Handling health information: what your practice must do

General information, not legal advice. Reviewed by: pending

This page explains the Australian Privacy Principles in plain English for practices using Refera. It has not yet been reviewed by a lawyer. Ask your own adviser how the Privacy Act 1988 (Cth) and any state health-records law apply to your practice.

Who this page is for: the practice owner or manager responsible for privacy.

Referral letters carry health information, which the Privacy Act treats as sensitive information. Your practice collects that information and decides why it is used. Refera handles it for you as a contracted administrative service provider. Your practice keeps its own legal duties; Refera’s controls help you meet them but do not replace them.

Before real referral data flows, Australian privacy counsel determines whether Refera is already an APP entity and whether a Privacy Act section 6EA opt-in registration is required. The proposed data processing agreement then sets out each party’s responsibilities.

APP 1: be open about how you handle referrals

Your practice needs an up-to-date privacy policy and practical procedures that make it work.

• Say in your privacy policy that the practice uses a service provider to administer referrals, and name the referral channel Refera reads, such as your Microsoft 365 referral inbox.
• Keep staff access tidy. Give each person their own Refera account and remove access promptly when someone leaves. See Team accounts and roles.
• Know who handles privacy questions and complaints at the practice.

APP 3: collect only what you need

A practice may collect health information only where it is reasonably necessary for its functions or activities, and with consent unless an exception applies. The Privacy Act’s permitted health situations cover some collection needed to provide a health service; your adviser can confirm which basis applies.

• Refera collects nothing new. It reads only what arrives in the referral inbox you choose, on your instruction, with no enrichment from other sources.
• Choose an inbox used for referrals. If other kinds of email arrive there, decide with IT whether a separate referral inbox or folder is better.

APP 5: tell patients

At or before the time you collect information, or as soon as practicable after, take reasonable steps to tell patients who is collecting it, why, who it is usually disclosed to, whether it is likely to go overseas, and how to access, correct or complain.

• A patient collection notice template is being prepared with counsel and is not yet approved. Until it is, update your practice’s own notice.
• If your practice’s agreement and activation enable AI-assisted administrative extraction, say so: referral text is processed in Australia to fill administrative fields for staff to check.
• Mention Refera wherever your notice lists service providers.

APP 6: use it for the reason you collected it

Use or disclose health information for the purpose you collected it, such as arranging the patient’s appointment, unless an exception applies, such as a directly related purpose the patient would reasonably expect.

• Refera uses referral information only to provide the contracted service. It never sells it, uses it for marketing or trains an AI model on it.
• Review every draft before anything leaves the practice. Nothing is sent without a named person approving it.
• Keep patient details out of support chats, contact forms and ordinary email to Refera.

A short checklist

The proposed data processing agreement asks each practice to:

1. have a lawful basis and authority for each collection, use and disclosure;
2. give patients an accurate collection notice where required;
3. name the Refera referral channel in its privacy materials;
4. control staff access and remove access that is no longer needed;
5. review every proposed message or action before using it;
6. keep clinical and patient-care responsibility; and
7. tell Refera promptly about a suspected misdirected email, unauthorised access or compromised account.

Related

• What Refera does and doesn’t do with your data
• Security, breaches and the NDB scheme
• Privacy and the APPs - every principle mapped to a Refera control.
• Breaches and state law

Administrative process-state only - Refera performs no clinical triage.