{"id":"F2008B00222","name":"Privacy Act 1988 - Guidelines approved under section 95A - December 2001","slug":"privacy-act-1988-guidelines-approved-under-section-95a-december-2001","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"repealed","isInForce":false,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":72976,"registerId":"commonwealth-F2008B00222-current","compilationNumber":null,"startDate":"2026-04-02","status":"Repealed","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"3","sectionType":"section","heading":"This term is based on entries contained in The Australian Concise Oxford Dictionary, Third Edition, 1997.","content":"3 This term is based on entries contained in The Australian Concise Oxford Dictionary, Third Edition, 1997.\n\nDisclosure\n\nIn general terms an organisation discloses personal information when it releases information to others outside the organisation. It does not include giving individual’s information about themselves. (cf: Key Concept—‘Use’, page 10.)\n\n(OFPC—Guidelines to the National Privacy Principles, September 2001)\n\nHealth information\n\nHealth information is a particular subset of personal information. Health information is personal information:\n\n• About an individual’s health or disability at any time (that is past, present or future);\n\n• About an individual’s expressed wishes regarding future health services;\n\n• About health services provided or to be provided to the individual;\n\n• Collected whilst providing a health service; or\n\n• Collected in connection with the donation or intended donation of body parts and substances.\n\nHealth information includes any information collected by a health service provider during the course of providing treatment and care to an individual, including;\n\n• Medical information;\n\n• Personal details, such as name, address, admission and discharge dates, billing information and Medicare number;\n\n• Information generated by a health service provider, such as notes or opinions about an individual and their health;\n\n• Information about physical or biological samples, where it can be linked to an individual; for example, where they have a name or identifier attached;\n\n• Genetic information, when this is collected or used in connection with delivering a health service, or genetic information when this is predictive of an individual’s health.\n\nUnder the Privacy Act 1988, higher privacy standards apply to the handling of sensitive information. Health information is one kind of sensitive information, and is subject to additional provisions.\n\n(OFPC—Guidelines on Privacy in the Private Health Sector, October 2001. Defined in Section 6, Privacy Act 1988 )\n\n(Cf: Key Concepts—‘Sensitive information’, page 10)\n\nHealth services\n\nProviders of health services range from hospitals, pharmacists and general practitioners to gyms and weight loss clinics. A more comprehensive but not exhaustive list of health service providers is provided at section A.2.1 of the OFPC—Guidelines on Privacy in the Private Health Sector, 2001. See Appendix 2 of the OFPC Guidelines for the definition of the term Health services, as defined in the Privacy Act 1988.\n\n(OFPC—Guidelines on Privacy in the Private Health Sector, October 2001. Defined in Section 6, Privacy Act 1988 ).\n\nManagement, funding or monitoring of a health service\n\nWhether an activity falls within the ‘management, funding or monitoring of a health service’ depends on the circumstances. Factors that might ordinarily be relevant to this question include whether the organisation provides a health service (health services are defined in section 6 of the Privacy Act 1988 and Appendix 2 of the OFPC Guidelines on Privacy in the Private Health Sector, 2001) or whether the organisation has a role in funding or monitoring the quality or other aspects of a health service. Management, funding or monitoring of a health service may include some quality assurance and audit activities.\n\n(OFPC Information Sheet 9—2001 Handling Health Information for Research and Management)\n\nOrganisation\n\nThe NPPs apply to businesses and bodies that fall within the definition of ‘organisation’ in section 6C of the Privacy Act 1988. Section 6C says that ‘organisation’ means: an individual; or body corporate; or partnership; or any other unincorporated association; or trust; that is not a small business operator, a registered political party, an agency, a State or Territory authority or a prescribed instrumentality of a State or Territory.\n\n(OFPC—Guidelines to the National Privacy Principles, September 2001. Defined in Section 6, Privacy Act 1988 )\n\n\\[For further information see the OFPC Information Sheet 12—2001 Coverage of and exemptions from the Private Sector Provision\\]s\n\nPersonal information\n\nPersonal information is information or an opinion (including information or an opinion forming part of a database) whether true or not, and whether recorded in material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion (Section 6 of the Privacy Act 1988 ). It includes all personal information regardless of its source.\n\n(OFPC—Guidelines to the National Privacy Principles, September 2001. Defined in Section 6, Privacy Act 1988 )\n\nPublic health and public safety 4\n\nPublic health includes activities such as education, economics, technology, legislation and management, which protect and enhance the health of all people and to prevent illness, injury and disability.\n\nPublic safety can be thought of as the condition for all people of being safe and free from danger or risks.\n\nTo be relevant to public health or public safety the outcome of the research, or compilation of analysis of statistics activity should have an impact on or provide information about public health or public safety. Examples of public health or public safety issues could include, water quality, food safety, mental health, environmental hazards, diabetes, cancer and heart disease.\n\nResearch\n\nThere are many definitions of research. These include systematic investigation to establish facts, principles or knowledge and a study of some matter with the objective of obtaining or confirming knowledge. A defining feature of research is the validity of results. The knowledge that is generated by research is valid in the sense that what is discovered about the particular facts investigated can be justifiably claimed to be true for all like facts.\n\n(for further discussion of this term please see; National Statement on Ethical Conduct in Research Involving Humans, 1999).\n\nSensitive information\n\nSensitive information is a subset of personal information. It means information or an opinion about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual preferences or practices, criminal record or health information about an individual (Section 6 of the Privacy Act 1988 ).\n\n(OFPC—Guidelines to the National Privacy Principles, September 2001. Defined in Section 6, Privacy Act 1988 ).\n\nUse\n\nIn general terms, use of personal information refers to the handling of personal information within an organisation including the ‘inclusion of information in a publication’.\n\n(OFPC—Guidelines to the National Privacy Principles, September 2001).\n\n4 This term is based on information from the following sources: Public Health Australia—An Introduction, Lawson, James S., 1991, The Australian Concise Oxford Dictionary, Third Edition, 1997, and the OFPC Information Sheet 9—2001 Handling Health Information for Research and Management.\n\nGUIDELINES APPROVED UNDER SECTION 95A OF THE PRIVACY ACT 1988\n\nA.1 Guidelines for the conduct of research relevant to public health or public safety\n\nA.1.1 These guidelines apply to NPP 10.3(d)(iii) for the collection of health information and NPP 2.1(d)(ii) for the use and disclosure of health information, for the purpose of research relevant to public health or public safety. These guidelines provide a mechanism for weighing the public interest in research relevant to public health or public safety against the public interest in the protection of privacy. The public interest in the research activity must substantially outweigh the public interest in maintaining the level of privacy protection afforded by the NPPs (other than NPP 10.3(d) and NPP 2.1(d)).\n\nA.1.2 It must be necessary to collect, use or disclose health information for the purpose of research relevant to public health or public safety. It must be determined that:\n\n(a) the outcome of the research activity would have an impact on or provide information about public health or public safety; and\n\n(b) the relevant purpose of the research activity can not be achieved by the collection, use or disclosure of de-identified data5.\n\nA.1.3 It must be impracticable 6 to seek consent from the individual(s) involved to collect, use or disclose their health information for the purpose of research relevant to public health or public safety.\n\nA.1.4 Where an organisation seeks to rely on these guidelines to collect, use or disclose health information for the purpose of research relevant to public health or public safety under NPP 10.3(d)(iii) 7 or NPP 2.1(d)(ii ), the organisation must be satisfied that the research activity in which health information is to be collected, used or disclosed has been approved by a HREC for the particular purpose.\n\n5 The NPPs and these guidelines do not apply to de-identified information or statistical data sets, which would not allow individuals to be identified. (OFPC—Guidelines on Privacy in the Private Health Sector).\n\n6 In assessing whether it is ‘impracticable’ to seek consent, this would ordinarily mean more than simply the incurring of some expense or effort in seeking consent. For example, it may be impracticable to seek consent where the organisation is unable to locate the individual, despite making reasonable efforts. (OFPC—Guidelines to the National Privacy Principles).\n\n7 NPP 10.3(d)(iii) and these guidelines are not the only mechanism under which health information may be lawfully collected without consent for the purpose of research relevant to public health or public safety. Collection of health information where it is impracticable to seek consent for the purpose of research is also authorised under NPP 10.3 (d)(i) and NPP 10.3 (d)(ii).\n\n(See: Introduction to these guidelines, page 2 and Appendix 5)\n\nConditions relating to approval of research relevant to public health or public safety given by a human research ethics committee\n\nA.1.5 A human research ethics committee (HREC) must give approval for the collection, use or disclosure of health information for the purpose of research relevant to public health or public safety, in accordance with these guidelines. The HREC must be constituted and functioning in accordance with the National Statement on Ethical Conduct in Research Involving Humans.\n\n\\[See: ‘2. Human Research Ethics Committees’, National Statement (1999)\\].\n\nA.1.6 An organisation from which health information is sought, may always decline to agree to the use or disclosure of health information it holds for the purpose of research relevant to public health or public safety, even where the use or disclosure of that health information has been approved by an HREC in accordance with these guidelines.\n\nA.2 Procedures to be followed in the collection of health information 8 for the purpose of research relevant to public health or public safety\n\nA.2.1 This section (A.2) of the guidelines applies to the collection of health information under NPP 10.3, for the purpose of research relevant to public health or public safety. A research proposal must be submitted to an HREC for approval. The research proposal must follow the procedures set out in this section (A.2) and will be considered by an HREC only if the proposal also satisfies requirements in section A.1 of these guidelines.\n\nA.2.2 An overriding obligation for those who seek to collect health information is at all times to respect the dignity and privacy of the individual.\n\nA.2.3 Collection of health information for the purpose of research relevant to public health or public safety must be in accordance with NPP 1.1 and NPP1.2. (See: Appendix 1)\n\n\\[See: OFPC—Guidelines to the National Privacy Principles for guidance on the privacy obligations required under NPP 1\\].\n\nA.2.4 The collector(s) of health information for the purpose of research relevant to public health or public safety must give a written proposal for that research activity to an HREC. The proposal must include any information necessary for members of that HREC to meet their responsibilities under these guidelines. Guidance on the information to be included in the written proposal for the collection of health information is set out in paragraph A.2.6 of these guidelines.\n\nA.2.5 The proposal to be submitted to an HREC for a research activity involving the collection of health information must contain a reference\n\n8 By definition (Section 6 of the Privacy Act 1988 ) the term ‘health information’ is also ‘personal information’. Therefore, all health information is information or opinion about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, (See: Key Concepts, pages 8 & 9).\n\nto NPP 10. The proposal must state the reasons for believing that the public interest in the proposed research activity substantially outweighs the public interest in adhering to the other NPPs (other than NPP 10.3(d)(iii)). In the proposal, the collector(s) must provide the HREC with the necessary information to enable the HREC to weigh the public interest consideration in accordance with paragraph D.5 of these guidelines.\n\nA.2.6 In the proposal to collect health information for the purpose of research relevant to public health or public safety, the collector(s) should state:\n\n(f) the reasons why de-identified information can not achieve the relevant purpose of the research activity;\n\n(g) the reasons why it is impracticable to seek consent from the individual for the collection of health information9;\n\n(j) the security standards to be applied to the health information. Standards must be in accordance with NPP 4. (See: Appendix 1).\n\n\\[Note: In particular, health information should be retained in accordance with the Joint NHMRC/AVCC Statement and Guidelines on Research Practice (See: Appendix 3), and in a form that is at least as secure as it was in the sources from which the health information was obtained unless more stringent legislative or contractual provisions apply\\];\n\n(k) a list of personnel within the collecting organisation or organisations with access to the health information collected;\n\n(l) the level of protection that will be applied by the collector(s) to protect health information disclosed to the collector(s) by the disclosing organisation. These should include:\n\n(i) terms of any release agreement between the disclosing organisation and the collector(s) to govern limits on the use and disclosure of collected health information.\n\n\\[See: paragraph A.2.9 of these guidelines\\]; and\n\n9 The impracticability of obtaining consent for research involving identified genetic information may extend beyond the individual to include relatives of the individual. See: ‘16 Human Genetic Research’ of the National Statement for further information.\n\n(ii) proposed methods of disposal of the health information on the completion of the research activity, as required by NPP 4.2. (See: Appendix 1).\n\nA.2.7 The collector(s) of health information for the purpose of research relevant to public health or public safety should provide to the organisation(s) from which health information is sought, written notification of the decision of the HREC made in accordance with these guidelines. This written notification removes the obligation for the disclosing organisation(s) to submit a written proposal to an HREC to disclose health information for the same research activity.\n\n\\[See: paragraph A.3.5 of these guidelines\\].\n\nA disclosing organisation may still decide to submit a written proposal to an HREC in accordance with section A.3 of these guidelines even if that disclosing organisation receives written notification of HREC approval from the collector(s).\n\nA.2.8 The collector(s) of health information for the purpose of research relevant to public health or public safety must immediately report to the HREC anything that might warrant review of ethical approval of the research proposal.\n\n\\[See: paragraph 2.37, ‘Human Research Ethics Committees’ National Statement (1999)\\].\n\nA.2.9 Disclosure of health information collected under these guidelines, and therefore collected in accordance with NPP 10.3, must be in accordance with NPP 10.4. (See: Appendix 1).\n\n\\[See: OFPC Information Sheet 9—2001 Handling health information for research and management for further information on privacy obligations required under NPP 10.4\\].\n\nA.2.10 Once a proposal submitted to an HREC to collect health information for the purpose of research relevant to public health or public safety satisfies the procedural requirements outlined in this section (A.2), the HREC must then weigh the public interest considerations set out in section D.5 of these guidelines.\n\nA.3 Procedures to be followed in the use and disclosure of health information 10 for the purpose of research relevant to public health or public safety\n\nA.3.1 This section (A.3) of the guidelines applies to the use or disclosure of health information under NPP 2.1(d), for the purpose of research relevant to public health or public safety. A research proposal must be submitted to an HREC for approval. The research proposal must follow\n\n10 By definition (Section 6 of the Privacy Act 1988 ) the term ‘health information’ is also ‘personal information’. Therefore, all health information is information or opinion about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, (See: Key Concepts, pages 8 & 9).\n\nthe procedures set out in this section (A.3) and will be considered by an HREC only if the proposal also satisfies requirements in section A.1 of these guidelines.\n\nA.3.2 An overriding obligation for those who seek to use or disclose health information is at all times to respect the dignity and privacy of the individual.\n\nA.3.3 Those who seek to use or disclose health information for the purpose of research relevant to public health or public safety must give a written proposal for that activity to an HREC. The proposal must include any information necessary for members of the HREC to meet their responsibilities under these guidelines. Guidance on the information to be included in the written proposal for the use or disclosure of health information is set out in paragraph A.3.6 of these guidelines.\n\nA.3.4 The proposal to be submitted to an HREC for a research activity, involving the use or disclosure of health information must contain a reference to NPP 2. The proposal must state reasons for believing that the public interest in the proposed research activity substantially outweighs the public interest in adhering to the other NPPs (other than 2.1(d)). In the proposal, the user or discloser must provide the HREC with the necessary information to enable the HREC to weigh the public interest consideration in accordance with paragraph D.5 of these guidelines.\n\nA.3.5 An organisation may disclose health information to a collecting organisation for the purpose of research relevant to public health or public safety without submitting a written proposal to an HREC, if the disclosing organisation receives written notification of HREC approval for health information to be collected from it.\n\n\\[See: paragraph A.2.7 of these guidelines\\].\n\nGuidance for preparing the written proposal to be submitted to an HREC\n\nA.3.6 In the proposal to use or disclose health information for the purpose of research relevant to public health or public safety, the user or discloser should state:\n\n(a) the aims or purpose of the use or disclosure;\n\n(b) the credentials and technical competence of those seeking to use or disclose the data;\n\n(f) the reasons why de-identified information can not achieve the relevant purpose of the research activity;\n\n(g) the reasons why it is impracticable to seek consent from the individual for the use or disclosure of health information11;\n\n(h) the specific uses or disclosures that will be applied to the health information during the study;\n\n(i) the proposed method of publication of results of the research, including a statement that health information will not be published unless in de-identified form;\n\n(j) the estimated time of retention of the health information;\n\n(k) the identity of the custodian(s) of the health information used or disclosed;\n\n(l) the security standards to be applied to the health information. Standards must be in accordance with NPP 4. (See: Appendix 1).\n\n\\[Note: In particular, health information should be retained in accordance with the Joint NHMRC/AVCC Statement and Guidelines on Research Practice (See: Appendix 3), and in a form that is at the least as secure as it was in the sources from which the health information was obtained unless more stringent legislative or contractual provisions apply\\];\n\n(m) a list of personnel within an organisation or organisations with access to the health information to be used or disclosed;\n\n(n) the level of protection that will be applied by those seeking to use or disclose health information to protect that health information. These should include:\n\n(i) the terms of any disclosure agreement between the organisation that holds the health information and the user or discloser, to govern limits on the use and disclosure of the health information.\n\n\\[See: paragraph A.3.10 of these guidelines\\]; and\n\n(ii) the proposed methods of disposal of the health information on the completion of the research activity as required by NPP 4.2 (See: Appendix 1); and\n\n(iii) the level of protection that will be applied to protect the privacy of health information where it is made available to others if that is proposed.\n\nA.3.7 An organisation seeking or approached to disclose health information for the purpose of research relevant to public health or public safety, where notification from the collector is not given under paragraph A.2.7 of these guidelines should submit a written proposal to an HREC to\n\n11 The impracticability of obtaining consent for research involving identified genetic information may extend beyond the individual to include relatives of the individual. See: ‘16 Human Genetic Research’ of the National Statement for further information.\n\ndisclose the health information. The discloser should retain written notification of the decision of an HREC made in accordance with these guidelines. A copy of this notification should be provided to the collector(s) of the health information.\n\nA.3.8 If those seeking to use or disclose health information propose to use or disclose that information to contact a person, the user or discloser of that information must inform the person:\n\n(a) that his or her health information is being used or disclosed in accordance with the Privacy Act 1988 and these guidelines; and\n\n(b) how his or her health information will be used or disclosed; and\n\n(c) that he or she is free at any time to withdraw consent for further involvement in the research activity;\n\n\\[See: paragraph 1.12 ‘Principles of Ethical Conduct’, National Statement (1999)\\] and\n\n(d) of the standards that will apply to protect the privacy of that individual; and\n\n\\[See: paragraph A.3.6(l) of these guidelines\\]\n\n(e) of the complaint mechanisms in section G of these guidelines.\n\nA.3.9 Those who seek to use or disclose health information for the purpose of research relevant to public health or public safety must immediately report to the HREC anything that might warrant review of ethical approval of the research proposal.\n\nA.3.10 Health information disclosed under these guidelines, and therefore disclosed in accordance with NPP 2.1(d), must be in accordance with NPP 2.1(d)(iii). (See: Appendix 1).\n\nA.3.11 Once a proposal submitted to an HREC to use or disclose health information for the purpose of research relevant to public health or public safety satisfies the procedural requirements outlined in this section (A.3), the HREC must then weigh the public interest considerations set out in section D.5 of these guidelines.\n\nB.1 Guidelines for the conduct of the compilation or analysis of statistics, relevant to public health or public safety\n\nB.1.1 These guidelines apply to NPP 10.3(d)(iii) for the collection of health information and NPP 2.1(d)(ii) for the use and disclosure of health information, for the purpose of the compilation or analysis of statistics, relevant to public health or public safety. These guidelines provide a mechanism for weighing the public interest in the compilation or analysis of statistics, relevant to public health or public safety against the public interest in protection of privacy. The public interest in the compilation or analysis of statistics activity must substantially outweigh the public interest in maintaining the level of privacy protection afforded by the NPPs (other than NPP 2.1(d)).\n\nB.1.2 It must be necessary to collect, use or disclose health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety. It must be determined that:\n\n(a) the outcome of the compilation or analysis of statistics activity would have an impact on or provide information about public health or public safety; and\n\n(b) the relevant purpose of the compilation or analysis of statistics activity can not be achieved by the collection, use or disclosure of de-identified data12.\n\nB.1.3 It must be impracticable 13 to seek consent from the individual(s) to collect, use or disclose their health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety.\n\nB.1.4 Where an organisation seeks to rely on these guidelines to collect, use or disclose health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety under NPP 10.3(d)(iii) 14 or NPP 2.1(d)(ii), the organisation must be satisfied that the compilation or analysis or statistics activity in which health information is to be collected, used or disclosed has been approved by an HREC for the particular purpose.\n\n12 The NPPs and these guidelines do not apply to de-identified information or statistical data sets, which would not allow individuals to be identified. (OFPC—Guidelines on Privacy in the Private Health Sector).\n\n13 In assessing whether it is ‘impracticable’ to seek consent, this would ordinarily mean more than simply the incurring of some expense or effort in seeking consent. For example, it may be impracticable to seek consent where the organisation is unable to locate the individual, despite making reasonable efforts. (OFPC—Guidelines to the National Privacy Principles).\n\n14 NPP 10.3(d)(iii) and these guidelines are not the only mechanism under which health information may be collected without consent for the purpose of the compilation or analysis of statistics, relevant to public health or public safety. Collection of health information where it is impracticable to seek consent for the purpose of the compilation or analysis of statistics is also authorised under NPP 10.3 (d)(i) and NPP 10.3 (d)(ii). (See: Introduction to these guidelines, page 2 and Appendix 5)\n\nConditions relating to approval of the compilation or analysis of statistics relevant to public health or public safety given by a human research ethics committee\n\nB.1.5 An HREC must give approval for the collection, use or disclosure of health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, in accordance with these guidelines. The HREC must be constituted and functioning in accordance with the National Statement on Ethical Conduct in Research Involving Humans.\n\n\\[See: ‘2. Human Research Ethics Committees’, National Statement (1999)\\]\n\nB.1.6 An organisation may always decline to agree to the use or disclosure of health information it holds for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, even where the collection, use or disclosure of that health information has been approved by an HREC in accordance with these guidelines.\n\nB.2 Procedures to be followed in the collection of health information 15 for the purpose of the compilation or analysis of statistics, relevant to public health or public safety\n\nB.2.1 This section (B.2) of the guidelines applies to the collection of health information under NPP 10.3, for the purpose of the compilation or analysis of statistics, relevant to public health or public safety. A compilation or analysis of statistics proposal must be submitted to an HREC for approval. The compilation or analysis of statistics proposal must follow the procedures set out in this section (B.2) and will be considered by an HREC only if the proposal also satisfies requirements in section B.1 of these guidelines.\n\nB.2.2 An overriding obligation for those who seek to collect health information is at all times to respect the dignity and privacy of the individual.\n\nB.2.3 Collection of health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety must be in accordance with NPP 1.1 and NPP 1.2. (See: Appendix 1).\n\n\\[See: OFPC—Guidelines to the National Privacy Principles for guidance on the privacy obligations required under NPP 1\\].\n\nB.2.4 The collector(s) of health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, must give a written proposal for that activity to an HREC. The proposal must include any information necessary for members of that HREC to meet their responsibilities under these guidelines. Guidance on the\n\n15 By definition (Section 6 of the Privacy Act 1988) the term ‘health information’ is also ‘personal information’. Therefore, all health information is information or opinion about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, (See: Key Concepts, pages 8 & 9).\n\ninformation to be included in the written proposal for collection of health information is set out in paragraph B.2.6 of these guidelines.\n\nB.2.5 The proposal to be submitted to an HREC for a compilation or analysis of statistics activity, involving the collection of health information, must contain a reference to NPP 10. The proposal must state the reasons for believing that the public interest in the proposed compilation or analysis of statistics activity substantially outweighs the public interest in adhering to the other NPPs (other than NPP 10.3(d)). In the proposal, the collector(s) must provide the HREC with the necessary information to enable the HREC to weigh the public interest consideration in accordance with paragraph D.5 of these guidelines.\n\nB.2.6 In the proposal to collect health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, the collector(s) should state:\n\n(f) the reasons why de-identified information can not achieve the relevant purpose of the compilation or analysis of statistics activity;\n\n(g) the reasons why it is impracticable to seek consent from the individual for the collection of health information16.\n\n(j) the security standards to be applied to the health information. Standards must be in accordance with NPP 4. (See: Appendix 1).\n\n\\[Note: In particular, health information should be retained in accordance with the Joint NHMRC/AVCC Statement and Guidelines on Research Practice (See: Appendix 3), and in a form that is at least as secure as it was in the sources form which the health information was obtained unless more stringent legislative or contractual provisions apply\\];\n\n(k) a list of personnel within the collecting organisation or organisations with access to the health information collected;\n\n16 The impracticability of obtaining consent for the compilation or analysis of statistics involving identified genetic information may extend beyond the individual to include relatives of the individual. See: ‘16 Human Genetic Research’ of the National Statement for further information.\n\n(l) the level of protection that will be applied by the collector(s) to protect health information disclosed to the collector(s) by the disclosing organisation. These should include:\n\n(a) the terms of any release agreement between the disclosing organisation and the collector(s) to govern limits on the use and disclosure of collected health information.\n\n\\[See: paragraph B.2.9 of these guidelines\\]; and\n\n(b) the proposed methods of disposal of the health information on the completion of the statistical activity, as required by NPP 4.2. (See: Appendix 1).\n\nB.2.7 The collector(s) of health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, should provide to the organisation from which the health information is sought, written notification of the decision of the HREC made in accordance with these guidelines. This written notification removes the obligation for the disclosing organisation to submit a written proposal to an HREC to disclose health information for the same compilation or analysis of statistics activity.\n\n\\[See: paragraph B.3.5 of these guidelines\\].\n\nA disclosing organisation may still decide to submit a written proposal to an HREC in accordance with section B.3 of these guidelines even if that disclosing organisation receives written notification of HREC approval from the collector(s).\n\nB.2.8 The collector(s) of health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety must immediately report to the HREC anything that might warrant review of ethical approval of the proposal.\n\nB.2.9 Disclosure of health information collected under these guidelines, and therefore collected in accordance with NPP 10.3, must be in accordance with NPP 10.4. (See: Appendix 1).\n\n\\[See: OFPC Information Sheet 9—2001 Handling health information for research and management for further information on privacy obligations required under NPP 10.4\\].\n\nB.2.10 Once a proposal submitted to an HREC to collect health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety satisfies the procedural requirements outlined in this section (B.2), the HREC must then weigh the public interest considerations set out in section D.5 of these guidelines.\n\nB.3 Procedures to be followed in the use and disclosure of health information 17 for the purpose of the compilation or analysis of statistics, relevant to public health or public safety\n\nB.3.1 This section (B.3) of the guidelines applies to the use or disclosure of health information under NPP 2.1(d), for the purpose of the compilation or analysis of statistics, relevant to public health or public safety. A compilation or analysis of statistics proposal must be submitted to an HREC for approval. The compilation or analysis or statistics proposal must follow the procedures set out in this section (B.3) and will be considered by an HREC only if the proposal also satisfies requirements in section B.1 of these guidelines.\n\nB.3.2 An overriding obligation for those who seek to use or disclose health information is at all times to respect the dignity and privacy of the individual.\n\nB.3.3 Those who seek to use or disclose health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, must give a written proposal for that activity to an HREC. The proposal must include any information necessary for members of the HREC to meet their responsibilities under these guidelines. Guidance on the information to be included in the written proposal for the use or disclosure of health information is set out in paragraph B.3.6 of these guidelines.\n\nB.3.4 The proposal to be submitted to an HREC for a compilation or analysis of statistics activity, involving the use or disclosure of health information, must contain a reference to NPP 2. The proposal must state reasons for believing that the public interest in the proposed compilation or analysis of statistics activity substantially outweighs the public interest in adhering to the other NPPs (other than 2.1(d)). In the proposal, the user or discloser must provide the HREC with the necessary information to enable the HREC to weigh the public interest consideration in accordance with paragraph D.5 of these guidelines.\n\nB.3.5 An organisation may disclose health information to a collecting organisation for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, without submitting a written proposal to an HREC, if the disclosing organisation receives written notification of HREC approval for health information to be collected from it.\n\n\\[See: paragraph B.2.7 of these guidelines\\].\n\n17 By definition (Section 6 of the Privacy Act 1988 ) the term ‘health information’ is also ‘personal information’. Therefore, all health information is information or opinion about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, (See: Key Concepts, pages 8 & 9).\n\nB.3.6 In the proposal to use or disclose health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, the user or discloser should state:\n\n(a) the aims or purpose of the use or disclosure;\n\n(b) the credentials and technical competence of those seeking to use or disclose the data;\n\n(f) the reasons why de-identified information can not achieve the relevant purpose of the compilation or analysis of statistics activity;\n\n(g) the reasons why it is impracticable to seek consent from the individual(s) for the use or disclosure of health information18;\n\n(h) the specific uses or disclosures that will be applied to the health information during the study;\n\n(i) the proposed method of publication of results of the research, including a statement that health information will not be published unless in de-identified form;\n\n(j) the estimated time of retention of the health information;\n\n(k) the identity of the custodian(s) of the health information used or disclosed;\n\n(l) the security standards to be applied to the health information. Standards must be in accordance with NPP 4. (See: Appendix 1).\n\n\\[Note: In particular, health information should be retained in accordance with the Joint NHMRC/AVCC Statement and Guidelines on Research Practice (See: Appendix 3), and in a form that is at the least as secure as it was in the sources from which the health information was obtained unless more stringent legislative or contractual provisions apply\\];\n\n(m) a list of personnel within an organisation or organisations with access to the health information to be use or disclosed;\n\n(n) the level of protection that will be applied by those seeking to use or disclose health information to protect that health information. These should include:\n\n(i) the terms of any disclosure agreement between the organisation that holds the health information and the user or discloser, to govern limits on the use and disclosure of the health information.\n\n\\[See: paragraph B.3.10 of these guidelines\\]; and\n\n18 The impracticability of obtaining consent for the compilation or analysis of statistics involving identified genetic information may extend beyond the individual to include relatives of the individual. See: ‘16 Human Genetic Research’ of the National Statement for further information.\n\n(ii) the proposed methods of disposal of the health information on the completion of the statistical compilation or analysis activity, as required by NPP 4.2. (See: Appendix 1); and\n\n(iii) the level of protection that will be applied to protect the privacy of health information where it is made available to others if that is proposed.\n\nB.3.7 An organisation seeking or approached to disclose health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, where notification from the collector is not given under paragraph B.2.7 of these guidelines, should submit a written proposal to an HREC to disclose the health information. The discloser should retain written notification of the decision of an HREC made in accordance with these guidelines. A copy of this notification should be provided to the collector(s) of health information.\n\nB.3.8 If those seeking to use or disclose health information propose to use or disclose that information to contact a person, the user or discloser of that information must inform the person:\n\n(a) that his or her health information is being used or disclosed in accordance with the Privacy Act and these guidelines; and\n\n(b) how his or her health information will be used or disclosed; and\n\n(c) that he or she is free at any time to withdraw consent for further involvement in the statistical activity.\n\n\\[See: paragraph 1.12, ‘Principles of Ethical Conduct’, National Statement (1999)\\]; and\n\n(d) of the standards that will apply to protect the privacy of that individual;\n\n\\[See: paragraph B.3.6(l) of these guidelines\\]; and\n\n(e) of the complaint mechanisms in section G of these guidelines.\n\nB.3.9 Those who seek to use or disclose health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, must immediately report to the HREC anything that might warrant review of ethical approval of the proposal.\n\nB.3.10 Health information disclosed under these guidelines, and therefore disclosed in accordance with NPP 2.1(d), must be in accordance with NPP 2.1 (d)(iii). (See: Appendix 1).\n\nB.3.11 Once a proposal submitted to an HREC to use or disclose health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, satisfies the procedural requirements outlined in this section (B.3), the HREC must then weigh the public interest considerations set out in section D.5 of these guidelines.\n\nC.1 Guidelines for the conduct of the management, funding or monitoring of a health service\n\nThe Guidelines approved under Section 95A of the Privacy Act 1988 are only authorised to provide guidance for the collection of health information for the purpose of the management, funding or monitoring of a health service19.\n\nFor information on the requirements for the use and disclosure of health information for the purpose of the management, funding or monitoring of a health service refer to the OFPC Guidelines on Privacy in the Private Health Sector (Section 2).\n\nC.1.1 These Guidelines approved under Section 95A of the Privacy Act 1988 apply to NPP 10.3(d)(iii) for the collection of health information for the purpose of health service management and provide a mechanism for weighing the public interest in health service management activities against the public interest in protection of privacy. The public interest in the health service management activity must substantially outweigh the public interest in maintaining the level of privacy protection afforded by the NPPs (other than NPP 10.3(d)).\n\nC.1.2 It must be necessary to collect health information for the purpose of health service management. It must be determined that:\n\n(a) the relevant purpose of the health service management activity can not be achieved by the collection of de-identified data20.\n\nC.1.3 It must be impracticable 21 to seek consent from the individual(s) to collect their health information for the purpose of health service management.\n\nC.1.4 Where an organisation seeks to rely on these guidelines to lawfully collect health information for the purpose of health service management under NPP 10.3(d)(iii) 22, the organisation must be satisfied that the health service management activity in which health information is to be collected, has been approved by an HREC for the particular purpose.\n\n19 For the purpose of these guidelines, health service management means the management, funding or monitoring of a health service.\n\n20 The NPPs and these guidelines do not apply to de-identified information or statistical data sets, which would not allow individuals to be identified. (OFPC—Guidelines on Privacy in the Private Health Sector).\n\n21 In assessing whether it is ‘impracticable’ to seek consent, this would ordinarily mean more than simply the incurring of some expense or effort in seeking consent. For example, it may be impracticable to seek consent where the organisation is unable to locate the individual, despite making reasonable efforts. (OFPC—Guidelines to the National Privacy Principles).\n\n22 NPP 10.3(d)(iii) and these guidelines are not the only mechanism under which health information may be collected without consent for the purpose of health service management. Collection of health information where it is impracticable to seek consent for the purpose of health service management is also authorised under NPP 10.3 (d)(i) and NPP 10.3 (d)(ii). (See: Introduction to these guidelines, page 2 and Appendix 5).\n\nConditions relating to approval of health service management activities given by a human research ethics committee\n\nC.1.5 An HREC must give approval for the collection of health information for the purpose of health service management, in accordance with these guidelines. The HREC must be constituted and functioning in accordance with the National Statement on Ethical Conduct in Research Involving Humans.\n\n\\[See: ‘2. Human Research Ethics Committees’, National Statement (1999)\\].\n\nC.1.6 An organisation may always decline to agree to the disclosure of health information it holds, for the purpose of health service management, even where the collection of that health information has been approved by an HREC in accordance with these guidelines.\n\nC.2 Procedures to be followed in the collection of health information 23 for the purpose of the management, funding or monitoring of a health service\n\nC.2.1 This section (C.2) of the guidelines applies to the collection of health information under NPP 10.3, for the purpose of health service management. A health service management proposal must be submitted to an HREC for approval. The health service management proposal must follow the procedures set out in this section (C.2) and will be considered by an HREC only if the proposal also satisfies requirements in section C.1 of these guidelines.\n\nC.2.2 An overriding obligation for those who seek to collect health information is at all times to respect the dignity and privacy of the individual.\n\nC.2.3 Collection of health information for the purpose of health service management must be in accordance with NPP 1.1 and NPP 1.2. (See: Appendix 1).\n\n\\[See: OFPC—Guidelines to the National Privacy Principles for guidance on privacy obligations established under NPP 1\\].\n\nC.2.4 The collector(s) of health information for the purpose of health service management must give a written proposal for that activity to an HREC. The proposal must include any information necessary for members of that HREC to meet their responsibilities under these guidelines. Guidance on the information to be included in the written proposal for collection of health information is set out in paragraph C.2.6 of these guidelines.\n\nC.2.5 The proposal to be submitted to an HREC for a health service management activity involving the collection of health information must\n\n23 By definition (Section 6 of the Privacy Act 1988 ) the term ‘health information’ is also ‘personal information’. Therefore, all health information is information or opinion about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, (See: Key Concepts, pages 8 & 9).\n\ncontain a reference to NPP 10. The proposal must state the reasons for believing that the public interest in the proposed health service management activity substantially outweighs the public interest in adhering to the other NPPs (other NPP 10.3(d)(iii)). In the proposal, the collector(s) must provide the HREC with the necessary information to enable the HREC to weigh the public interest consideration in accordance with paragraph D.5 of these guidelines.\n\nC.2.6 In the proposal to collect health information for the purpose of health service management, the collector(s) should state:\n\n(f) the reasons why de-identified information can not achieve the relevant purpose of the health service management activity;\n\n(g) the reasons why it is impracticable to seek consent from the individual(s) for the collection of health information24;\n\n(j) the security standards to be applied to the health information. Standards must be in accordance with NPP 4. (See: Appendix 1).\n\n\\[Note: In particular, health information should be retained in accordance with the Joint NHMRC/AVCC Statement and Guidelines on Research Practice (See: Appendix 3), and in a form that is at least as secure as it was in the sources from which the health information was obtained unless more stringent legislative or contractual provisions apply\\];\n\n(k) a list of personnel within the collecting organisation or organisations with access to the health information collected;\n\n(l) the level of protection that will be applied by the collector(s) to protect health information disclosed to the collector(s) by the disclosing organisation. These should include:\n\n(i) the terms of any release agreement between the disclosing organisation and the collector(s) to govern limits on the use and disclosure of collected health information.\n\n\\[See: paragraph C.2.9 of these guidelines\\]; and\n\n24 The impracticability of obtaining consent for health service management activities involving identified genetic information may extend beyond the individual to include relatives of the individual. See: ‘16 Human Genetic Research’ of the National Statement for further information.\n\n(ii) the proposed methods of disposal of the health information on the completion of the health service management activity, as required under NPP 4.2. (See: Appendix 1).\n\nC.2.7 The collector(s) of health information for the purpose of health service management should provide to the organisation from which health information is sought, written notification of the decision of the HREC made in accordance with these guidelines.\n\nC.2.8 The collector(s) of health information for the purpose of health service management must immediately report to the HREC anything that might warrant review of ethical approval of the proposal.\n\nC.2.9 Disclosure of health information collected under these guidelines, and therefore collected in accordance with NPP 10.3, must be in accordance with NPP 10.4. (See: Appendix 1).\n\n\\[See: OFPC Information Sheet 9—2001 Handling health information for research and management for further information on privacy obligations required under NPP 10.4\\].\n\nC.2.10 Once a proposal submitted to an HREC to collect health information for the purpose of health service management satisfies the procedural requirements outlined in this section (C.2), the HREC must then weigh the public interest considerations set out in section D.1.5 of these guidelines.\n\nD. Consideration by human research ethics committees (HRECs)\n\nD.1 Before making a decision under these guidelines, an HREC must assess whether it has sufficient information, expertise and understanding of privacy issues, either amongst the members of the HREC or otherwise available to it, to make a decision that takes proper account of privacy matters. For the review of proposals for the collection of health information for the purpose of health service management, this may necessitate the appointment of additional members with specific expertise in the management, funding or monitoring of a health service.\n\n\\[See: ‘2. Human Research Ethics Committees’ and ‘18. Privacy of Information’, National Statement (1999)\\].\n\nD.2 In making decisions under these guidelines, an HREC must consider whether the proposal complies with the relevant NPPs in the course of:\n\n(a) the collection of health information for the purposes of:\n\n(i) research relevant to public health or public safety; or\n\n(ii) the compilation or analysis of statistics, relevant to public health or public safety; or\n\n(iii) the management, funding or monitoring of a health service;\n\nor\n\n(b) the use and disclosure of health information for the purposes of:\n\n(i) research relevant to public health or public safety; or\n\n(ii) the compilation or analysis of statistics, relevant to public health or public safety.\n\nThis would include considering whether the purpose of the proposed activity can be achieved using de-identified data and whether it is impracticable to collect, use or disclose health information for the proposed activity with the consent of the individual(s) involved.\n\nD.3 In making decisions under these guidelines the HREC must ensure that the committee has the competence to determine if the public interest in the proposed activity substantially outweighs, or does not substantially outweigh, the public interest in the protection of privacy.\n\nD.4 If the public interest in the proposed research, or compilation or analysis of statistics, or health service management activity does not substantially outweigh the public interest in the protection of privacy, then the activity should not be approved to proceed by the HREC.\n\nWeighing the public interest\n\nD.5 In determining whether the public interest in the proposed activity substantially outweighs, or does not substantially outweigh, the public interest in the protection of privacy, an HREC should consider the following matters:\n\n(a) the degree to which the proposed collection, use or disclosure of\n\nhealth information is necessary to the functions or activities of the organisation;\n\n(b) the degree to which the research, or compilation or analysis of statistics activity is relevant to public health or public safety;\n\n(c) the degree to which the research, or compilation or analysis of statistics or the health service management activity is likely to contribute to :\n\n(i) the identification, prevention or treatment of illness, injury or disease; or\n\n(ii) scientific understanding relating to public health or safety; or\n\n(iii) the protection of the health of individuals and/or communities; or\n\n(iv) the improved delivery of health services; or\n\n(v) enhanced scientific understanding or knowledge; or\n\n(vi) enhanced knowledge of issues within the fields of social science and the humanities relating to public health or public safety;\n\n(d) any likely benefits to individuals, to the category of persons to which they belong, or the wider community that will arise from the research, or compilation or analysis of statistics, or management of a health service being undertaken in the manner proposed;\n\n(e) in considering benefits to the category of persons to which the individual(s) belong, specific consideration should be given to any likely benefits to individuals that belong to certain categories where the information may be of a particularly personal or sensitive nature; for example:\n\n(i) children and young people; or\n\n(ii) persons with intellectual or psychiatric disability; or\n\n(iii) persons highly dependent on medical care; or\n\n(iv) persons in dependent or unequal relationships; or\n\n(v) persons who are members of collectivities; or\n\n(vi) Aboriginal and Torres Strait Islander peoples; or\n\n(vii) persons whose information relates to their mental or sexual health;\n\n\\[See: National Statement for further information on considerations relevant to the above categories of persons.\\];\n\n(f) whether the research, or compilation or analysis of statistics, or management of a health service study design can be satisfied without needing to apply NPP 2.1(d)(ii) and/or NPP 10.3(d)(iii) and the scientific defects in the activity that might arise if the activity was not undertaken in the manner proposed;\n\n(g) the cost of not undertaking the research, or compilation or analysis of statistics, or management of a health service activity (to government, the public, the health care system etc);\n\n(h) the public importance of the proposed research, or compilation or analysis of statistics, or management of a health service activity;\n\n(i) the extent to which the data being sought are usually available to the public from the organisation that holds that data; and\n\n(i) whether the research, or compilation or analysis of statistics activity, involves use of the data in a way that is inconsistent with the purpose for which the data was made public; and\n\n(ii) whether the research, or compilation or analysis of statistics activity requires alteration of the format of the data of a kind that would, if used or disclosed by an organisation, involve a breach of an NPP;\n\n(j) whether the risk of harm to an individual whose health information is to be collected, used or disclosed in the proposed research, or compilation or analysis of statistics, or management of health service activity is minimal, based on the information provided in proposals submitted under paragraphs A.2.6; or A.3.6; or B.2.6; or B.3.6; or C.2.6 of these guidelines;\n\n(k) the standards of conduct that are to be observed in the research, or compilation or analysis of statistics, or management of a health service activity, including:\n\n(i) the study design and the scientific credentials of those involved in conducting that study;\n\n(ii) if the study involves contact with participants, the procedures or controls that will apply to ensure that participants are treated with integrity and sensitivity, including whether questions to be asked or procedures to be employed are intrusive;\n\n(iii) whether access to health information is adequately restricted to appropriate personnel involved in conducting the proposed study;\n\n(iv) the procedures that are to be followed to ensure that the health information is permanently de-identified before the publication of results;\n\n(v) the procedures that are to be followed at the completion of the proposed study to ensure that all data containing health information are at least as secure as they were in the sources from which the data was obtained, including the date when the data will be destroyed or returned. These procedures must be in accordance with NPP 4 (See: Appendix 1).\n\nRecording, notification and monitoring of decisions made by an HREC\n\nD.6 Details of the decision made by the HREC regarding proposals to conduct research, or the compilation or analysis of statistics, relevant to public health or public safety, or health service management must be recorded in accordance with paragraph 2.30 of the National Statement on Ethical Conduct in Research Involving Humans (1999).\n\nWhenever the collection, use or disclosure of health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety, or the collection of health information for the purpose of health service management activities are being considered under these guidelines, the HREC must also record details of the following:\n\n(a) the organisation(s) from which health information is sought;\n\n(b) the data items sought from the organisation(s) and approved by the HREC;\n\n(c) the number of records involved;\n\n(d) the NPP to which the proposal applies (NPP 2 or NPP 10);\n\n(e) how and on what grounds the HREC came to the conclusion that it had sufficient information, expertise and understanding of privacy issues either amongst the members of the HREC or otherwise available to it to make a decision that takes proper account of privacy; and\n\n(f) considerations involved in weighing the public interest in the proposed research, compilation or analysis of statistics, or management of a health service activity against the public interest in the protection of privacy, including why de-identified health information would not achieve the purpose of the approved proposal and why it is impracticable to obtain consent from the individual(s) involved.\n\nD.7 It is an obligation of the HREC to monitor proposals approved in accordance with these guidelines for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety, or for the purpose of the management of a health service in accordance with paragraphs 2.33-2.38, ‘Human Research Ethics Committees’, National Statement (1999).\n\nD.8 When the HREC approves a proposal for research, or the compilation or analysis of statistics, relevant to public health or public safety, or for the management of a health service, it must decide whether the proposed activity should commence within a defined period from the date of approval and whether the project should be completed within a set period, and notify those conducting the study of that decision.\n\nE. Responsibilities of the National Health and Medical Research Council (NHMRC)\n\nE.1 The AHEC will report annually to NHMRC in relation to HRECs generally, based on the annual compliance report completed by HRECs. The annual compliance report will include all decisions, and details of these decisions as required by paragraph D.6 of these guidelines.\n\nE.2 The AHEC of the NHMRC may request at any time, information in relation to paragraphs D.6, D.7 and D.8 of these guidelines.\n\nE.3 When there has been a failure to comply with these guidelines the AHEC of the NHMRC will:\n\n(a) Report details of the failure to the Federal Privacy Commissioner and may name those involved in the particular study or the HREC responsible; and\n\n(b) Where that failure involves health information disclosed by an organisation, inform that organisation of details of the failure.\n\nF. Reports to or for the Federal Privacy Commissioner\n\nF.1 AHEC will annually report to the Federal Privacy Commissioner all details recorded under paragraph D.6 of these guidelines, of the research, compilation or analysis of statistics, or health service management activities conducted under these guidelines and shall provide an evaluation of the operation of these guidelines for the year of reporting. AHEC will also include in its report details relating to the number of complaints made under paragraph G.1 (b) of these guidelines.\n\nF.2 AHEC will also provide to the Federal Privacy Commissioner, at his or her request, additional information about the operation of the guidelines, research, compilation or analysis of statistics, or the management of a health service activities conducted under these guidelines and/or failure to comply with these guidelines.\n\nG. Complaints mechanisms\n\nG.1 Complaints may be made to:\n\n(a) The individual(s), institution(s) or organisation(s) conducting the research, or compilation or analysis of statistics, relevant to public health or public safety, or health service management activity; and /or\n\n(b) HRECs concerning the individual(s) or institution(s) involved in the research, or compilation or analysis of statistics, relevant to public health or public safety, or the management of a health\n\nservice, regarding the conduct of an approved activity that may interfere with the privacy of the individual involved,\n\n\\[See: paragraphs 2.39-2.43 ‘Human Research Ethics Committees’, National Statement (1999)\\]; and/or\n\n(c) the Federal Privacy Commissioner concerning the collection, use or disclosure of health information by organisations.\n\nUnder section 36(1) of the Privacy Act 1988, an individual may complain to the Privacy Commissioner about an act or practice that may be an interference with the privacy of the individual. Where an organisation seeks to rely on these guidelines to:\n\n(i) collect health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety, or the management of a health service; or\n\n(ii) use and disclose health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety\n\nunder Section 95A, an individual may complain if the procedures set out in these guidelines are not followed.\n\nG.2 The AHEC of the NHMRC may request at any time, information in relation to G.1 (b) of these guidelines.\n\nH. Date of Review\n\nH.1 The NHMRC will initiate a review of the adequacy and operation of these guidelines two years from the date of issue on 21 December 2001. This review will complement and coincide with any evaluation of the new privacy legislation.\n\nAPPENDIX 1\n\nNational Privacy Principles\n\n\\[from the Privacy Act 1988 (Commonwealth), incorporating the Privacy Amendment (Private Sector) Act 2000 (Commonwealth)\\]\n\n","sortOrder":0},{"sectionNumber":"1","sectionType":"section","heading":"Collection","content":"1 Collection\n\n1.1 An organisation must not collect personal information unless the information is necessary for one or more of its functions or activities.\n\n1.2 An organisation must collect personal information only by lawful and fair means and not in an unreasonably intrusive way.\n\n1.3 At or before the time (or, if that is not practicable, as soon as practicable after) an organisation collects personal information about an individual from the individual, the organisation must take reasonable steps to ensure that the individual is aware of:\n\n(a) the identity of the organisation and how to contact it; and\n\n(b) the fact that he or she is able to gain access to the information; and\n\n(c) the purposes for which the information is collected; and\n\n(d) the organisations (or the types of organisations) to which the organisation usually discloses information of that kind; and\n\n(e) any law that requires the particular information to be collected; and\n\n(f) the main consequences (if any) for the individual if all or part of the information is not provided.\n\n1.4 If it is reasonable and practicable to do so, an organisation must collect personal information about an individual only from that individual.\n\n1.5 If an organisation collects personal information about an individual from someone else, it must take reasonable steps to ensure that the individual is or has been made aware of the matters listed in subclause 1.3 except to the extent that making the individual aware of the matters would pose a serious threat to the life or health of any individual.\n\n","sortOrder":1},{"sectionNumber":"2","sectionType":"section","heading":"Use and disclosure","content":"2 Use and disclosure\n\n2.1 An organisation must not use or disclose personal information about an individual for a purpose (the secondary purpose ) other than the primary purpose of collection unless:\n\n(a) both of the following apply:\n\n(i) the secondary purpose is related to the primary purpose of collection and, if the personal information is sensitive information, directly related to the primary purpose of collection;\n\n(ii) the individual would reasonably expect the organisation to use or disclose the information for the secondary purpose; or\n\n(b) the individual has consented to the use or disclosure; or\n\n(c) if the information is not sensitive information and the use of the information is for the secondary purpose of direct marketing:\n\n(i) it is impracticable for the organisation to seek the individual’s consent before that particular use; and\n\n(ii) the organisation will not charge the individual for giving effect to a request by the individual to the organisation not to receive direct marketing communications; and\n\n(iii) the individual has not made a request to the organisation not to receive direct marketing communications; and\n\n(iv) in each direct marketing communication with the individual, the organisation draws to the individual’s attention, or prominently displays a notice, that he or she may express a wish not to receive any further direct marketing communications; and\n\n(v) each written direct marketing communication by the organisation with the individual (up to and including the communication that involves the use) sets out the organisation’s business address and telephone number and, if the communication with the individual is made by fax, telex or other electronic means, a number or address at which the organisation can be directly contacted electronically; or\n\n(d) if the information is health information and the use or disclosure is necessary for research, or the compilation or analysis of statistics, relevant to public health or public safety:\n\n(i) it is impracticable for the organisation to seek the individual’s consent before the use or disclosure; and\n\n(ii) the use or disclosure is conducted in accordance with guidelines approved by the Commissioner under section 95A for the purposes of this subparagraph; and\n\n(iii) in the case of disclosure—the organisation reasonably believes that the recipient of the health information will not disclose the health information, or personal information derived from the health information; or\n\n(e) the organisation reasonably believes that the use or disclosure is necessary to lessen or prevent:\n\n(i) a serious and imminent threat to an individual’s life, health or safety; or\n\n(ii) a serious threat to public health or public safety; or\n\n(f) the organisation has reason to suspect that unlawful activity has been, is being or may be engaged in, and uses or discloses the personal information as a necessary part of its investigation of the matter or in reporting its concerns to relevant persons or authorities; or\n\n(g) the use or disclosure is required or authorised by or under law; or\n\n(h) the organisation reasonably believes that the use or disclosure is reasonably necessary for one or more of the following by or on behalf of an enforcement body:\n\n(i) the prevention, detection, investigation, prosecution or punishment of criminal offences, breaches of a law imposing a penalty or sanction or breaches of a prescribed law;\n\n(ii) the enforcement of laws relating to the confiscation of the proceeds of crime;\n\n(iii) the protection of the public revenue;\n\n(iv) the prevention, detection, investigation or remedying of seriously improper conduct or prescribed conduct;\n\n(v) the preparation for, or conduct of, proceedings before any court or tribunal, or implementation of the orders of a court or tribunal.\n\nNote 1: It is not intended to deter organisations from lawfully co-operating with agencies performing law enforcement functions in the performance of their functions.\n\nNote 2: Subclause 2.1 does not override any existing legal obligations not to disclose personal information. Nothing in subclause 2.1 requires an organisation to disclose personal information; an organisation is always entitled not to disclose personal information in the absence of a legal obligation to disclose it.\n\nNote 3: An organisation is also subject to the requirements of National Privacy Principle 9 if it transfers personal information to a person in a foreign country.\n\n2.2 If an organisation uses or discloses personal information under paragraph 2.1(h), it must make a written note of the use or disclosure.\n\n2.3 Subclause 2.1 operates in relation to personal information that an organisation that is a body corporate has collected from a related body corporate as if the organisation’s primary purpose of collection of the information were the primary purpose for which the related body corporate collected the information.\n\n2.4 Despite subclause 2.1, an organisation that provides a health service to an individual may disclose health information about the individual to a person who is responsible for the individual if:\n\n(a) the individual:\n\n(i) is physically or legally incapable of giving consent to the disclosure; or\n\n(ii) physically cannot communicate consent to the disclosure; and\n\n(b) a natural person (the carer ) providing the health service for the organisation is satisfied that either:\n\n(i) the disclosure is necessary to provide appropriate care or treatment of the individual; or\n\n(ii) the disclosure is made for compassionate reasons; and\n\n(c) the disclosure is not contrary to any wish:\n\n(i) expressed by the individual before the individual became unable to give or communicate consent; and\n\n(ii) of which the carer is aware, or of which the carer could reasonably be expected to be aware; and\n\n(d) the disclosure is limited to the extent reasonable and necessary for a purpose mentioned in paragraph (b).\n\n2.5 For the purposes of subclause 2.4, a person is responsible for an individual if the person is:\n\n(a) a parent of the individual; or\n\n(b) a child or sibling of the individual and at least 18 years old; or\n\n(c) a spouse or de facto spouse of the individual; or\n\n(d) a relative of the individual, at least 18 years old and a member of the individual’s household; or\n\n(e) a guardian of the individual; or\n\n(f) exercising an enduring power of attorney granted by the individual that is exercisable in relation to decisions about the individual’s health; or\n\n(g) a person who has an intimate personal relationship with the individual; or\n\n(h) a person nominated by the individual to be contacted in case of emergency.\n\n2.6 In subclause 2.5:\n\nchild of an individual includes an adopted child, a step-child and a foster-child, of the individual.\n\nparent of an individual includes a step-parent, adoptive parent and a foster-parent, of the individual.\n\nrelative of an individual means a grandparent, grandchild, uncle, aunt, nephew or niece, of the individual.\n\nsibling of an individual includes a half-brother, half-sister, adoptive brother, adoptive sister, step-brother, step-sister, foster-brother and foster-sister, of the individual.\n\n3 Data quality\n\nAn organisation must take reasonable steps to make sure that the personal information it collects, uses or discloses is accurate, complete and up-to-date.\n\n","sortOrder":2},{"sectionNumber":"4","sectionType":"section","heading":"Data security","content":"4 Data security\n\n4.1 An organisation must take reasonable steps to protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure.\n\n4.2 An organisation must take reasonable steps to destroy or permanently de-identify personal information if it is no longer needed for any purpose for which the information may be used or disclosed under National Privacy Principle 2.\n\n","sortOrder":3},{"sectionNumber":"5","sectionType":"section","heading":"Openness","content":"5 Openness\n\n5.1 An organisation must set out in a document clearly expressed policies on its management of personal information. The organisation must make the document available to anyone who asks for it.\n\n5.2 On request by a person, an organisation must take reasonable steps to let the person know, generally, what sort of personal information it holds, for what purposes, and how it collects, holds, uses and discloses that information.\n\n","sortOrder":4},{"sectionNumber":"6","sectionType":"section","heading":"Access and correction","content":"6 Access and correction\n\n6.1 If an organisation holds personal information about an individual, it must provide the individual with access to the information on request by the individual, except to the extent that:\n\n(a) in the case of personal information other than health information—providing access would pose a serious and imminent threat to the life or health of any individual; or\n\n(b) in the case of health information—providing access would pose a serious threat to the life or health of any individual; or\n\n(c) providing access would have an unreasonable impact upon the privacy of other individuals; or\n\n(d) the request for access is frivolous or vexatious; or\n\n(e) the information relates to existing or anticipated legal proceedings between the organisation and the individual, and the information would not be accessible by the process of discovery in those proceedings; or\n\n(f) providing access would reveal the intentions of the organisation in relation to negotiations with the individual in such a way as to prejudice those negotiations; or\n\n(g) providing access would be unlawful; or\n\n(h) denying access is required or authorised by or under law; or\n\n(i) providing access would be likely to prejudice an investigation of possible unlawful activity; or\n\n(j) providing access would be likely to prejudice:\n\n(i) the prevention, detection, investigation, prosecution or punishment of criminal offences, breaches of a law imposing a penalty or sanction or breaches of a prescribed law; or\n\n(ii) the enforcement of laws relating to the confiscation of the proceeds of crime; or\n\n(iii) the protection of the public revenue; or\n\n(iv) the prevention, detection, investigation or remedying of seriously improper conduct or prescribed conduct; or\n\n(v) the preparation for, or conduct of, proceedings before any court or tribunal, or implementation of its orders;\n\nby or on behalf of an enforcement body; or\n\n(k) an enforcement body performing a lawful security function asks the organisation not to provide access to the information on the basis that providing access would be likely to cause damage to the security of Australia.\n\n6.2 However, where providing access would reveal evaluative information generated within the organisation in connection with a commercially sensitive decision-making process, the organisation may give the individual an explanation for the commercially sensitive decision rather than direct access to the information.\n\nNote: An organisation breaches subclause 6.1 if it relies on subclause 6.2 to give an individual an explanation for a commercially sensitive decision in circumstances where subclause 6.2 does not apply.\n\n6.3 If the organisation is not required to provide the individual with access to the information because of one or more of paragraphs 6.1(a) to (k) (inclusive), the organisation must, if reasonable, consider whether the\n\nuse of mutually agreed intermediaries would allow sufficient access to meet the needs of both parties.\n\n6.4 If an organisation charges for providing access to personal information, those charges:\n\n(a) must not be excessive; and\n\n(b) must not apply to lodging a request for access.\n\n6.5 If an organisation holds personal information about an individual and the individual is able to establish that the information is not accurate, complete and up-to-date, the organisation must take reasonable steps to correct the information so that it is accurate, complete and up-to-date.\n\n6.6 If the individual and the organisation disagree about whether the information is accurate, complete and up-to-date, and the individual asks the organisation to associate with the information a statement claiming that the information is not accurate, complete or up-to-date, the organisation must take reasonable steps to do so.\n\n6.7 An organisation must provide reasons for denial of access or a refusal to correct personal information.\n\n","sortOrder":5},{"sectionNumber":"7","sectionType":"section","heading":"Identifiers","content":"7 Identifiers\n\n7.1 An organisation must not adopt as its own identifier of an individual an identifier of the individual that has been assigned by:\n\n(a) an agency; or\n\n(b) an agent of an agency acting in its capacity as agent; or\n\n(c) a contracted service provider for a Commonwealth contract acting in its capacity as contracted service provider for that contract.\n\n7.1A However, subclause 7.1 does not apply to the adoption by a prescribed organisation of a prescribed identifier in prescribed circumstances.\n\nNote: There are prerequisites that must be satisfied before those matters are prescribed: see subsection 100(2).\n\n7.2 An organisation must not use or disclose an identifier assigned to an individual by an agency, or by an agent or contracted service provider mentioned in subclause 7.1, unless:\n\n(a) the use or disclosure is necessary for the organisation to fulfil its obligations to the agency; or\n\n(b) one or more of paragraphs 2.1(e) to 2.1(h) (inclusive) apply to the use or disclosure; or\n\n(c) the use or disclosure is by a prescribed organisation of a prescribed identifier in prescribed circumstances.\n\nNote: There are prerequisites that must be satisfied before the matters mentioned in paragraph (c) are prescribed: see subsection 100(2).\n\n7.3 In this clause:\n\nidentifier includes a number assigned by an organisation to an individual to identify uniquely the individual for the purposes of the organisation’s operations. However, an individual’s name or ABN (as defined in the A New Tax System (Australian Business Number) Act 1999 ) is not an identifier.\n\n","sortOrder":6},{"sectionNumber":"8","sectionType":"section","heading":"Anonymity","content":"8 Anonymity\n\nWherever it is lawful and practicable, individuals must have the option of not identifying themselves when entering transactions with an organisation.\n\n","sortOrder":7},{"sectionNumber":"9","sectionType":"section","heading":"Transborder data flows","content":"9 Transborder data flows\n\n9.1 An organisation in Australia or an external Territory may transfer personal information about an individual to someone (other than the organisation or the individual) who is in a foreign country only if:\n\n(a) the organisation reasonably believes that the recipient of the information is subject to a law, binding scheme or contract which effectively upholds principles for fair handling of the information that are substantially similar to the National Privacy Principles; or\n\n(b) the individual consents to the transfer; or\n\n(c) the transfer is necessary for the performance of a contract between the individual and the organisation, or for the implementation of pre-contractual measures taken in response to the individual’s request; or\n\n(d) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the individual between the organisation and a third party; or\n\n(e) all of the following apply:\n\n(i) the transfer is for the benefit of the individual;\n\n(ii) it is impracticable to obtain the consent of the individual to that transfer;\n\n(iii) if it were practicable to obtain such consent, the individual would be likely to give it; or\n\n(f) the organisation has taken reasonable steps to ensure that the information which it has transferred will not be held, used or disclosed by the recipient of the information inconsistently with the National Privacy Principles.\n\n","sortOrder":8},{"sectionNumber":"10","sectionType":"section","heading":"Sensitive information","content":"10 Sensitive information\n\n10.1 An organisation must not collect sensitive information about an individual unless:\n\n(a) the individual has consented; or\n\n(b) the collection is required by law; or\n\n(c) the collection is necessary to prevent or lessen a serious and imminent threat to the life or health of any individual, where the individual whom the information concerns:\n\n(i) is physically or legally incapable of giving consent to the collection; or\n\n(ii) physically cannot communicate consent to the collection; or\n\n(d) if the information is collected in the course of the activities of a non-profit organisation—the following conditions are satisfied:\n\n(i) the information relates solely to the members of the organisation or to individuals who have regular contact with it in connection with its activities;\n\n(ii) at or before the time of collecting the information, the organisation undertakes to the individual whom the information concerns that the organisation will not disclose the information without the individual’s consent; or\n\n(e) the collection is necessary for the establishment, exercise or defence of a legal or equitable claim.\n\n10.2 Despite subclause 10.1, an organisation may collect health information about an individual if:\n\n(a) the information is necessary to provide a health service to the individual; and\n\n(b) the information is collected:\n\n(i) as required by law (other than this Act); or\n\n(ii) in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind the organisation.\n\n10.3 Despite subclause 10.1, an organisation may collect health information about an individual if:\n\n(a) the collection is necessary for any of the following purposes:\n\n(i) research relevant to public health or public safety;\n\n(ii) the compilation or analysis of statistics relevant to public health or public safety;\n\n(iii) the management, funding or monitoring of a health service; and\n\n(b) that purpose cannot be served by the collection of information\n\nthat does not identify the individual or from which the individual’s identity cannot reasonably be ascertained; and\n\n(c) it is impracticable for the organisation to seek the individual’s consent to the collection; and\n\n(d) the information is collected:\n\n(i) as required by law (other than this Act); or\n\n(ii) in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind the organisation; or\n\n(iii) in accordance with guidelines approved by the Commissioner under section 95A for the purposes of this subparagraph.\n\n10.4 If an organisation collects health information about an individual in accordance with subclause 10.3, the organisation must take reasonable steps to permanently de-identify the information before the organisation discloses it.\n\n10.5 In this clause:\n\nnon-profit organisation means a non-profit organisation that has only racial, ethnic, political, religious, philosophical, professional, trade, or trade union aims.\n\nAPPENDIX 2\n\nPrivacy Act 1988 (Commonwealth), Section 95A\n\nOverview\n\n(1) This section allows the Commissioner to approve for the purposes of the National Privacy Principles (the NPPs ) guidelines that are issued by the National Health and Medical Research Council or a prescribed authority.\n\nApproving guidelines for use and disclosure\n\n(2) For the purposes of subparagraph 2.1(d)(ii) of the NPPs, the Commissioner may, by notice in the Gazette, approve guidelines that relate to the use and disclosure of health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety.\n\nPublic interest test\n\n(3) The Commissioner may give an approval under subsection (2) only if satisfied that the public interest in the use and disclosure of health information for the purposes mentioned in that subsection in accordance with the guidelines substantially outweighs the public interest in maintaining the level of privacy protection afforded by the NPPs (other than paragraph 2.1(d)).\n\nApproving guidelines for collection\n\n(4) For the purposes of subparagraph 10.3(d)(iii) of the NPPs, the Commissioner may, by notice in the Gazette, approve guidelines that relate to the collection of health information for the purposes of:\n\n(a) research, or the compilation or analysis of statistics, relevant to public health or public safety; or\n\n(b) the management, funding or monitoring of a health service.\n\nPublic interest test\n\n(5) The Commissioner may give an approval under subsection (4) only if satisfied that the public interest in the collection of health information for the purposes mentioned in that subsection in accordance with the guidelines substantially outweighs the public interest in maintaining the level of privacy protection afforded by the NPPs (other than paragraph 10.3(d)).\n\nRevocation of approval\n\n(6) The Commissioner may, by notice in the Gazette, revoke an approval of guidelines under this section if he or she is no longer satisfied of the matter that he or she had to be satisfied of to approve the guidelines.\n\nReview by AAT\n\n(7) Application may be made to the Administrative Appeals Tribunal for review of a decision of the Commissioner to refuse to approve guidelines or to revoke an approval of guidelines.\n\nAPPENDIX 3\n\nJoint NHMRC/AVCC Statement and Guidelines on Research Practices Section 2\n\nData storage and retention\n\n2.1 Data (including electronic data) must be recorded in a durable and appropriately referenced form. Data management should comply with relevant privacy protocols, such as the Australian Standard on personal privacy protection25.\n\n2.2 The department or research unit must establish procedures for the retention of data and for the keeping of records of data held.\n\n2.3 Data must be held for sufficient time to allow reference. For data that is published this may be for as long as interest and discussion persists following publication. It is recommended that the minimum period for retention is at least 5 years from the date of publication but for specific types of research, such as clinical research, 15 years may be more appropriate 26.\n\n2.4 Wherever possible, original data must be retained in the department or research unit in which they were generated. Individual researchers should be able to hold copies of the data for their own use. Retention solely by the individual researcher provides little protection to the researcher or the institution in the event of an allegation of falsification of data.\n\n2.5 Data related to publications must be available for discussion with other researchers. Where confidentiality provisions apply (for example, where the researchers or institution have given undertakings to third parties, such as the subjects of the research), it is desirable for data to be kept in a way that reference to them by third parties can occur without breaching such confidentiality.\n\n2.6 Confidentiality agreements to protect intellectual property rights may be agreed between the institution, the researcher and a sponsor of the research. Where such agreements limit free publication and discussion, limitations and restrictions must be explicitly agreed.\n\n2.7 It is the obligation of the researcher to enquire whether confidentiality agreements apply and of the Head of the Department or research unit to inform researchers of their obligations with respect to these provisions.\n\n2.8 All confidentiality agreements should be made known at an early stage to the head of the research institution, or nominated representative.\n\n","sortOrder":9},{"sectionNumber":"25","sectionType":"section","heading":"Personal Privacy Protection in Health Care Information Systems, Australian Standard AS 4400-1995.","content":"25 Personal Privacy Protection in Health Care Information Systems, Australian Standard AS 4400-1995.\n\n26 The December 1991 Guidelines for Good Clinical Research Practice in Australia. Published by the Therapeutic Goods Administration of the Commonwealth Department of Health and Family Services, recommends retention of data for at least 15 years.\n\n2.9 The procedures formulated by institutions must include guidelines on the establishment and ownership of and access to databases containing confidential information, and any limits on this.\n\n2.10 When the data are obtained from limited access databases, or via a contractual arrangement, written indication of the location of the original data, or key information regarding the database from which it was collected, must be retained by the researcher or research unit.\n\n2.11 Researchers must be responsible for ensuring appropriate security for any confidential material, including that held in computing systems. Where computing systems are accessible through networks, particular attention to security of confidential data is required. Security and confidentiality must be assured in a way that copes with multiple researchers and the departure of individual researchers.\n\nAPPENDIX 4\n\nOffice of the Federal Privacy Commissioner— Guidelines on Privacy in the Private Health Sector Section A.3.5 Health information held before the commencement of the Privacy Act\n\nThe new provisions in the Privacy Act are effective from 21 December 2001.\n\nOnly some of the National Privacy Principles (NPPs) apply to information collected before 21 December 2001. These include NPP 4 on data security, NPP 5 on openness, NPP 7 on identifiers and NPP 9 on transborder data flows. NPP 6 on access also applies to information already collected, but only where that information is still in use and if compliance would not pose an unreasonable administrative burden or expense.\n\nFor further information on when each of the NPPs apply, see the Guidelines on Privacy in the Private Health Sector or the OFPC Information Sheet 10—2001 Application of the Privacy Act to information already held\n\nAPPENDIX 5\n\nOffice of the Federal Privacy Commissioner—Information Sheet 9 2001— Handling Health Information for Research and Management, Attachments 1 and 2.\n\nThe following diagrams are designed to outline the circumstances in which it is lawful under the National Privacy Principles to collect, use or disclose health information.\n\nRequirements when collecting health information without consent:\n\n• for research or the compilation and analysis of statistics relevant to public health or public safety, or\n\n• for the management, funding or monitoring of a health service.\n\n![](image.006.png)\n\nRequirements for using or disclosing health information for research or the compilation or analysis of statistics relevant to public health or public safety or for health service management activities\n\n![](image.007.png)\n\nAPPENDIX 6\n\nInformation about the National Statement on Ethical Conduct in Research Involving Humans\n\nThe National Statement on Ethical Conduct in Research Involving Humans (National Statement) is a significant advance for research Australia. It is issued by the National Health and Medical Research Council (NHMRC) under the National Health and Medical Research Council Act 1992\\. It has been endorsed or supported by the Australian Vice-Chancellors’ Committee, the Australian Research Council, and the Academies of Humanities, Science, Social sciences, and Technological Science and Engineering.\n\nThe National Statement applies to all disciplines of research involving or impacting upon humans. All individuals, institutions and organisations conducting research that involves human participants should use it.\n\nThe National Statement provides general ethical principles that should be applied to all research involving humans, as well as guidelines on specific research types, participant groups and other issues.\n\nThe National Statement can be downloaded free of charge from the NHMRC web site at http://www.nhmrc.gov.au/publications/synopses/e35syn.htm\n\nIt can also be purchased from AusInfo Government Bookshops for $14.00 (inc. GST) by phoning their toll free number 132 447 (catalogue no. 9818566).\n\nThe National Health and Medical Research Council\n\nThe National Health and Medical Research Council (NHMRC) is a statutory body within the portfolio of the Commonwealth Minister for Health and Aged Care, established by the National Health and Medical Research Council Act 1992. The NHMRC advises the Australian community and Commonwealth; State and Territory Governments on standards of individual and public health, and supports research to improve those standards.\n\nThe NHMRC advises the Commonwealth Government on the funding of medical and public health research and training in Australia and supports many of the medical advances made by Australians.\n\nThe NHMRC also develops guidelines and standards for the ethical conduct of health and medical research.\n\nThe Council comprises nominees of Commonwealth, State and Territory health authorities, professional and scientific colleges and associations, unions, universities, business, consumer groups, welfare organisations, conservation groups and the Aboriginal and Torres Strait Islander Commission.\n\nThe Council meets up to four times a year to consider and make decisions on reports prepared by committees and working parties following wide consultation on the issue under consideration.\n\nA regular publishing program ensures that Council’s recommendations are widely available to governments, the community, scientific, industrial and educational groups.\n\nThe Council publishes extensively in the following areas:\n\n| • Aged care• Child health• Clinical practice guidelines• Communicable diseases• Dentistry• Diabetes• Drugs and poisons• Drug and substance abuse• Environmental health• Ethics – Animal• Ethics – Human• Health procedures | • Health promotion• Infection control• Men’s health• Mental health• NHMRC – National Health and Medical Research Council• Nutrition• Public health• Research• Sport/Injury• Women’s health• Workforce |\n| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n\nA list of current publications is available from:\n\nThe Publications Officer\n\nONHMRC\n\nMDP 100\n\nGPO Box 9848\n\nCanberra ACT 2601\n\nPhone: (02) 6289 9520 (24-hour answering machine)\n\nToll free: 1800 020 103\n\nFax: (02) 6289 9197\n\nE-mail: nhmrc.publications@health.gov.au\n\nInternet: http://www.nhmrc.health.gov.au","sortOrder":10}],"analysis":{"kimi_summary":{"_metrics":{"model":"kimi-k2.5","source":"moonshot-realtime","completionTokens":2462},"content_quality":"ok","complexity_score":6,"scope_assessment":{"changed":false,"description":"The guidelines maintain their original 2001 scope, providing a narrow exemption for private sector health information handling limited to research, statistical compilation, and health service management where consent is impracticable. No evidence of scope expansion beyond these original purposes."},"complexity_factors":["Extensive cross-referencing to external documents including the National Privacy Principles, National Statement on Ethical Conduct, and Section 95 Guidelines","Nested conditional requirements requiring simultaneous satisfaction of impracticability, inadequacy of de-identified data, and public interest balancing tests","Distinct procedural tracks for collection (NPP 10.3) versus use/disclosure (NPP 2.1) and different requirements for research, statistics, and health service management","Interaction with state and territory privacy legislation requiring dual compliance assessment","Technical defined terms requiring external statutory context (e.g., 'health information', 'organisation', 'HREC')"],"plain_english_summary":"These guidelines create a limited legal pathway for private-sector health organisations to access identifiable patient health information without consent for public‑health/safety research, statistics, or health‑service management, but only where consent is impracticable, de‑identification won’t work, and the public interest substantially outweighs privacy. Mandatory HREC approval, strict security/destruction rules, de‑identified publication, complaint rights, and the ability of data holders to refuse are required; the rules supplement existing privacy and research ethics frameworks."},"flash_summary":{"complexity_score":8,"scope_assessment":{"changed":true,"description":"These guidelines extend the earlier s95 approach (which applied to Commonwealth agencies) to private‑sector organisations and explicitly cover collection/use/disclosure for research, compilation/analysis of statistics and health‑service management where consent is impracticable and de‑identification is inadequate. They make HREC approval, procedural documentation and reporting to NHMRC/Privacy Commissioner part of compliance with NPP 2.1(d)(ii) and NPP 10.3(d)(iii) (see 'The Guidelines approved under Section 95A...' and Appendix 2)."},"complexity_factors":["Multiple decision‑makers and reporting lines: HRECs approve proposals (A.1.5, B.1.5, C.1.5), AHEC/NHMRC monitor and report to the Privacy Commissioner (E.1; F.1), and the Commissioner may approve or revoke guidelines (Appendix 2(2)–(6)).","Public‑interest balancing test with multi‑factor analysis: HRECs must weigh detailed public‑interest factors (D.5) rather than apply a single bright‑line rule.","Interlocking statutory framework: interaction with National Privacy Principles (Appendix 1), s95A (Appendix 2) and prior s95 guidance creates layered legal obligations.","Threshold of 'impracticable' to seek consent: subjective, facts‑based test with examples but no fixed formula (A.1.3; notes in A.2.6 and B.1.3), increasing case‑by‑case uncertainty.","De‑identification and mandatory de‑identification on disclosure: requirement that de‑identified data be used where possible and permanent de‑identification prior to disclosure under NPP 10.4 (A.1.2(b); Appendix 1, 10.4).","Detailed procedural and documentation burdens: lengthy proposal content lists for collectors/disclosers (A.2.6; A.3.6; B.2.6; B.3.6; C.2.6) increase compliance costs and recordkeeping obligations (D.6).","Organisational discretion to decline disclosure: organisations may refuse to disclose even with HREC approval (A.1.6; B.1.6; C.1.6), adding coordination and contract negotiation complexity.","Security, retention and disposal obligations tied to NPP4 and NHMRC/AVCC guidance (A.2.6(j); A.3.6(l); Appendix 3 §§2.1–2.4; Appendix 1 §4), increasing technical compliance requirements.","Overlap with state/territory laws and other Commonwealth requirements: need to check and reconcile multiple legal regimes (Other legislation and regulation section).","Enforcement, review and complaint pathways: internal HREC monitoring (D.7–D.8), complaints to HRECs or the Privacy Commissioner (G.1) and AAT review of Commissioner decisions (Appendix 2(7))."],"plain_english_summary":"Approves NHMRC guidelines under s95A authorising organisations to collect, use or disclose identified health information without consent for research, statistical analysis, or health‑service management when consent is impracticable and de‑identification won’t achieve the purpose. It sets procedural requirements, an HREC approval and a public‑interest balancing test.\n\nThis affects private‑sector organisations, HRECs, NHMRC and the Federal Privacy Commissioner because it prescribes what must be documented, reported, secured and reviewed before sensitive health data can lawfully be handled without consent."}},"importantCases":[],"_links":{"self":"/api/acts/privacy-act-1988-guidelines-approved-under-section-95a-december-2001","history":"/api/acts/privacy-act-1988-guidelines-approved-under-section-95a-december-2001/history","analysis":"/api/acts/privacy-act-1988-guidelines-approved-under-section-95a-december-2001/analysis","conflicts":"/api/acts/privacy-act-1988-guidelines-approved-under-section-95a-december-2001/conflicts","importantCases":"/api/acts/privacy-act-1988-guidelines-approved-under-section-95a-december-2001/important-cases","documents":"/api/acts/privacy-act-1988-guidelines-approved-under-section-95a-december-2001/documents"}}