correction rights. Individuals have a statutory right to access their health information (s 25; HPP 6.1). The Act sets out methods of access including inspection, copies, printouts and explanation by a suitably qualified provider (s 28; Sch 1 HPP 6.1-6.2). Organisations must respond to requests within 45 days and must provide written reasons for refusal (s 34(2); Sch 1 HPP 6.10). HPP 6.5 requires organisations to correct information that is inaccurate, incomplete, misleading or not up to date; HPP 6.6-6.9 provide mechanisms where correction is refused or complicated, including associating the individual’s statement with the record, and notifying other providers who have relied on the information.
• Identifiers and transborder transfers. HPP 7 limits assignment and adoption of identifiers (Sch 1 HPP 7). HPP 9 limits transfer of health information outside Victoria to prescribed bases, including recipient expectations of similar rules or consent (Sch 1 HPP 9.1).
• Procedural duties when refusing access. Part 5 prescribes grounds for refusal such as where providing access would pose a serious threat to life or health (s 26; HPP 6.1(a)), where information is given in confidence (s 27; HPP 1.7), where it would unreasonably impact on third party privacy (HPP 6.1(b)), existing legal proceedings and privilege (HPP 6.1(c)), and other specified grounds (Sch 1 HPP 6.1). There is a procedure for nomination of an independent suitably qualified health service provider to assess refusal on health‑risk grounds (ss 36-42).
• Duties of notice and recordkeeping. Organisations must make written notes of particular deletions, transfers and specific disclosures (HPP 4.3-4.4; HPP 2.3).
• Compliance and remedial duties. If the HCC rules a contravention, it will specify remedial action and a timeframe; the organisation must report compliance and may be required to extend time on application (s 64). The HCC may also serve compliance notices for serious or repeated contraventions (s 66).

Rights and limits: s 8 limits private causes of action, so remedies are to be sought through the Act’s procedures. The Tribunal can award compensation up to specified limits for proven contraventions (s 78(1)(a)(iv)) and may order corrections or restraining orders (s 78).

Enforcement is primarily administrative, tribunal‑based and criminal for specified offences.

• Administrative enforcement by the Health Complaints Commissioner. The HCC may conciliate complaints (Part 6 Div 3, s 59), investigate and make rulings (s 64), serve compliance notices where contraventions are serious or repeated (s 66), obtain documents and information (ss 60, 67) and refer matters to the Tribunal (ss 52, 65). The HCC’s functions and powers are detailed in ss 87-88.
• Tribunal jurisdiction and orders. The Tribunal (VCAT) hears complaints referred by the HCC, the Minister or complainants/ respondents and may make orders: require access to be provided, restrain repetition of an act or practice, order specific remediation, award compensation up to $100,000 for loss or injury to feelings or humiliation, order reimbursement of expenses and make orders in relation to public registers (ss 74-78). The Tribunal may also make interim orders pending hearing (s 73).
• Compliance notices and statutory penalties. The HCC can serve a compliance notice where it appears an organisation has contravened the Act and the act is serious or has occurred at least five times in two years (s 66(1)). Non‑compliance with a compliance notice is an offence: for bodies corporate the penalty is 3,000 penalty units; for any other case 600 penalty units; and the offence is indictable (s 71(1)(note provides amounts). A compliance notice does not take effect until specified review and appeal periods have expired or review proceedings are finalised (s 71(2)).
• Criminal offences. Part 7 establishes specific offences with corresponding penalties (ss 79-84). Examples include unlawfully requiring consent by threat or false representation (s 80), unlawful destruction or removal of health information with intent to evade the Act (s 81), unlawfully requesting or obtaining access by threat or false representation (s 82) and persuading a person not to exercise rights under the Act by threat or false representation (s 83). Penalty units for corporate and other offenders are specified at the foot of those provisions.
• Investigative powers. The HCC may compel production of documents and attendance for questioning (ss 60, 67), examine witnesses under oath (s 69), and must respect certificates provided under s 60(3) and s 67(3) where disclosure would produce FOI‑exempt information. Protection against self‑incrimination is provided (s 70). Failure to attend or provide required information without reasonable excuse is an offence (s 84).
• Who may prosecute. Proceedings for offences may only be brought by a police officer, the Health Complaints Commissioner or a person authorised by the Commissioner (s 94). The Act presumes authority of the person bringing proceedings unless evidence shows otherwise (s 94(2)).
• Other enforcement levers. The HCC may publish reports and make recommendations to Ministers; guidelines issued by the HCC may be disallowed by Governor in Council (s 24); the HCC may report orders relating to public registers to responsible Ministers (s 78(3)).

Limits and interaction. The Act states that it does not create civil causes of action outside its procedures (s 8). The Crown is bound but not prosecutable for offences under the Act (s 9). Where other Acts are inconsistent the other Act prevails (s 7).

The Act contains multiple express cross‑references and carve outs that shape its interaction with other statutes and regimes.

• Primacy and inconsistency rule. The Act declares that if a provision made under it is inconsistent with a provision made under any other Act, the other provision prevails to the extent of the inconsistency (s 7(1)). That is the baseline rule.
• Freedom of Information. The Act expressly preserves the operation of the Freedom of Information Act 1982: Part 5 and specified HPPs do not apply to documents of agencies within the FOI Act or official documents of Ministers, except as otherwise provided by that Act; access or correction in relation to those documents can only be sought under FOI procedures (s 16). The HCC may advise complainants to use FOI where appropriate (s 51(4)).
• Specified statutory information‑sharing regimes. The Act disapplies or modifies HPPs where information is collected or used under other Victorian statutes. Examples include information sharing under the Family Violence Protection Act 2008 (s 14B), the Child Wellbeing and Safety Act 2005 (s 14C), quality and safety information sharing under the Health Services Act 1988 (s 14D), the Terrorism (Community Protection) Act 2003 (s 14E) and the Electronic Patient Health Information Sharing System under the Health Services Act 1988 (s 14F). These provisions either exempt specific HPP obligations or limit their application for the purposes of those regimes, sometimes subject to guidelines or conditions.
• Courts, tribunals and inquiries. The Act does not apply to judicial or quasi‑judicial functions of courts or tribunals and their registries (s 14). Royal Commissions, Boards of Inquiry and Formal Reviews are similarly excluded when acting in the performance of their functions (s 14A).
• Legal professional privilege. The Act expressly does not apply to documents subject to legal professional privilege or client legal privilege, and does not affect laws of privilege (s 96). HPP 6.1(c) also cross‑references this point.
• Commonwealth Privacy Act. The Act excludes agencies that fall within the Commonwealth Privacy Act 1988 from application (s 10(5), s 11(4)). The Act also allows referral of complaints to the Federal Privacy Commissioner or Information Commissioner in cases where alternate remedies under other Acts are available (s 51(3)).
• Regulatory and administrative overlap. Complaints that could properly be the subject of other regulatory regimes (for example the National Disability Insurance Scheme Act, Privacy and Data Protection Act 2014 or Ombudsman matters) may be referred to those bodies and the HCC must notify the parties (s 51(3) and s 51(3)(d)). The HCC may also liaise with registration boards about complaints involving registered health practitioners (ss 52, 55, 64(6)).
• Contracts and State outsourcing. The Act treats acts or practices by outsourced service providers under State contracts as having been done by the outsourcing organisation where enforcement cannot be brought against the outsourced provider under the Act (s 12(1)). The Act also makes it a term of a contract for provision of health services that the provider will allow access to health information in accordance with the Act (s 44(1)), and voids contract terms that attempt to exclude this obligation (s 44(4)).
• Regulations and delegated instruments. The Governor in Council may make regulations prescribing maximum fees, retention periods, and other necessary matters (s 100). The HCC may issue guidelines under s 22 that modify application of certain HPPs; the Governor in Council may disallow such guidelines (s 24).
• Tribunal remedies vs common law. The Act curtails creation of private causes of action outside its procedures (s 8). Remedies therefore sit largely with the HCC and the Tribunal, subject to specific offences and prosecutions (Part 7, s 94).

These interactions create an architecture where the Act sits alongside FOI, other Victorian statutes that authorise information sharing, Commonwealth privacy coverage and regulatory registration frameworks. The Act both defers to and conditions its operation where other laws apply, and provides administrative pathways for coordination or referral (for example, s 51(3) and s 52).

The version provided incorporates amendments to 7 February 2024 and includes extensive amendment items recorded in the Act’s endnotes and Table of Amendments. The Act has been updated over time to add definitions, adjust scope and cross‑links, and to accommodate new statutory regimes. The endnotes list the principal amending Acts and the affected provisions, including but not limited to:

• Amendments to definitions and coverage linked to the National Registration framework and health practitioner regulation (e.g. Health Professions Registration Act 2005; Statute entries cited in the Table of Amendments).
• Integration with other privacy and information regulators and statutes, for example the Privacy and Data Protection Act 2014 and Freedom of Information Amendment (Office of the Victorian Information Commissioner) Act 2017, reflected as changes to sections and cross‑references (see entries for No. 60/2014 and No. 20/2017).
• Additions to the exemptions and information‑sharing carve outs responding to new statutory schemes: Family Violence Protection Act amendments (No. 23/2017), Child Wellbeing and Safety Act amendments (No. 11/2018), Terrorism (Community Protection) Act amendments (No. 47/2021), Health Services Act Electronic Patient Health Information Sharing System (No. 4/2023).
• Changes to definitions and operational provisions to reflect other sectoral reforms, for example the Mental Health and Wellbeing Act 2022 (No. 39/2022) which introduced the concept of a "health information statement" and specific guidance for mental health and wellbeing service providers (s 22(1A); Sch 1 references; entries in amendment table).
• Transitional and technical amendments such as those related to courts, tribunals, and other administrative machinery (various amending Acts and statutory entries cited in the endnotes table).

The Act’s endnotes include an extensive table of amendments listing assented Acts, commencement dates and which provisions of this Act were affected. The Act therefore shows a pattern of iterative amendment to accommodate new information sharing laws, other regulators and administrative frameworks. The Commissioner’s powers to issue guidelines and the Governor in Council’s power to disallow such guidelines remain mechanisms that permit administrative adaptation without primary‑law amendment (ss 22-24). The Act also expressly preserves the effect of later or inconsistent laws by the general inconsistency rule (s 7).

When consulting the Act for current operational detail, users should consult the version note and the Table of Amendments set out in the statutory endnotes to identify which provisions changed, when they took effect and the context of each change. The text as supplied shows amendment entries across many years and multiple Acts; the HPPs and Part 5 were the subject of major commencement staging when the Act was brought into force (Endnotes, Commencement summary).

The text of the Act, as provided, contains no citations to judicial decisions or recorded litigation history. It does not reference any cases or appellate decisions. The Act’s enforcement and remedial architecture is administrative and tribunal‑centric, which shapes the typical dispute pathway:

• Complaints are lodged with the Health Complaints Commissioner and may be conciliated, investigated and ruled on (Part 6, ss 45, 59, 64). The Commissioner may serve compliance notices where contraventions are serious or repeated (s 66).
• Parties may require referral to the Victorian Civil and Administrative Tribunal (Tribunal) under specified timeframes once the Commissioner decides not to entertain a matter, declines conciliation, or issues a ruling (ss 51(5), 57(1), 63(3), 65(1)). The Tribunal has explicit power to hear complaints referred under the Act and to make orders including access, injunctions restraining repetition of acts, corrective actions, compensation up to specified limits and reimbursement of expenses (ss 74-78).
• There are criminal offences in Part 7 (ss 79-84) that may be prosecuted by a police officer, the Health Complaints Commissioner or a person authorised by the Commissioner (s 94). Section 94 addresses who may bring proceedings but the Act does not supply case law or decisions interpreting particular provisions.

Because s 8 states that nothing in the Act gives rise to any civil cause of action outside its procedures, litigants seeking redress in courts will generally proceed through the HCC and Tribunal routes, or by criminal prosecution for specified offences where statutory thresholds are met. Judicial authority interpreting the Act is not included in the provided text; practitioners will need to search case law databases or tribunal decisions to locate and analyse VCAT and court decisions interpreting the Act, its HPPs and procedural provisions.

In short, the Act sets out administrative and tribunal processes as primary enforcement routes and provides for criminal prosecutions in specific circumstances; the printed statute contains no litigation history to report.

The Act contains multiple technical traps and transitional details that can catch practitioners or organisations unaware if not read closely.

• No private tort cause of action outside the Act. Section 8 makes clear that the Act does not create civil causes of action other than through the Act’s procedures. That shifts remedy avenues to HCC rulings, compliance notices and VCAT orders rather than ordinary common law claims.
• Timing of application of certain HPPs. Section 20 limits the temporal reach of particular HPPs: HPP 1 applies only to health information collected after the commencement of that section; HPP 3 applies to collection only after commencement for certain aspects; HPP 6 applies to health information as specified in s 25. Organisations handling historical records must map which principles apply to which records (s 20).
• Confidential third‑party information. HPP 1.7 and s 27 create a confidentiality exception where information is given in confidence to a health service provider by someone other than the individual, with a request that it not be communicated to the individual. That creates a specific ground to refuse access and tight obligations on recording and handling such information (Sch 1 HPP 1.7; s 27).
• Delegated discretion via guidelines. The Health Complaints Commissioner can issue guidelines that modify application of HPPs and, subject to a public interest test, may lessen privacy protections if satisfied the public interest in the guideline outweighs privacy (s 22(5)). Organisations must track Commissioner guidelines because they can materially change how HPPs are applied in practice.
• Outsourcing and joint liability. Section 12 treats certain acts or practices by outsourced service providers under State contracts as if done by both the outsourcing organisation and the outsourced service provider where the act cannot be enforced against the outsourced provider under the Act. Organisations entering State contracts must be aware that outsourcing does not necessarily shift enforcement exposure.
• Record retention and deletion rules. HPP 4.2 imposes strict rules against deletion of health information, including specific minimum retention periods for records created when the individual was a child and a general seven year rule after the last occasion of service. Deletion outside the regulation or prescribed circumstances can breach the Act; deletions that do occur must be documented under HPP 4.3.
• Access timeframes and procedures. The organisation must respond within 45 days to a request for access (s 34(2)). If charging a fee, the organisation must notify the individual and provide access within 7 days after payment or within 45 days after the request, whichever is later (s 34(2)(b)). Failure to meet timing or to specify reasonable times and places can be treated as refusal (s 35).
• Mental health records fee prohibition. Section 32(2A) prohibits mental health and wellbeing service providers from charging a fee for providing access to health information held because of providing a mental health and wellbeing service. That is a specific carve‑out from the general fee regime.
• Interaction with FOI and privileged materials. Section 16 tightly links Part 5 and HPP 5.2 to FOI for documents of FOI agencies or Ministerial official documents. Also, s 96 preserves legal professional privilege, which affects access and correction outcomes (Sch 1 HPP 6.1(c); s 96).
• Consequences for obstructing HCC functions. Offences relating to failure to attend, refusing to give information, obstruction or furnishing false information carry penalties (s 84). Organisations and individuals should be cautious about obstructing HCC inquiries.
• Compliance notice thresholds. The HCC may serve compliance notices only where contraventions are serious or flagrant or have occurred at least five times in two years (s 66(1)). Compliance notices carry significant statutory penalties if breached (s 71). Organisations should treat service of a compliance notice as a high‑risk event.
• Exemptions for information sharing laws. Several HPPs do not apply, or apply in modified form, where other statutes authorise or require collection or disclosure (ss 14B-14F). Practitioners must map statutory information sharing obligations against HPP obligations to avoid conflicts.
• Limit on Crown prosecution. Section 9(2) prevents prosecution of the Crown. Organisations should be mindful of differing exposure between private contractors and Crown actors.

Each of these "gotchas" is anchored in a particular provision; practitioners should check the exact subsection cited above when advising clients or auditing compliance.

Concrete steps organisations should take to align with the Act and reduce enforcement risk, grounded in its provisions.

• Map scope and applicability. Determine whether the entity is an organisation under ss 10 or 11 by assessing whether it is a health service provider or collects, holds or uses health information. Check whether the entity is excluded because it is an agency under the Commonwealth Privacy Act 1988 (s 10(5); s 11(4)).
• Adopt, publish and maintain policies. HPP 5.1 requires clear, published policies on management of health information and steps for access. Ensure a publicly available document sets out identity, contact point, access steps and complaints processes (Sch 1 HPP 5.1-5.2; s 22 guidance powers).
• Train staff and implement operational procedures. Train personnel on HPP 1 collection rules, HPP 2 use/disclosure gates, HPP 4 security and retention, HPP 6 access/correction, and the process for handling requests within Part 5 (Sch 1 HPPs; ss 25-35). Document “reasonable steps” taken to secure data (HPP 4.1) and to ensure data quality (HPP 3.1).
• Recordkeeping and audit trail. Maintain written notes required by HPP 4.3 when deleting records and HPP 2.3 when disclosing under certain paragraphs. Make a record of transfers under HPP 4.4. Keep logs of access requests, decisions, notices and timelines to evidence compliance with s 34(2) 45‑day rule and to prepare for any HCC audit (s 87(h)).
• Access processes and timeframes. Implement a standard operating procedure to handle requests as required by ss 33-35: validate identity and authority (s 31), determine the correct method of access (s 28), provide access within 45 days unless a fee applies (s 34(2)), and provide written reasons for refusal (Sch 1 HPP 6.10; s 34(2)(a)). For refusals on health‑risk grounds follow Division 3 (ss 36-42) and offer or accept nomination of a suitably qualified health service provider.
• Fees and financial controls. Ensure any fees charged for access comply with regulations and s 32. Do not charge for lodgment of requests (s 32(5)). Be aware of the mental health and wellbeing provider carve‑out s 32(2A).
• Consent management and lawful bases. Capture, record and manage consents where used as the lawful basis for collection, use or disclosure under HPP 1.1 and HPP 2.2. Where other lawful bases apply (legal obligation, research gateways under HPP 1.1(e) and HPP 2.2(g)) document the statutory or guideline basis and compliance with any Commissioner guidelines (s 22).
• Data retention and deletion workflows. Implement retention schedules aligned with HPP 4.2 and regulations under s 100. For child records, plan to retain until the individual attains 25 or seven years after last service as applicable. Document deletions under HPP 4.3 and ensure deletion only occurs in permitted circumstances.
• Security controls and de‑identification. HPP 4.1 requires reasonable steps to prevent misuse and unauthorised access. Adopt encryption, access controls, logging and de‑identification procedures when using data for management, planning or research under HPP 2.2(f) and HPP 2.2(g). If transborder transfers are contemplated, ensure the conditions of HPP 9.1 are satisfied and documented.
• Handling confidential third‑party information. Where third parties provide information in confidence, follow HPP 1.7 and s 27: confirm confidentiality, record that the information is confidential and limit recording to relevance to care or services.
• Outsourcing contracts. Review State contracts and other outsourcing arrangements in light of s 12. Ensure contracts allocate responsibilities for compliance, remediation and cooperation with HCC investigations. Do not assume outsourcing removes exposure.
• Engage with the Health Complaints Commissioner regime. Monitor HCC guidelines (s 22) and public notices, and prepare to respond to notices requiring information, attendance or production under ss 60 and 67. Maintain a response protocol for conciliation invitations and investigate internal complaint handling so that complaints can be addressed before escalation.
• Prepare for compliance notices and Tribunal proceedings. Know the thresholds for compliance notices (s 66(1)) and internal escalation procedures. If a compliance notice is served, understand review rights to the Tribunal (s 72) and deadlines for application. Maintain files showing remediation steps taken under any HCC ruling (s 64(7) reporting requirement).
• Legal privilege and FOI. Build processes to identify privileged documents (s 96) and FOI agency documents (s 16) to route access requests appropriately. Where documents are FOI agency material, advise requesters to use FOI procedures and cooperate with FOI obligations.
• Periodic compliance reviews and audits. Use the HCC’s powers to conduct or commission audits (s 87(h)) as a prompt to conduct internal audits. Review contracts, retention schedules, consent records and technical security periodically.
• Notifications and transfers on closure. For changes in practice ownership or closure follow HPP 10, publish required notices, and implement mechanisms to transfer or retain records safely in Victoria (Sch 1 HPP 10.1-10.7).

Document all decisions and the factual basis for them so that, if a complaint or investigation arises, records demonstrate the organisation took "reasonable steps" as required throughout the HPPs. The Act repeatedly relies on reasonableness standards (for example HPPs 1.4, 3.1 and 4.1) and on guidelines issued under s 22, so compliance must be both procedural and substantive.