Do you need to update client consent every 12 months under the new Code of conduct?

The day the Psychology Board of Australia’s new Code of conduct came into force, I looked outside. The sky was blue, the sun was shining and the world had kept turning.

When the Code was released, what worried me most wasn’t the Code itself. It was us. I was afraid, and still am, that psychologists will over-regulate themselves out of uncertainty. Like the horse in that meme, sometimes what holds you back is all in your head.

Some concerns about the Code are well founded. Others are mountains made out of molehills. This is one of the molehills: section 4.2, informed consent.

The two clauses causing panic

Points (g) and (h) have been freaking people out. In short:

• (g) tell clients how long you will rely on their consent, in the absence of significant changes;
• (h) revisit consent when that period has passed, or when there has been a significant change to the service or the relationship.

The starting point is simple: consent is no longer assumed to last forever, and whatever period you rely on, you have to tell the client.

I’ve seen many people read this as “I need to update consent every 12 months”. That’s wrong. Worse, it creates work for you without addressing the real risk.

Where it comes from

One thing I like about the new Code is that it builds in the legislation you used to have to read alongside the old one. That includes the Australian Privacy Principles.

Go back to the source. The APP guidelines say consent should be current and specific: generally sought when the information is collected, or at the time of a use or disclosure the original consent didn’t cover. And the important line: consent given at a particular time in particular circumstances “cannot be assumed to endure indefinitely”.

That’s the change. It isn’t the Code; the Code just reflects what has already happened in privacy law.

Where stale consent bites

As a supervisor, practice owner and clinician, I can think of two situations.

Families. Mum and dad both consent to you treating their young child. During treatment the parents separate. That’s a material change. You carry on relying on the original consent, until one parent decides they no longer want you seeing the child and withdraws it. I’ve seen a number of psychologists get into trouble this way. Their consent was specific, but it wasn’t current.

Insurers. I get around a dozen requests a year from life, income protection or health insurers asking for every note I’ve ever taken about a client. Sure enough, their signed form gives consent to release the lot. But when I first met the client, I explained the foreseeable uses and disclosures of their information. The insurer has changed the ball game. It isn’t reasonable to rely on consent given one, two or ten years ago to release everything. I need to re-consent the client.

What actually protects you

A 12-month rule does two things: it creates a pile of work, and it doesn’t protect you from the thing you need protecting from.

What you need is a process for updating consent when there is a material change in the relationship or the client’s circumstances: separation or divorce, a change of employment, a new third-party payer, a request from an insurer.

Some of you will say, “Hang on, health information is treated differently.” Exactly right. It is some of the most sensitive information in Australia, and the Office of the Australian Information Commissioner has separate guidance on health privacy. Read it in detail and what it says about consent is the same: it must be current and specific.

Consent isn’t forever. Be willing to update it when circumstances change, and you’ve solved the problem. Good luck.

Source: OAIC, Australian Privacy Principles guidelines, Chapter B: Key concepts, paragraphs B.51–B.52.

If you want to work through the Code case by case, Rebecca and I built Principles to Practice through PractAus for exactly this.