From February this year, changes to privacy laws have been put in place that are likely to significantly affect doctors and their practice.Many doctors will not be aware of their new obligations leaving them vulnerable to inadvertently breaching the Privacy Amendment Act, 2017.“Ignorance is no excuse as a legal argument,” Dr Peter Walker, GP and senior risk manager at Avant explained.This latest amendment to the privacy laws demands that doctors must have an updated protocol on how breaches of a patient’s privacy should be handled. Both the patient and the relevant authority must be notified if a breach occurs that is thought to potentially cause the patient harm.If something goes wrong and the patient’s privacy is breached, doctors must now conduct a risk assessment, including an assessment of the risk of harm resulting from the breach.If harm is possible (physical, emotional, psychological, financial, or harm to reputation), the doctor is then obliged to alert the patient/s concerned and write a statement for the Office of the Australian Information Commission via their online form.Fines may be incurred if the action to reduce the risk of possible breaches has not been made, or if it is insufficient, especially if serious harm results.Fines are also possible for doctors who fail to comply with the amended Privacy Act (for example, if they do not notify the Australian Information Commission of a breach or if they do not have an updated privacy plan).The obligation to notify a patient of a privacy breach does enable that patient to take further action if they perceive they have been harmed. They may then escalate the issue themselves, perhaps in Court. In serious circumstances, the Commission will also refer to other entities, such as the Australian Health Practitioner Regulation Agency or if the matter is criminal, to the Police.If no harm is likely to result, doctors do not have to notify the patient or the Commission, but this is likely to be difficult for a clinician to assess without legal advice. “Prevention really is better than cure, but many doctors are unaware of this new legislation.” Dr Walker said.The following examples are given to illustrate to GPs considerations about privacy in the light of the amended Act.“Sorry, Mr B, I need your consent before I fax that referral letter to the specialist for you because this is not a form of communication that is absolutely safe regarding your privacy. For example, a wrong number may be typed in by accident or the specialist may not receive the fax. For your interest, the fax has a hard drive that will store information and so for this reason we remove this before we dispose of the fax machine. If any of this is of concern to you regarding your privacy you can pass the letter over yourself on the day of your consultation…”“Sorry, Mr B, we don’t email information either to you or the specialist, as email may be hacked; this is less likely to happen to medical email systems, but it is still possible and our practice policy has decided not to use email…” “Mr B, I can text the information from the referral letter to the specialist’s mobile phone with your permission to do so. However, please understand that someone who is holding his phone for him may see the message. This is quite possible, as he is operating now…” “Sorry, Mr B, I understand your concern about needing an urgent appointment, and that the post is slow and the referral may not get to the specialist in time, but this is considered to be a legally safe way of sending correspondence if you don’t take the referral with you now. I know the specialist wants to see the referral before offering you an urgent appointment …”Other possible scenarios in which privacy breaches may occur include the theft of documents (e.g. laptop, briefcase), conversations about a patient’s condition being overheard where the patient can be identified, the incorrect disposal of paperwork that identifies a patient, and discussions about a patient with a third party (who is not part of the health team managing them) without that patient’s consent.The Privacy Amendment Act 2017 builds upon the Privacy Act, amended in March 2014, that instructed all medical practices to have a Privacy Policy. The Australian Information Commission is able to audit any medical practice regarding this to see if that practice complies.This legislation is aimed at promoting the security of a patient’s personal details in all communications between themselves and health professionals, and among health professionals generally.To this end, doctors will need to look carefully for any potential breaches of these new privacy laws resulting from their current means of communication with colleagues and the patients themselves.ReferenceOffice of the Australian Information Commissioner. Notifiable Data Breaches. Available at: oaic.gov.au/engage-with-us/consultations/notifiable-data-breachesThis article is based on Dr Peter Walker’s video interview conducted at the Sydney Women’s and Children’s Health Update on Saturday February 17th 2018.