A lack of nuance in proposed privacy laws risks unintended consequences, like disrupting clinical follow-up messaging and halting the flow of patient data to Primary Health Networks, the AMA warns government.
The draft law in question was an amendment to the Privacy Act 1988, which attempted to “bolster privacy protections for Australians and help tackle emerging risks from new technologies, including artificial intelligence and wearable devices such as smart glasses”.
All up, there were roughly 40 proposals. Most sought to uplift privacy protections, while the rest sought to clarify obligations, simplify obligations, and to improve the efficiency of the privacy regulator.
The amendment was general in nature, with only one section pertaining to medicine specifically – schedule five, which covered exceptions to the law for research.
According to a consultation paper attached to the amendment, the current reliance on different exceptions and guidelines had created barriers to research partnerships, necessitating the introduction of a single, broad exception.
“Broadening the scope of research covered by the new exception will facilitate a wider range of socially beneficial research, including research that addresses sensitive or complex issues, while ensuring that privacy risks continue to be managed through ethical review and compliance with the human research guidelines,” it said.
But the AMA, in its submission, said it was concerned that the research exception change would allow ethics approval to become a pathway for commercial exploitation of patient information.
“The human research guidelines should require independent ethics review, conflict management, a public-interest assessment, data minimisation, controls on re-identification and onward disclosure, and transparency,” it wrote.
Section 16B of the existing laws looked at permitted health situations in relation to the collection, use, or disclosure of health information.
A permitted health situation was defined as an event where information was collected because it was necessary to provide a health service, and the collection was either required by law or collected in accordance with rules established by a competent health or medical body.
Related
In the text of the draft legislation, an amendment to subsection 16B(2) read: “If an organisation collects health information that relates to an individual … the organisation must take such steps as are reasonable in the circumstances to ensure that the information is de-identified before the organisation discloses it”.
In its submission, the AMA pointed out that GP practices provided de-identified health information to PHNs for research.
“The new definitions of ‘de-identified’ and ‘reasonably identifiable’ require GPs to consider what information is reasonably available to a PHN, registry, linkage unit or downstream researcher. This is not feasible,” the submission read.
Ideally, the AMA said, the human research guidelines should provide de-identification “safe harbours” for scenarios where information was collected via repositories and intermediaries.
The association also called for amendments to a clause under section 16B, which would allow the disclosure of patient data for legal claims, so that it would also allow for the disclosure of patient data during regulatory matters before AHPRA or the PSR.
Another section which drew the AMA’s attention was a new definition for “direct marketing”, which the consultation document said was “intended to be interpreted broadly and includes disclosures that support or inform direct marketing, even where marketing is not the sole purpose”.
Basically, the draft law would make it easier for people to opt out of receiving direct marketing texts and emails. But in doing so, it would also reclassify direct marketing as “trade”, and using personal information for trade was prohibited without consent.
“Communications about vaccination, screenings, preventive-health campaigns or follow ups will all fall within the definition of ‘direct marketing’ as they are targeted communications,” the AMA warned.
Its proposed fix was for the government to introduce an exemption for disclosures made for the “provision, continuity or administration of a health service, clinical follow-up, preventive healthcare, screening, vaccination, patient safety or public health, unless the substantial purpose is unrelated commercial advertising”.
The post Privacy amendment may trip up GPs appeared first on Medical Republic.
Add Comment