In Australia a psychologist may disclose client information without consent only where the release is required or authorised by law, or is required to facilitate emergency care. In practice that means four common grounds: a serious threat to life, health or safety, mandatory child protection reporting, a court order or subpoena, and mandatory notifications about another practitioner.
What is the legal test for disclosing without consent?
Two rulebooks apply at once, and both must be satisfied.
The first is professional. Section 3.3 of the shared Code of conduct adopted by the Psychology Board of Australia says patients "have a right to expect that you will hold information about them in confidence, unless the release of information is required or authorised by law, or is required to facilitate emergency care". Good practice under that section includes "seeking informed consent before disclosing information, including formally documenting such consent where possible".
The second is privacy law. Health information is sensitive information under the Privacy Act, so it may only be used or disclosed for a secondary purpose on one of the grounds in APP 6. The everyday ground, APP 6.2(a), needs the client to reasonably expect the disclosure and the secondary purpose to be "directly related to the primary purpose of collection". That is a tighter test than the one applied to ordinary personal information, and it is why "they probably would not mind" is not a lawful basis.
When does risk of serious harm justify breaking confidentiality?
This is the ground clinicians reach for most, and the one most often applied too loosely. It sits in section 16A of the Privacy Act as a permitted general situation, and it has two limbs that both have to be met:
- "it is unreasonable or impracticable to obtain the individual's consent to the collection, use or disclosure", and
- you "reasonably believe that the collection, use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety".
Two things follow. First, asking the client for consent is the default step, not an optional courtesy: the exception only opens once seeking consent is unreasonable or impracticable, which is a fact you should be able to point to. Second, the disclosure must be necessary to lessen or prevent the threat, which limits both who you tell and how much you tell them. Ringing a partner "so they know" is rarely the minimum disclosure that reduces risk; contacting an acute care team usually is.
Note also what this ground is: a permission, not an instruction. Section 16A tells you when disclosure is allowed, and it does not by itself compel you to warn anyone. Whether you should act sits with your clinical judgement and your ordinary duty of care. Where the risk is to the client themselves, the disclosure decision and the clinical reasoning behind it belong in your suicide risk assessment documentation.
When are you legally required to report child abuse?
Mandatory reporting is created by state and territory child protection law, not by the Privacy Act, so it lands under the "required or authorised by law" ground. The professions covered and the abuse types covered differ by jurisdiction, and you are bound by the law where you practise.
In New South Wales, mandatory reporters include registered psychologists in both the health care and welfare categories, per Communities and Justice. Registered psychologists are also mandatory reporters in Victoria under the Children, Youth and Families Act 2005, and in Western Australia psychologists were added to the mandatory reporting of child sexual abuse scheme from 1 May 2024. Queensland has its own reporting pathway.
Confirm your own obligations against your jurisdiction's legislation rather than a national summary. Where a report is mandatory, consent is not required and the client's refusal does not remove the duty.
What if the notes are subpoenaed or a court orders release?
A court or tribunal order is an express APP 6.2(b) ground, and so is a subpoena that validly compels production. That does not mean you hand the file to whoever asked. You produce to the court, not to the issuing party, and objections such as protected confidences are raised before production. The mechanics, timeframes and objection grounds are set out in our guide to responding to a subpoena for therapy notes.
A related trap: a lawyer's letter, an insurer's request or a police request is not a court order. Police requests fall under the enforcement related activities ground in APP 6.2(e), and if you rely on it, APP 6.5 requires you to make a written note of the use or disclosure.
Can you talk to a client's family, carer or GP?
Sometimes, and on a narrower basis than most practices assume.
Writing back to the referring GP is usually defensible under APP 6.2(a), because a client referred by their GP would reasonably expect a report back and the purpose is directly related to their care. Talking to a partner or parent generally is not, unless you have consent.
Where an adult client lacks capacity to consent, the OAIC's guidance on patients with impaired capacity sets out disclosure to a "responsible person" as a defined pathway with its own conditions, not a general licence to brief the family. Capacity is decision-specific and can fluctuate, so record the basis for your assessment at the time you relied on it. Where you see a couple or a family, settle the disclosure rules before the first joint session, as covered in our note on couples therapy notes and no-secrets policies.
Must you report concerns about another practitioner?
Yes, in defined circumstances, and this obligation catches psychologists who treat other clinicians. Under section 140 of the National Law, "notifiable conduct" means practising while intoxicated by alcohol or drugs, sexual misconduct connected with practice, placing the public at risk of substantial harm because of an impairment, or placing the public at risk of harm through a significant departure from accepted professional standards.
Section 141 requires a practitioner who forms a "reasonable belief" that another practitioner has engaged in notifiable conduct to notify Ahpra as soon as practicable. Thresholds differ by notifier group: Ahpra's guidance states the threshold for a treating practitioner is higher than for other notifiers, "to give practitioners the confidence to seek help without the fear of a mandatory notification", and that treating practitioners in Western Australia providing a health service to a practitioner-patient are exempt from the mandatory requirement altogether.
What should you record when you disclose?
Treat the disclosure as a clinical event and write it up like one. At minimum, record the date and time, who you disclosed to and their role, exactly what information you released, the ground you relied on, why you could not reasonably obtain consent if you did not have it, and what you did next. Where you relied on the enforcement ground, the written note is a legal requirement rather than good practice.
The reasoning matters more than the conclusion. A file that says "disclosed to CATT" tells a future reader nothing; one that records the specific indicators, the alternatives you weighed and why disclosure was necessary to reduce the threat will stand up years later. Keep it factual and separate from your speculative impressions, a distinction we unpack in psychotherapy notes versus clinical progress notes. Since the file may be read long after the episode, apply your usual record retention periods.
PractaLuma is AI-native practice management software for Australian mental-health practices, and its structured clinical notes and client records give disclosures a consistent place to live instead of a free-text paragraph someone has to hunt for.
How do you set the limits of confidentiality at intake?
Say it plainly, in the first session, and record that you said it. A workable script names the general rule, then the exceptions: risk of serious harm to the client or someone else, mandatory reporting obligations, court orders and subpoenas, and any disclosure the client authorises.
Put the same wording in your written consent form so the client has it after the session, and note in the file that limits were explained and the client had the chance to ask questions. Doing this at intake changes what happens later: a client who was told about mandatory reporting at the start is far less likely to experience a report as a betrayal, and you have a contemporaneous record of informed consent. Telehealth adds its own consent and identity-verification steps, covered in our telehealth documentation guide.
Frequently asked questions
Can a psychologist break confidentiality if a client discloses a past crime? Not automatically. A historical offence with no current risk does not meet the serious threat test, and there is no general obligation to report past crimes. Mandatory child protection reporting may still apply, and some jurisdictions have offences for failing to report child sexual abuse, so check the law where you practise.
Do you have to tell the client before you disclose? Not always, but usually you should. Consent is the first option, and the serious threat ground only opens where seeking consent is unreasonable or impracticable. Where it is safe to do so, telling the client what you are about to disclose and why preserves the working relationship.
Does a parent have an automatic right to a child's therapy notes? No. Access depends on the young person's capacity to make their own decisions and on your state or territory's health records law. A mature minor may be able to consent, and to object, in their own right.
Is discussing a client in supervision a breach of confidentiality? Supervision is generally within the client's reasonable expectations and directly related to their care, but de-identify wherever you can and tell clients at intake that you use supervision.
Can you refuse to release notes to an insurer? An insurer's request is not a court order. Release requires the client's consent or another APP 6 ground, and the client can limit what they authorise.
This article is general information for clinicians, not legal advice. Confidentiality obligations vary by state and territory. Seek advice from your professional indemnity insurer or a lawyer on specific matters.