The Health Professional Councils Authority (HPCA) provides staffing, administrative and business services to support the 15 health professional Councils¹ in NSW.
 

The Councils regulate the health, conduct and performance of registered health practitioners in NSW and perform any other functions imposed by law.

The HPCA and the Councils are bound by a privacy framework, principally being the Privacy and Personal Information Protection Act 1998 (PPIP Act) which applies to non-health related personal information, and the Health Records and Information Privacy Act 2002 (HRIP Act) which applies to personal health information.

This statement details how the HPCA and Councils manage your personal² and health³ information and how the HPCA and Councils are permitted to use and disclose that information in accordance with NSW privacy laws.
 

Collection of your personal and health information

To manage complaints and notifications about registered health practitioners (and students registered to undertake health practitioner training in NSW), and to exercise other statutory functions, the HPCA and the Councils may collect a range of personal and health information about you.

The HPCA and the Councils, generally collect your personal and health information directly from you. However, in some cases, a third party may provide your personal or health information (for instance if we receive a complaint or notification about you). We may also receive information from other regulators, like the Health Care Complaints Commission (who may have engaged with you), where the receipt of information is relevant to our statutory responsibilities.
 

Use or disclosure of your personal and health information

Your personal and health information may be used by the HPCA and the Councils or disclosed to other organisations to enable the HPCA and the Councils to fulfil their functions and responsibilities under the National Law, including to facilitate compliance with the Health Care Complaints Act 1993 (HCC Act), and associated regulations⁴ (which require and authorise us to collect certain information).

For example, your personal and health information may be used or disclosed as follows:

• to manage a complaint or application, or for other authorised functions under the National Law;
• to contact you for further information about a complaint, notification, or application;
• to authorised third parties to help prevent a serious and/or imminent threat to someone’s life, health or welfare;
• for operational and management activities, including those related to funding, planning, safety, and quality improvement;
• to monitor and evaluate our regulatory and associated administrative processes, and for other quality assurance purposes;
• to manage a legal action, claim or complaint brought against the HPCA and/or the Councils;
• to provide information to co-regulators, including the Health Care Complaints Commission, Australian Health Practitioner Regulation Agency (Ahpra) and the National Boards for each health profession as authorised or required by law.

The law also permits or requires your personal and health information to be disclosed to other third parties, for example:

• for research, training, and management purposes in accordance with Statutory Guidelines on Research issued under NSW privacy law;
• to share information where the information relates to the safety, welfare, or wellbeing of children in accordance with the Children and Young Person Care and Protection Act 1998 (NSW);
• to use and disclose information for law enforcement purposes, or to comply with subpoenas, summonses or warrants;
• to State and Commonwealth government agencies for statutory reporting purposes

Who are the types of bodies and persons to whom we usually disclose your personal and health information?

Your personal and health information may be provided to:

• our professional advisors and contractors (strictly on the basis that the information is to be used only for providing services to or performing functions on behalf of the HPCA or the Councils and must not be otherwise disclosed);
• Australian and overseas health regulators (“registration authorities”), defined by s.5 of the National Law)⁵ including the Health Care Complaints Commission (Commission), the Australian Health Practitioner Regulation Agency (Ahpra) and National Boards;
• Commonwealth, State and Territory entities having functions relating to professional services provided by health practitioners or the regulation of health practitioners;
• researchers for public interest research projects as approved by a Human Research Ethics Committee;
• other government entities where authorised or required by law

Security of your personal and health information

The HPCA and the Councils, follow strict government standards regarding the secure storage of your health and personal information in all formats. Systems are regularly enhanced and audited to protect your information from unauthorised access and loss. Personal and health information is held in paper records and/or electronic record systems.

Your personal and health information is retained for as long as is necessary and only for the purpose for which that information was collected, and to the extent permitted by applicable laws, specifically the State Records Act 1998 (NSW).
 

Disclosure of your personal and health information overseas

If you practise an equivalent health profession in another country (or apply to do so), your personal and health information may be provided to overseas registration authorities, including in response to an inquiry from the relevant registration authority.
 

You can access and correct your personal and health information

You are entitled to request access to your personal and health information held by the HPCA and the Councils. Normally requests must be in writing, with proof of identity provided.  Requests for access to information are responded to as soon as possible, and in most cases no later than 28 days. A fee may apply.

 A request to access your information may be declined in certain circumstances.

If you believe the information held about you is incorrect or an error has been made, please let us know. Where appropriate, errors will be corrected or a notation to the relevant record will be made.