Suppose a parent calls your office and requests their child’s counselling records? Or a court order lands on your desk seeking access to counselling notes? Or perhaps, your school counsellor raises concerns about a student’s wellbeing and wants to discuss information shared in a counselling session? When can you disclose a student’s counselling records and when should you not? This is a question that is becoming increasingly problematic for schools. The answer lies in balancing the duty of care with confidentiality and privacy requirements. This article will set out your legal obligations and answer some common questions in this space.
Your legal obligations:
Schools owe a duty of care to their students and all children under common law and state-based legislation. The duty is generally to take reasonable care to protect students from harm which is reasonably foreseeable. Several states including New South Wales, Victoria, South Australia and Queensland have reversed this onus in relation to child abuse caused by an individual associated with the organisation.
To help facilitate student wellbeing, most schools have a counsellor, psychologist or pastoral care available to students. In these sessions, personal information will be collected by the school including medical information, relationship status, familial issues, disclosure of bullying or mental health concerns and other sensitive information.
Schools are required to handle this information in accordance Privacy Act 1988 (Cth) (Privacy Act), the Australian Privacy Principles (APPs) and state-based legislation. For example, the information collected can only be used for the primary purpose (in this case being the provision of counselling services) unless a permissible secondary purpose exists. Permissible secondary purposes include those related to the primary purpose, where consent is provided, the disclosure is authorised under Australian law or a court order or a permitted health situation exists. The Australian Psychological Society takes the position that a psychologist is obliged to release information when “required by law”, which includes the law which imposes a duty of care on schools.
Key questions answered:
Do I need the student’s consent to disclose their counselling records to their parents?
It will depend on the age of the student. The Office of the Australian Information Commissioner (OAIC) recognises that a child’s capacity to consent to the handling of personal information needs to be determined on a case by case basis depending on the maturity and ability to sufficiently understand what is being proposed. As a general rule, schools can presume that students aged 15 and over have capacity to consent. While the Privacy Act doesn’t currently specify a specific age, predicted amendments may define a child as 15 or 18. For Victorian schools, the Victorian Privacy and Data Protection Act 2014 (Vic) defines a child as someone under 18 years of age, but does not specify the age when individuals can make their own privacy decisions.
Many secondary schools state in their policies or counselling intake or permission forms that all students from year 7 will be required to give consent for the release of their counselling records (unless an exception applies). We recommend that schools decide what their policy will be and embed this into their documents to ensure there is clarity amongst students and parents.
What if one parent is requesting the information but the other parent or student does not agree?
Schools can be caught in a tricky situation where parents disagree on the disclosure of counselling records, especially if the parents are separated or in the process of separating. First and foremost, if the student is able to consent, the school should seek the student’s consent. This rings true with other child safety obligations for the empowerment of children. If the student does not, or is unable to, consent, schools should seek consent from both parents before disclosing any records. This is particularly where the records contain sensitive information. If the parents cannot agree on the disclosure, the school should request a court order before disclosing any records.
What about requests from third parties?
Schools should be careful about releasing counselling records or information to third parties without the proper consent from the student or their parents. Schools should always require any such request to be in writing. If the student or their parents do not consent, it may be that the school requires further advice on whether or not they are required to provide the records. Most states (Victoria, NSW, Queensland, South Australia) have introduced information sharing schemes, as recommended by the Royal Commission into Institutional Responses to Child Sexual Abuse, which permit the sharing of confidential information to organisations in limited circumstances for the purpose of safeguarding children. We explain the Victorian Child Information Sharing Scheme here. In the absence of an applicable information sharing scheme or court order permitting a disclosure to a third party, refer to APP 6.
What about requests from former students about their own records?
We have received queries from schools concerned about providing former students with their own counselling records, especially where the former student may be considering a historical child abuse claim or other claim against the school. APP 12 requires organisations give individuals access to their own information on request. While there are some exceptions to this, they are limited. One such exception is if the record includes personal information belonging to other individuals and the sharing of that information would have an unreasonable impact of those other individuals. If an exception applies, the school may have grounds to refuse or redact information. More information about handling information access requests is here.
The counsellor, psychologist, wellbeing officer or chaplain is concerned about a student – what should we do with this information?
Where a staff member is concerned about a student’s wellbeing, that staff member can share that information within the school with other limited and appropriate staff for the purpose of the student’s safety or the discharge of the duty of care. Always share information in accordance with your policies and procedures. While the privacy obligations under the Privacy Act apply to the school not the individual, internal sharing of the information should be on a need to know basis. At the same time, the school needs to ensure that it is fulfilling its duty of care. Where concern for a student’s wellbeing rises to the level of needing to make a report to an external organisation such as Child Protection, this should be done and is an exception to obligations under the Privacy Act (see below).
When do I have to provide counselling records?
There will be situations when the school is required to disclose the information held in counselling records. This includes:
- Court order – if a school receives a court order to provide the information, it must comply with the order.
- Reporting requirements – there are extensive reporting requirements that apply to schools in relation to child abuse and concerns for a child’s safety and wellbeing. These are set out in state based legislation.
- Health and safety concerns – where a school has genuine health and safety concerns for a student or another individual, information may need to be disclosed. An example would be where the information needs to be disclosed to lessen or prevent a serious threat to health, life or safety. These are difficult situations and schools should seek legal advice if such a situation arises.
- Responding to the student’s own request to access their personal information – individuals have an access right under APP 12.
The above situations (amongst others) are exceptions under the Privacy Act and the disclosure of information without consent is permitted.
Recommendations and next steps:
Managing requests and disclosures of counselling records is a difficult topic and often requires decisions to be made in short timeframes. Where records are incorrectly disclosed, schools could find themselves at risk of various claims including breach of privacy (with increased significant maximum penalties) or negligence. To mitigate these risks, we recommend that schools:
- Ensure they have the requisite policies and procedures – having clear policies on when counselling records will be released and the consent procedure will ensure there is no confusion between the school, students and parents. It will also be something the school can rely on when making its decisions and should be embedded into the parent code of conduct.
- Train your school counsellor / chaplain – your staff should be trained on your policies and procedures, as well as how to manage counselling records in accordance with privacy law and your obligations.
- Provide a collection notice – students who access your school’s counselling service should be made aware of the information that is being collected, how it will be used and stored and the situations where disclosure may happen. This is a requirement under privacy law.
- Disclose carefully – once information is disclosed, it cannot be retrieved. Schools should proceed carefully when disclosing information, particular sensitive counselling records. Where there is uncertainty, we recommend that schools seek further advice.
How we can help
At Moores we have a specialised team that supports the education sector on a variety of areas including privacy and data security. This makes us well placed to assist schools in the careful balance of duty of care with confidentiality and privacy requirements.
We are more than happy to guide you through the process of determining your obligations in disclosing a student’s counselling or pastoral care records.
Contact us
Please contact us for more detailed and tailored help.
Subscribe to our email updates and receive our articles directly in your inbox.
This article was originally published November 2019. Updated June 2024.
Disclaimer: This article provides general information only and is not intended to constitute legal advice. You should seek legal advice regarding the application of the law to you or your organisation.