The Personal Health Information Protection act, 2004 is based on 10 privacy principles:

1. Accountability for Personal Health Information
   The HRSRH is responsible for the personal information of its patients, and has a Chief Privacy Officer (CPO) to monitor and manage confidentiality and privacy issues.
2. Identifying Purposes for the Collection of Personal Health Information
   Before, or at the time personal health information is collected, the HRSRH informs individuals of the purposes for which the information is to be used. The Act allows the use of notices to bring the purposes of collection, use and disclosure to the attention of patients.
3. Obtaining Consent for the Collection, Use, or Disclosure of Personal Health Information
   The knowledge and consent of individuals are required before information can be collected, used, or disclosed. Consent can be implied or express.
4. Limiting Collection of Personal Health Information
   The HRSRH limits the collection of personal information, so that individuals are only asked what is necessary.
5. Limiting Use, Disclosure, and Retention of Personal Health Information
   Personal health information will not be used or disclosed for purposes other than those for which it is collected, except with the consent of the individuals or as required by law. The information is kept only as long as it is needed.
6. Ensuring Accuracy of Personal Health Information
   The HRSRH ensures personal information is accurate, complete and up-to-date for the purposes it is used. 
7. Ensuring Safeguards for Personal Health Information
   The HRSRH has appropriate safety measures to protect personal information.
8. Openness Concerning Policies and Practices
   Information about the HRSRH personal information policies and practices is available to everyone. 
9. Access to Personal Health Information
   Upon request, individuals may know the specific purposes for which their personal health information is collected, used or disclosed. If the information is found to be inaccurate or incomplete, it is amended as appropriate. We can correct a date of birth for example but we cannot correct an opinion or observation made in good faith.
10. Challenging Compliance
    Individuals with concerns relating to privacy at the HRSRH can address challenges to the CPO or to the Information & Privacy Commissioner.