Resources on data privacy, regarding access to My Health Record, assessments, lack of consent, etc?

Hi all,

I made a complaint about being refused access by a triage service at the start of the year (rural Victoria). Five months later, I finally received a call by someone saying they would like to offer a new assessment and to talk about the complaint. I rejected the assessment because I didn't trust them and had no need for one, but said I was happy to talk about the problems I was having being directed to the triage service by other providers over and over.

I made it very clear I have no desire for the triage service to be involved with me at all, outside of the complaint and what is around it.

I believe they undertook a psychiatric assessment regardless, without telling me this is what they were doing. As far as I am aware, I went in just to talk about the complaint (being refused service, and why community health kept pinging them even if they thought I wasn't "acute" due to a lack of resources in this area) and they've... gone and accessed and copied over my My Health Record data.

Given the triage service is not involved in my care at all, I don't understand why they have done this or how this would be appropriate given I was only speaking about a complaint over something five months ago. According to the My Health Record hotline (two different calls), this is not okay and they are not allowed to do this, as they are not involved with my care: ringing up a medical service for information about the nearest vaccination centre, as an example, does not give that medical service the right to then access your My Health Record files: they might have to log your call and what it was about, but they are not involved in your care so cannot access your external records: same difference!

But according to the triage service after I contacted them to point out it was inappropriate for them to access my records over a complaint (they are not involved in my care) I didn't need to provide any kind of consent, nor would they ever need to tell me if I was undergoing an assessment (even a voluntary one!), and that simply walking through the door was how I provided consent because of the nature of their service? They don't need to tell me I'm being assessed, they can just say "let's talk about your complaint" and then that contact gives them a lawful excuse to access my external medical records if I say anything to them at all, even when it is only around a complaint?

Does anyone have resources or a write up on how this works legally? Has anyone else had this kind of situation? Did you manage to resolve it? I really could use some resources on privacy and access of data and that kind of thing, because there really isn't much I can find anywhere online. 😞