Confidentiality in Healthcare Practice for Health Practitioners facing an Ahpra notification, complaint or allegation

The route the information took, and what now closes it. What was disclosed, opened, overheard or posted; to whom, and how they could identify the patient; why it happened; what you did in the hour you knew — the recall, the recipient contacted, the patient told; the clause named by number from your own code — 3.3 point b with 4.10 for a shared space, 3.3 point c for a record opened without a reason, 3.3 with 8.3 for an email to the wrong recipient, 3.3 point g for a post; and the change, systemic as well as personal, each part dated. The course’s five components of reflection — description, analysis, impact, learning and action — are the structure.

Yes — before you answer, and before you contact the patient or the recipient about the breach, because how that is done is part of the answer. Your indemnity insurer or defence organisation is the first call, and a lawyer should read the response before it goes to Ahpra, your National Board, your profession’s Council of NSW or the HCCC, the OHO, a privacy body, your employer, or a panel or tribunal. Nothing on this page is legal advice, and no course determines the outcome of a notification.

Yes, concretely: the patient told; the room, the list or the permissions changed and dated; your own record access audited, then audited again. No provider is accredited by Ahpra or any National Board, and no course decides a matter. What the Board, a panel and a tribunal weigh is dated, targeted remediation with reflection that engages the standard — and this course is written to clause 3.3 and the professions’ own codes, so the connection is plain on the certificate and in your reflective account. Check the wording of any condition, undertaking or direction with your indemnity insurer or defence organisation, your union or professional association or a lawyer before you rely on it.

After an assessment or an investigation your Board may take no further action, caution you, accept an undertaking or impose conditions — supervision, an audit of your record access, education (section 178) — refer you to a panel, or refer the most serious matters to a tribunal (section 193), which can reprimand, impose conditions, fine, suspend, cancel registration and disqualify (section 196). Deliberate or repeated access, and an account of it that was not true, are what take a confidentiality matter towards a tribunal; in 2024/25, 94.3% of the matters closed after a tribunal referral ended in disciplinary action. The honest account and the change since are weighed every time.

Not Ahpra, in either case. In New South Wales your profession’s Council of NSW and the Health Care Complaints Commission manage conduct, health and performance matters between them, and Ahpra does not investigate registered practitioners there. In Queensland every complaint goes first to the Office of the Health Ombudsman, which decides what it keeps and what it refers on to Ahpra and the Board. The letterhead tells you which body has your file, and the same response — the reasoning, the standard, the remediation — is what each of them reads for. A privacy breach may also engage the OAIC or a state or territory privacy body separately.

It depends on your profession. The shared Code of conduct is issued by twelve National Boards — Aboriginal and Torres Strait Islander Health Practice, Chinese medicine, chiropractic, dental, medical radiation practice, occupational therapy, optometry, osteopathy, paramedicine, pharmacy, physiotherapy and podiatry — and there the confidentiality clause is 3.3. It does not apply to doctors, nurses, midwives or psychologists, each of whom has a separate code with the same duty under different numbering: Good medical practice at 4.4, the NMBA codes at 3.5, and the Psychology Board’s code, in force since 1 December 2025, at 3.3. Check which code covers you before you cite one.

The code puts it narrowly: information is held in confidence unless its release is required or authorised by law, or is needed to facilitate emergency care. A mandatory notification under the National Law and a reporting duty under state or territory law sit inside that exception, as do a court order and a lawful request from a regulator. Everything else needs consent, and the code asks you to document it where possible. Then share only the relevant information, and record the reasoning — disclosing more than was needed is a breach even where some disclosure was justified. If you are unsure, take advice before you disclose, not after.

Yes. Clause 3.3 point g is explicit: do not transmit, share, reproduce or post any person’s information or images, even if the person is not directly named or identified, without first getting written and informed consent. Confidentiality protects against recognition, not only against naming: a role, a place, an event or an unusual presentation can identify a patient, and in a small or remote community that threshold is much lower than many practitioners assume. De-identification is not a defence if the person is recognisable from the detail, and the course’s social media case is written on exactly this point.

It may be. Clause 3.3 asks you to make sure staff are aware of the need to respect confidentiality and do not discuss patients in a non-professional context, and clause 7.1 asks you to take reasonable steps where patient safety may be compromised. If you had responsibility for the room, the team or the system, the question will include what you had put in place — the access rules, the induction, the reminder after the last near miss. That is also why confidentiality remediation is so often systemic as well as personal, and why a response names the system change beside your own.

Not quite, and the distinction matters. Confidentiality is the professional duty you owe the patient, set by your Board’s code; privacy law is the statutory framework — the Privacy Act 1988 and its thirteen Australian Privacy Principles, with state and territory health records law beside them. One incident can bring a notification to Ahpra and a privacy complaint to the OAIC at the same time, and the code says the law prevails where the two conflict. The course makes the distinction in its own terms: privacy as the patient’s right to personal space, bodily modesty and freedom from intrusion, confidentiality as your duty to protect their information — and either can be breached without the other.

Ask your adviser about the order, but the pattern is clear: remediation begun before the response is evidence you can describe in it, and remediation promised for later is an intention. A dated certificate showing you worked through the standard before the outcome was known reads differently from one dated afterwards, and the systemic changes — the room, the mailing list, the access permissions — are worth making and dating at once. The course is 2 CPD hours and self-paced, so it can sit beside the response rather than after it.

They overlap on consent to share information, and they are often taken together. This course works from the information outwards: what was disclosed, opened, overheard or posted, to whom, the duty in your Board’s code and the privacy law beneath it, and the system change that answers it. The Privacy, Consent and Chaperone course works from the consultation inwards: consent as a process, privacy and dignity during an examination, and the question of a third person in the room. If the letter is about where information went, start here; if it is about what happened in the room, start there.

Each National Board sets its own continuing professional development registration standard, and targeted CPD on the subject of a notification is among the remediation the Board and the tribunals recognise. The certificate records the course, the 2 CPD hours and the date, which is what a CPD portfolio needs; how the hours count towards your requirement depends on the standard’s categories, so check them.

The course is 2 CPD hours, self-paced, with twelve months’ access from purchase. The certificate is issued on completion, dated, with the course title and the CPD hours, for a response, a portfolio or your CPD record.