Epidemiological Studies (Confidentiality) Regulation 1992

The central concept in the Regulation is the “prescribed study”. The Act’s dictionary defines “prescribed study” in two paragraphs: paragraph (a) covers studies already set out in the Act itself; paragraph (b) covers studies declared by regulation to be prescribed studies. The Regulation operates solely under paragraph (b). Each of its sections 4 through 9 declares a named study to be “a study to which the Act applies”. That language triggers the Act’s confidentiality protections for information collected in those studies. The Regulation does not define “prescribed study” independently; it merely implements the statutory mechanism for adding studies.

The Regulation uses the phrase “Territory epidemiological study” to characterise most of the listed studies. This is not defined in the Regulation itself but is likely taken from the Act. The term “epidemiological study” is broad , it covers research into patterns, causes, and effects of health conditions in populations. Each prescription identifies the study by its formal name, its subject matter, the institution conducting it, and its start date. This level of specificity means that a study must match the description exactly to be covered; variations (different name, different institution, later start) would not be caught unless a further amendment is made.

Another concept is the definition of “opioid” contained in section 4(2). It is limited to that section and defines opioid to mean opium, or any drug with a morphine-like pharmacological effect (synthetic, semisynthetic, or an opium derivative). This definition applies only to the controlled availability of opioids study; it does not extend to other sections that use the terms “opioid” or “opiate” (such as section 8, which refers to “opioid dependence” and “opiate program”). The Regulation does not define “drug user”, “child abuse”, “supervised injecting place”, or “pill testing”. Those terms must be interpreted in accordance with their ordinary meaning or any definitions in the Act or other applicable laws.

The Regulation makes no provision for the duration of prescription. It does not state that any study is time-limited or that prescription lapses upon completion of the study. Once declared, a study remains prescribed unless the Regulation is amended to remove it. The Regulation also contains no mechanism for researchers to self-certify their study as prescribed; prescription is a legislative act. This means that any new epidemiological study that researchers or government wish to protect requires an amendment to the Regulation , a process that involves drafting, notification, and potential disallowance by the Legislative Assembly. That creates uncertainty for research timelines because the protection is not available until the amendment commences.

The Regulation directly affects four groups. The first group is researchers and institutions conducting the six listed studies. They must comply with the Act’s obligations regarding confidentiality of information obtained during the study. This includes the National Centre for Epidemiology and Population Health, the Australian Institute of Criminology, and the Research School of Population Health at the Australian National University. For the supervised injecting place trial, researchers associated with the trial under the Supervised Injecting Place Trial Act 1999 are also affected. The second group is the participants in those studies. Participants receive the benefit of a statutory guarantee that their personal information will not be disclosed without authorisation. This assurance may encourage participation, particularly in studies on illegal or stigmatised behaviour such as illicit drug use, child abuse, or drug dependence.

The third group is any person who comes into possession of information from a prescribed study. This could include government agencies, data processors, or downstream researchers who receive de-identified or aggregate data. If the data contains information that is still protected, those recipients may be bound by the Act’s prohibitions on disclosure. The Regulation does not specify whether de-identified data ceases to be protected; that question would be resolved by the Act. The fourth group is the ACT government. The Executive must administer the Regulation and any amendments. The Regulation imposes no direct costs on government, but the Act likely requires government agencies that hold study data to maintain confidentiality. Additionally, if government wishes to add new studies, it must allocate resources to the amendment process.

Indirectly, the Regulation affects the broader research community and the public. Researchers planning similar epidemiological studies may decide to seek prescription to gain confidentiality protections, or may design their studies to fit within the existing list. The Regulation may also influence ethical approval processes: ethics committees may consider whether a study is covered by statutory confidentiality as a factor in assessing risk. The public may benefit from increased research participation in sensitive areas, but may also have concerns about the breadth of confidentiality , for example, whether it prevents disclosure of child abuse information to authorities. The Regulation itself does not address exceptions; those are in the Act.

The practical reach of the Regulation is limited to the ACT. Studies listed are described as “Territory epidemiological studies”, which implies they are conducted under the authority or auspices of the ACT government. However, the institutions include Commonwealth bodies (Australian Institute of Criminology, ANU). The Regulation may affect inter-jurisdictional data sharing if the Act restricts disclosure to other states or the Commonwealth. Without seeing the Act, it is unclear whether data can be shared across borders for research purposes. The Regulation creates a legal environment that is specific to these six studies; any other epidemiological study in the ACT is not automatically covered and must rely on other confidentiality protections (e.g., ethics, contract, privacy law).

The Regulation itself imposes no duties and confers no rights. It is a legislative instrument that designates studies, and duties and rights arise from the Act. However, the Regulation is the trigger, so its effect is to create a link between the listed studies and the Act’s provisions. Based on the title of the Act (“Confidentiality”), the key duty is likely a prohibition on disclosing protected information obtained in connection with a prescribed study, except as authorised by the Act. This prohibition probably applies to researchers, research staff, and anyone else who accesses the data. The duty may extend to retaining information only for the purposes of the study and ensuring its security.

The corresponding right belongs to study participants. They have a right to expect that sensitive information they provide (such as drug use history, parental behaviours, or pill testing results) will not be disclosed to third parties without their consent or a legal exception. The Regulation thus enhances the trustworthiness of these studies. In the absence of such statutory protection, participants might rely only on ethical promises, which are less enforceable and carry lower penalties.

The exact scope of the duty and the exceptions depends on the Act. Common exceptions in health confidentiality laws include disclosure to prevent serious harm, disclosure required by court order, disclosure for public health purposes, or disclosure with consent. The Regulation does not mention any exceptions, so readers must refer to the Act. The Regulation also does not specify whether the duty applies to de-identified, aggregate data. If the Act defines “protected information” as information that identifies or could identify an individual, then de-identified data may fall outside the duty. But the Regulation does not clarify this.

Rights of researchers under the Regulation are minimal. They have the right to rely on the statutory protection to resist demands for disclosure from third parties (such as police or media) unless the Act allows it. This can be a powerful tool in litigation or investigations. Researchers also have the right to access the protection only if their study is listed. If a study is not listed, they cannot claim the Act’s protection, even if the study is similar in nature.

The Regulation’s specific definitions can also affect duties. For example, the opioid definition in section 4(2) is narrow - it includes opium and morphine-like drugs but may exclude other substances that are not morphine-like (e.g., certain synthetic opioids). If the study collects data on those substances, the duty may not attach to that information unless the Act covers all information collected for the study, regardless of whether it falls within the opioid definition. The Regulation’s definition appears only in the section for that study, not as a general definition. Potentially, information about non-morphine-like opioids might be outside the scope. This ambiguity imposes a duty on researchers to understand the Act’s scope of coverage.

The Regulation contains no penalty provisions. Penalties for breach would be found in the Act. The republication notes at the front of the Regulation state that the value of a penalty unit at the date of republication (28 April 2019) is $160 for an individual and $810 for a corporation. This indicates that the Act likely creates offences for unauthorised disclosure of protected information, with penalties expressed in penalty units. For example, if the Act sets a maximum penalty of 50 penalty units, the maximum fine for an individual would be $8,000 and for a corporation $40,500 at those rates. The Regulation does not specify the number of units because it is not an offence-creating instrument.

Enforcement of the confidentiality regime would likely occur through criminal prosecution by the ACT Director of Public Prosecutions, or through civil action by affected participants. The Regulation does not create a private right of action, but the Act may. The supervised injecting place trial is linked to an Act of the same name (Supervised Injecting Place Trial Act 1999), which may have its own enforcement mechanisms. The Regulation is silent on reporting breaches, auditing, or oversight. It does not establish a regulator or commissioner to monitor compliance. Enforcement therefore depends on the institutional structures of the Act.

One enforcement risk is that the Regulation is very specific: it lists studies by name, institution, and start date. If a study continues beyond its original scope (e.g., extends to a new population or collects new types of data), the prescription may not cover that extended activity. A researcher who mistakenly believes the protection extends to the expanded study could be in breach if they disclose data. Similarly, if data from a prescribed study is transferred to a non-prescribed study, the confidentiality protection may lapse. The Regulation does not address data sharing between studies. This creates ambiguous compliance boundaries.

The Regulation has been amended several times to add new studies, but there is no record of any enforcement action or prosecution in the provided text. The amendment history shows that studies were added in 1999, 2000, 2003, and 2019, and that minor amendments were made in 2007 (by the Statute Law Amendment Act 2007, which likely updated references). This pattern suggests that the Regulation is not an area of active enforcement focus; rather, it is a administrative mechanism to enable research. However, the existence of penalty unit values indicates that the legislature considers confidentiality important enough to back it with criminal sanctions. The real-world frequency of prosecutions is unknown from the source.

The Regulation is made under the Epidemiological Studies (Confidentiality) Act 1992, and its primary interaction is with that Act. It also references the Supervised Injecting Place Trial Act 1999 in section 7, by declaring that the scientific trial under that Act is a prescribed study. Thus, the Regulation creates a legal link between the two Acts: data collected for the supervised injecting place trial is protected by the Epidemiological Studies (Confidentiality) Act. If the Supervised Injecting Place Trial Act contains its own confidentiality provisions, those may overlap or conflict. The Regulation does not resolve which prevails.

The Regulation may interact with the ACT’s privacy laws, such as the Information Privacy Act 2014. That Act regulates how ACT public sector agencies handle personal information. Since the prescribed studies are conducted by public institutions (e.g., Australian National University is not an ACT agency, but the National Centre for Epidemiology and Population Health may be part of ANU, which is a Commonwealth entity). The Regulation does not displace privacy laws; it adds an extra layer of protection. For example, a disclosure that would be allowed under the Information Privacy Act’s exceptions (e.g., for law enforcement) might still be prohibited by the Epidemiological Studies Act. Researchers must comply with both regimes.

The Regulation also interacts with the Health Records (Privacy and Access) Act 1997 (ACT) if the studies collect health information. That Act creates rights for individuals to access their health records and imposes obligations on health service providers. The Epidemiological Studies Act may restrict such access to protect the integrity of the research. The Regulation does not address this, so the interaction is ambiguous.

Commonwealth laws may also be relevant. The Privacy Act 1988 (Cth) covers many organisations, including the Australian National University. The Act and Regulation operate in the same field. Nothing in the Regulation suggests it overrides Commonwealth privacy law. A researcher subject to both regimes must comply with the higher standard. Similarly, if a court orders disclosure of study data, the Act may provide a basis to resist, but the Regulation itself cannot override a court order if the Act allows for disclosures required by law. The Regulation’s silence on this point means the Act must be consulted.

The Regulation is silent on interactions with contracts. Research participants often sign consent forms that include promises of confidentiality. The statutory protection under the Regulation reinforces those promises but does not substitute for them. If a researcher breaches a confidentiality contract, the participant may sue for breach of contract in addition to any statutory penalty. The Regulation does not harmonise these two avenues.

The amendment history shows that the Regulation was subject to the Legislation Act 2001 (ACT) for editorial changes, republication, and commencement rules. Those general provisions affect how the Regulation is interpreted and when amendments take effect. For example, section 75(1) of the Legislation Act governs commencement of subordinate laws. The Regulation is a subordinate law and is subject to parliamentary scrutiny and possible disallowance.

The Regulation was originally notified on 9 November 1992 as the Epidemiological Studies (Confidentiality) Regulations. It commenced on that date. The original version contained sections 1 (name), 2 (commencement), 3 (definitions), and 4 (the controlled availability of opioids study). The first amendment came via SL1999-28, notified on 3 November 1999, which changed the name from “Regulations” to “Regulation” (singular) and inserted sections 5 and 6 (parenting practices and child abuse studies). That amendment also substituted the heading of section 4 and made notes. In 2000, SL2000-19 inserted section 7 (supervised injecting place trial). The Legislation (Consequential Amendments) Act 2001 (A2001-44) made minor changes: it omitted sections 2 and 3 entirely (section references were removed) and likely updated cross-references. That Act came into effect on 12 September 2001.

In 2003, SL2003-9 inserted section 8 (the opiate program TOP). That amendment commenced on 18 April 2003. In 2007, the Statute Law Amendment Act 2007 (A2007-3) made technical amendments to sections 4, 5, 6, 7, and 8 - likely updating references to renamed bodies or modernising drafting. Those amendments commenced on 12 April 2007. The most recent amendment is SL2019-6, notified 26 April 2019 and commenced 28 April 2019, which inserted section 9 (pill testing trial).

The Regulation has been republished six times. The current version (R6) is effective from 28 April 2019. Earlier republications occurred in 2000, 2002, 2003, 2004, and 2007. The endnotes show that sections 2 and 3 were omitted, so the Regulation now has no commencement or definitions provision - those matters are left to the Act and the Legislation Act. The name of the regulation was originally plural (“Regulations”) and was changed to singular in 1999. This is a formal change with no substantive effect.

Notably, the 2007 amendments were made by a general Statute Law Amendment Act, meaning they were omnibus changes to correct drafting issues. The Regulation has not been the subject of any later substantive amendment to date. The pill testing study was added relatively recently, reflecting the ACT government’s decision to legalise and evaluate pill testing at music festivals. The amendment history demonstrates that the Regulation is infrequently amended, but when it is, it is to accommodate new high-profile drug-related research.

The source materials provided for the Regulation do not contain any reference to litigation. There is no case law noted in the endnotes, and the Regulation itself does not mention any court proceedings. This is not surprising: the Regulation is a legislative instrument that merely lists studies; it is not typically the subject of direct challenge. Disputes are more likely to arise under the Act itself, where a person may be prosecuted for unauthorised disclosure or may seek to compel disclosure. No such cases are cited in the Regulation’s history.

From a practical standpoint, the Regulation operates in a sensitive area - research on illicit drug use, child abuse, and injecting places - which could attract litigation, but the source provides no evidence. The possibility exists that participants might dispute the application of the Regulation to their data, or researchers might seek judicial review of a decision to not prescribe their study. However, the Regulation’s text is clear that prescription is a legislative act, not subject to individual application. A researcher could not compel an amendment.

The absence of litigation history does not mean no disputes have occurred. It may mean that disputes were settled confidentially, or that the Act’s provisions have not been tested. Given that the Regulation has been in force for over 30 years, and that the studies involve controversial activities, one might expect some legal challenges, but none are recorded in the provided source. This could indicate that the confidentiality regime is well-respected or that enforcement is rare. Alternatively, the Act may contain wide exceptions that minimise conflict.

It is also possible that litigation under the Act occurred but did not result in published decisions, or that decisions are available only in the ACT Supreme Court or the ACT Civil and Administrative Tribunal but not referenced in the Regulation’s republication. The Regulation is not a case reporter. The instruction to only name cases the source names means that no litigation history can be derived from the source itself. Hence, the answer must simply state that the Regulation does not record any litigation.

Several features of the Regulation can catch out practitioners. First, the definition of “opioid” in section 4(2) is specific to that section only. It does not apply to the later sections that also use opioid-related terms, such as “the opiate program” (TOP) in section 8. This means that if the TOP study collects data on substances that are not morphine-like (e.g., certain opioid agonists with different pharmacological profiles), that data might not be covered by the opioid definition in section 4, but that is irrelevant because section 4 does not apply to section 8. However, the Act’s definition of “protected information” may not depend on that definition - it may cover all information collected for the study. The definitional discrepancy could create confusion if a researcher tries to argue that some data is outside the scope.

Second, section 7 declares “the scientific trial for the Supervised Injecting Place Trial Act 1999 and a study that is part of or ancillary to the trial” to be prescribed studies. This wording is broader than the other sections, which each name a specific study with a start date and institution. The ancillary component adds uncertainty: what qualifies as “ancillary” is not defined. Researchers conducting related surveys, biological testing, or follow-ups may need to determine whether their activity is ancillary. Without definitions, the reach of section 7 is ambiguous.

Third, the Regulation does not specify any end date for the prescription. The studies listed began in 1991, 1998, and 2019, but the Regulation does not limit coverage to a particular period. If a study has concluded, it is unclear whether the Act still protects the data. The Act may define “information obtained” as information obtained during the currency of the study, but that is not stated in the Regulation. Researchers sitting on old data sets may not know whether the ongoing obligation applies. This could be a trap for those who release historical data years later.

Fourth, the Regulation was originally “Epidemiological Studies (Confidentiality) Regulations” (plural). The name changed in 1999. Older versions of the Regulation may still be cited, and practitioners searching for current law might mistakenly rely on the earlier plural form. The republication notes indicate the change, but it could cause confusion in document searches.

Fifth, sections 2 and 3 were omitted from the Regulation by the 2001 consequential amendments. This means there is no longer a commencement provision or a definitions section in the Regulation. The absence of a commencement section means that the start date of the Regulation is governed by the Legislation Act. That is standard, but it removes a clear point of reference. The definitions that were in section 3 (likely definitions of “the Act” and “prescribed study”) were omitted, presumably because they were redundant or are now in the Act. However, the Regulation now begins with section 1 (name) and then jumps to section 4. This renumbering is not an issue in practice because the sections are correctly cited.

Sixth, the pill testing study (section 9) refers to a study called “Pill testing in the ACT: Pilot evaluation”. The section defines it by reference to subject matter (pill testing at a music festival, evaluation of impact), the institution (Research School of Population Health, ANU), and a start date of April 2019. If the study expands beyond a music festival (e.g., to multiple festivals or a club setting), the prescription may not cover that expanded scope. Similarly, if the same research group conducts a second pill testing study with a different start date, that new study would not be prescribed until the Regulation is amended. Researchers might assume continuity and inadvertently lose protection.

Finally, the Regulation does not provide a mechanism for a study to be removed from the list. If a study is completed or abandoned, it remains a prescribed study on paper. This is not a problem per se, but it means the list may contain obsolete entries. The supervised injecting place trial may have ended; the regulation does not reflect that. The Regulation likely should be amended to remove completed studies to avoid confusion, but no such amendments have been made.

Compliance with the Regulation itself is straightforward: if you are conducting a study that is not listed, you cannot rely on the Act’s confidentiality protections. For researchers conducting one of the six listed studies, compliance requires understanding and adhering to the Act’s obligations. The Regulation gives no procedural guidance on how to meet those obligations. However, based on the nature of the Act, practical steps include: (i) ensuring that all personnel handling study data are informed of their confidentiality duties; (ii) obtaining written consent from participants that includes the statutory confidentiality guarantee; (iii) storing data securely and limiting access; (iv) developing a data sharing policy that distinguishes between anonymous aggregate data and identifiable data; (v) establishing a process for dealing with requests for data from law enforcement, courts, or family members; (vi) implementing a breach notification procedure; and (vii) documenting that the study is indeed a prescribed study under the Regulation.

For studies that are not prescribed, researchers cannot obtain the Act’s protections. They may need to rely on other confidentiality instruments, such as ethical guidelines, contractual terms with participants, or other legislation (e.g., the Privacy Act 1988 (Cth)). If they want the protection, they would need to lobby the ACT government to amend the Regulation to include their study. That involves a policy case and a legislative process that may take months.

For participants, compliance is passive: they must provide information truthfully and, if they have concerns about disclosure, they can inquire whether the study is listed. Participants can also report suspected breaches of confidentiality to the researcher or to relevant authorities.

For government officials who process data from these studies (such as health department analysts), compliance means recognising that the data may be protected even if it has been aggregated. Officials should request written confirmation from the researchers that the data is not subject to the Act, or else handle it as confidential.

The Regulation imposes no reporting or audit obligations. There is no designated body to oversee compliance. The chief compliance risk is that researchers might unintentionally share data with a collaborator in another jurisdiction without ensuring the recipient respects the same confidentiality. The Act likely prohibits disclosure to anyone, regardless of location. Researchers should have data transfer agreements that mirror the Act’s restrictions.

Given the age of some studies (1991, 1998), records may be archived. Compliance requires that archival storage maintains security. If data is to be destroyed, researchers must ensure secure destruction. The Regulation does not specify a retention period; that would be governed by the Act, ethics approvals, or institutional policies. The safest approach is to retain data as long as the study is prescribed, but since no end date exists, indefinite retention is legally permissible. However, indefinite retention carries its own risks (e.g., data breach over time). Researchers should periodically revisit whether continued retention is justified.

In summary, the Regulation itself is a simple list. Compliance is about awareness: know whether your study is on the list, and if it is, follow the Act. If it is not, do not claim the Act’s protection. The Regulation is a threshold, not a manual.