Privacy internal review is a process whereby this health service handle complaints about how it has dealt with personal Information under the NSW Privacy and Personal Information Protection (PPIP) Act 1998 and/or personal health information under the NSW Health Records and Information Privacy (HRIP) Act 2002. 

Individuals have the right to seek an internal review of certain conduct of a health service, in circumstances where the individual believes that the health service has breached the terms of either the PPIP Act and/or the HRIP Act.

The request for review can only be made where it is alleged that the health service has: 

• breached any of the Health Privacy Principles (HPPs) under the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act); 
• breached any of the Information Protection Principles (IPPs) under the Privacy and Personal Information Protection Act 1998 (PPIP Act); 
• breached a code of practice or direction issued under either the HRIP Act or PPIP Act; or 
• disclosed information from a public register in a way that contravenes Section 57 of the PPIP Act. 

The request for internal review should be lodged using an application form available from the health service, NSW Health or the NSW Privacy Commission. This application should be sent directly to the health service within 6 months from the time the applicant first became aware of the conduct sought to be reviewed. If an application for internal review is received more than 6 months from the time the applicant because aware of the conduct, the health service will refuse to accept the application unless special circumstances apply.

The NSW Privacy Commissioner will be notified of the application, the progress of the internal review and findings of the internal review to allow for submissions to be made to the health service where appropriate.  The NSW Privacy Commissioner will subsequently be notified of the action proposed to be taken by the health service in relation to the matter.

A Review Officer will be appointed to conduct the internal review, which should be completed within 60 calendar days from the day on which the application is received by the health service. If the review is not completed within 60 calendar days, the health service will contact the applicant to explain the circumstances for the delay. If this occurs, the applicant is entitled to make an application to the NSW Civil and Administrative Tribunal to review the privacy complaint. 

In order to investigate the circumstances surrounding the complaint, the Review Officer may need to discuss the matter with relevant staff members and seek legal advice from the Ministry of Health. All information held by the health service in connection with the complaint will otherwise be kept secure and confidential.

The internal review must recommend that the health service respond in any one or more of the following ways: 

• take no further action on the matter 
• make a formal apology to the applicant 
• take such remedial action as it thinks appropriate 
• provide undertakings that the conduct will not occur again 
• implement administrative measures to ensure that the conduct will not occur again, such as revision of relevant policies and procedures, and privacy training for relevant staff. 

Within 14 calendar days of the completion of the internal review, the applicant will be notified in writing of: 

• the findings of the review and the reasons for those findings, and 
• the action proposed to be taken by the health service including the reasons for taking that action, and 
• the right of the applicant to have the findings of the review and proposed action of the health service reviewed by the 
  NSW Civil and Administrative Tribunal (NCAT).

If the applicant is not satisfied with the findings of the internal review, or the action taken by the health service in relation to the application, the applicant may apply to the NCAT a review of the conduct that was the subject of the application. The application to NCAT must be made within 28 calendar days from being notified of the findings of the internal review.