Chapter 8: Using and disclosing genetic information in the case of a serious threat

Version 2.0, May 2025

Key points

• Provided certain conditions are met, you can use or disclose a patient’s genetic information to genetic relatives with or without the patient’s consent where you reasonably believe the use or disclosure is necessary to lessen or prevent a serious threat to the life health or safety of a genetic relative of the patient.
• In a situation where consent has not been given, the use or disclosure must also be in accordance with the s 95AA guidelines of the Privacy Act 1988.

• The information in this Chapter is not intended to imply the existence of an obligation for health service providers to identify and contact all relatives who may be at high risk of having a genetic predisposition, but is aimed at clarifying how the Privacy Act applies to providers who choose to do so.

Use or disclosure to lessen or prevent a serious threat

A patient’s genetic information can reveal information about inheritable diseases that may seriously threaten not just the patient’s own health, but also the health of genetic relatives. With knowledge of their risk of a genetic condition, relatives may be able to take preventative or mitigating action.

In many cases, a patient who becomes aware of the risk of a genetic condition may choose to advise relatives personally, or may consent to you informing relatives.

While you normally need a patient’s consent to use or disclose genetic information, you can use or disclose it without consent if you meet the following conditions (as set out in s 16B(4)):

• you collected the genetic information in the course of providing a health service to the patient
• you reasonably believe the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of a genetic relative of the patient
• you use or disclose the information in accordance with guidelines issued by the National Health and Medical Research Council and approved by the Information Commissioner under s 95AA of the Privacy Act (s 95AA guidelines)
• where you are disclosing the information, you disclose it to a genetic relative of the patient.

A genetic relative is an individual who is related to the patient by blood, such as a patient’s sibling, parent or descendant.

You can also collect and use the personal information of the patient’s genetic relative without the relative’s consent, where it is unreasonable or impracticable to obtain their consent first, and you reasonably believe the collection and use is necessary to lessen or prevent a serious threat to the life, health or safety of that relative (Item 1 of the table at s 16A(1) Privacy Act 1988 (Cth)). In practice, seeking prior consent from a relative in this scenario will usually be unreasonable or impracticable.

Lessening or preventing a serious threat

You can only use or disclose a patient’s genetic information without consent if you reasonably believe that the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of a genetic relative of the patient.

You must have a reasonable basis for your belief, and you must be able to justify it. The test is what a reasonable person, who is properly informed, would believe in the circumstances.

When deciding whether a threat is serious, you should consider both the likelihood of it occurring and the severity of the resulting harm if it materialises. A threat that may have dire consequences but is highly unlikely to occur would not normally be a serious threat. However, a potentially harmful threat that is likely to occur but at an uncertain time (such as a genetic mutation that increases the risk of developing a certain cancer), may be a serious threat that can be lessened or prevented by disclosing the threat to the relative.

Section 95AA guidelines

If you are considering using or disclosing genetic information without the patient’s consent, you must do so in accordance with the s 95AA guidelines. These legally binding guidelines are issued by the National Health and Medical Research Council and approved by the Australian Information Commissioner.

The guidelines require you to take reasonable steps to obtain the patient’s consent for the use or disclosure of their genetic information before you proceed to use or disclose it without consent (see Guideline 3.2.3).

In addition, the guidelines outline the factors you should consider when determining if a use or disclosure of genetic information is necessary to lessen or prevent a serious threat to the life, health or safety of a patient’s genetic relatives. They also provide guidance on matters such as good ethical practice, what to do when the patient or genetic relative is a child, contacting relatives, and the scope of information that is provided to relatives.

Ensuring the accuracy of the genetic information

Before using or disclosing a patient’s genetic information, you should take reasonable steps to ensure that the genetic information is accurate, up-to-date, complete and relevant, having regard to the purpose of the use or disclosure. In some circumstances, it might be reasonable to take no steps, for example, where you have good reason to believe that the source of the information is reliable.

Collecting and using the contact details of a patient’s genetic relatives with or without consent

You can disclose a patient’s genetic information to genetic relatives with or without the patient’s consent if a permitted situation exists, as outlined above. You will need to get the relatives’ contact details from the patient, your own records, or from publicly available records.

The contact details of a genetic relative are ‘health information’ in these circumstances. While you would usually need the relative’s consent to collect health information, you can collect the contact details without consent on the basis that it is unreasonable or impracticable to obtain consent, and you reasonably believe the collection is necessary to lessen or prevent a serious threat to the life, health or safety of that relative (Item 1 of the table at s 16A(1) Privacy Act 1988 (Cth)). In practice, seeking prior consent from a relative in this scenario will usually be unreasonable or impracticable. Once you have collected the contact details, you can use them to contact the relative to inform them of their possible genetic risk, as this is the primary purpose for which you collected the information.

Alternatively, you may already hold a genetic relative’s contact details in your records (for example, if that individual is your patient’s ‘next of kin’ contact). You can use the genetic relative’s contact details for the secondary purpose of informing that person of the potential risk of inheriting a genetic condition where you are satisfied that it is unreasonable or impracticable to obtain consent, and you reasonably believe the use is necessary to lessen or prevent a serious threat to the genetic relative’s life or health (s 16B(4) of the Privacy Act).

It is likely to be impracticable to seek a relative’s prior consent to collection or use of their contact details, as the health professional will not know about the relative other than through the patient and cannot contact the relative without collecting the contact details from the patient.

Ensuring the accuracy of the contact details

Before collecting and using a relative’s contact details, you should take reasonable steps to ensure that the contact details are accurate, up-to-date, complete and relevant.

Using contact details that are inaccurate, incomplete or out-of-date could have serious consequences for individuals. For example, the patient’s genetic relative may remain unaware of the risk from an inheritable condition or, if you send the information to the wrong person, that person may be unnecessarily distressed.