Health Privacy Principles (HPPs) for agencies

Read the document below or download it here Fact sheet - Health Privacy Principles (HPPs) for agencies, updated April 2023

The 15 Health Privacy Principles are the key to the Health Records and Information Privacy Act 2002 (HRIP Act)

These are legal obligations which NSW public sector agencies and private sector organisations must abide by when they collect, hold, use and disclose a person’s health information.

As exemptions may apply in certain circumstances, it is  suggested you seek further advice from the Privacy Contact Officer or the Health Information Manager in your agency or organisation in the first instance. You can also contact the Information and Privacy Commission NSW (IPC) for further advice.

Collection

Only collect health information for a lawful purpose that is directly related to the agency or organisation’s activities and necessary for that purpose. You should not collect health information by any unlawful means.

Ensure health information is relevant, accurate, up to date, complete and not excessive, and that the collection does not unreasonably intrude into the personal affairs of the person to whom the information relates to.

Only collect health information from the person concerned, unless it is unreasonable or impracticable to do so.

Inform a person as to why you are collecting their health information, what you will do with it, and who else may see it. Tell the person how they can view and correct their health information and any consequences that will occur if they decide not to provide their information to you.

If you collect health information about a person from a third party you must still take reasonable steps to notify the person that this has occurred.

Storage

Ensure the health information is stored securely, not kept any longer than necessary, and disposed of appropriately.Security safeguards should be in place, so that health information  is protected againstloss, unauthorised access, use, modification,disclosure or any other misuse.

(Note: private sector organisations should also refer to section 25 of the HRIP Act for further provisions relating to retention.)

Access and accuracy

Explain to the person what health information is being stored, the reasons it is being used and any rights they have to access it.

Allow a person to access their health information without unreasonable delay or expense.

(Note: private sector organisations should also refer to sections 26-32 of the HRIP Act for further provisions relating to access.)

Allow a person to update, correct, delete, add or amend their personal information where necessary. This will ensure that the health information is accurate, is being collected or used for its directly related purpose, and is relevant, up to date, complete and not misleading.

Note: private sector organisations should also refer to sections 33-37 of the HRIP Act for further provisions relating to amendment.

Ensure that the health information is relevant, up to date, accurate, complete, and not misleading before using it.

Use

Only use health information for the purpose for which it was collected or for a directly related purpose, which a person would expect. Otherwise, you would generally need their consent to use the health information for a secondary purpose, unless one the exceptions in HPP 10 applies (e.g. emergencies, threat to health or welfare, research or training etc).

Disclosure

Only disclose health information for the purpose for which it was collected, or for a directly related purpose that a person would expect. Otherwise, you would generally need their consent, unless one of the exceptions in HPP 11 applies (e.g. in some instances disclosure is allowed in the event of an emergency, serious threat to health or welfare, research or training etc).

Note: also see HPP 10.

Identifiers and anonymity

Only identify people by using unique identifiers if it is reasonably necessary to carry out your functions efficiently.

Give the person the opportunity of receiving services from you anonymously, where this is lawful and practicable.

Transferrals and linkage

Only transfer health information outside New South Wales in accordance with HPP 14.

Only use health records linkage systems if the person has expressly consented to this information being included (this includes disclosure of an identifier).  

For more information

Contact the Information and Privacy Commission NSW (IPC):

Freecall: 1800 472 679
Email: ipcinfo@ipc.nsw.gov.au
Website: www.ipc.nsw.gov.au