“Can you tell me if my wife has an appointment today?” It sounds harmless. Answering it wrongly can breach the Privacy Act 1988. For medical receptionists, privacy is not paperwork — it is a set of split-second phone habits, and they need to be trained deliberately.

What the Privacy Act means at the front desk

Australian general practices handle health information, which is sensitive information under the Privacy Act. That includes appointment and billing details, not just diagnoses or test results. Even confirming that a person attends your clinic can disclose their health information.

The practical rule is to check who is calling and the basis for sharing information before answering. The OAIC’s guidance on using and disclosing health information explains when information may be shared: for the purpose it was collected, with consent, or under another applicable exception. Reception staff should follow the practice’s procedure and escalate uncertain requests.

Five phone situations every receptionist must handle correctly

1. The spouse or family member calling “on behalf of”

A family relationship alone does not establish authority to receive information. Check the caller’s identity and the patient’s current consent or other authority, including what information may be shared. Follow the practice’s process for recording that check. Consent can be oral, written or implied in appropriate circumstances; it is not always a signed form.

If authority is unclear, a useful script is: “I need to check that we can share that information. I can take a message or ask the appropriate team member to help.” Requests involving children, guardians or patients unable to consent need careful escalation. The OAIC sets out specific conditions for disclosure to a responsible person when a patient cannot consent.

2. The identity check before releasing anything

Use your practice’s approved identity-check procedure before discussing patient information. For telephone communication, the RACGP Standards for general practices (5th edition), Criterion C1.2, specify at least three approved patient identifiers, such as full name, date of birth and address. Ask the caller to provide the details rather than reading them out for confirmation.

Knowing a patient’s details does not establish a third party’s authority to act for them. The OAIC’s access guidance requires identity and representative authority to be checked. If you remain unsure, pause the disclosure and follow the practice’s escalation process.

3. Test results

Reception staff should not interpret results or offer clinical reassurance. Follow the practice’s written results policy and the clinician’s documented instructions about what reception may relay. If a message has not been authorised for reception, arrange the clinician’s requested follow-up or refer the query to the clinical team. Complete identity checks before communicating any patient-specific message.

4. Police, employers and insurers

These callers can sound authoritative and urgent. Refer their requests to the practice manager or designated privacy or clinical lead so the basis, scope and documentation of any disclosure can be checked. Some disclosures are permitted or required without consent, but a caller’s job title is not enough. The OAIC explains the legal and enforcement-related exceptions. Escalate an immediate safety concern promptly under the practice’s emergency procedure.

5. The waiting room itself

Acoustic privacy counts too. Avoid repeating a caller’s symptoms or unnecessary identifying details where others can hear. Lower your voice and move a sensitive discussion to a more private space when needed. The OAIC’s collection guidance gives practical examples of protecting privacy in waiting rooms and other public areas.

Make the safe answer the easy answer

Receptionists need clear procedures when they are put on the spot. Give them word-for-word phrases, a visible decision tree at the desk, and explicit permission to pause a disclosure while checking with the right team member. Practise common calls during induction, including a family member requesting appointment details and a caller asking for results.

Privacy, identity checks and the front-desk “privacy firewall” are covered in Modules 2 and 3 of the GP Receptionist Certificate — $20 per person inc. GST, with printable identity, privacy and safe-next-action resources included. View course pricing.

Privacy belongs on day one, not week three. See where it sits in the free medical receptionist induction checklist, or cover it in the GP Receptionist Certificate.

New starter this week? What a medical receptionist needs to know on day one covers the privacy habits to teach before independent front-desk work.

For a consistent handover after a call, use our free medical receptionist telephone message template, with prompts for safe contact preferences, caller authority and follow-up ownership.

Sources and scope

This article draws on the OAIC’s Guide to health privacy and the RACGP communications standard linked above. State and territory health privacy requirements may also apply, including additional rules for private health service providers in NSW, Victoria and the ACT.

This article is general information, not legal advice. For a specific privacy matter, follow your practice’s policy and seek advice from your medical defence organisation, privacy adviser or the OAIC.