v\:* {behavior:url(#default#VML);} o\:* {behavior:url(#default#VML);} w\:* {behavior:url(#default#VML);} .shape {behavior:url(#default#VML);}
st1\:*{behavior:url(#ieooui) }
.msocomanchor { BACKGROUND: infobackground } .msocomoff { DISPLAY: none } .msocomtxt { VISIBILITY: hidden } .msocomtxt { POSITION: absolute } .msocomtxt { TOP: -1000px } .msocomtxt { LEFT: -1000px } .msocomtxt { WIDTH: 33% } .msocomtxt { BACKGROUND: infobackground } .msocomtxt { COLOR: infotext } .msocomtxt { BORDER-TOP: threedlightshadow 1pt solid } .msocomtxt { BORDER-RIGHT: buttonshadow 2pt solid } .msocomtxt { BORDER-BOTTOM: buttonshadow 2pt solid } .msocomtxt { BORDER-LEFT: threedlightshadow 1pt solid } .msocomtxt { PADDING-RIGHT: 3pt; PADDING-LEFT: 3pt; PADDING-BOTTOM: 3pt; PADDING-TOP: 3pt } .msocomtxt { Z-INDEX: 100 }
Temporary Public Interest Determination No. 2005-1   Privacy Act 1988 Part VI  
Nature of Application:
In providing a health service to an individual, to provide appropriate diagnosis, assessment and treatment of that individual, the collection of health information from the Health Insurance Commission’s Prescription Shopping Project Information Service, without obtaining the consent of the individual.
Relevant National Privacy Principles:
National Privacy Principles 1, 2 and 10  
Issued:
10 February 2005
Registered:
10 February 2005
Effective:
10 February 2005 to 9 February 2006
 
  TEMPORARY PUBLIC INTEREST DETERMINATION NO. 2005-1     I, Karen Curtis, Privacy Commissioner, make the following determination under section 80A of the Privacy Act 1988.   Dated this tenth day of February 2005               KAREN CURTIS Privacy Commissioner   I am satisfied, in accordance with section 80A(1) of the Privacy Act 1988 (the Privacy Act), of the following.   (1)               The Applicant is an organisation.   (2)               The Applicant has applied under section 73(1) of the Privacy Act for a Public Interest Determination under section 72(2) of the Privacy Act about the acts and practices of the Applicant specified in paragraph (3).   (3)               The Applicant may need to collect sensitive information from the Health Insurance Commission (HIC) via that agency’s Prescription Shopping Project Information Service (the Information Service) in order to assist in clinical decision-making with respect to the appropriate diagnosis, assessment and treatment of an individual.   Where the Applicant needs to collect this sensitive information, the collection could occur in any or all of the following circumstances:   a.       without obtaining the consent of the individual; and   b.      without satisfying any other exception provided in National Privacy Principle 10 which would enable the collection of sensitive information.   (4)               These acts and practices set out in (3) may breach National Privacy Principle 10.   (5)               The public interest in the Applicant doing these acts, or engaging in the practices, set out in (3) outweighs to a substantial degree the public interest in adhering to National Privacy Principle 10.   (6)               National Privacy Principle 1 does not impede the Applicant from being able to collect information from the Information Service.   (7)               The application made by the Applicant raises issues that require an urgent decision.   (8)               The Applicant is not taken to contravene section 16A of the Privacy Act 1988 if, during the period from 10 February 2005 to 9 February 2006 (inclusive), the Applicant engages in the acts and practices set out in (3).  
Statement of Reasons for Determination (under section 80A(3)(b))
  Section 80A(3)(b) of the Privacy Act requires that I include a statement of reasons for the determination.  
1.         The Application
  On 2 February 2005, the Applicant applied under section 73 of the Privacy Act for a Public Interest Determination under section 72 of the Privacy Act. The Applicant is an organisation for the purposes of the Privacy Act.   I have decided to withhold the name of the Applicant.  This decision recognises that the Applicant is a general practitioner in private medical practice and disclosure of the Applicant’s name may constitute an unnecessary interference with their privacy.  I also considered the particularly sensitive nature of the application and recognised that disclosure of the Applicant’s name could result in inferences being made about patients of the Applicant.   2.         Background to Prescription Shopping Project Information Service   The HIC has advised me that a purpose of the Prescription Shopping Project is to reduce the number of individuals who obtain Pharmaceutical Benefits Scheme (PBS) medicines in excess of their therapeutic need.    As part of the Prescription Shopping Project, an Information Service has been developed whereby the HIC is authorised to disclose certain health information about an individual to a prescribed organisation (e.g. a person’s general practitioner, at the organisation’s request).  This would be information relating to whether an individual has been identified under the Prescription Shopping Project as a ‘prescription shopper’ and if necessary information about the individual’s PBS history.   The HIC’s authority to disclose this information, as well as to perform certain other functions necessary to implement the Information Service, is provided by the Health Insurance Commission (Additional Functions – Prescription Shopping Project) Determination 2003 (‘the HIC Determination’), made by the Minister for Health and Ageing.  The HIC Determination is attached at A.   Prescription shoppers are ‘identified’ under the Prescription Shopping Project if they have met one or more of a number of prescribed criteria.  I have been advised by the HIC that at any time there may be around 20,000 individuals identified by the Prescription Shopping Project.  This represents less than 1% of the PBS patient population.  The Information Service will only disclose information to organisations covered by the HIC Determination and only in regard to ‘identified’ individuals, not all Australians.  Also, a prescribed organisation (i.e. a doctor) can only seek information from the Information Service about a current patient.    Further information on the Prescription Shopping Project Information Service is available from the HIC website.[1]   The criteria used to ‘identify’ an individual are, as defined in the HIC Determination:   a)            they have been supplied with PBS medicines prescribed by six or more different prescribers (excluding specialists) in a three month period;   b)            they have obtained 25 or more PBS items for target medicines in a three month period; or   c)            they have obtained 50 or more PBS items in a three month period.   The HIC has advised me that there are three levels of information about an individual that can be disclosed by the HIC to a prescribed organisation. The three levels involve:   i)              the release of information by telephone, confirming that an individual is/is not identified in accordance with the Prescription Shopping Project criteria;   ii)             the release of information by telephone, confirming the total number of PBS medicines, and the total number of doctors involved in prescribing these PBS medicines, in relation to the individual during the most recent three month period; and   iii)           the release of hard copy information containing the full PBS medicines record for the individual for this 3 month period.    Prescribers select the level of information they require.  Use of the service is voluntary and prescribers are not required to access the Information Service.    3.         Issues raised by the Applicant   In order to provide appropriate diagnosis, assessment and treatment of an individual, the Applicant has submitted that there may be occasion when the Applicant needs to collect information through the Information Service.  The application relates to the practice of collecting this health information without obtaining the consent of the individual (i.e. the patient).   The form of collection envisaged by the Applicant would occur in the context of providing a health service to an individual, where the individual is suspected by the Applicant of seeking prescriptions for PBS medicines in excess of their therapeutic need, including where an individual may have a drug dependency.  The Applicant submits that such an individual may be unwilling, if asked, to provide their consent to the collection of health information from the Information Service, as this collection may disclose their status as an identified person in the Prescription Shopping Project.   The Applicant submits that it is impracticable to gain the consent of many drug dependent individuals for the following reasons:   a)            it is the Applicant’s experience that, in similar circumstances where it is necessary to obtain PBS medication or other health history, this group of patients is unwilling to provide accurate information or to consent to the Applicant sourcing the information reliably from elsewhere; and   b)            these individuals choose to leave the surgery rather than have their real histories revealed.  This results in the Applicant being denied the opportunity to arrange better care and treatment for these individuals.   The Applicant has expressed concerns in the application that the collection of health information from the Information Service may be in breach of National Privacy Principle 10, where the individual’s consent is not sought for the collection of the health information, nor do any other available exceptions seem to apply.   The Applicant has submitted that the use of the Information Service may be critical in informing clinical judgements in relation to the Applicant’s patients.   I note that the Applicant has submitted that, in many cases, seeking consent from the individual for the collection of information from the Information Service will be entirely viable and appropriate.   4.       Relevant provisions of the Privacy Act   Section 6 of the Privacy Act defines “health information” as:    (a) information or an opinion about: (i) the health or a disability (at any time) of an individual; or (ii) an individual’s expressed wishes about the future provision of health services to him or her; or (iii) a health service provided, or to be provided, to an individual; that is also personal information; or (b) other personal information collected to provide, or in providing, a health service; or (c) other personal information about an individual collected in connection with the donation, or intended donation, by the individual of his or her body parts, organs or body substances.   Section 6 of the Privacy Act defines “sensitive information” so as to include inter alia:   (a)     health information about an individual.   National Privacy Principle 1.3 states:   1.3 At or before the time (or, if that is not practicable, as soon as practicable after) an organisation collects personal information about an individual from the individual, the organisation must take reasonable steps to ensure that the individual is aware of: (a) the identity of the organisation and how to contact it; and (b) the fact that he or she is able to gain access to the information; and (c) the purposes for which the information is collected; and (d) the organisations (or the types of organisations) to which the organisation usually discloses information of that kind; and (e) any law that requires the particular information to be collected; and (f) the main consequences (if any) for the individual if all or part of the information is not provided.   National Privacy Principle 1.5 states that:   1.5 If an organisation collects personal information about an individual from someone else, it must take reasonable steps to ensure that the individual is or has been made aware of the matters listed in subclause 1.3 except to the extent that making the individual aware of the matters would pose a serious threat to the life or health of any individual.   National Privacy Principle 10 concerns the collection of “sensitive information”.  Relevantly, NPP 10.1 and 10.2 state:   10.1 An organisation must not collect sensitive information about an individual unless: (a) the individual has consented; or (b) the collection is required by law; or (c) the collection is necessary to prevent or lessen a serious and imminent threat to the life or health of any individual, where the individual whom the information concerns: (i) is physically or legally incapable of giving consent to the collection; or (ii) physically cannot communicate consent to the collection; or (d) if the information is collected in the course of the activities of a non-profit organisation—the following conditions are satisfied: (i) the information relates solely to the members of the organisation or to individuals who have regular contact with it in connection with its activities; (ii) at or before the time of collecting the information, the organisation undertakes to the individual whom the information concerns that the organisation will not disclose the information without the individual’s consent; or (e) the collection is necessary for the establishment, exercise or defence of a legal or equitable claim.   10.2 Despite subclause 10.1, an organisation may collect health information about an individual if: (a) the information is necessary to provide a health service to the individual; and (b) the information is collected: (i) as required by law (other than this Act); or (ii) in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind the organisation.   Section 29 of the Privacy Act requires that inter alia:   In the performance of his or her functions, and the exercise of his or her powers, under this Act, the Commissioner shall: (a) have due regard for the protection of important human rights and social interests that compete with privacy, including the general desirability of a free flow of information (through the media and otherwise) and the recognition of the right of government and business to achieve their objectives in an efficient way;     5.         Reasons for the Decision   5.1       Public interest considerations   There are two National Privacy Principles raised in the application (10 & 1).  Although it was not raised in the application, I also considered the relevance of National Privacy Principle 2.  In this section, I will deal with these in turn.   The application was made for a public interest determination under s 72 of the Privacy Act.  However, I have decided to deal with the application under s 80A of the Privacy Act because it raises matters requiring an urgent decision (see section 5.2(c)).  Under s 80A, I am empowered to make a Temporary Public Interest Determination where I am satisfied that each of the following apply:   i)          an act or practice of an organisation that is the subject of the application for a public interest determination breaches, or may breach, a National Privacy Principle (s 80A(1)(a));   ii)         the public interest in the organisation doing the act or engaging in the practice outweighs to a substantial degree the public interest in adhering to the National Privacy Principle (s 80A(1)(b)); and   iii)         where the application raises issues that require an urgent decision (s 80A(1)(c)).   Under section 80B(2) of the Privacy Act, the effect of such a determination is that the organisation is taken not to breach the specified National Privacy Principle when doing an act, or engaging in a practice, which is described in the determination.   5.2       Consideration given to National Privacy Principle 10   5.2(a)   Does or may the act or practice breach National Privacy Principle 10?   The act or practice raised in the application concerns the Applicant collecting health information from the Information Service without the consent of the individual in question.  The Applicant has submitted that, in the circumstances detailed in the application, consent cannot be relied on when collecting health information about an individual.  It is clear that collecting health information without an individual’s consent will constitute a breach of National Privacy Principle 10 unless another exception applies.  It does not appear that the circumstances detailed in the application would allow the Applicant to rely on any other exception.   In particular, I have considered whether the Applicant may rely on National Privacy Principle 10.2(b)(ii), the terms of which are cited in the HIC Determination.  The scope of this exemption is unclear and yet to be tested in court.  In the circumstances set out in the application, I am satisfied that there may be a breach should the Applicant claim to rely on this exception to collect health information without consent.   As required by s 80A(1)(a), I am satisfied that the act or practice described in the application would or may constitute a breach of National Privacy Principle 10.   5.2(b)   Does the public interest in allowing the Applicant to breach National Privacy Principle 10 outweigh to a substantial degree the public interest in adherence to the principle?   Generally, an individual’s right to be informed as to the handling of their personal information, and especially their health information, and to have some measure of control over how their information is collected is regulated by National Privacy Principles 1 and 10.  There is potential for harm to an individual if their health information is handled without their consent or knowledge.    In addressing a potential interference with privacy, it is necessary to balance other interests.  The other interests raised by the application include the possibility of an immediate and direct threat posed to an individual’s health.    I am satisfied that, in certain cases, there may be an unwillingness on the part of an individual to provide consent to the collection of information from the Information Service, where this would assist in determining the individual’s therapeutic needs.  Denying the Applicant access to the Information Service may limit the Applicant’s knowledge of the individual’s prescription history and hinder the Applicant from, where appropriate, offering counselling or other treatment alternatives.  For the Applicant not to be able to collect this information may lead to serious and potentially life-threatening consequences in respect of the individual’s clinical management and welfare.   Accurate and reliable information regarding an individual’s health history including their medication history, underpins the clinical management of the individual.  I accept that some individuals may put their health and lives at risk in attempting to obtain PBS medication that is in excess of their therapeutic need.  It is likely that the Information Service may assist the Applicant in the appropriate diagnosis, assessment and treatment of such individuals.   I also note that while the collection of health information in the circumstances raised by the application may constitute an interference with an individual’s privacy, the information, once collected, will continue to be afforded protections offered by the Privacy Act.  For example, the Applicant will be prohibited by National Privacy Principle 2 from using or disclosing the health information for any other purpose unless permitted by the Privacy Act.   I am satisfied that:   (a)        Where the Applicant believes that consent cannot be sought for the collection of information from the Information Service, then the lack of access to the Information Service is likely to have a serious and negative impact on the clinical management of some individuals; and   (b)        the central public interest objective being served by this determination is the provision of quality health care to the individual, and ultimately good public health outcomes for the community; and   (c)        that the collection of information from the Information Service may contribute significantly to good health care on both respects outlined in (b).   As required by s 80A(1)(b), I am satisfied that the public interest in the Applicant collecting health information from the Information Service outweighs to a substantial degree the public interest in the Applicant adhering to National Privacy Principle 10 in these circumstances, as the collection may immediately and directly affect the health care of an individual.   5.2(c)   Does the application raise issues that require an urgent decision?   The Applicant has submitted that the health of some individuals is at risk and that this risk could be lessened by information available through the Information Service.  The Applicant cannot currently collect this information without possibly breaching National Privacy Principle 10.   As stated above in section 5.2(b), the Information Service may provide important information to assist the Applicant in assessing the individual’s clinical needs.  In the absence of a determination, the Applicant’s access to the Information Service may be restricted or prevented.  There is a chance that the Applicant could or may breach the Privacy Act in the immediate future if there was a need to use the Information Service.  This lends weight to the view that the matter requires urgent consideration.   As required by s 80A(1)(c), I am satisfied that the matter is urgent as, in the absence of a temporary public interest determination made as soon as possible, the Applicant would or may be in breach of NPP 10 when collecting health information from the Information Service.   5.3       Consideration given to National Privacy Principle 1   5.3 (a)  Does or may the act or practice breach National Privacy Principle 1?   The application also raises the Applicant’s obligations in respect of National Privacy Principle 1.  A collection by the Applicant, from the Information Service, of information about one of their patients is likely to be necessary for one of the Applicant’s functions (as required by National Privacy Principle 1.1) and, subject to the making of a determination, be lawful and fairly collected (National Privacy Principle 1.2).  Accordingly, there would be no breach of those elements of National Privacy Principle 1.   I have also considered whether the obligations under National Privacy Principles 1.3 and 1.5 (that is, to provide an individual with notice of certain things when collecting information about them) would impede the Applicant’s collection of information from the Information Service.   I note that the obligations imposed by National Privacy Principle 1.5 may be met at or before the time of collection, or if that is not possible, as soon as practicable after the collection.    In addition, it should be noted that National Privacy Principle 1.5 requires that the Applicant take “reasonable steps” to ensure that the individual is aware of certain matters; what is reasonable will depend on the circumstances at hand.  The principle also expressly provides that, in certain limited circumstances, the Applicant does not have to inform the individual of the various matters listed in National Privacy Principle 1.3, including if giving notice would pose a serious threat to the life or health of any individual.   Accordingly, I am satisfied that National Privacy Principle 1 does not impose obligations which do, or are likely to, prevent the Applicant from collecting information from the Information Service.  It follows therefore that the Applicant could collect information from the Information Service without breaching the law in this respect.   As the act or practice would not constitute a breach of National Privacy Principle 1 for the purposes of s 80A(1)(a), it is not necessary for me to consider the further matters listed in s 80A(1).   5.4       Consideration given to National Privacy Principle 2   The HIC has advised me that if the Applicant contacts the Information Service, the Applicant must disclose personal information concerning the individual to determine the individual’s identity (specifically, name, Medicare number and date of birth). This appears to be a disclosure of personal information under National Privacy Principle 2.   National Privacy Principle 2 sets out the general rule that an organisation must only use or disclose personal information for the primary purpose of collection. Use and disclosure for a secondary purpose is not allowed except where such use or disclosure falls within the exceptions listed in National Privacy Principle 2.   As the Applicant is unlikely to have collected the individual’s identifying details initially for the primary purpose of disclosure to the HIC, I have considered the application of National Privacy Principle 2.1(a) to the application.  This exception permits a disclosure of sensitive information where it is directly related to the primary purpose of collection and it falls within the individual’s reasonable expectations.   The Applicant would contact the Information Service to assist in their clinical decision making relating to the individual’s presentation at the health service.  This purpose seems directly related to the primary purpose for which the relevant information was initially collected (to provide diagnosis, assessment, and treatment).    The Applicant must also be confident that the individual would reasonably expect the disclosure to occur.  I note that the HIC has committed to undertake communication strategies with providers (such as the Applicant) and patients to explain the purpose and functions of the Information Service.  This is consistent with the HIC’s functions under the HIC Determination to promote awareness of the Prescription Shopping Project.[2]    I have formed the view that, insomuch as these communication strategies are effectively implemented by the HIC and organisations, including the Applicant, then individuals would reasonably expect their personal information to be disclosed to the HIC if an organisation uses the Information Service.   I consider the Applicant could rely on National Privacy Principle 2.1(a) to ground the disclosure of an individual’s identifying information to the HIC for the purpose of using the Information Service.  Accordingly, it is not necessary to exclude the Applicant or organisations generally from the obligations imposed by this principle.   As the act or practice would not constitute a breach of National Privacy Principle 2 for the purposes of s 80A(1)(a), it is not necessary to consider the further matters listed in s 80A(1).   5.5       Other matters taken into account In considering this application I have taken into account oral advice from the HIC that any alternative regulatory or statutory measures would take some time, and that a determination, if warranted, would be needed as an interim measure to allow information from the Information Service to be collected.   6.       Statutory conferences and process regarding Public Interest Determination   During the period in which this Temporary Public Interest Determination is in effect, I will consider the application by the Applicant for a Public Interest Determination under section 72 of the Privacy Act.   7.      Attachments   A:  Health Insurance Commission (Additional Functions – Prescription Shopping Project) Determination 2003
Attachment A            

[1] http://www.hic.gov.au/providers/programs_services/pbs/prescription_shop.htm#info_services
[2] Clause 8.