AMA Overview of the Privacy Legislation

In relation to the Privacy Amendment (Private Sector) Act 2000 (the Act), the AMA has long argued that overarching health privacy legislation is vital to adequately and appropriately protect patient privacy. However, the new privacy legislation fails to:

• ensure the security of electronic health (e-health) records; thus, it is incapable of preventing the on-selling of patient information to those organisations interested in developing commercial databases;
• adequately protect the privacy and confidentiality of 'incompetent' patients, such as children or those with a mental impairment, as the new provisions not only give a guardian access to the complete medical record of the patient but also provide the guardian with the means to alter the record;
• protect the medical practitioner's private or preliminary views in the thinking processes required for full medical assessments, accurate diagnosis and the formulation of treatment programs;
• sufficiently enhance the protection of patient privacy, while it imposes onerous and financially burdensome compliance obligations on health providers, the cost of which will inevitably be passed on to the consumer.

In relation to the Draft Health Privacy Guidelines, (the draft Guidelines), the AMA's view is that they require major revision. In terms of general considerations, they:

• are too long and complex to be practical and 'user friendly' for health providers;
• impose standards that exceed those set by the National Privacy Principles (NPPs) in the Act, thus, making compliance virtually impossible in certain circumstances;
• undermine best clinical practice;
• interfere with the medical practitioner's common law duty of care to their patients;
• conflict with national and international ethical codes of conduct;
• add substantial compliance costs that must ultimately be passed on to patients; and
• fail to recognise the medical profession's role in clinical training and medical research.

In terms of specific considerations, the draft Guidelines incorporate a fundamental error of interpretation of the NPPs, in applying an unwarranted narrow interpretation of 'primary purpose' and 'directly related secondary purposes' to the collection of information by health providers. The 'primary purpose' of collection of health information by health providers is 'the health care of the patient', as opposed to the definition in the draft Guidelines that limits the primary purpose by reference to an isolated episode of care. This indicates a failure to comprehend the very fundamental nature of health care itself, and has unintended but grave consequences to patient health and well being.