Health Records Act

There have been recent changes at both federal and state level which have increased the protection of a patient’s privacy through provisions dealing with the collection, storage and control of information. The legislature is continually striving to achieve the fine balance between an individual’s right to confidentiality against the disclosure of such information to a third party.

At federal level, the national privacy principles and information privacy principles are codified in the Privacy Act 1988 (Cth) which covers the collection, storage, security use and disclosure of personal information. These principles apply to private organisations, individuals and government agencies.

At state level, patients may obtain access to their records by using freedom of information legislation. At state level, such privacy legislation does not apply to private facilities or doctors in private practice. In Victoria, the Information Privacy Act 2000 (Vic) applies to public sector agencies whereas the Health Records Act 2001 (Vic) applies to both private and public sector agencies.

The Health Records Act 2001 (Vic) ("HRA") deals specifically with health information and its purpose as enshrined in section 1, is to promote fair and responsible handling of health information by –

1. protecting the privacy of an individual’s health information that is held in the public and private sectors; and
2. providing individuals with a right of access to their health information; and
3. providing an accessible framework for the resolution of complaints regarding the handling of health information.

Health information is defined in section 3 of HRA and includes information or an opinion about the physical, mental or psychological health of an individual at any time, a disability of an individual, an individual’s expressed wishes about the future of health services to him or her, and the health services provided to an individual.

The HRA contains health privacy principles which impose similar obligations to the ones contained in federal legislation. The Victorian health privacy principles are contained in Schedule 1 to the Act and cover the collection, use and disclosure of health information.

As authorised agents of the Victorian Workcover Authority, insurers and their legal representatives alike are constantly seeking medical information about individuals who seek to claim compensation for work related injuries. The Victorian Workcover Authority is most likely to be a public sector organisation for the purposes of the HRA and therefore the codified health privacy principles apply to its collection, use and disclosure of health information regarding workers who bring a claim under the Accident Compensation Act 1985 (Vic).

Health Privacy Principle 1 states that ‘an organisation must not collect health information about an individual unless the information is necessary for one or more of its functions or activities and one or more of the listed exceptions apply’. This really must be a codification of the general principle of privilege which attaches to doctor-patient communications and is enacted by state legislation in section 28 of the Evidence Act 1958 (Vic). It is also interesting to note there is no Australian authority to support the claim to medical professional privilege. However, there are several exceptions to this principle, two of which are relevant to the collection of health information by a public sector organisation. The firstly exception is consent and the second is in defence of a legal proceeding.

Consent is really an exception to the principle of confidentiality. A person may consent expressly or by implication to the doctor releasing information to a third party. Express consent is clear. For instance, when the patient asks a doctor for a certificate of incapacity to be provided to his or her employer or when the patient asks a doctor for a medical report to support a claim. It ought to be queried whether a claim form in support of an application under the Accident Compensation Act 1985 is evidence of a patient’s express or even implied consent. A claim form for statutory benefits contains an authority to release medical information. It is essentially written authorisation to any person who has provided a medical service to the worker in relation to the injury which the claim relates to give information regarding the service relevant to the claim. It is arguably not consent to provision of health information regarding other injuries. Further, the weight of the consent must be queried. Regard must be had to whether a worker fully appreciates the consequences of authorising access to his or her medical information.

The alternative view to this is that authorised agents of the Victorian Workcover Authority and indeed other statutory bodies responsible for administering claims for compensation need to be able to adequately assess the merits of a claim and in doing so require access to the claimant’s medical history and current medical information.

In support of this view, is the other exception to the collection of information, which is ‘for the establishment exercise or defence of a legal or equitable claim’. In defending legal proceedings issued by workers under the Accident Compensation Act, legal representatives for the Victorian Workcover Authority will issue subpoenas to relevant treating medical practitioners for the production of medical records, notes and documents. In accordance with HRA, the VWA and its authorised agents, such as insurers are entitled to the collection of such information.

Health Privacy Principle 2 of the HRA governs the use and disclosure of health information. It states that ‘an organisation must not use or disclose health information about an individual for a purpose other than the primary purpose for which the information was collected unless one or more of a number of exceptions apply. The exception relevant to a public sector organisation is when the use or disclosure of such health information is ‘necessary for the establishment, exercise or defence of a legal proceeding.

In using such health information, regard ought to be had to the disclosure of such information to Courts, barristers and even other medical practitioners. It would seem that HPP2 permits authorised agents of the Authority and solicitors acting on behalf of the Victorian Workcover Authority to disclose the collected information and seek legal advice or further medical opinion so that a legal proceeding may be exercised.

It seems that the very extensive privacy legislation that has been adopted in recent years strengthens the legal protection of patients’ personal information and their right to have such information kept confidential but at the same time allows organisations to collect and properly use such information for the defence of claims.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.