Privacy updates and training

Due to recent changes, this month we wish to remind you of the update to the Privacy Act 2020 with a new principle called the Information Privacy Principle 3A (IPP3A). For practices’, the new principle means there are additional notification obligations when receiving personal information about a patient from a third party. 

Under IPP3A, if your practice receives patient information from another provider (such as a lab, hospital, specialist, pharmacy or ACC), you must take reasonable steps to let the patient know their information has been collected. This change applies to any information collected on or after 1st May 2026. 

This includes telling patients: 

• What information was received 
• Why it was collected 
• Who holds it (your practice) 
• How to contact you 
• Their right to access and correct their information 

For most practices, compliance can be covered by your privacy statement, patient information provided on enrolment, and day-to-day conversations with patients. 

The IPP3A includes practical exceptions similar to IPP3, with additional provisions for: 

• Publicly available information 
• National security or international relations 
• Trade secrets and commercial factors 
• Serious risks to public health or safety 

The Office of the Privacy Commissioner provides clear, practical guidance on steps you can take to ensure compliance, and we recommend using their resources as your primary reference point: 

• Review the IPP3A requirements and guidance 
• Check your privacy statement and overall approach using their Doing Privacy Well framework. 
• Make sure your staff training is up to standard. The Privacy Commissioner expects all organisations to demonstrate that they have provided staff with a basic understanding of privacy, with training: 
  • Provided at induction or before accessing systems 
  • Relevant to staff roles 
  • Refreshed over time 
• Use the Commissioner’s free online training modules to support your team, including health-specific and breach response training. 
• Refresh your understanding of privacy breach notification requirements (including the 72-hour reporting timeframe where serious harm is likely). 

These obligations apply to all personal information your practice holds, including employee information. 

The Privacy Commissioner’s website is designed to guide you through what ‘good’ looks like in practice. And if you need help applying this within your practice, the HealthyPractice team is here to support you, additionally we have further resources and guidance on our site here. 

Before we go, last month we posed a question of the month:  

Q: If an employee is off sick during their 90-day trial period, can the trial period be extended? 

Thanks to those that took the time to respond, you were all on the right track:  

A: No, a 90-day trial period cannot be extended due to sickness. It begins on the first day of employment, and the employment contract outlining the trial period must be signed before the employee commences any work, otherwise it is invalid and is unlikely to hold up to any scrutiny. We have further information on the 90 day trial period on our site. 

June’s question of the month is: 

Q: If an employee agrees to work on a public holiday for 4 hours on a day that is their normal day of work, but they would normally work 8 hours on a non-public holiday, what entitlements are they owed? 

We’d love to hear your thoughts!  

The HealthyPractice team