Information sharing under the Act

Information sharing principles

The Mental Health and Wellbeing Act 2022 (the Act) includes information sharing principles to give mental health and wellbeing providers clarity of the purpose and expectations around information sharing.

The Act requires entities and people making decisions, performing functions or exercising powers relating to the disclosure, use or collection of health or personal information to give proper consideration to the following information sharing principles:

• Disclosure, collection and use of information principle: The disclosure, use or collection of personal or health information about a person receiving mental health and wellbeing services should be directed at:
  • enhancing a person’s ability to access, understand and self-manage their information
  • improving the person’s experience of the mental health and wellbeing system
  • supporting the person to transition between services or levels of care
  • supporting the provision of safe, integrated, high-quality treatment, care and support
  • where appropriate, supporting families, carers and supporters to fulfil their role
• Dignity of person paramount principle: Information is to be recorded accurately and respectfully
• Aboriginal and Torres Strait Islander information principle: Information of Aboriginal and Torres Strait Islander people is to be treated in a manner that promotes self-determination and is culturally safe, acknowledging connections to family, kin and community
• Accessibility of information principle: Information is to be provided to people in an accessible format that acknowledges the needs of that person, as reasonably practicable, having regard to their age, disability, neurodiversity, culture, language, communication, religion, ethnicity, sex, gender identity and sexual orientation
• Accuracy of information principle: Information relating to a person receiving mental health and wellbeing services that is recorded or shared is to be accurate, relevant and up to date.

Information sharing with consumer consent

The Act adopts a consent-driven approach to information sharing. As a general rule, consumer consent is required for the sharing of health and personal information, and consumers are able to withdraw this consent at any time. There are, however, a number of exceptions to this position which are set out below.

Information sharing with ‘specified service providers’ is supported where it is reasonably necessary to assist in the referral of the person between a mental health and wellbeing service provider and a specified service provider, or to ensure integrated services are provided to the person. ‘Specified services’ are state-funded providers of alcohol and drug treatment services and state-funded community housing services. This is intended to support improved access to integrated alcohol and other drug treatment services, and to housing for consumers.

The Act also allows for regulations to be made to include other types of service providers in the definition of ‘specified service providers.’ No such regulations are currently planned.

A mental health and wellbeing service provider must inform a consumer that they may disclose their information with specified service providers who provides services to the consumer unless the consumer elects that the information is not disclosed. If the person elects to not have their personal information disclosed, then the mental health and wellbeing service provider must keep a written record of that election.

Obligation to share information with consent at key points of care

The Act includes a positive duty for providers to share some or all of a person's health information to family, a carer or a supporter, with consumer consent, following the consumer's admission or discharge from an inpatient service.

When can consent to the sharing of information be overridden?

A mental health and wellbeing service provider is not required to disclose the health information of a consumer to family, a carer or a supporter despite consent being given for that disclosure if:

• the disclosure poses a threat to the life or health of any person
• the disclosure could unreasonably impact on the privacy of other persons
• the disclosure is unlawful
• the disclosure is inconsistent with a requirement or authorisation by or under law
• the disclosure may prejudice an investigation of unlawful activity
• the disclosure may prejudice a law enforcement function by or on behalf of law enforcement agency
• the disclosure is likely to cause damage to the security of Australia in the course of a law enforcement agency performing a function.

Information sharing without consent

The Act continues to permit the sharing of information without consent in specified circumstances.

Electronic Health Information System

The EHIS is known as CMI/ODS which is the Victorian public mental health client information management system managed and maintained by the Department of Health.

A person who is employed or engaged by a mental health and wellbeing service provider or a prescribed emergency service provider may enter a person's health information into the EHIS (CMI/ODS) without consumer consent. The EHIS (CMI/ODS) may also be accessed by providers for the purposes of providing mental health and wellbeing services, including integrated care, to the consumer to whom that information relates without obtaining consent from the consumer.

Circumstances where health information can be disclosed without consent

The Act lists circumstances where the health information of a person can be disclosed without the consent of the person. These circumstances include:

• Health information may be disclosed if the disclosure is reasonably necessary for the mental health and wellbeing service provider to perform functions or exercise powers under the Act or any other Act. or if the disclosure is permitted by certain Health Privacy Principles (HPP), listed below.
  • HPP 2.1, which permits the disclosure of information for the primary purpose for which the information was collected.
  • HPP 2.2 (a), which permits disclosure of information for a secondary purpose if the secondary purpose is directly related to the primary purpose and the consumer would reasonably expect the service to disclose the information for the secondary purpose. A ‘related’ purpose must be directly connected or associated with the primary purpose of collection.
  • HPP 2.5, which permits the disclosure of information if a consumer is suspected to be or is dead, is suspected to be missing or is missing or is involved in an accident or other misadventure and is incapable of consenting to the disclosure. Disclosure in these circumstances should only be to the extent reasonably necessary to identify the consumer or to ascertain the identity and location of an immediate family member or other relative of the person to:
    • enable a member of the police force, a coroner or other prescribed organisation to contact the immediate family member or other relative for compassionate reasons; or
    • assist in the identification of the person.
• Disclosure is also permitted in accordance with HPP 2.2 (f) (funding, management etc. of the health services). HPP 2.2(g) (research in the public interest) and HPP 2.2(k) (establishing a legal defence).
• Health information can also be disclosed if the disclosure is:
  • Made in accordance with any guidelines issued by the Health Complaints Commissioner under the Health Records Act 2001 (HR Act); and where the disclosure is reasonably necessary to lessen or prevent a serious threat to a person's life, health, safety or welfare, or a serious threat to public health, public safety or public welfare.
  • Reasonably required by another mental health and wellbeing service provider or a health service provider to provide health services to the person.
  • Permitted by an Act other than the HR Act.
  • Made in general terms to family, a carer or supporter of the person and the disclosure is not contrary to the views and preferences expressed by the person that the health information must not be disclosed to family, a carer or supporter. This disclosure is subject to section 31 of the Act which limits the disclosure of health or personal information of a person if there may be a risk of family violence or other serious harm to that person by disclosure of that information. This limitation applies regardless of whether the person has consented to the disclosure of their personal or health information.
  • Made to a psychiatrist giving a second psychiatric opinion. The disclosure may include providing access to a consumer’s clinical records or discussing a consumer’s treatment with the psychiatrist giving the second psychiatric opinion.
  • Made to a parent of the person and the person is under 16 years of age or the Secretary of the Department of Families Fairness and Housing with parental responsibility of the child under a relevant child protection order.
  • Made to a guardian of the person and the disclosure is reasonably required in connection with the performance of a duty or the exercise of a power by the guardian.
  • Made to a support person (within the meaning of the Medical Treatment Planning and Decisions Act 2016) of the person to whom the health information relates.

Information sharing with specific organisation is also permitted without consent, for example:

• Information sharing with Ambulance Service Victoria is supported where it is for the purposes of the provision of an emergency service or performing a function under the Act.

The information sharing provisions within the Act do not override information sharing enabled in other Acts, including those which allow for information sharing without consent to assess and manage risk, for example under Part 5A of the Family Violence Protection Act 2008. These continue in accordance with current legislative arrangements.

Offences for misuse of information

The Act protects the privacy of people accessing mental health and wellbeing services. It is an offence to:

• knowingly access the EHIS (CMI/ODS) or use or disclose health information or personal information on the system unless the person is authorised to do so under the Act.
• knowingly access the system or use or disclose health information or personal information on the system other than in accordance with that authorisation.

These offences are in addition to the obligations of non-disclosure of personal information imposed under other laws, such as the Health Records Act 2001, the Privacy and Data Protection Act 2014 (for services provided in the public health system), and the Privacy Act 1988 (Cth).

Failure to comply with the Information Sharing Principles also allows a consumer to complain to the Mental Health and Wellbeing Commission.

Health information statements

The Act introduces a new process to enable a person to make a statement on information held about them by a mental health and wellbeing service provider, in circumstances where the provider has refused to amend or correct information under the Freedom of Information Act 1982 or Health Privacy Principles.

A provider who refuses to amend or correct information must provide the reasons in writing for that refusal and inform the person that they may make a health information statement within 12 months of receiving the notice of refusal.

Mental health and wellbeing providers may use the template provided to communicate a refusal to amend or correct health information.

Written notice of refusal to amend or correct health information

docx 134.56 KB | Updated: 13 September 2023

Any health information statement received from a consumer must be included on the person's health information record.

Consumers may use the template provided to communicate a health information statement.

Health information statement

docx 134.13 KB | Updated: 13 September 2023