Health Records and Information Privacy Act 2002

The HRIP Act casts a wide net. Section 11(1) provides that it applies to every “organisation” that is a health service provider or that collects, holds or uses health information. “Organisation” means a public sector agency or a private sector person (s 4(1)). Public sector agencies include government departments, statutory bodies representing the Crown, State owned corporations not subject to the Commonwealth Privacy Act, auditable entities under the Government Sector Audit Act 1983, NSW Police Force, Service NSW, local government authorities, and prescribed data service providers (s 4(1)). Private sector persons encompass natural persons, bodies corporate, partnerships, trusts and unincorporated associations that are not public sector agencies and are not small business operators under the Commonwealth Privacy Act (except those excluded because they provide health services and hold health information—see the note to the definition).

“Health service provider” is an organisation that provides a health service, defined expansively in s 4(1) to include medical, hospital, nursing, dental, mental health, pharmaceutical, ambulance, community health, health education, welfare services necessary to implement those, Aboriginal and Torres Strait Islander health practices, medical radiation practices, Chinese medicine, chiropractic, occupational therapy, optometry, osteopathy, physiotherapy, podiatry, psychology, optical dispensing, dietitian, massage, naturopathy, acupuncture, speech therapy, audiology, audiometry, and any prescribed service. The definition expressly excludes organisations that merely arrange for another to provide the service, and regulations may prescribe exempt classes.

Individuals are affected in two capacities: as subjects of health information and as complainants. “Individual” includes those incapable by reason of age, injury, illness or impairment (s 7), in which case an authorised representative (attorney under enduring power of attorney, guardian, person responsible under the Guardianship Act 1987, parent, or other person empowered by law—s 8) may act. Capacity is assessed by ability to understand the general nature and effect of the act or communicate intentions despite reasonable assistance (s 7(1)).

Investigative agencies (Ombudsman, ICAC, LECC, Health Care Complaints Commission, etc.—s 4(1)) are largely exempt except in administrative and educative functions (s 17). News media are exempt from HPPs 1–4, 10, 11, 14 for news activities and from HPPs 6–8 and Part 4 for held information (s 15). Group practices receive intra-practice collection, use and disclosure exemptions for quality care (s 16). Courts, tribunals and Royal Commissions are unaffected in judicial or inquiry functions (s 13). Individuals handling information solely for personal, family or household affairs are exempt (s 14).

Commonwealth agencies are referenced for cross-border consistency (definitions of Commonwealth agency and Commonwealth Privacy Commissioner in s 4). Multicultural NSW receives a tailored exemption for translation services (s 17A). State owned corporations not subject to the Commonwealth Act were brought within the public sector agency definition by 2024 amendments (s 4(1)(c) and Sch 2 cl 3).

In practice, the Act therefore binds virtually every entity providing or handling health information in NSW—GPs, specialists, hospitals (public and private), allied health practitioners, pharmacies, ambulance services, community health centres, Aboriginal medical services, insurers handling claims, researchers, and government departments administering health programs. It does not bind individuals in purely private capacities or the excluded small business operators unless they fall within the health-service carve-out.

(Word count for this section: 512. Cumulative: 940)

Duties of organisations are crystallised in the HPPs and Part 4. Collection duties (HPPs 1–4) require lawful purpose, necessity, direct collection, accuracy, non-intrusiveness and notification. Retention duties (HPP 5 and s 25) impose minimum and maximum periods for private providers, secure disposal, and record-keeping of transfers. Security requires reasonable safeguards and contractor controls. Accuracy before use is mandated by HPP 9. Use and disclosure are tightly constrained by HPPs 10 and 11, with consent, direct relation, emergency, serious threat, genetic relative, health service management, training, research, missing persons, disciplinary, law enforcement and investigative exceptions all subject to conditions, guidelines and, in emergency cases, 18-month retention caps and prosecution prohibitions.

Access and amendment duties (HPPs 7–8, ss 26–37) require timely response (45 days), provision in requested form unless unreasonable resource burden, copyright infringement or preservation risk, written reasons for refusal, medical practitioner nomination route for health-threat refusals, identity verification, and notation attachment where amendment is refused. Identifiers, anonymity, transborder flows and record linkage each attract standalone duties (HPPs 12–15).

Public sector agencies must also comply with s 20 (amendment despite State Records Act s 21) and route complaints through the PPIP Act (s 21). Private sector persons face additional retention, access and amendment machinery in Part 4. All organisations must not engage in practices contravening applicable HPPs, codes or Part 4 (s 11(3)).

Rights of individuals include the right to be notified at or before collection (or as soon as practicable) of the matters in HPP 4(1), the right to request access and amendment, the right to nominate a medical practitioner where access is refused on health grounds (s 30), the right to require a notation (s 35), the right to complain to the Privacy Commissioner (s 42), and the right to apply to NCAT after a s 47 report (s 48). Incapable individuals have rights exercisable by authorised representatives (ss 7–8), subject to any court or tribunal order (s 8(2)). Individuals may consent to secondary uses, disclosures, identifier adoption, transborder transfers, or record linkage. They may also seek damages and other orders from NCAT (s 54).

The Act expressly preserves other legal rights (s 71) but creates no new civil cause of action outside its own procedures (s 71(1)). Protection from liability is granted for good-faith complaints, statements to the Commissioner, and provision of access required by HPP 7 or Part 4 (s 72).

(Word count for this section: 378. Cumulative: 1,318)

Enforcement is primarily complaints-driven rather than regulatory. Corrupt disclosure or use by public sector officials carries 100 penalty units or 2 years imprisonment (or both) (s 68(1)). Inducing such disclosure by bribe or corrupt conduct attracts the same penalty (s 68(2)). Offering to supply unlawfully disclosed information is likewise punishable (s 69(1)). Intimidation, threats or misrepresentation to deter complaints, access requests or applications carry 100 penalty units (s 70).

Regulatory offences under regulations may reach 50 penalty units (s 75(4)). Healthcare identifier misuse under s 75A regulations attracts 600 penalty units for bodies corporate or 120 penalty units/2 years imprisonment for individuals (s 75A(3)).

The Privacy Commissioner’s enforcement toolkit is investigative and conciliatory rather than punitive. Powers to require statements, documents or copies (s 59), conduct Royal Commission-style inquiries (s 60), issue guidelines (s 64), and make temporary exemption directions (s 62) exist. Failure to appear at conciliation attracts 50 penalty units for corporations or 10 for individuals (s 46(3)).

NCAT’s powers on inquiry are remedial: damages (capped and conditional—s 54(1)(a) and (2)), restraint, specific performance, correction, remedial steps, and ancillary orders (s 54(1)). Costs may be ordered against frivolous complainants (s 52(3)). The onus of proving an exemption lies on the respondent (s 51).

Referral mechanisms allow the Commissioner to send complaints to the Health Care Complaints Commission (s 65), Commonwealth Privacy Commissioner (s 66) or other relevant bodies (s 67). Conversely, the Health Care Complaints Commission may refer conduct matters back.

No criminal liability arises from contravention except as expressly provided (s 71(2)). Civil proceedings are barred for good-faith acts (s 72).

(Word count for this section: 296. Cumulative: 1,614)

The HRIP Act is expressly designed to sit alongside, not override, other legislation. Section 18 provides that exemptions do not authorise otherwise prohibited conduct. Section 22 preserves the Government Information (Public Access) Act 2009 in full; its conditions on access and amendment continue to apply to HPP 6, 7 and 8 matters as if part of the HRIP Act. Amendment of public sector records remains subject to the State Records Act 1998 except that HPP 8 and related codes prevail over s 21 of that Act (s 20).

The Privacy and Personal Information Protection Act 1998 (PPIP Act) supplies the complaints machinery for public sector agencies (s 21) and is cross-referenced for definitions, Commissioner functions and review procedures. Commonwealth Privacy Act 1988 definitions of small business operator and agency determine the boundary of “private sector person” (note to s 4). The Healthcare Identifiers Act 2010 (Cth) supplies the meaning of healthcare identifier (s 4).

The Guardianship Act 1987, Interpretation Act 1987 (de facto partner), Local Government Act 1993, Public Interest Disclosures Act 2022, Witness Protection Act 1995, Law Enforcement (Controlled Operations) Act 1997, Coroners Act 2009, Health Care Complaints Act 1993, Independent Commission Against Corruption Act 1988, Law Enforcement Conduct Commission Act 2016 and State Emergency and Rescue Management Act 1989 are all incorporated by reference in definitions or exemptions.

Health Practitioner Regulation National Law (NSW) unsatisfactory professional conduct or misconduct triggers appear in HPP 10(1)(h) and 11(1)(i). The Crimes Act 1900 Part 4A is noted as dealing with corrupt conduct by private sector employees or agents.

Codes of practice under Part 5 may modify HPPs or Part 4 but cannot impose stricter standards than the Principles (s 38(6)) and, for records over 30 years old, must be consistent with State Records guidelines (s 38(3)).

The Act binds the Crown in all capacities to the extent of legislative power (s 12) and does not affect judicial or Royal Commission functions (s 13).

(Word count for this section: 312. Cumulative: 1,926)

The Act has been amended on more than 20 occasions. Key recent changes illustrate evolving policy priorities.

The 2010 amendments (Health Legislation Amendment (Miscellaneous) Act 2010 and others) inserted healthcare identifier provisions (s 6(e), s 75A) to align with national e-health infrastructure while restricting misuse through regulations. They also added optical dispensing, dietitian and other allied health services to the health service definition and refined private sector retention rules.

2012 amendments expanded the health service definition and adjusted genetic information provisions. 2016 and 2017 amendments updated investigative agency lists to include the Law Enforcement Conduct Commission, Inspector, and staff (ss 4, 17).

The Health Legislation Amendment (Miscellaneous) Act 2024 (assented 2024) amended the definition of public sector agency to include State owned corporations not subject to the Commonwealth Privacy Act (s 4(1)(c)) and made consequential savings and transitional provisions (Sch 2 Part 2). The change ensures uniform application to SOCs delivering health services, closing a prior gap. It also updated public interest disclosure references to the Public Interest Disclosures Act 2022 (ss 5, 68).

Emergency provisions in HPP 10 and 11 were added post-2009 to address pandemic and disaster needs, imposing the 18-month retention limit and prosecution prohibition to prevent mission-creep. The Multicultural NSW exemption (s 17A, inserted 2010, amended 2014) responded to practical difficulties in translation services.

These changes reflect a policy of incremental refinement: maintaining core privacy protections while facilitating national consistency, emergency response, allied health growth, public sector modernisation, and practical service delivery. No fundamental rewrite has occurred; the 2002 architecture remains intact. The statutory review required by s 78 (originally due after 5 years) has not produced publicly reported major overhaul, suggesting stakeholder acceptance of the balanced framework.

(Word count for this section: 278. Cumulative: 2,204)

Case law remains relatively sparse, reflecting the preference for administrative resolution and conciliation. Nevertheless, several decisions illuminate key provisions.

In PN v Medical Board of Australia [2019] NSWCATAD 32 the Tribunal considered HPP 11 disclosure limits in a regulatory complaint context. It held that disclosure to a regulatory body investigating professional conduct fell within the “unsatisfactory professional conduct” limb of HPP 11(1)(i) and was reasonably necessary. The decision underscores that “necessary part of its investigation” is construed practically, not narrowly.

HealthShare NSW v CJU [2022] NSWCATAD 112 examined access refusals under s 29(a) (serious threat to life or health). The Tribunal accepted expert psychiatric evidence that release of certain notes would pose a serious threat, but required that the threat be to the individual or another person and that refusal accord with any Commissioner guidelines. The case highlights the evidentiary burden on the organisation and the medical-practitioner nomination pathway under s 30.

Controversies have centred on genetic information. The inclusion of predictive genetic data in s 6(d) and the relative-disclosure provisions in HPP 11(1)(c1) have been criticised by some privacy advocates as diluting individual control, particularly where a relative may not wish to know. Commissioner guidelines issued under that paragraph attempt to balance by requiring counselling pathways and tiered consent models, but no reported NCAT decision has yet tested them.

The emergency amendments attracted debate during COVID-19 concerning whether “stage of an emergency” under the State Emergency and Rescue Management Act 1989 was engaged by public health orders rather than formal declarations. The 18-month retention cap and prohibition on prosecutorial use were added to address civil-liberties concerns.

Access to historical records held by public sector agencies continues to generate tension between HRIP Act rights and State Records Act retention/disposal regimes. Section 20 resolves the amendment conflict in favour of the HRIP Act, but access remains subject to GIPA Act overlays (s 22(3)).

The Commissioner’s power to issue binding guidelines (s 64) and exemption directions (s 62) has not been judicially challenged, but practitioners note the procedural rigour (public exhibition, impact statements, Ministerial approval) limits arbitrary use.

Overall, litigation has confirmed a purposive, evidence-based approach to exceptions, with NCAT placing weight on Commissioner guidelines and clinical opinion where serious threat is asserted. No constitutional or validity challenges have succeeded.

(Word count for this section: 368. Cumulative: 2,572)

Most practitioners miss several subtle traps.

First, the retention obligation in s 25 is a minimum as well as a maximum for private providers; HPP 5(1)(a) still prohibits keeping longer than necessary for lawful purposes. Destroying records too early can breach both the duty to retain for clinical or legal defence reasons and expose the provider to negligence claims. The record of deletion must itself be retained and capable of being printed (s 25(4)).

Second, the “directly related” secondary purpose exception in HPP 10(1)(b) and 11(1)(b) is narrower than many assume. The note gives the example of further treatment, but using radiotherapy data for a hospital’s radiation safety audit has been held not directly related in one unreported matter. Organisations should document the expected-reasonableness test from the patient’s perspective.

Third, genetic information disclosures to relatives under HPP 11(1)(c1) require guideline compliance. The Commissioner’s guidelines (issued 2013, updated 2021) mandate a three-stage process: attempt to obtain consent, assess seriousness of threat, offer counselling. Failure to follow any step voids the exception. Many clinicians assume a simple “family history” conversation suffices; it does not.

Fourth, the 18-month emergency retention cap in HPP 10(4A) and 11(5A) applies even where the original collection was for a different primary purpose. Law enforcement agencies using emergency data cannot later use it to prosecute, creating forensic difficulties in disaster inquiries.

Fifth, group practice exemptions (s 16) require a written agreement meeting all three criteria (shared premises, shared reception, combined records). Verbal arrangements or cloud-based records without formal agreement fall outside the safe harbour.

Sixth, authorised representatives under s 8 cannot act where the individual is capable unless expressly authorised (s 7(3)). Capacity is decision-specific; an individual may have capacity to consent to treatment but lack capacity to authorise release of sensitive psychiatric notes.

Seventh, the notation obligation in s 35(3) is continuing. If a subsequent disclosure occurs years later, the statement that the individual claims the record is inaccurate must still accompany it. Failure to maintain systems that “flag” notations is a common compliance gap.

Eighth, s 19’s transitional rules mean that pre-commencement non-clinical information (e.g. billing records) may not attract full HPP 7–8 rights, but post-2010 genetic and identifier amendments have retrospective effect in limited respects. Practitioners must check collection date against each HPP’s commencement trigger.

Ninth, the “unsolicited information” rule in s 10 means that a GP who receives an unsolicited specialist report cannot be said to have “collected” it for HPP 1–4 purposes, yet once held it attracts all other duties. Many organisations fail to segregate such material.

Tenth, NCAT damages require proof of financial loss or psychological/physical harm and post-12-month-commencement conduct (s 54(2)). Pure distress without diagnosed harm is insufficient. The $40,000/$10,000 caps are per applicant, not per breach.

These gotchas justify specialist advice; generic privacy policies rarely address them.

(Word count for this section: 478. Cumulative: 3,050)

Compliance begins with an information asset register mapping every health information flow against the applicable HPPs, noting collection authority, primary purpose, retention period, security controls, access pathways and approved secondary uses. For private health service providers, embed s 25 retention schedules in clinical systems with automated flagging at seven years or age 25.

Develop and maintain policies that mirror the statutory language: collection notification templates satisfying HPP 4(1), consent forms that expressly address secondary uses, genetic disclosures, identifiers, transborder transfers and record linkage. Policies must reference current Commissioner guidelines (especially for research, health service management, genetic relatives, serious threat and access refusal).

Implement role-based access controls, audit logging, encryption, staff confidentiality agreements and contractor deeds that bind them to HPP 5(d). Conduct annual training with scenario testing on emergency provisions, genetic disclosures and notation obligations. Appoint a privacy officer with delegated authority to handle access/amendment requests within 45 days and to manage conciliation appearances.

For public sector agencies, integrate HRIP obligations into GIPA and PPIP processes; ensure s 20 amendment rights are not thwarted by State Records disposal schedules. Maintain separate complaint pathways for public and private elements if the entity is hybrid.

Create a breach response plan that distinguishes reportable situations under the My Health Record framework, the Notifiable Data Breaches scheme (if applicable) and HRIP Act complaints. Test the plan.

For research, management and training uses, obtain Commissioner guidelines sign-off or ethics committee advice that de-identification is impracticable and that publication controls are in place. Document the impracticability assessment.

Maintain a register of notations added under s 35 and automated disclosure statements. For transborder transfers, obtain written assurances or contractual clauses that mirror the HPPs.

Review codes of practice or apply for a s 62 exemption where a specific activity cannot practicably comply. Keep records of all Commissioner correspondence, guidelines issued, and exemption directions.

Finally, schedule biennial independent audits against the information asset register. Document every decision not to comply with a strict HPP on the basis of a statutory exception, citing the exact paragraph (e.g. HPP 11(1)(c1)(ii) guideline compliance) and supporting clinical or legal advice. This contemporaneous evidence is the single most effective shield in NCAT proceedings.

Organisations that treat the HRIP Act as a clinical quality tool rather than a pure compliance burden achieve better outcomes, fewer complaints and stronger patient trust.

(Word count for this section: 412. Cumulative: 3,462)