Contacting relatives does not breach privacy laws

5 minute read


Australia’s privacy regulator has clarified when clinicians can contact family members to discuss their genetic risk.


Health professionals have discretion to directly contact relatives of patients to inform them of their genetic risk, but confusion exists as to whether this breaches privacy laws.

The Office of the Australian Information Commissioner has updated chapter eight of the guide to health privacy in May of this year. The document now provides clear directions for health professionals to legally collect the details of patients’ relatives and disclose genetic information in accordance with the Privacy Act.

It states that clinicians are permitted to collect and use relatives’ contact details if they reasonably believe it necessary for lessening or preventing a serious threat to the life, health or safety of the relative.

The guidance explains that it cannot be reasonably expected for a health professional to gain consent from the relative to collect their information, as they are unable to contact the relative to ask permission without first collecting their contact details from the patient.

To further avoid doubt, the guidance now plainly states that once the details have been collected, a clinician may use them for the intended purpose; that is, to contact the relative and inform them of their possible genetic risk.

Some genetic variants allow for the legal disclosure of patient information to family without patient consent. These include variants that increase the risk of developing certain cancers.

The National Health and Medical Research Council (NHMRC) developed a legal framework for health professionals to disclose genetic information to at-risk relatives without patient consent, which provides a criteria that must be met and the process of notification.

A hypothetical scenario provided in the document detailed a patient with a BRCA1 genetic variant. As this variant significantly increases breast and ovarian cancer risk, and that her first-degree relatives have a 50% risk of also having this variant, the patient requests that her doctor contact her sister on her behalf. The doctor is legally able to collect the sister’s details from the patient, contact her and disclose her potential genetic risk.

However, as the risk is great, the condition poses a serious threat to the life, health or safety of the sister, and notification would allow for the sister to undergo genetic testing and preventative care, the doctor would legally be able to contact the sister even without the patients consent.

If a health professional already holds a relative’s contact details in their records, for example as next of kin, they can use them for the purpose of informing them of their potential genetic risk.

The health privacy guideline does not create a duty to notify; it only aims to clarify how the Privacy Act applies to clinician discretion in these situations. There does not exist an obligation for providers to identify and contact all relatives who may be at high risk of genetic predisposition.

The update from the national privacy regulator was prompted by Dr Jane Tiller, public health genomics ethical, legal and social advisor at Monash University.

She sought clarification after identifying that Australian clinicians experienced significant confusion about their ability to directly notify at‐risk relatives without breaching privacy laws.

In a recent MJA paper about the update, Dr Tiller, a lawyer as well as a genetic counsellor and public health researcher, addressed the primary ethical argument of “the right not to know”.

She said it was prudent to consider this ethical argument, but important to note that it was not a right enshrined in privacy legislation.

Whether a relative was contacted directly by a health professional or informed by the patient, it was the patient who decided whether relatives should be notified rather than the relatives themselves.

“Cascade genetic testing of at‐risk relatives can save lives. Challenges with family communication pose a major barrier to family risk notification,” Dr Tiller wrote.

She recognised that some people may not wish to know about their genetic risk. But given that the circumstances in which disclosure is permitted are limited to situations where it was necessary to lessen or prevent serious risk, Dr Tiller said it was reasonable to assume that individuals would likely want to know.

From recent surveys, Dr Tiller explained that Australians overwhelmingly appeared to want to be told about the genetic risk of medically actionable conditions and showed strong support for direct contact from clinicians and few privacy concerns.

Further, surveys of Australian genetics services representatives found that the majority agreed a clinical guideline would assist their understanding of discretion in this area.

Dr Tiller said the development of clinical guidelines for each state and territory would be timely and ideally include clarification regarding local laws from privacy regulators.

Tiffany Boughtwood, the new Australian Health Genomics Commissioner with Genomics Australia, told the media she welcomed the updated guidance.

“Providing clarity about contacting at-risk relatives will support the health workforce to deliver high-quality, appropriate genomics-informed health care,” she said.

The Medical Journal of Australia, 14 July 2025

End of content

No more pages to load

Log In Register ×