Review of Medicare and PBS Guidelines issued under s.135AA of the National Health Act 1953
Paper at http://www.privacy.gov.au  

Submission by the Australian Privacy Foundation
February 2005

The Australian Privacy Foundation
The Australian Privacy Foundation is the main non-governmental organisation dedicated to protecting the privacy rights of Australians. The Foundation aims to focus public attention on emerging issues which pose a threat to the freedom and privacy of Australians. The Foundation has led the fight to defend the right of individuals to control their personal information and to be free of excessive intrusions. The Foundation uses the Australian Privacy Charter as a benchmark against which laws, regulations and privacy invasive initiatives can be assessed.  For information about the Foundation and the Charter, see www.privacy.org.au 
Overview
We are concerned that the Issues Paper does not explain where the pressure for review of the Guidelines is coming from, with the result that it is difficult for submissions to address the full implications of any changes.  

We are also concerned that the Issues Paper effectively invites submissions as to why the underlying legislation (NHA s.135AA) should be amended. Despite declaring at the outset (p.3) that this is not within the scope of the review, much of the subsequent  discussion does not draw a sufficiently clear distinction between the Guidelines and the provisions of s.135AA.  In particular, the invitation (Issue (a))  to comment on whether other current provisions adequately protect privacy in the handling of Medicare and PBS claims information is inappropriate, as this clearly goes to the objective of s.135AA. Other provisions cannot be sufficient – otherwise the Guidelines would be redundant – and this is not at issue in this review. The paper also invites (pp.10 & 11) discussion of Guideline 1.1 as though it has the same discretionary status as the other guidelines, when it is significantly a restatement of the core NHA provisions about separation of data (s.135AA(5)(d-(e)), which cannot be changed without legislative amendment.

Detailed comments

The paper states on p.11 (first paragraph) that “an individual’s Medicare claims data will contain the individual’s name and Medicare card number …”.  This seems to conflict with the practical and intended effect of s.135AA, which is to ensure that the claims data, while received with those identifiers attached, is only stored with the internally generated HIC PIN attached.  It would be helpful, and less confusing, to emphasise that the claims data, once stored, does not contain the individual’s name and Medicare card number. We would be grateful for clarification and confirmation of what we think to be a significant primary effect of the Guidelines. 

We note that s.135AA does not itself deal with the issue of what data the Department of Health & Ageing  may hold – the regime whereby the Department receives so-called ‘de-identified’ information from the HIC is constructed entirely by the Guidelines and is therefore open for review.

In this respect, we question whether it is misleading to describe the claims data held by the Department as ‘de-identified’.  Whether it is technically accurate in light of the definition of de-identified given in footnote 12 depends critically on whether ‘an organisation’ in that definition is read as ‘any organisation’ or just as ‘the organisation in whose hands a judgement is being made about whether it is ‘de-identified.  Whether it is substantively misleading in effect depends on the way in which the data is being used in practice.

In order to assess this, it would be necessary to know the extent to which the Department is now taking advantage of the ‘re-identification’ facility offered by the Guidelines.  It would have been helpful if the Issues paper had given some empirical data about the volume of records and of re-identification, and trends since the Guidelines have been in place, to better inform consideration of the benefits and risks.  In this respect, see our comment below concerning the information that is supposed to be made publicly available by the Department pursuant to GL 6.3

If the volume of re-identification is significant, then we question whether the objective of the Guidelines is being met – we suggest that the construction of the elaborate arrangements for de-identified use by the Department with a ‘difficult’ process for re-identified uses was entirely deliberate and consistent with the intention of Parliament.  Any changes to the Guidelines that facilitated re-identified uses would be contrary to the spirit of the provision.  Re-identification should remain a relatively rare and exceptional activity. 

Similarly, we would have found it useful to know the reasons behind the suggestion (Issue (c)) that the HIC might be allowed to keep linked data for more than 3 months.  All the arguments that led to the setting of that period remain valid, and we would like to have the opportunity to comment on any contrary arguments.

In relation to Issue (d), the list of potential secondary uses starting on p.17 are all ones which existed at the time the Guidelines were drawn up.  No evidence is presented as to why the case for these uses has become stronger, how the Guidelines currently hinder such uses, or what precise changes would be required to facilitate them.  With the exception of item 6, all of these uses can be made of claims information with the consent of the individuals concerned.  There is no case made for why consent cannot or should not be obtained for these uses.  Secondary use 6 (statistical research) expressly relates to de-identified data, and it is not clear how the Guidelines currently obstruct such uses.  In the absence of further information, we favour no change to the Guidelines, which continue to implement the intention of Parliament in enacting s.135AA, and also reflect the community attitudes which are outlined in the Paper.  Our response to Issue (f) is that the Guidelines do effectively meet community expectations.

It is suggested on p.19 (under Consent and Access – Issue (e)) that an individual cannot consent to their Medicare and PBS data being linked and provided to them in a single report, and that this hinders their ability to easily and conveniently access their full claims information.  This is a complete furphy!  There is no reason why the HIC cannot design its processes for responding to access requests to give the ‘results’ of the two separate enquiries in one combined response.

Issue (g) is premised on possible future harmful delays in retrieving information that is more than 5 years old from the Department to respond to individual’s requests.  This seems to be another ‘speculative’ furphy. The HIC and the Department should be able to devise procedures for responding to such requests that do not involve unacceptable delays.

We note from the Commissioner’s note to GL 5.4 that Amendment 1996 No 1 made an exception  to this Guideline.  We cannot recall any significant public consultation concerning this change and submit that it be revisited as part of the current review.  We do not see why disclosures under pre-existing secrecy provisions should have been exempted from Guideline 5.4.  The later Guideline, developed and issued in the full knowledge of the existence of those secrecy provisions, should prevail.

In relation to Issue (h), we have several comments:

One change which might be useful is to replace the term ‘database’ with a more technology neutral concept.  Distributed storage and processing have made the concept of a database obsolete.  The important point is to ensure separate storage of the data and controls over linkage, however it is held. 

We assume that the opportunity will be taken to delete the second part of Guideline 1.4(b), inserted in 2000, which is now time-expired?

We note the assertion that the reference to the s.95 NH&MRC Medical Research Guidelines (MRG) at Guideline 4A.1 cannot refer to ‘the MRG in force from time to time’.  This means the s.135AA Guidelines will either be out of date from time to time or require periodic re-issuing.  A way should be found to avoid this difficulty – even if it requires legislative amendment.

Information that should be available under the Guidelines

We note that there are several requirements for information under the Guidelines.  These are:

A Technical Standards Report and any variations (GL 1.3, also 3.2, 4.3)
A publicly available policy statement outlining usual practices of disclosure under GL 6.1 (GL 6.3)
Reports to the Privacy Commissioner about procedures developed under 6.2, 6.4 and 6.5 (GL 6.6)

There is no reference in the Issues Paper to the information provided pursuant to these requirements.  We suggest that this information would assist consideration of any proposed changes and request that it be made available during further consultations.

Conclusion

The Issues paper does not present detailed arguments in favour of relaxation of the Guidelines.  We hope that if the Commissioner receives submissions to that effect, a further round of consultation is undertaken to obtain reactions.  

In the absence of arguments for change, we support the continuation of the Guidelines in their current form, subject to the minor changes in wording and formatting as discussed above.

End.

Correspondence in relation to this submission should be addressed to:
Nigel Waters, Board Member, Australian Privacy Foundation
Phone: 02 4981 0828 and 0407 230342
E-mail: nigelwaters@iprimus.com.au

Contact Details for the APF and Board Members are at:
http://www.privacy.org.au/About/Contacts.html