Privacy and Information Sharing

Health information

Health information is a type of personal information and under Victorian law is defined as information or opinion about an identifiable person’s physical, mental or psychological health or disability. It has stronger legal protections because its inappropriate use and disclosure can cause greater harm to or discrimination against a person. Schools typically hold health information about students and other individuals.

Due to its high risk, extra steps must be taken to make sure the information has stronger protections in place. The exact levels of protection needed will depend on the circumstances.

Stronger or higher levels of protection may include:

• implementing tighter access controls
• getting valid consent
• using contracts with third parties.

When managing health information, schools must only collect, use and store what's essential to fulfil the purpose of collection.

Types of health information records

Examples of records that may contain health information are:

• Individual Education Plans, behaviour support plans and other learning or educational assessments
• health care information provided by allied health professionals
• Student Support Services (SSS) documentation and referrals
• health practitioner reports provided by parents to the school
• support plan forms that describe a student’s health and wellbeing
• applications and assessments for disability supports funding
• notes about student behaviour or wellbeing recorded in school systems
• information about medical appointments that show or suggest specific services or conditions.

Parents and carers rights and responsibilities

Parents and carers:

• must make sure the school has relevant health information about their child
• may choose to limit the release of information about chronically ill or critically injured children who are not currently attending school.

Collecting, using and sharing health information in schools

Schools must collect, use, store and share health information in line with relevant laws and departmental policy.

Collecting health information

Schools may collect student health information as needed to carry out their core functions.

When collecting this information, school’s must collect the minimum amount needed to do their job. School staff must always exercise sensitivity towards the family and student’s needs.

When a parent/carer or mature minor student wants to limit the sharing of information, schools must inform them of:

• the school’s need to know the student’s health conditions and first aid requirements so plans for support can be in place
• how the school protects their personal and health information.

For guidance when collecting information, refer to Collection notices.

Schools can also request relevant information from authorised services under the Child and Family Violence Information Sharing Schemes.

Using and disclosing health information

Schools’ use and/or disclosure of health information must be limited to when:

• it is necessary to carry out school functions
• it is needed to lessen or prevent a serious threat to a person or the public’s health, safety or welfare
• a parent/carer or mature minor consents to the sharing of information
• sharing information outside the department is required or authorised by law.

For example, if a parent or carer consents (unless the disclosure is required by law), a school can share observations (not interpretations) of a student's behaviour with the student's medical/health practitioner to help them monitor and plan the student's health care.

For guidance on sharing information with other staff visit Sharing information.

For guidance on disclosing student information externally, visit Requests for Information about Students.

Health professionals

Health professionals must disclose student personal and health information when needed to ensure a student’s health, safety or wellbeing.

They must not disclose this information unless:

• parent/carer or mature minor consent is provided
• they legally have to or are authorised to under relevant laws or information sharing schemes.

If schools need to share health information and are unsure if it is allowed, contact the Privacy team by emailing privacy@education.vic.gov.au

Storing health information

Health information must be stored securely and access limited to only those who require it for one of the purposes described in using and sharing health information.

When storing health information schools must:

• minimise how much information is stored by only storing essential information or top-level summaries
• take extra care when storing it by considering who has access and whether access can be restricted through system permissions or secure storage locations
• document strict processes for granting and removing access to the information
• regularly review access to the information to make sure only the right people have access
• avoid keeping information for longer than needed in digital or physical systems.

In practice, this may look like:

• writing a summary of a student’s adjustments, such as listing ‘requires noise reducing headset’ rather than ‘Autism Spectrum Disorder’
• deleting or disposing of information after it is in an authorised recordkeeping system
• making sure health information is stored in system locations that only authorised staff can access.

Where to store health information

Department systems such as CASES21, SOCS or HART are recommended for storing health information. A school’s administration server may also be appropriate. For more guidance, refer to Software and Administration Systems.

If a school needs to use third-party software to store health information, it must meet security, privacy and records management requirements.

For guidance on the software assessment process, refer to Software and Administration Systems.

Before replacing or decommissioning any system storing health information, the records must be transferred from third-party software to the school.