WRITTEN BY Jecinta Neuman
They say that ‘an apple a day keeps the doctor away’, but ‘when your apple does fail, a doctor will prevail’. Okay, maybe people don’t say that last part, but it’s nonetheless true. Generally, you might take a visit to the doctors for granted (unless you live in a country without universal healthcare), however as commercial lawyers we do sometimes wonder how well our health data and privacy is protected and what our rights are in the event that these are breached.
For health service providers and practice managers, we recommend that you stay up to date with health data protection legislation and guidelines. This is the case not only for doctors and private hospitals but also extends to pharmacists, dentists, gyms and childcare centres.
The Office of the Australian Information Commissioners (‘OAIC’) released their Guide to Health Privacy (‘the Guide’) earlier this year. It sets out a handy explanation for health service providers, including doctors and other health professionals, as to what their obligations under the Privacy Act 1988 (‘the Privacy Act’) are as well as tips to ensure they are able to meet those obligations. The Guide has been introduced in the wake of high number of both privacy complaints to the OAIC and notifiable data breaches suffered by health service providers. Since mandatory reporting was introduced in February 2018, the health service provider sector has seen the highest cases of notifiable data breaches. Often, information that health service providers hold about individuals and families are extremely sensitive and could be misused if it falls into the wrong hands.
The type of information that the Guide covers includes information about an individual’s physical or mental health, notes on their symptoms, diagnosis and any treatments given, physical or biological samples and their results, prescriptions and other pharmaceutical purchases, and any other personal information that identifies the individual (e.g. name, address, date of birth, Medicare and private health provider numbers, gender, race, sexuality or religion) that is collected for the purpose of providing a health service.
The Guide covers what the privacy obligations under the Privacy Act are in relation to:
The OAIC has various powers to regulate health service providers and how they collect, store, use and disclose personal information. The extent to which these powers work does depend on the breach, but includes the ability to:
So, enjoy your apples and rest assured that your personal information will be in good hands if health service providers implement these guidelines.