This page provides information for Queensland Health staff about the management of information related to consumers receiving treatment and care in Queensland Health mental health alcohol and other drug services, including:

  • information sharing requirements and practices
  • common legislative frameworks that apply to information sharing
  • when and how consumer information can and should be shared

This information should be read in conjunction with the following Queensland Health resources:

Each Hospital and Health Service (HHS) also has its own Privacy Policy which must be complied with. You can access HHS Privacy Policies from individual Hospital and Health Services.

Information sharing principles

Queensland Health staff play a vital role in safeguarding patient privacy while enabling appropriate sharing of information to support treatment, safety, and continuity of care. Appropriate and relevant information sharing is essential for quality treatment and care.

Key principles

  1. Share information appropriately and only when relevant to support safe, effective treatment and care.
  2. Prioritise information sharing when necessary to protect the health, safety, and wellbeing of consumers and others.
  3. Seek consumer consent wherever possible and continue efforts to obtain consent if capacity is impaired.
  4. If obtaining consent is not practicable, assess whether disclosure is permitted or required under relevant legal frameworks.
  5. Consumers should be informed about who has access to their information and why.
  6. Use information only for the purposes for which it was shared*

    *Unless required by law to disclose further – refer to ‘Mandatory information disclosure’.

  7. Document decisions related to information sharing to uphold accountability, support clinical governance and protect patients and staff.

National Mental Health Information Sharing Framework

State and Territory health and mental health services must work collaboratively to support positive service and treatment outcomes for consumers interacting with multiple or cross-jurisdictional services. Queensland is a signatory to the National Mental Health Information Sharing Framework (PDF, 1MB) (National Framework), which provides a high-level principles-based commitment to information sharing between states and territories.

Queensland's information sharing mechanisms are aligned with the National Framework’s objectives, to ensure permitted confidential information disclosure (without consent where necessary) to support continuity of mental health care and community protection from harm.

Understanding requirements and obligations

It is essential that all staff understand their obligations regarding the collection, protection, and release of patient information. Queensland Health staff are required to complete core training that must be completed on induction and renewed periodically as specified in Queensland Health’s Core Mandatory Training Policy (PDF 289 kB). Training includes components on information privacy and confidentiality, including obligations under:

Staff working in authorised mental health services must also complete additional requirements:

  • Consumer Integrated Mental Health and Addiction (CIMHA) (iLearn) - CIMHA is a statewide consumer-centric clinical information system designed to support the provision of public mental health alcohol and other drug services in Queensland and is the designated patient record for the purposes of the Mental Health Act 2016. Provision of user access to CIMHA may require completion of some or all training modules.
  • Mental Health Act 2016 (Queensland Centre for Mental Health Learning (QCMHL)) – This training is mandatory for staff seeking appointment as an authorised doctor or authorised mental health practitioner under the Mental Health Act 2016. The course can also be used by other staff of authorised mental health services or anyone in the community who wishes to gain a detailed understanding of the Mental Health Act 2016.
  • Chief Psychiatrist Patient Records Policy (PDF 169 kB) – Provides mandatory requirements for management of patient records. Any person performing a function or exercising a power under the Mental Health Act 2016 must comply with this policy.

Receiving and using consumer information

Queensland Health staff can receive and consider information from anyone who has an interest in a consumer’s health and wellbeing.

There is no barrier to staff receiving information however use of that information is only for the purposes for which it was shared.

Responsible information sharing

Information sharing is essential for safe, coordinated and consumer-centred mental health, alcohol and other drug assessment, treatment and care.

When and how relevant information can be shared depends on the purpose for sharing the information, including who it is being shared with, and the person’s capacity to provide informed consent to their information being shared. The appropriateness of sharing information should be considered for each information sharing situation individually. Staff should:

  • disclose information in accordance with an appropriate legislative mechanism (including prescribed agreements)
  • use professional judgement and exercise discretion
  • obtain consumer consent wherever possible
  • only share what is necessary for the consumer’s treatment and care or to protect the consumer or others from harm
  • only share information that is relevant to the request or situation
  • ensure information is accurate and up to date
  • share information securely and in a timely manner
  • document what you have shared, with whom and why.

Sharing information with family, carers, support people and others

Staff should ensure that everyone identified as important to the consumer is appropriately engaged and involved in the consumer’s treatment and care. Sharing relevant information may help enhance relationships between the consumer and their carer/family. It may also assist in reducing stress experienced by the carer/family member and be beneficial to their own mental and physical health.

Supporting recovery: For most people receiving care from mental health alcohol and other drug services, the meaningful engagement of people who play a significant part in their lives is an important part of their recovery. It is fundamental to a consumer centred approach that information is shared as often as possible between clinicians, consumers and those involved in helping a person’s recovery.

Ensuring safety: It is also imperative to share relevant information to protect the health, safety and wellbeing of consumers, their families, carers, support people and other people who may interact with the consumer.

Consumer involvement and consent

The importance and need for information sharing and its relationship to supporting recovery should be regularly discussed with consumers. A person’s preference regarding disclosure of their information should be respected whenever possible.

Sharing information with informed consent is always preferable. If the person lacks the capacity to consent to the sharing of information, staff should as far as practicable:

  • consider whether a relevant advance health directive has been made
  • identify a substitute decision maker where relevant, and seek consent (such as an attorney or a statutory health attorney appointed under the Powers of Attorney Act 1998 or the Guardianship and Administration Act 2000)
  • make ongoing attempts to get consent as the person’s health improves
  • share information without consent as permissible by law if required and appropriate.

It is preferable that this consent process is clinician led.

For people receiving treatment or care under the Mental Health Act 2016, refer to the reference guide for clinicians about what you must discuss with consumers.

Capacity to consent

A person has capacity to give consent to information sharing if the person can:

  • understand the nature and effect of decisions about the matter
  • freely and voluntarily make the decision about the matter
  • communicate the decision in some way.

Capacity to consent is decision specific. A person may have capacity to consent to some decisions but not others.

Information disclosed or shared should always be documented in the consumers’ health record, including what information was shared, with who and for what purpose.

Consent for children

For children (under the age of 18), staff must seek consent to share the child’s information from their parent or guardian unless the clinician believes the child is mentally and emotionally mature enough to understand and consent to the information sharing. A clinician should apply the Gillick Test to determine if a child is capable of making their own decision about information sharing.

The Gillick Test refers to the common law as it applies to a young person’s ability to consent to medical treatment. Consent is based on the capacity of the young person to understand the nature and extent of treatment, the side effects of treatment and the ability of the young person to communicate their decision. Find out more about the Gillick Test.

The Office of the Information Commission Queensland website also has information on how the Information Privacy Act 2009 applies to children and minors.

Informed consent

When seeking informed consent for information sharing from a consumer, staff must:

  • explain the request for the disclosure of information, including the specific information requested, the purpose, who will have access and how it will be used.
  • communicate in a way the consumer will understand, using clear and concise language.
  • offer appropriate cultural support including interpreters, liaison officers, First Nations health workers or Transcultural health workers.
  • provide the consumer sufficient time to consider and clarify the purpose, benefits, and potential risks of sharing the specific information.
  • assure the consumer that they can decline or withdraw their consent at any time prior to information being shared.
  • make sure there is shared understanding with the consumer of what has been agreed regarding disclosure, including what information they are consenting to be shared.
  • make sure that any consent is given voluntarily and preferably in writing.
  • document the consumer’s consent, consent process and the steps taken to share information in the consumer’s health record, including what information was shared, with who and for what purpose.

Learn more about Informed consent and find clinician resources and Guide to Informed Decision-making in Health Care.

Validity of consent

Consent cannot be assumed to endure indefinitely. Good practice is to inform a consumer that they are entitled to change their mind and withdraw their consent at any time. Prior to information being shared under prior consent processes staff must ensure that consent is still current and relevant. Staff should consider:

  • what purpose consent was given for initially
  • whether consent provided was clinician-led
  • any changes that may have affected the consent since it was initially given (e.g., the specificity and sensitivity of the information that a consumer has consented to disclosure of), and
  • how long a period has passed since consent was given.

Information sharing without consent

Information sharing with informed consent is always preferred. In some circumstances, where permissible by law, staff must consider sharing information when a consumer, or a person empowered to act on their behalf, does not consent or cannot consent (e.g. the person lacks capacity), or it is not practicable to obtain consent. This decision should be made on a case-by-case basis based on the clinician’s professional judgement.

Sharing information when a person has expressly refused should only occur in extremely limited circumstances if permitted or required by law (refer to the Legislative mechanisms for sharing information section), such as when it’s:

  • necessary for the person’s treatment and care
  • communicated in general terms to a person who has ‘sufficient interest’ in the health and welfare of a consumer
  • to prevent serious risk to life, health or safety* (e.g. If there is a risk of suicide or a person expresses an intention to harm themselves and/or others)
  • for the protection, safety or wellbeing of a child*
  • allowed under an interdepartmental agreement or memorandum of understanding (MoU).

*The relevant chief executive must authorise disclosure in these instances.

A decision to share information despite a consumer’s refusal must be documented in their health record, including the legislative mechanism used to allow the disclosure, what information was shared, with who and for what purpose.

Read the Confidentiality General Principles Guideline (PDF, 791KB) (Queensland Health intranet access required) to learn more about ‘sufficient interest’ and the duty of confidentiality exceptions under the Hospital and Health Boards Act 2011 (Qld) including the circumstances when confidential information may be disclosed.

Legislative mechanisms for sharing information

Queensland legislation provides a flexible framework which supports information sharing and disclosure in certain situations, while recognising the person’s right to confidentiality and privacy.

Legislation that allows for information sharing to protect the health, safety and wellbeing of consumers, family, carers and the community, includes but is not limited to:

How the purpose for disclosing information aligns with the appropriate information sharing mechanism must be considered. There may be circumstances where multiple information sharing frameworks could be used to authorise a disclosure. Staff should use professional judgement and exercise discretion to determine the most appropriate courses of action, taking into account relevant circumstances and potential impacts.

The decision regarding which legislative mechanism was used, and relevant rationale should be clearly documented in the consumer’s health record.

Disclosure permitted by law

Staff may exercise discretion in deciding whether to disclose particular information, where permitted by law. In providing this information, the staff member is not deemed to have breached the duty of confidentiality and is protected under the relevant legislation.

Information disclosed or shared under a legislative authority should always be documented in the consumer’s health record.

Hospital and Health Boards Act 2011

The Confidentiality General Principles Guideline (Queensland Health intranet access required) developed by the Department of Health Privacy and Right to Information Unit explains the duty of confidentiality exceptions in detail and the circumstances when confidential information may be disclosed, and associated penalties for breaches of confidentiality and privacy.

There is a duty of confidentiality under Section 142 of the Hospital and Health Boards Act 2011 that staff must not disclose confidential patient information unless permitted or required by law.

Where circumstantial information sharing without consent is required, this Act provides a legislative framework to allow it, including (but not limited to):

  • Section 145 – Disclosure of confidential information for care or treatment of person
  • Section 146 – Disclosure to a person who has sufficient interest in the health and welfare of person
  • Section 147 – Disclosure to lessen or prevent serious risk to life, health or safety
  • Section 148 – Disclosure for the protection, safety or wellbeing of a child
  • Section 151 – Disclosure to another entity under a prescribed agreement
  • Section 160 – Disclosure of confidential information in the public interest

Mental Health Act 2016

The Mental Health Act 2016 allows for designated persons to share confidential information when carrying out their responsibilities under the Act. Chapters 9 and 17 of the Mental Health Act 2016 outline key provisions for sharing confidential information and enable confidential information to be shared with and by families, carers, independent patient rights advisers and other support persons.

Learn more and access resources about Mental Health Act 2016.

Domestic and Family Violence Protection Act 2012

The DFVP Act (Part 5A) enables staff to share relevant information with any other prescribed agency, specialist domestic and family violence service provider or support service provider if they reasonably believe a person fears or is experiencing domestic violence, and giving the information may help the receiving agency to lessen or prevent a serious threat to the person’s life, health or safety because of domestic violence.

A person employed or engaged by a prescribed agency (e.g. a mental health clinician working in an authorised mental health service, or an Independent Patient Rights Adviser engaged by the Hospital and Health Service) may give, receive or use information under the DFVP Act if the person’s duties include:

  • assessing threats to life, health or safety because of domestic violence; or
  • taking action to lessen or prevent threats to life, health or safety because of domestic violence, including by providing assistance or a service to a person involved in the domestic violence.

All consumer assessments should include considerations of domestic and family violence – actual or potential. Staff should discuss any identified domestic and family violence or risk of violence and proposed actions with their team leader or senior manager or equivalent. Where there is an assessed risk of domestic and family violence, staff should share information with prescribed entities, specialist domestic and family violence services and support service providers.

While recommending consent be sought whenever safe, possible and practicable, the Domestic and Family Violence Protection Act 2012 recognises that, in almost all situations involving domestic and family violence, consent should not be sought from perpetrators, and the safety and protection of victims takes precedence over gaining a perpetrator’s consent to share information.

Guidance on recognising and supporting consumers and their families, carers or support people who may be at risk of domestic and family violence is available on the Queensland Health Domestic and family violence website.

Learn more: The Domestic and Family Violence Information Sharing Guidelines and Domestic and Family Violence Information Sharing Guidelines: practical guidance on the Department of Families, Seniors, Disability Services and Child Safety site, provide practical guidance including examples, flowcharts and case studies on the interpretation and application of the domestic and family violence information sharing provisions. The site also provides resources, training, and an interactive decision tree to guide users through the decision-making process about information sharing about domestic and family violence.

Weapons Act 1990

Under the Weapons Act 1990, staff may inform the Queensland Police Service of a consumer’s unsuitability to possess a weapon e.g. a consumer with a history of attempted suicide, aggression and/or violence may be unsuitable to have a firearm because it poses a risk to their health and safety or the safety of others.

Access resources on Queensland Police Services Mental and physical health website.

Information disclosed under a legislative requirement should always be documented in the consumer’s health record.

Guardianship and Administration Act 2000

Under the Guardianship and Administration Act 2000, health providers are to give all necessary information to a guardian or attorney of an adult who has power for health matters to enable the guardian or attorney to make an informed decision regarding the adult’s treatment and care.

Access information and resources about making decisions for others as a guardian or administrator on the Queensland Government website.

Child Protection Act 1999

When considering suspected child abuse and neglect, there are mandatory reporting and information disclosure requirements regarding children and minors.

Doctors and registered nurses are mandated to report information under the Child Protection Act 1999. This includes when there is reasonable suspicion that a child is at unacceptable risk of significant harm caused by physical or sexual abuse including if:

  • a child may be in need of protection
  • an unborn child may need protection after he or she is born.

All clinicians have a duty of care to report any reasonable suspicion or evidence to any child abuse or neglect to the Department of Families, Seniors, Disability Services and Child Safety, and must notify the Hospital and Health Service Child Protection Liaison Officer or Child Protection Advisor of suspicion or evidence of any form of child abuse or neglect.

The Queensland Health Guidelines: Reporting concerns of child sexual abuse and neglect to Child Safety and Sexual Offences against Children to the Police (PDF 2808 kB) provides instructions on the actions required under Queensland legislation to report concerns of child abuse and neglect.

Information and resources are available on the Queensland Health Child Protection and Wellbeing Unit (Queensland Health intranet access required) and Child protection education resources for health workers .

You can also find out more about mandatory reporting for child safety on the Department of Families, Seniors, Disability Services and Child Safety website.

MHAOD service staff should use discretion when sharing confidential information and guidance and/or required approvals should be sought from senior management and/or the local Hospital and Health Service legal unit as appropriate.

Mandatory information disclosure

In certain circumstances, it is mandatory to report particular information in relation to a consumer. In providing this information, the clinician is not deemed to have breached the duty of confidentiality and is protected under the relevant legislation.

Information Sharing Agreements

There are a range of Agreements and Memorandum of Understanding (MOU) documents that facilitate information sharing with other agencies and interstate jurisdictions in specific circumstances. These agreements exist to establish consistent processes for managing and sharing information for shared consumers/clients to coordinate the provision of services and prevention of harm.

Learn more about some of Queensland Health’s interdepartmental agreements with other government agencies and statutory bodies, including:

  • Queensland Corrective Services
  • Parole Board Queensland
  • Queensland Police Service
  • Department of Justice and Attorney-General

Learn more information about interstate agreements developed with interstate government agencies to facilitate patient transfers and transport for consumers moving between state lines.

Disclosure of information for research purposes

Disclosure of confidential information internally for research purposes: Explains the privacy obligations and circumstances when it is appropriate to disclose confidential consumer information internally for research purposes. For more information, contact the Privacy and Right to Information Unit via email rti-privacy@health.qld.gov.au.

Record keeping and compliance

All decisions about sharing consumer information must be documented in the consumer’s health record. The documentation must be in compliance with Queensland Government, Queensland Health and Hospital and Health Service documentation and record keeping standards.

When sharing information, staff must document:

  • details regarding the consent process, including whether consent was given or not given
  • which legislative mechanism the information was shared under
  • what information was shared and why (details about the request i.e. purpose)
  • who the information was provided to
  • what method/how the information was shared

If staff decide not to share information, they should document the reasons why in the consumer’s health record.

Accurate and timely record keeping supports consumer care, legislative compliance, complaint management and review of matters as required.

Compliance and procedures

Penalties may be set out in legislation for the improper use or disclosure of confidential or personal information.

Obligations for Queensland Health staff regarding the privacy and confidentiality of consumer information are set out in the Privacy and Confidentiality guideline available on QHEPS.

In addition, the Code of Conduct for the Queensland Public Service sets out the standards of behaviour regarding the appropriate use and disclosure of information which apply to everyone working for Queensland Health.

Each Hospital and Health Service also has its own local procedures for privacy and confidentiality compliance requirements.

Decision Maker & Privacy and Confidentiality Contact Officer contacts - contact information for enquiries about personal information, health records, privacy and Right To Information requests for each Hospital and Health Service.

Auditing

Auditing the disclosure of patient information plays a critical role in clinical care. It helps meet legal and ethical standards and ensures both patients and staff are protected through transparent and accountable practices.

As per Recommendation 2 of the Operation Impala Report on misuse of confidential information in the Queensland public sector, any agreement which sets out processes and roles in relation to information sharing between agencies should contain clauses that specify:

  • which agency is responsible for conducting targeted audits of shared data
  • regularly defined intervals at which audits are to be conducted, preferably quarterly.

Learn more about Operation Impala on the Crime and Corruption Commission Queensland website.

Hospital and Health Services

Hospital and Health Services must also establish and administer an audit program to ensure that information disclosed under interdepartmental or prescribed agreements is:

  • consistent with the agreement
  • documented in the consumer record.

Help and support

In the first instance, staff should contact their local Right to Information Unit or Legal Unit within their Hospital and Health Service for queries regarding information sharing and the most appropriate mechanism for disclosure.

Decision Maker & Privacy and Confidentiality Contact Officer contacts provides contact information for enquiries about personal information, health records, privacy and Right To Information requests for each Hospital and Health Service.

For help and support about privacy obligations, security of personal information, guidelines for complaints and breaches contact the Department of Health Privacy and Right to Information Unit.

Information privacy resources (access to Queensland Health's intranet required) are available on QHEPS.

For consumers, clients and carers

Consumers, clients or carers can contact their local Decision Maker & Privacy and Confidentiality contact officer at their Hospital and Health Service for help with:

  • requesting their consumer record
  • making a Right to Information request
  • questions, feedback or complaints about information sharing.

Further information

Last updated: 19 January 2026