Privacy

This statement details how the Health Professional Councils Authority (HPCA) and the Health Professional Councils manage your personal¹ and health² information and how the HPCA and Councils are permitted to use and disclose that information in accordance with NSW privacy laws.

We must follow strict privacy laws about how we handle people’s information. Two main NSW laws set the rules for how we must collect, use, store, and protect your information.

• The Privacy and Personal Information Protection Act 1998: This covers personal information that isn’t about your health, such as your name, address, or contact details.

• The Health Records and Information Privacy Act 2002: This covers personal information about your health, such as medical records or health history.

Collection of your personal and health information

We may collect personal and health information about you. This helps us manage complaints and notifications about registered health practitioners and carry out our other legal functions, including maintaining the Register of NSW Pharmacies. 

We usually collect your personal and health information directly from you.

However, we may also receive information from other people or organisations. For example, we may receive information:

• if someone makes a complaint or notification about you

• from other regulators, such as the Health Care Complaints Commission (HCCC), when it is relevant to the work we are legally required to do.  

Learn more about how we regulate pharmacy businesses

Use or disclosure of your personal and health information

We may use your personal and health information or disclose it to other organisations to fulfil our functions and responsibilities under the Health Practitioner Regulation National Law (NSW).

This includes meeting our obligations under the Health Care Complaints Act 1993 (HCC Act), and associated regulations³, which require and authorise us to collect certain information.

For example, your personal and health information may be used or disclosed:

• to manage a complaint or application, or for other authorised functions under the National Law
• to keep a public Register of Pharmacies that includes particulars of approved pharmacy premises and the names of registered holders of financial interests/owners
• to contact you for further information about a complaint, notification, or application
• to authorised third parties to help prevent a serious and/or imminent threat to someone’s life, health or welfare
• for operational and management activities, including those related to funding, planning, safety, and quality improvement
• to monitor and evaluate our regulatory and associated administrative processes, and for other quality assurance purposes
• to manage a legal action, claim or complaint brought against the HPCA and/or the Councils
• to provide information to co-regulators, including the HCCC, Australian Health Practitioner Regulation Agency (Ahpra) and the National Boards for each health profession as authorised or required by law.

The law also permits or requires us to disclose your personal and health information to third parties in other circumstances including:

• for research, training, and management purposes in accordance with Statutory Guidelines on Research issued under NSW privacy law
• to share information where the information relates to the safety, welfare, or wellbeing of children in accordance with the Children and Young Person Care and Protection Act 1998 (NSW)
• to use and disclose information for law enforcement purposes, or to comply with subpoenas, summonses or warrants;
• statutory reporting to State and Commonwealth government agencies. 

Who we usually disclose your personal and health information to

• Our professional advisors and contractors (strictly on the basis that the information is to be used only for providing services to or performing functions on behalf of the HPCA or the Councils and must not be otherwise disclosed).
• Australian and overseas health regulators (“registration authorities”), defined by section 5 of the National Law)⁴ including the HCCC, Ahpra and National Boards.
• Commonwealth, State and Territory entities whose functions relate to health practitioner professional services or regulation. 
• Researchers for public interest research projects as approved by a Human Research Ethics Committee.
• Other government entities where authorised or required by law.

Security of your personal and health information

The HPCA and the Councils, follow strict government standards regarding the secure storage of your health and personal information in all formats. We regularly enhance and audit our systems to protect your information from unauthorised access and loss. We hold personal and health information in paper records and/or electronic record systems.

We retain your personal and health information for as long as is necessary and only for the purpose for which that information was collected, and to the extent permitted by applicable laws, specifically the State Records Act 1998 (NSW)open_in_new.

Disclosure of your personal and health information overseas

If you practise an equivalent health profession in another country (or apply to do so), we may provide your personal and health information to overseas registration authorities, including in response to an inquiry from the relevant registration authority.

You can access and correct your personal and health information

You can request access to the personal and health information we hold about you. Normally, you must make your request in writing and provide proof of identity.  We respond to access to information requests as soon as possible. In most cases, this is no later than 28 days. A fee may apply.

A request to access your information may be declined in certain circumstances.

If you believe the information held about you is incorrect or an error has been made, please let us know. Where appropriate, we will correct errors or make a notation to the relevant record.

Please send any questions or complaints about the privacy of your personal or health information, or requests to access or amend it, to the Information and Privacy Officer at hpca-information-privacy@health.nsw.gov.au.

Further information

For further details about how the HPCA and the Councils collect and manage personal and health information see our NSW Health Privacy Management Planopen_in_new and the NSW Health Privacy Manual for Health Informationopen_in_new. 

You can also contact the Office of the NSW Privacy Commissioner via telephone at 1800 472 679 or visit the Information and Privacy Commission NSW website open_in_newfor further information about your privacy in NSW.

Notes  

^{1 Section 4, Privacy and Personal Information Protection Act 1998}open_in_new^{, Definition of “personal information”}

^{2 Section 6, Health Records and Information and Privacy Act 2002}open_in_new^{, Definition of “health information”}

^{3 Health Practitioner Regulation (New South Wales) Regulation 2016}open_in_new 

^{Health Practitioner Regulation National Law Regulation 2018}open_in_new  

^{Health Practitioner Regulation (Adoption of National Law) Regulation 2022}open_in_new

^{Health Practitioner Regulation (Adoption of National Law) Regulation 2023}open_in_new

^{4 A registration authority means—}

^{(a)  a local registration authority; or}

^{(b)  an entity of a jurisdiction outside Australia that has responsibility for registering health practitioners in that jurisdiction.}

The Health Professional Councils Authority (HPCA) maintains this website. This Privacy Policy applies to all the publicly accessible pages on our website.

We are not responsible for the privacy practices of any third-party websites linked to from our site. 

If you have questions about this website, how this Privacy Policy applies, or you want to ask for access to information we hold, please contact us on 1300 197 177.

How we handle information when you visit our website

When you visit this website, we treat any information you provide to us responsibly and in line with the NSW Government’s privacy obligations. These obligations are set out in the Privacy and Personal Information Protection Act 1998 (NSW).open_in_new 

What information do we collect?

We automatically record some information when you visit pages on our website. 

This information includes:

• the IP (Internet Protocol) address of the machine you are using

• the date and time of your visit to the site

• the pages you accessed and documents you downloaded

• the previous site you visited

• the type of browser and operating system you have used.