Health Privacy It’s My Business

1. Health Privacy It’s My Business Health Records Act2001 (Vic) eReferral Service Co-ordination System Susan Joseph

3. Privacy is … Exercising some control over who knows what about us. Privacy of the body Privacy of the home Freedom from surveillance Freedom from eavesdropping Information privacy Susan Joseph

4. Privacy protection is a balancing act: Maximising the level of control that individuals have over their personal information while ensuring that the rightinformation is available to the right people at the right time in the right way to enable necessary operations and services. Susan Joseph

5. Privacy for Victorians Health Records Act (Vic) Information Privacy Act (Vic) Privacy Act (Cth) • Covers … • All health related personal information held in public and private sectors • Covers … • Federal government agencies, e.g. Centrelink • Much of the private sector • Covers … • All personal info handled by State govt agencies and local govt • (other than health info) Susan Joseph

6. Key Elements • Health Privacy Principles (HPPs) - applicable to public and private sectors • Right of access to personal health information in the private sector - Breen v Williams Susan Joseph

7. Three important aspects of Privacy: • Confidentiality • Data protection • Consumer choice Susan Joseph

8. Objects of the Act (s.6) • To ensure responsible handling of health information • To balance public interest in protecting privacy with public interest in legitimate use of information • To enhance ability of individuals to be informed about their health care • To promote provision of quality health services Susan Joseph

9. Who is covered by the Act? Most organisations hold health information about individuals. The Act covers: • health service providers; • any other person/organisation that collects/handles personal health information. (e.g. schools, employers, churches) Susan Joseph

11. What is health information? • For health service providers it is all identifying personal information collected to provide a health service; • For non health service providers it is all identifying personal information about the health or disability of an individual. Susan Joseph

12. Personal information means: • Information or opinion about an individual whose identity is apparent, or can be reasonably ascertained • Does not have to be true • Does not have to be recorded • Includes that forming part of a database Susan Joseph

13. Minors No change to current common law situation: • A minor is capable of giving informed consent when they achieve sufficient understanding and intelligence to enable him or her to understand fully what is proposed • No set age, must be assessed on a case by case basis Susan Joseph

14. Deceased individuals • The Act applies in relation to the health information of a deceased individual who has been dead for 30 years or less in the same way it applies to the health information of a living person. Susan Joseph

15. Impact of other legislation • The Health Records Act does not override other legislation. • Existing provisions in other statutes governing the confidentiality, use and disclosure of health information and those that regulate access to certain kinds of personal information continue to apply. Susan Joseph

16. Collection Use & Disclosure Data Quality Data Security &Retention 5.Openness Access & Correction Identifiers Anonymity Trans border Data Flows Transfer / closure ofpractice of health service provider Making information available to another health service provider Health Privacy Principles Susan Joseph

17. HPP 1: Collection • Only collect health information necessary for the performance of your functions or activities • Generally need consent to collect health information (either express or implied) • Provide a ‘collection statement’ to notify those you collect from about what you do with the information and that they can gain access to it. Susan Joseph

18. HPP 2: Use & Disclosure • Only use or disclose health information for the primary purpose for which it was collected or a directly related secondary purpose the person would reasonably expect. • Other use/disclosure allowed in certain circumstances – includes with consent. Susan Joseph

19. HPP 3: Data Quality Take reasonable steps to ensure the healthinformation you hold is: • accurate, complete, and up-to-date • relevant to the functions you perform Susan Joseph

20. HPP 4: Security & Retention • An organisation must take reasonable steps to protect the health information it holds from misuse, loss, unauthorised modification or disclosure. • Retention for public sector agencies is through the Public Records Act. Susan Joseph

21. Role of theHealth Services Commissioner • Education, sector-based training and information • Handling inquiries from consumers and providers about their rights and responsibilities • Making statutory guidelines under the Act (s.22) • Resolving complaints about interference with privacy • Monitoring compliance Susan Joseph

22. HSC Complaints Process • Many people make enquiries without lodging a formal complaint. • Approx 50% of telephone inquiries result in lodgement of a complaint. • Complaints must be received in writing. • A person must have standing to make a complaint. • Consent is obtained from complainants to send their complaint to the respondent. Susan Joseph

23. HSC Complaints Process (2) • Approx 90% of complaints are resolved informally. • Approx 10% of complaints go to conciliation. • If a complaint is not resolved through conciliation the complainant may request the complaint be referred to VCAT for hearing. Susan Joseph

25. Health Services Commissioner Contact Details: Level 30 570 Bourke Street Melbourne Tel: 03 8601 5222 Toll free: 1800 136 066 Website: www.health.vic.gov.au/hsc Email: hra@dhs.vic.gov.au Fax: (03) 8601 5219 TTY: 1300 550 275 DX: 210182 Susan Joseph