Privacy update – what every medical student should know

Privacy and confidentiality are cornerstones of healthcare, but privacy issues are not always obvious in a busy clinical environment. In MIPS’ February webinar, Privacy update: Medico-legal issues for medical and dental practitioners, MIPS Chief Medical Officer Dr Owen Bradfield and MIPS Claims Advisor, and former principal lawyer, Nevena Brown discussed common dilemmas and practical ways to protect patients and practitioners.¹

Know what counts as health information

Health information extends beyond the notes in a patient’s medical record. It can include referral letters, emails between practitioners, reports, handwritten notes, clinical photographs, audio recordings and even a clinician’s opinion about a patient.²

Under the Privacy Act 1988 and the Australian Privacy Principles, healthcare providers must consider how information is collected, used, disclosed, stored, accessed, retained and deleted. Only information reasonably necessary to provide the relevant healthcare service should be collected.^2,3,4

Privacy laws can vary between Australian states and territories, and between public and private healthcare settings. If you are on placement in a hospital, follow the organisation’s privacy policies and seek guidance from your supervisor or the hospital’s privacy team when needed.^1,2

Access is not permission

Having access to an electronic medical record does not mean you have permission to view it. Records should only be accessed for a genuine clinical purpose connected with the patient’s care.^1,2

Curiosity, self-education or interest in a high-profile patient are not valid reasons. You should not use a workplace system to look up your own record or the records of friends or family members. Electronic systems can audit who has viewed a file, and inappropriate access may result in workplace disciplinary action, regulatory consequences or even criminal charges.¹

Take care with clinical photography

Clinical photographs are health information and must be handled with the same care as other parts of the medical record. Before taking an image, make sure the patient understands why it is needed, how it will be used, where it will be stored and their right to access it. Their consent is essential.^1,2,5

MIPS’ medico-legal experts advise using a device dedicated to clinical purposes – not your personal mobile phone. Taking clinical images on a personal phone can mix them with personal photographs and may result in the images being automatically uploaded to a personal cloud storage account.^1,5

Ensure clinical photographs are transferred to the patient’s medical record, where they can be stored and managed appropriately. Images must not be retained in personal photo libraries or shared through personal messaging accounts.^1,5

Pause before you photograph, record or share

Privacy decisions can be complex, and students are not expected to navigate them alone. Before accessing, photographing, recording or sharing patient information, pause and consider whether it is necessary, authorised, and appropriately protected. Follow local policy and ask your supervisor when unsure. Building these habits now will help protect patient trust throughout your career.

Think before using AI

AI scribes and other digital tools introduce further privacy considerations. Before an AI scribe is used, the patient’s consent must be obtained. You should also understand what information the tool collects, where it is stored and how it may be used.^1,6

Never enter identifiable or potentially re-identifiable patient information into an unapproved, publicly available AI platform. Removing a patient’s name may not be enough: information about their circumstances or a clinical image could still reveal their identity. AI-generated notes must also be checked for accuracy before they become part of the medical record.^1,2,6

Consent is central, but there are exceptions

Patient consent is generally needed before health information is disclosed. Exceptions may apply, including mandatory reporting obligations, emergencies, subpoenas, coronial notices and properly authorised police requests. When disclosure without consent is necessary, only relevant information should be released, and the reasons should be documented.^1,2,4

If police or another third party asks for records, do not assume the request itself provides authority to disclose them. Check the legal basis and seek advice if you are uncertain.¹

Want to learn more? Watch the MIPS webinar: Privacy update: Medico-legal issues for medical and dental practitioners

References

1. Medical Indemnity Protection Society. Privacy update: Medico-legal issues for medical and dental practitioners [webinar]. February 2026. Available at: MIPS privacy update webinar (accessed September 2026).
2. Office of the Australian Information Commissioner. Guide to health privacy. Version 2.0, May 2025. Available at: Guide to health privacy (accessed September 2026).
3. Australian Government. Privacy Act 1988 (Cth). Available at: Privacy Act 1988 (accessed September 2026).
4. Office of the Australian Information Commissioner. Australian Privacy Principles guidelines. Available at: Australian Privacy Principles guidelines (accessed September 2026).
5. Office of the Australian Information Commissioner. Taking photos of patients. Available at: Taking photos of patients (accessed September 2026).
6. Office of the Australian Information Commissioner. Checklist: Privacy considerations when using commercially available AI products. Available at: Privacy considerations when using commercially available AI products (accessed September 2026).