Tricky situations

Privacy and confidentiality

Patient health information is confidential by law. When in doubt, err toward not sharing — you can always call back after you've verified, but you can't take information back once it's out.

The core rule

You can only share patient information with:

The patient themselves, after identity is confirmed
The referring doctor
A third party the patient has given explicit written consent to

Everything else needs a check with the office manager first.

At the desk

Don't read out patient names, DOB, or clinical details where other patients can hear
Turn monitors so the waiting room can't see the screen
Close patient files between appointments — don't leave charts open on the counter
Never discuss a patient with a colleague in front of other patients

On the phone

Before you discuss any patient-specific detail, confirm the caller's identity with at least 3 factors:

Full name
Date of birth
Address or Medicare number

If the caller can't pass, stay polite and firm:

"I'm not able to share that information without confirming your identity — I can call you back on the number we have on file if that helps."

Their own appointment times and locations
Their own referral details on file
What the scan involves, prep, and fasting requirements
Prices and billing codes

Imaging results or interpretations — these go from the radiologist to the referring doctor, not direct to the patient
Clinical opinions of any kind
Other patients' information, ever, including to family

Requests for records

The process splits by what the patient wants — their images, their report, or both.

Images. A patient can have a copy of their own imaging on USB. The USB must be brand new and still sealed in its packaging — don't reuse a stick, and don't accept a USB the patient brought in. Hand it over in person at the front desk.

Report. We don't release the written report directly to the patient. Direct them to pick it up from their GP, referring doctor, or allied health professional — the report is sent there.

Third-party requests (insurer, lawyer, another clinic)

Third-party requests require either:

A signed patient consent form on file, or
A valid subpoena or court order.

If either isn't clearly in place, escalate to the office manager before sending anything.

The legal backdrop

Your obligations come from the Privacy Act 1988, the Australian Privacy Principles (APPs), and state-specific health-records legislation (e.g. the Health Records Act in Victoria). You don't need to memorise the statutes — you need to remember the core rule at the top of this page. When in doubt, err toward not sharing.