General / overarching principles

Overview

Workers compensation, information privacy, health record and public access laws regulate the exchange of personal and health information.

Insurers are to deal with a worker’s personal and health information in accordance with relevant legislation and, where required, the worker’s current and express consent.

This guidance considers:

• relevant provisions in the workers compensation legislation regarding the collection, use and disclosure of information, as well as notice requirements about information that should be provided to the worker
• the worker’s signed authority provided with a claim, which authorises the sharing of information between service providers and the insurer
• seeking consent from the worker to collect, use and disclose information about their health, injury and recovery.

Relevant workers compensation provisions

Information collection and sharing

Insurers must be aware of the relevant provisions in the workers compensation legislation that deal with the collection and sharing of information.

Section 40B of the Workplace Injury Management and Workers Compensation Act 1998 (1998 Act) provides that the Authority (SIRA) may collect, use and disclose data relating to:

• policies of insurance
• claims for compensation or work injury damages
• the functions, activities and performance of insurers and employers
• the provision of health, legal and other services to workers, and
• any matter in respect of which a complaint is made to the Authority or the Independent Review Officer concerning any aspect of the schemes to which the workers compensation legislation relates.

For that purpose, the Authority may obtain data from insurers, from relevant insurance or compensation authorities, from hospitals, government agencies and from any other source.

The Authority, the Independent Review Officer and insurers are authorised to exchange data concerning policies of insurance, claims, complaints and other related matters under the workers compensation legislation.

Disclosure requirements

Insurers must be aware of the disclosure requirements outlined in section 243 of the 1998 Act. Specifically, any information obtained in connection with the administration of the 1998 Act must not be disclosed, unless that disclosure is made:

• with the consent of the person from whom the information was obtained, or
• in connection with the administration or execution of the Act, or
• for the purposes of any legal proceedings arising out of the Act or any report of any such proceedings, or
• in accordance with section 72 of the 1998 Act (Inspection of relevant claims information etc), or
• in accordance with the requirements imposed under the Ombudsman Act 1974, or
• with other lawful excuse.

Signed authority

Insurers may require a worker to provide a signed authority with their claim. This signed authority authorises the sharing of information between service providers and the insurer for the duration of the claim.

Part 3.2 of the Workers compensation guidelines (Guidelines) states that a worker may be required to supply the insurer with a signed authority so providers of medical and hospital treatment, or workplace rehabilitation services, can give the insurer relevant information relating to the compensable injury.

Information relevant to the worker’s injury includes:

• the treatment or service provided, or
• the worker’s medical condition, or
• treatment relevant to the claim.

The SIRA worker’s injury claim form includes an authority to release medical information and a worker’s declaration. Insurers may also use their own form.

Seeking consent

Before collecting, using or disclosing personal and health information for the purpose of managing the worker’s injury and workers compensation claim, the insurer should obtain informed and valid worker consent. This promotes transparency in the claims process and protects the worker’s privacy.

Informed consent is where a worker is properly and clearly informed about how their personal and health information will be handled before the worker consents to the release and exchange of information. It also ensures the worker understands the implications of not doing so.

When requesting a worker’s written consent, insurers must provide advice to the worker about:

• the worker’s rights and obligations, including the right to withdraw or modify consent, and the potential impacts of not providing or withdrawing consent
• the types of information that may be collected, used or disclosed, and who is authorised to collect, use or disclose the information including the purposes for which the information may be used.

A worker’s consent is only informed and valid if they have capacity to consent (ie they have been given the above information, can understand this information and can form a view and communicate their decision about consent).

If an insurer has a concern about the worker's capacity to consent, for example, because they have a disability or have a limited understanding of English, the insurer should provide the individual with support to help them gain sufficient capacity to provide consent.

In short, consent is only valid if it is voluntary, informed, specific, current, and given by a person with capacity.

If there is any doubt about a worker’s ability to understand or communicate in English, then an appropriately qualified interpreter should be used.

Requests from third parties

Requests from third parties outside the worker's compensation claims management process (for example, life insurance or superannuation providers) are not covered by the signed authority to release medical information and workers declaration under the SIRA worker’s injury claim form provided to manage the worker’s compensation claim.

Where a request to disclose personal information is received from a third party outside the claims management process in relation to a worker’s injury and/or workers compensation claim, the insurer is to consider whether a new consent from the worker is required prior to disclosing the documents.

No claim form

The SIRA worker’s injury claim form provides a worker’s declaration consenting to the collection, disclosure and use of any personal and health information in connection with an injury/condition to which the worker’s claim relates.

In some situations, there may not be a SIRA worker’s injury claim form on the claim file (eg where there has been verbal notification of injury). In these situations, the insurer will need to ensure the written  consent of the worker is obtained. It is likely that the worker’s consent would be provided through a signed standard consent form for release of personal information or for the duration that is listed on the certificate of capacity in relation to the injury.

No certificate of capacity

In some situations, an insurer may approve medical treatment and expenses without a certificate of capacity (eg relying on a medical report). Where the insurer needs to liaise with worker’s nominated treating doctor, they will need to ensure they have appropriate authorisation or consent from the worker.

Revoking an authorisation or consent

A worker or their legal representative may advise the insurer that they have chosen to revoke their authorisation or consent.

Insurers are to contact the worker and acknowledge and discuss the revocation. Insurers should advise the worker if there are consequences of such revocation – eg the insurer may be prevented from obtaining the necessary information to determine a claim for medical treatment or assess entitlements.