After Disclosure: Who Holds the Information, and Which Privacy Law Applies

Neurodivergent nurses bring pattern recognition, sustained attention within a clinical domain, and empathy grounded in lived experience to the teams they work in. Some choose to tell an employer about their neurodivergent cognitive profile, often because an adjustment would let that work happen with less friction. The decision to disclose has been covered at length on this site. What happens to the information afterwards has had far less attention, and a good deal of the risk sits there: where the disclosure is recorded, who may read it, how long it is kept, and which privacy law governs any of that.

Which privacy law applies to a disclosure at work

Under the Privacy Act 1988 (Cth), an employee record is defined in section 6(1) as a record of personal information relating to the employment of an employee, and the Office of the Australian Information Commissioner (OAIC) lists health information about an employee as an example of what that includes. Section 7B(3) exempts a private sector employer’s handling of an employee record from the Australian Privacy Principles where the handling is directly related to a current or former employment relationship. The OAIC states the practical effect plainly: a private sector employer does not have to grant an employee access to their employee records under that Act.

The reach of the Act depends on who the employer is. The OAIC states that the Privacy Act covers Australian Government and Norfolk Island administration employee records, so the Australian Privacy Principles do apply to those. Most Australian nurses work for state or territory health services, private hospitals or aged care providers, and the position varies by jurisdiction, with state-run services sitting under their own state privacy legislation. A nurse who wants to know which rules cover their own record needs to identify the employer type first, then look to that jurisdiction’s privacy regulator.

Where the exemption stops

The exemption is narrower than it first appears. The OAIC’s guidance states that it does not cover acts or practices outside the scope of the employment relationship. It does not cover contractors and subcontractors handling the personal information of another organisation’s employees, and the guidance names recruitment, human resource management and medical services supplied under contract as examples. It does not extend to volunteers. An employer that passes a disclosure to an external occupational health provider or to an agency is therefore in different territory from an employer holding the same note on its own file.

Australian research describes recognition, disclosure and adjustment as one connected process shaped by the setting (Gray et al., 2026), and work with autistic and ADHD nurses has examined health alongside the work environment (Hedlund & Jordal, 2025).

Disclosure remains a personal and contextual decision with real professional risk, and choosing to say nothing is an equally legitimate choice. What the record-keeping question shows is where the burden of adaptation is structurally misplaced: the labour of tracking where a disclosure went, what it triggered, and whether it will follow a nurse into the next role falls on the person who disclosed, while the organisation holds the record. Employers that write down who holds disclosure information, for what purpose, for how long, and under which policy remove a category of uncertainty their staff currently carry alone. Related reading covers what you are legally required to tell an employer, the double bind healthcare organisations create around disclosure, and what Australian law requires on reasonable adjustments.

References

Gray, L., Mcneill, B. A., Woodman, J., Bernard, S., Kos, J., Hewitt, Y., Goldingay, S., Hayley, A., Hitch, D., Macfarlane, S., Pecora, L., Watchorn, V., & Evans, S. (2026). “You Have So Much to Offer as a Health Professional”: Neurodivergent Students’ Experiences of Recognition, Disclosure, and Accommodation in Australian Health Professions Education. Teaching and Learning in Medicine, 1–18. https://doi.org/10.1080/10401334.2026.2632753

Hedlund, Å., & Jordal, M. (2025). What about neurodiversity among nurses? A cross-sectional exploration of work environment and health among nurses with ADHD and/or autism. WORK: A Journal of Prevention, Assessment & Rehabilitation, 80(3), 1287–1295. https://doi.org/10.1177/10519815241289852

Office of the Australian Information Commissioner. (2023). Employee records exemption. https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/employee-records-exemption

Office of the Australian Information Commissioner. (2022). Employment. https://www.oaic.gov.au/privacy/your-privacy-rights/more-privacy-rights/employment

Privacy Act 1988 (Cth). https://www.legislation.gov.au/Series/C2004A03712

This post contains general information only and does not constitute legal, medical, or professional advice. Information is accurate to the best of the author’s knowledge at the time of publication. For advice specific to your situation, please consult an appropriately qualified professional.