Allens Arthur Robinson: Biotech News

Allens Biotech News is a fortnightly news service to keep you on top of developments in this fast-moving industry.

Inappropriate disclosure of health information and access to medical records
Company News
BioTip: Secret use pitfalls
Events

Inappropriate disclosure of health information and access to medical records

In brief: Lawyer Jacqueline Goodall reports on the outcome of three recent decisions by the federal Privacy Commissioner on the protection of health information under privacy law.

L v Contractor to Australian Government Agency
H v Health Service Provider
K v Health Service Provider
Conclusion

L v Contractor to Australian Government Agency

In L v Contractor to Australian Government Agency¹, L made a complaint to the federal Privacy Commissioner (the Commissioner) alleging that a health-care provider, contracted to provide health services to L's employer, had improperly disclosed correspondence between L and the health-care provider to L's employer. The Commissioner investigated the matter under section 40(1) of the Privacy Act 1988 (Cth).

Disclosure of personal information to third parties is prohibited under the Privacy Act, unless certain circumstances exist, such as a person has consented to the disclosure or the disclosure is required or authorised by law.

The health-care provider admitted that it had contravened the Privacy Act and there were no lawful grounds for L's personal information to be disclosed to L's employer.

L accepted the health-care provider's offer to provide a written apology, to make a payment of compensation to L's chosen charity, to review its confidentiality policy and make the policy available to all staff. The Commissioner, satisfied that the complaint had been adequately addressed by the health-care provider, closed the complaint.

Return to top

H v Health Service Provider

In H v Health Service Provider the Commissioner², a medical centre disclosed the results of H's medical test to a third party. H initially pursued the matter with the medical centre, but not satisfied with its response, which was to reprimand the employee responsible for the disclosure, made a complaint to the Commissioner. The Commissioner investigated the matter under s40(1) of the Privacy Act.

As with the previous case, the starting position is that use or disclosure of personal information other than for the primary purpose of its collection is prohibited under the Privacy Act, unless certain circumstances exist. For example, disclosure is permitted if for a directly related secondary purpose within the individual's reasonable expectation. Further, an organisation must take reasonable steps to protect the personal information it holds from misuse and loss, and from unauthorised access, modification or disclosure.

The Commissioner found that the medical centre had used H's personal information, which had been collected for the purpose of providing a particular form of heath care, for a different, unrelated purpose that was in no way within H's reasonable expectations. Thus, it was found that the medical centre had disclosed H's personal information in contravention of the Privacy Act.

However, the Commissioner concluded the measures taken by the medical centre, including staff training, physical integrity, security, records-handling policy and staff-confidentiality agreements, could be reasonably expected to protect personal information it held. The staff member had departed from standard records-handling procedures. As regards the processes it had to protect personal information it held, the Commission found that the medical centre had complied with its obligations under the Privacy Act.

An offer of compensation without admission of liability was made by the medical centre and accepted by H. Satisfied that the medical centre had adequately dealt with the complaint, the Commissioner closed the matter.

Return to top

K v Health Service Provider

In K v Health Service Provider³, a patient, K, sought a copy of two documents from the patient's medical records held by a medical centre.

The medical centre refused to provide K the documents for the following reasons:

providing a copy of the first document would pose a risk to K's health;
providing a copy of the second document, a letter from a family member to the medical centre, would have an unreasonable impact on the privacy of another person.

K complained to the Commissioner about the refusal to provide copies of the documents. The Commissioner investigated the matter under s40(1) of the Privacy Act.

Individuals have a right to access their own health information, unless certain exceptions apply. For example, a person may be denied access to protect the health or safety of the person or the privacy or another person.
The Commissioner engaged an independent medical consultant to judge whether the first document posed a serious risk to K's health. The consultant found, and the Commissioner agreed, that the first document posed no such threat. The medical centre provided K with a copy of the document.

In determining whether access to the letter from the family member could be withheld, the Commissioner took into account that the family member had specifically requested that the information not be released and had not been informed of the possibility that the information may be released to K at a later time, and the fact that the information was not of a commonplace nature so its disclosure would have serious consequences for the family member and their relatives.

The Commissioner found that the medical centre was lawfully able to deny K access to the letter.

Return to top

Conclusion

Privacy law provides individuals a general right to gain access to their own health information and protects them from unauthorised disclosure by organisations holding that information. However, there are limits on those rights and protections.

As was the case in L v Contractor to Australian Government Agency, a health-care provider cannot disclose a patient's health information to a person's employer, even when the health-care provider has been engaged to provide health services to the person by the employer. However, such disclosure would be permitted with the patient's consent.

As was the case in H v Health Service Provider, the use or disclosure of personal information other than for the primary purpose of its collection is prohibited. However, such disclosure may be lawful if it was for a directly related secondary purpose within the individual's reasonable expectation.

As was the case in K v Health Service Provider, individuals have a right to access their own health information, unless the information would impact on the privacy of another person.

Footnotes

[2007] PrivCmrA 14.
[2007] PrivCmrA 10.
[2007] PrivCmrA 13.

Return to top

Company news

In brief: Regular news from the biotech industry.

Acrux announces marketing partner for Estradiol
BioPharmica to spin-off brain anaesthesia arm
GSK and Baxter to donate H5N1 vaccine to WHO
Novogen and Chattm settle Isoflavone patent infringement case
Schering Plough successful in class action
Roche agrees to buy DNA microarray company NimbleGen for US$272.5 million
Roche buy licensing rights to arthritis drug for up to US $370 million
Sanofi Aventis and Bristol-Myers Squibb succeed in Plavix litigation

Acrux announces marketing partner for Estradiol

21 June – Australian biotech Acrux has announced a licensing agreement with the Australian subsidiary of Aspen Pharmacare to market the Estradiol MDTS spray for the treatment of menopause symptoms. This will be Acrux's first product in Australia and will use Acrux's unique hand-held spray technology for delivering drugs through the skin. Acrux expects to submit a marketing application to the Therapeutic Goods Administration in the third quarter of 2007, with the product expected to be available to Australian women in 2009. In the US, the Food and Drug Administration is currently reviewing the US branding of Estradiol, EvaMist, and, following FDA approval, KV Pharmaceutical will market EvaMist in the US.