Open disclosure to patients under Victoria's new duty of candour laws: What has changed?

Doctor in a white lab coat is speaking to a patient seated in front of her. In the background, a radiotherapy treatment machine can be seen.

On 30 November 2022, the Health Legislation Amendment (Quality and Safety) Act 2022 (Vic) (Act) came into effect.

The Act amends key Victorian health legislation, including the Health Services Act 1988 (Vic) (Principal Act).

Notably, the Act requires health service entities to provide a patient with a statutory duty of candour (SDC) when a patient of the health service has suffered a serious adverse patient safety event (SAPSE). The Act also details the steps that need to be taken to investigate and report on a SAPSE and the confidentiality protections that apply to information obtained through this process.

The Victorian Duty of Candour Guidelines (Guidelines) complement the Act and contain strict deadlines for the conduct of open disclosure meetings with patients. It is vital for health service entities to familiarise themselves with the Guidelines, which will apply to any SAPSE that occurs after 30 November 2022.

In this insight, we address key questions arising from the Act and the Guidelines.

Statutory duty of candour: Key questions answered

Who is a patient for the purpose of the SDC?

The Guidelines define "patient" as any patient including inpatients, consumers, clients, or residents that have suffered a SAPSE in the course of receiving health services.

In circumstances where the patient lacks capacity or has died, the Act states that the definition of patient extends to the patient's immediate family, carer or next of kin, and a person nominated by the patient.

What is a health service entity for the purpose of the SDC?

The Act broadly defines a health service entity (HSE) as follows:

  • a public health service
  • a public hospital
  • a multi-purpose service
  • a denominational hospital
  • a private hospital
  • a day procedure centre
  • an ambulance service within the meaning of the Ambulance Services Act 1986 (Vic)
  • a non-emergency patient transport service within the meaning of the Non-Emergency Patient Transport and First Aid Services Act 2003 (Vic) that is licensed under that Act
  • the Victorian Institute of Forensic Mental Health established by section 328 of the Mental Health Act 2014 (Vic); and
  • a prescribed entity that provides health services

What is a serious adverse patient safety event?

The Act defines a serious adverse patient safety event (SAPSE) as "an event of a prescribed class of category that results in harm to one or more individuals".

With respect to what constitutes harm, the Guidelines distinguish harm into three categories, explained below.

  • Prolonged psychological harm: Psychological harm which a patient has experienced, or is likely to experience, for a continuous period of at least 28 days. This can include harm that results from racism, abuse, a sexual safety incident or psychological ill-treatment
  • Moderate harm: Harm that requires a moderate increase in treatment to a patient, but does not include harm that causes permanent injury. For example, moderate harm would include an unplanned return to surgery
  • Severe harm: Harm that causes a permanent lessening in the functioning of an individual that is unrelated to the underlying condition. This includes harm that can lead to a person experiencing permanent impairment, disability or death

While incidents involving "severe harm" should be readily identifiable, we anticipate that there will be difficulties determining whether an incident has resulted in "prolonged psychological harm" or "moderate harm". For instance:

  • "moderate harm" is defined to include increased treatment that does not result in permanent injury, which is sufficiently broad to include situations that may fall outside current RiskMan reporting policies. Accordingly, HSEs may wish to consider revising review and reporting processes to identify "moderate harm" events, in order to comply with the SDC requirements
  • "prolonged psychological harm" is also broadly defined, in that it includes psychological harm which the patient is likely to experience for a continuous period of at least 28 days. Therefore, HSEs will likely need to consider "prolonged psychological harm" in the context of discharge planning and/or incident reporting processes, including the potential involvement of psychological/psychiatric staff, in order to identify likely prolonged psychological harm that may only become apparent following discharge

What happens once a SAPSE is identified?

Pursuant to section 128ZC of the Act, once a SAPSE has been identified, unless the patient has "opted out" of the process in writing, the HSE must:

  • provide the patient with:
    • a written account of the facts regarding the SAPSE; and
    • an apology for the harm suffered by the patient; and
    • a description of the HSE's response to the event; and
    • the steps that the HSE has taken to prevent the re-occurrence of the event; and
    • any prescribed information; and
  • comply with the Guidelines

In order for a patient to "opt out", the patient must provide the HSE with a signed statement to that effect. However, should the patient later decide to receive such information, then the HSE is required to provide it notwithstanding the earlier signed statement.

What timeframes apply?

The Guidelines require HSEs to:

  • make the abovementioned apology within 24 hours of a SAPSE being identified
  • organise a SDC meeting within three days, and the details of that meeting must be confirmed with the patient/next of kin
  • hold a SDC meeting within 10 days, and during that meeting the patient/next of kin should be provided with:
    • an honest, factual explanation of what occurred in simple language
    • an apology for the harm suffered
    • an opportunity for the patient to relay their experience and ask questions
    • an explanation of steps taken to date to review the SAPSE and any immediate action/improvements taken; and
    • any implications as a result of the SAPSE and any follow up for the patient
  • the SDC meeting must be documented, with a copy provided to the patient/next of kin within 10 business days of the meeting
  • within 50 business days of the SAPSE, the HSE must complete a review of the SAPSE and produce a report outlining what happened, including any areas identified for improvement. If the SAPSE is classified a sentinel event, the report must also comply with the sentinel event requirements and outline clear communications from the review findings. This report must be offered to the patient/next of kin. If more than one HSE is involved, the timeframe may be extended to 75 business days

We discuss the legal implications and confidentiality issues with respect to the apology and SAPSE review report in further detail below.

Noting the mandatory timeframes and content of an SDC meeting, and the impact that this meeting can have on the patient experience, HSEs may wish to consider providing additional training for staff to ensure that SDC meetings are compliant, but confined to the facts of the SAPSE and next steps for the investigation, pending conclusion of the SAPSE review process.

What does an apology mean in the context of civil proceedings?

An apology for the purpose of the SDC is defined in the Act as "an expression of compassion, regret or sympathy in connection with any matter, whether or not the apology admits or implies an admission of fault in connection with the matter".

Section 128ZD makes it clear that an apology, irrespective of whether it was made orally or in writing, or whether it was made before or after the civil proceeding was in contemplation or commenced:

  • does not constitute an express or implied admission of liability for the death or injury; and
  • is not relevant to the determination of fault or liability in connection with that proceeding

Evidence of an apology is not admissible in any civil or disciplinary proceedings as evidence of the fault or liability of the person or the HSE in connection with that matter. However, this section does not affect the admissibility of a statement with respect to a fact in issue or tending to establish a fact in issue. Accordingly, while the apology is not admissible, it appears that no such protection applies to all other information disclosed as part of the SDC process (as distinct from the SAPSE review, which we discuss below).

As an aside, protection against the use of apologies as evidence already exists under sections 14I and 14J of the Wrongs Act 1958 (Vic).

SAPSE review

The Chief Executive Officer of a HSE may appoint a SAPSE review panel at its own motion, but must appoint a SAPSE review panel if directed to do so by the Secretary of the Department of Health, which may be a joint SAPSE review panel with other involved HSEs.

Section 128Q of the Act prohibits anyone who was directly involved in the SAPSE from being a member of the SAPSE review panel and requires the involvement of someone external to the HSE. Individual members of the panel are protected under section 128R of the Act, and any liability arising out of the SAPSE review instead attaches to the relevant HSE.

Section 128O of the Act states that a SAPSE review must:

  • establish the facts of the SAPSE, including any relevant surrounding context
  • identify the factors that may have led or contributed to the SAPSE, including, but not limited to the following:
    • any relevant factors external to the HSEs involved in the event
    • organisational management factors related to the HSEs involved in the event
    • working environmental factors, including the assignment and performance of tasks, technology used by the HSEs, team management and staffing allocation
    • factors relating to the patients to whom health services were provided by the HSEs involved in the event; and
  • identify any remedial measures that may be taken in relation to the SAPSE, and any measures to prevent similar events from occurring in future and improve the quality and safety of the health services provided by the HSEs involved in the event

A person who provides information to a SAPSE review panel is protected from liability under section 128S of the Act.

SAPSE review report

Once the SAPSE review has been completed, a report must be prepared and produced, which must include (section 128T(2)):

  • a description of the SAPSE
  • analysis identifying why the event happened and any factors that contributed to the event
  • any recommendations about changes or improvements in a policy, procedure or practice relating to the provision of a health service that are intended to reduce the likelihood of, or prevent, the same type of event happening again
  • any prescribed matter or requirement

A HSE that has received a SAPSE review report must offer a copy of the report to the following persons who, in the reasonable opinion of the Chief Executive Officer of a HSE, have a sufficient personal or professional interest in the subject of the report:

  • a patient
  • a person nominated by the patient
  • the immediate family, carer or next of kin of a patient, if the patient is deceased or lacks capacity

The SAPSE review report is to be provided to any of the above persons, if the offer to provide it to them is accepted.

Confidentiality requirements of a SAPSE review report

Protections apply to HSEs in relation to the production and admissibility of SAPSE reports. The purpose of the protection scheme is to encourage reporting of errors and foster information sharing within health services, by reducing concerns about potential medicolegal risks.

Specifically, provided that:

  • a SAPSE has occurred; and
  • the requirements for completing a SAPSE review are followed,1

the SAPSE review process and any documents created (including the SAPSE report) are protected and not admissible in civil, criminal or disciplinary proceedings. This means that SAPSE documents are unable to be produced before any court, tribunal, board or agency (section 128U of the Act). Further, this protection extends to members of a SAPSE review panel, as they cannot be compelled to give evidence in any proceedings. In addition, a SAPSE report is unable to be requested from health services under freedom of information laws or pursuant to the Health Privacy Principles in the Health Records Act 2001 (Vic).

In circumstances where the SAPSE is also classified as a sentinel event, HSEs may produce a SAPSE report that also complies with all the reporting requirements of a sentinel event. Provided that the SAPSE review process and report meet all the SAPSE requirements under the Act, the SAPSE confidentiality protections will apply to the review process.

For the above protections to apply, HSEs will need to make sure that they are correctly identifying SAPSE incidents and that SAPSE reports comply with all statutory requirements, particularly sections 128T(2) and 128Q.

However, it is important to note that the protections outlined above do not extend to coronial investigations. As such, SAPSE reports may be disclosed to the Coroner for the purposes of an investigation or inquest (section 128U(3).

Non-compliance with the SDC

In the event of non-compliance, the Minister or the Secretary can take action including publishing a statement about the HSE's failure to comply with SDC on the website of the Department, if the Minister considers that the HSE has failed to comply with SDC on two or more occasions and the failure to comply is of a serious nature. However, the Minister will give the HSE a reasonable opportunity to make oral or written submissions prior to the publication of the statement.

Further, there will be reporting requirements relevant to SAPSEs and the SDC, which are presently to be determined. HSEs must therefore ensure systems are in place to capture SDC data.


While there will undoubtedly be some initial teething difficulties and resourcing issues that arise from compliance with the initial SDC meeting requirements and the difficulties in identifying a SAPSE that involves "moderate harm" or "prolonged psychological harm", the Act may in time help to standardise timeframes and processes for clinical review incidents and provide greater certainty to HSEs and consumers alike.

Further, the confidentiality protections that apply to SAPSE reviews may unencumber the clinical review process, so that the reviews can focus solely on improved clinical outcomes for patients.

1 As outlined in Division 8, Part 5A of the Health Services Act 1988 (Vic)

Image by Accuray on Unsplash

All information on this site is of a general nature only and is not intended to be relied upon as, nor to be a substitute for, specific legal professional advice. No responsibility for the loss occasioned to any person acting on or refraining from action as a result of any material published can be accepted.

Key contacts

Anna Murray

Senior Associate