Requesting consent to release and exchange personal and health information
Workers compensation, information privacy and health records laws regulate the exchange of personal and health information.
This information is available as a print-friendly PDF.
Employers will need to collect, use and disclose a worker’s personal and health information to facilitate their return to work and recovery. Employers should obtain a worker’s consent before collecting, using or disclosing their personal and health information.
When doing so, employers have obligations to comply with privacy laws that deal with the collection, use, storage and disclosure of personal and health information. The privacy law(s) that may apply will vary depending on the insurer type and the type of information being dealt with.
Generally, the following principles apply to how employers handle a worker’s personal and health information.
What is personal and health information?
Personal information is any information or opinion that can identify an individual.
Health information includes any information or opinion about a worker’s physical or mental health or disability, or the provision of other health services.
Common examples include a worker’s return to work plan, doctor’s report, or even information about their medical appointment.
How should a worker’s claim information be stored?
Employers must have strict rules regarding the secure storage of information about a worker’s claim. This applies to both paper and electronic records.
Paper records must be held securely (commonly under lock and key) and electronic records must form part of a secure computerised database.
Employers must limit access to a worker’s personal and health information so that only those directly responsible for coordinating and monitoring their recovery at work can access the information.
Why is consent required?
Consent promotes good communication and transparent decision-making between the worker, the employer and the RTW team.
Good communication can increase adherence to treatment, improve long-term outcomes, hasten recovery and reduce emotional distress.
What is valid consent?
For consent to be valid it must be voluntary, informed, specific, current and given by a person with capacity to do so. The worker should be properly and clearly informed about how their personal and health information will be handled so they can decide whether to give consent. This includes the worker being given all the relevant information including the benefits of providing consent and risks of not doing so.
A worker’s consent is only genuine and valid if they have been given this information and can understand, provide and communicate their consent. This includes accommodating the needs of workers with a disability and those who do not speak English.
When requesting a worker’s written consent, employers should ensure the worker knows and understands:
- their rights and obligations
- what type of information will be exchanged
- who will have access to their information
- the importance and benefits of the support team being able to exchange information
- the possible impact of not providing their consent.
Note: Under section 47(5) of the 1998 Act, the worker must authorise the worker’s nominated treating doctor to provide relevant information to the insurer or the employer for the purposes of an injury management plan for the worker. However, any further authority provided by the worker must be given voluntarily.