Ethics and professionalism CPD for health practitioners in Australia [email protected]
Sign in Choose courses

Online course · Australia

Privacy, Health Records and My Health Record in Australian Practice

The Privacy Act, State Health Records Laws and Handling Patient Information Well

  • About 3 hours
  • 20 scenario questions
  • Reflective account
  • Certificate of completion
  • Online, self-paced

About this course

Health information is the most sensitive data most people will ever share, and Australian practices hold it under a patchwork of Commonwealth and state laws. This three-hour course explains which laws apply to you and how to handle patient information well every day.

The course explains why health information is different, the Privacy Act 1988 and the Australian Privacy Principles, state and territory privacy and health records laws, professional duties and the changing legal picture. Collection is covered through APP 3, collection notices, information from third parties and anonymity.

Use and disclosure lessons cover primary and secondary purposes, permitted exceptions, families and carers, and requests from insurers, employers, lawyers and police. A section on security covers reasonable steps, the Notifiable Data Breaches scheme, retention and destruction, cloud services and AI.

Later sections address access and correction under APP 12, refusing or limiting access, requests on behalf of others, the My Health Record system, authorised viewing, emergency access, breach notification, uploading and share by default, and privacy in everyday practice, from reception areas and messaging apps to curiosity access and complaints.

What you will learn

  • Identify which Commonwealth and state privacy laws apply to your setting
  • Collect only what you need, tell patients why and get consent where the law requires it
  • Decide when information may be used or disclosed under APP 6 and professional confidentiality
  • Protect records and know what to do, and whom to tell, when a data breach happens
  • Apply retention rules and plan for closing or transferring a practice
  • Respond to access and correction requests within the law
  • Use My Health Record lawfully, including emergency access and share by default
  • Prevent everyday risks such as curiosity access and handle privacy complaints well

Who this course is for

  • Registered practitioners in private and public practice
  • Practice managers, reception and administrative staff
  • Practice owners responsible for systems, cloud services and vendors
  • Practitioners using AI scribes, messaging apps or personal devices
  • Anyone responsible for responding to a privacy complaint or data breach

How the course works

  1. After checkout the course is added to My Courses in your account, so you can start straight away on any device with a modern browser.

  2. Move through 7 sections (28 lessons in total) in your own time; lessons open in sequence and the player remembers where you stopped on that device.

  3. Each section ends with key points and prompts for reflection. Your notes can be downloaded as a Word course pack or printed for your portfolio.

  4. Sit the 20-question assessment at the end. Score 80% or more (16 of 20) to pass; answer options are reshuffled if you retake.

  5. Complete the reflective account and feedback to finish. Your certificate of completion shows the estimated learning time (about 3 hours), and you record the time you actually spend in your CPD log.

Course content

8 sections · About 3 hours · 20-question final assessment

1The Privacy Landscape for Australian Health Practitioners4 lessons
  • Why Health Information Is Different
  • The Privacy Act 1988 and the Australian Privacy Principles
  • State and Territory Privacy and Health Records Laws
  • Professional Duties and the Changing Legal Picture
2Collecting Health Information Lawfully4 lessons
  • Necessity and Consent: APP 3 in Practice
  • Telling People: Collection Notices and Privacy Policies
  • Information From Third Parties and Unsolicited Information
  • Anonymity, Identifiers and Sensitive Services
3Using and Disclosing Information: APP 6 and Confidentiality4 lessons
  • Primary Purpose, Secondary Purpose and Reasonable Expectations
  • Permitted Exceptions: When You May or Must Disclose
  • Families, Carers and Responsible Persons
  • Requests From Insurers, Employers, Lawyers and Police
4Security, Data Breaches and Retention4 lessons
  • Reasonable Steps to Secure Information
  • The Notifiable Data Breaches Scheme
  • Retention, Destruction and Practice Transitions
  • Cloud Services, Overseas Vendors and Artificial Intelligence
5Access to and Correction of Health Records4 lessons
  • The Right of Access Under APP 12
  • When Access May Be Refused or Limited
  • Correcting Records Without Altering Them
  • Requests on Behalf of Others and Transfers of Care
6My Health Record: Access, Uploads and Obligations4 lessons
  • How the My Health Record System Works
  • Authorised Viewing and the Limits on Use
  • Emergency Access and Breach Notification
  • Uploading Information and Share by Default
7Privacy in Everyday Practice4 lessons
  • Reception, Waiting Rooms and Conversations
  • Phones, Email, Messaging Apps and Personal Devices
  • Curiosity Access and Inappropriate Use of Records
  • Privacy Complaints and Building a Privacy-Aware Practice
8Conclusion, Final Assessment and Reflection4 lessons
  • Conclusion and key points
  • References and quick-reference guide
  • Final assessment (20 questions, 80% pass mark)
  • Your reflective account

Assessment and certificate

  • Certificate of completion stating the estimated learning time (about 3 hours); record the time you actually spend.
  • A written reflective account you can keep with your CPD records.

Questions about this course

Does the Privacy Act apply to small health practices?

Yes. Unlike many small businesses, any private sector organisation that provides a health service and holds health information is covered by the Privacy Act, regardless of turnover.

What is 'share by default'?

From 1 July 2026, share by default requires certain information, such as specified pathology and diagnostic imaging reports, to be uploaded to My Health Record. The course explains what this means for practitioners.

Do I have to report a data breach?

If an eligible data breach is likely to result in serious harm, you must notify affected individuals and the Office of the Australian Information Commissioner. The course explains how to assess and respond.

Can I look up a patient's record out of concern if they are not my patient?

No. Accessing records without a legitimate purpose, often called curiosity access, is a serious privacy breach and a common cause of complaints.

What evidence do I get when I finish?

You receive a certificate of completion stating the estimated learning time, and you can download a course pack holding your learning record, a revision sheet and your own reflections. Your CPD log should show the time you actually spend.

Does completing the course satisfy a condition or undertaking?

Not automatically. Where a Board has set education as a condition or undertaking, the course usually has to be nominated and accepted first, so check with Ahpra or the Board, and your legal adviser or defence organisation, before you enrol.

Related courses

A$309About 3 hours
Enrol