The Amended Privacy Act and the Health Service Industry.

We have been anxiously awaiting the introduction of changes to the Privacy Act 1988 regarding privacy amendments applicable to the health profession. Now it seems that no one is willing to say or do anything in fear of non compliance with the Privacy Act.

Amendments were introduced to bring the Privacy Act into line with other countries and make the private sector in Australia bound by federal statutory privacy rules. The health industry was issued with a more tailored set of guidelines due to the sensitive nature of information collected and circulated by health service providers. These Guidelines to the National Privacy Principles and Guidelines on Privacy in the Private Health Sector apply from the 21st of December 2001, with no trial period. Continuing dialogue between the health care profession and the Federal privacy Commissioner is essential and will ensure appropriate changes can be made to the guidelines during their implementation.

The Office of the Health Privacy Commissioner believes “the Privacy Act offers protection and choice to patients, while balancing this with the need for health service providers to share information, where necessary, for the provision of quality healthcare.”

The 10 National Privacy Principles (NPP’s) apply to all information held. In the health care profession this includes information held on paper, electronically, visually (eg X-Rays, ultrasounds, CT or MRI scans, videos and photos) and audio recordings. The following is a brief description of each of the 10 National Privacy Principles as set out by the Federal Privacy Commissioner.

NPP1:

Collection & NPP10: Sensitive Information – set out providers’ obligations when collecting health information from patients. These include collecting health information only with consent, and collecting only the information necessary to provide the service.

NPP2:

Use and Disclosure – sets out how health information, once collected, can be used within the organisation or disclosed to third parties outside the organization.

NPP3:

Data Quality & NPP4: Data Security – set standards for keeping information up-to-date, accurate and complete, as well as for protecting and securing it from loss, misuse and unauthorized access.

NPP5:

Openness – requires providers to be open about how they handle health information, including the need to develop a document (such as a privacy policy) to clearly explain how they handle health information.

NPP6:

Access & Correction – gives patients a general right of access to their own health records, and a right to have information corrected, if it is inaccurate, incomplete or out of date.

NPP7:

Identifiers – limits the use of Commonwealth government identifiers (such as the Medicare number or the Veterans Affairs number) by providers to the purposes for which they were issued.

NPP8:

Anonymity – where lawful and practicable, patients must have the option of using health services without identifying themselves.

NPP9:

Transborder data flows – sets out obligations for providers regarding the transfer of health information out of Australia.

Practitioners must be aware that as from the implementation of the amended Act, patients and their legal advice have access to whatever is written or collected in records. All records remain the property of health service provider. Right of access to “new records” can occur by way of:

• Inspection
• Provision of a copy or a summary
• Viewing of the record accompanied by an explanation by the health service provider

Right of access to ‘old records’ (i.e. records collected prior the acts introduction) can occur by way of:

• The forms outlined above only where the provider agrees
• An accurate summary of the information
• There is no right of access to non factual information (e.g. practitioner comments)

Reasonable fees may be charged by organizations to recover costs of providing information.

It is important to note that although some states have additional privacy laws, eg NSW Privacy and personal information Act 1998, ACT – Health Records (Privacy and Access) Act 1997 and Victoria – Health records Act 2001, the federal law will override the State laws in areas of conflict.

For more information on the amendments to the Privacy Act, go to the Office of the Federal Privacy Commissioner’s website at www.privacy.gov.au or contact their Hotline on 1300 363 992.

Dr Melanie Buys O’Shea