This term is based on entries contained in The Australian Concise Oxford Dictionary, Third Edition, 1997.
3 This term is based on entries contained in The Australian Concise Oxford Dictionary, Third Edition, 1997.
Disclosure
In general terms an organisation discloses personal information when it releases information to others outside the organisation. It does not include giving individual’s information about themselves. (cf: Key Concept—‘Use’, page 10.)
(OFPC—Guidelines to the National Privacy Principles, September 2001)
Health information
Health information is a particular subset of personal information. Health information is personal information:
• About an individual’s health or disability at any time (that is past, present or future);
• About an individual’s expressed wishes regarding future health services;
• About health services provided or to be provided to the individual;
• Collected whilst providing a health service; or
• Collected in connection with the donation or intended donation of body parts and substances.
Health information includes any information collected by a health service provider during the course of providing treatment and care to an individual, including;
• Medical information;
• Personal details, such as name, address, admission and discharge dates, billing information and Medicare number;
• Information generated by a health service provider, such as notes or opinions about an individual and their health;
• Information about physical or biological samples, where it can be linked to an individual; for example, where they have a name or identifier attached;
• Genetic information, when this is collected or used in connection with delivering a health service, or genetic information when this is predictive of an individual’s health.
Under the Privacy Act 1988, higher privacy standards apply to the handling of sensitive information. Health information is one kind of sensitive information, and is subject to additional provisions.
(OFPC—Guidelines on Privacy in the Private Health Sector, October 2001. Defined in Section 6, Privacy Act 1988 )
(Cf: Key Concepts—‘Sensitive information’, page 10)
Health services
Providers of health services range from hospitals, pharmacists and general practitioners to gyms and weight loss clinics. A more comprehensive but not exhaustive list of health service providers is provided at section A.2.1 of the OFPC—Guidelines on Privacy in the Private Health Sector, 2001. See Appendix 2 of the OFPC Guidelines for the definition of the term Health services, as defined in the Privacy Act 1988.
(OFPC—Guidelines on Privacy in the Private Health Sector, October 2001. Defined in Section 6, Privacy Act 1988 ).
Management, funding or monitoring of a health service
Whether an activity falls within the ‘management, funding or monitoring of a health service’ depends on the circumstances. Factors that might ordinarily be relevant to this question include whether the organisation provides a health service (health services are defined in section 6 of the Privacy Act 1988 and Appendix 2 of the OFPC Guidelines on Privacy in the Private Health Sector, 2001) or whether the organisation has a role in funding or monitoring the quality or other aspects of a health service. Management, funding or monitoring of a health service may include some quality assurance and audit activities.
(OFPC Information Sheet 9—2001 Handling Health Information for Research and Management)
Organisation
The NPPs apply to businesses and bodies that fall within the definition of ‘organisation’ in section 6C of the Privacy Act 1988. Section 6C says that ‘organisation’ means: an individual; or body corporate; or partnership; or any other unincorporated association; or trust; that is not a small business operator, a registered political party, an agency, a State or Territory authority or a prescribed instrumentality of a State or Territory.
(OFPC—Guidelines to the National Privacy Principles, September 2001. Defined in Section 6, Privacy Act 1988 )
[For further information see the OFPC Information Sheet 12—2001 Coverage of and exemptions from the Private Sector Provision]s
Personal information
Personal information is information or an opinion (including information or an opinion forming part of a database) whether true or not, and whether recorded in material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion (Section 6 of the Privacy Act 1988 ). It includes all personal information regardless of its source.
(OFPC—Guidelines to the National Privacy Principles, September 2001. Defined in Section 6, Privacy Act 1988 )
Public health and public safety 4
Public health includes activities such as education, economics, technology, legislation and management, which protect and enhance the health of all people and to prevent illness, injury and disability.
Public safety can be thought of as the condition for all people of being safe and free from danger or risks.
To be relevant to public health or public safety the outcome of the research, or compilation of analysis of statistics activity should have an impact on or provide information about public health or public safety. Examples of public health or public safety issues could include, water quality, food safety, mental health, environmental hazards, diabetes, cancer and heart disease.
Research
There are many definitions of research. These include systematic investigation to establish facts, principles or knowledge and a study of some matter with the objective of obtaining or confirming knowledge. A defining feature of research is the validity of results. The knowledge that is generated by research is valid in the sense that what is discovered about the particular facts investigated can be justifiably claimed to be true for all like facts.
(for further discussion of this term please see; National Statement on Ethical Conduct in Research Involving Humans, 1999).
Sensitive information
Sensitive information is a subset of personal information. It means information or an opinion about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual preferences or practices, criminal record or health information about an individual (Section 6 of the Privacy Act 1988 ).
(OFPC—Guidelines to the National Privacy Principles, September 2001. Defined in Section 6, Privacy Act 1988 ).
Use
In general terms, use of personal information refers to the handling of personal information within an organisation including the ‘inclusion of information in a publication’.
(OFPC—Guidelines to the National Privacy Principles, September 2001).
4 This term is based on information from the following sources: Public Health Australia—An Introduction, Lawson, James S., 1991, The Australian Concise Oxford Dictionary, Third Edition, 1997, and the OFPC Information Sheet 9—2001 Handling Health Information for Research and Management.
GUIDELINES APPROVED UNDER SECTION 95A OF THE PRIVACY ACT 1988
A.1 Guidelines for the conduct of research relevant to public health or public safety
A.1.1 These guidelines apply to NPP 10.3(d)(iii) for the collection of health information and NPP 2.1(d)(ii) for the use and disclosure of health information, for the purpose of research relevant to public health or public safety. These guidelines provide a mechanism for weighing the public interest in research relevant to public health or public safety against the public interest in the protection of privacy. The public interest in the research activity must substantially outweigh the public interest in maintaining the level of privacy protection afforded by the NPPs (other than NPP 10.3(d) and NPP 2.1(d)).
A.1.2 It must be necessary to collect, use or disclose health information for the purpose of research relevant to public health or public safety. It must be determined that:
(a) the outcome of the research activity would have an impact on or provide information about public health or public safety; and
(b) the relevant purpose of the research activity can not be achieved by the collection, use or disclosure of de-identified data5.
A.1.3 It must be impracticable 6 to seek consent from the individual(s) involved to collect, use or disclose their health information for the purpose of research relevant to public health or public safety.
A.1.4 Where an organisation seeks to rely on these guidelines to collect, use or disclose health information for the purpose of research relevant to public health or public safety under NPP 10.3(d)(iii) 7 or NPP 2.1(d)(ii ), the organisation must be satisfied that the research activity in which health information is to be collected, used or disclosed has been approved by a HREC for the particular purpose.
5 The NPPs and these guidelines do not apply to de-identified information or statistical data sets, which would not allow individuals to be identified. (OFPC—Guidelines on Privacy in the Private Health Sector).
6 In assessing whether it is ‘impracticable’ to seek consent, this would ordinarily mean more than simply the incurring of some expense or effort in seeking consent. For example, it may be impracticable to seek consent where the organisation is unable to locate the individual, despite making reasonable efforts. (OFPC—Guidelines to the National Privacy Principles).
7 NPP 10.3(d)(iii) and these guidelines are not the only mechanism under which health information may be lawfully collected without consent for the purpose of research relevant to public health or public safety. Collection of health information where it is impracticable to seek consent for the purpose of research is also authorised under NPP 10.3 (d)(i) and NPP 10.3 (d)(ii).
(See: Introduction to these guidelines, page 2 and Appendix 5)
Conditions relating to approval of research relevant to public health or public safety given by a human research ethics committee
A.1.5 A human research ethics committee (HREC) must give approval for the collection, use or disclosure of health information for the purpose of research relevant to public health or public safety, in accordance with these guidelines. The HREC must be constituted and functioning in accordance with the National Statement on Ethical Conduct in Research Involving Humans.
[See: ‘2. Human Research Ethics Committees’, National Statement (1999)].
A.1.6 An organisation from which health information is sought, may always decline to agree to the use or disclosure of health information it holds for the purpose of research relevant to public health or public safety, even where the use or disclosure of that health information has been approved by an HREC in accordance with these guidelines.
A.2 Procedures to be followed in the collection of health information 8 for the purpose of research relevant to public health or public safety
A.2.1 This section (A.2) of the guidelines applies to the collection of health information under NPP 10.3, for the purpose of research relevant to public health or public safety. A research proposal must be submitted to an HREC for approval. The research proposal must follow the procedures set out in this section (A.2) and will be considered by an HREC only if the proposal also satisfies requirements in section A.1 of these guidelines.
A.2.2 An overriding obligation for those who seek to collect health information is at all times to respect the dignity and privacy of the individual.
A.2.3 Collection of health information for the purpose of research relevant to public health or public safety must be in accordance with NPP 1.1 and NPP1.2. (See: Appendix 1)
[See: OFPC—Guidelines to the National Privacy Principles for guidance on the privacy obligations required under NPP 1].
A.2.4 The collector(s) of health information for the purpose of research relevant to public health or public safety must give a written proposal for that research activity to an HREC. The proposal must include any information necessary for members of that HREC to meet their responsibilities under these guidelines. Guidance on the information to be included in the written proposal for the collection of health information is set out in paragraph A.2.6 of these guidelines.
A.2.5 The proposal to be submitted to an HREC for a research activity involving the collection of health information must contain a reference
8 By definition (Section 6 of the Privacy Act 1988 ) the term ‘health information’ is also ‘personal information’. Therefore, all health information is information or opinion about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, (See: Key Concepts, pages 8 & 9).
to NPP 10. The proposal must state the reasons for believing that the public interest in the proposed research activity substantially outweighs the public interest in adhering to the other NPPs (other than NPP 10.3(d)(iii)). In the proposal, the collector(s) must provide the HREC with the necessary information to enable the HREC to weigh the public interest consideration in accordance with paragraph D.5 of these guidelines.
A.2.6 In the proposal to collect health information for the purpose of research relevant to public health or public safety, the collector(s) should state:
(f) the reasons why de-identified information can not achieve the relevant purpose of the research activity;
(g) the reasons why it is impracticable to seek consent from the individual for the collection of health information9;
(j) the security standards to be applied to the health information. Standards must be in accordance with NPP 4. (See: Appendix 1).
[Note: In particular, health information should be retained in accordance with the Joint NHMRC/AVCC Statement and Guidelines on Research Practice (See: Appendix 3), and in a form that is at least as secure as it was in the sources from which the health information was obtained unless more stringent legislative or contractual provisions apply];
(k) a list of personnel within the collecting organisation or organisations with access to the health information collected;
(l) the level of protection that will be applied by the collector(s) to protect health information disclosed to the collector(s) by the disclosing organisation. These should include:
(i) terms of any release agreement between the disclosing organisation and the collector(s) to govern limits on the use and disclosure of collected health information.
[See: paragraph A.2.9 of these guidelines]; and
9 The impracticability of obtaining consent for research involving identified genetic information may extend beyond the individual to include relatives of the individual. See: ‘16 Human Genetic Research’ of the National Statement for further information.
(ii) proposed methods of disposal of the health information on the completion of the research activity, as required by NPP 4.2. (See: Appendix 1).
A.2.7 The collector(s) of health information for the purpose of research relevant to public health or public safety should provide to the organisation(s) from which health information is sought, written notification of the decision of the HREC made in accordance with these guidelines. This written notification removes the obligation for the disclosing organisation(s) to submit a written proposal to an HREC to disclose health information for the same research activity.
[See: paragraph A.3.5 of these guidelines].
A disclosing organisation may still decide to submit a written proposal to an HREC in accordance with section A.3 of these guidelines even if that disclosing organisation receives written notification of HREC approval from the collector(s).
A.2.8 The collector(s) of health information for the purpose of research relevant to public health or public safety must immediately report to the HREC anything that might warrant review of ethical approval of the research proposal.
[See: paragraph 2.37, ‘Human Research Ethics Committees’ National Statement (1999)].
A.2.9 Disclosure of health information collected under these guidelines, and therefore collected in accordance with NPP 10.3, must be in accordance with NPP 10.4. (See: Appendix 1).
[See: OFPC Information Sheet 9—2001 Handling health information for research and management for further information on privacy obligations required under NPP 10.4].
A.2.10 Once a proposal submitted to an HREC to collect health information for the purpose of research relevant to public health or public safety satisfies the procedural requirements outlined in this section (A.2), the HREC must then weigh the public interest considerations set out in section D.5 of these guidelines.
A.3 Procedures to be followed in the use and disclosure of health information 10 for the purpose of research relevant to public health or public safety
A.3.1 This section (A.3) of the guidelines applies to the use or disclosure of health information under NPP 2.1(d), for the purpose of research relevant to public health or public safety. A research proposal must be submitted to an HREC for approval. The research proposal must follow
10 By definition (Section 6 of the Privacy Act 1988 ) the term ‘health information’ is also ‘personal information’. Therefore, all health information is information or opinion about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, (See: Key Concepts, pages 8 & 9).
the procedures set out in this section (A.3) and will be considered by an HREC only if the proposal also satisfies requirements in section A.1 of these guidelines.
A.3.2 An overriding obligation for those who seek to use or disclose health information is at all times to respect the dignity and privacy of the individual.
A.3.3 Those who seek to use or disclose health information for the purpose of research relevant to public health or public safety must give a written proposal for that activity to an HREC. The proposal must include any information necessary for members of the HREC to meet their responsibilities under these guidelines. Guidance on the information to be included in the written proposal for the use or disclosure of health information is set out in paragraph A.3.6 of these guidelines.
A.3.4 The proposal to be submitted to an HREC for a research activity, involving the use or disclosure of health information must contain a reference to NPP 2. The proposal must state reasons for believing that the public interest in the proposed research activity substantially outweighs the public interest in adhering to the other NPPs (other than 2.1(d)). In the proposal, the user or discloser must provide the HREC with the necessary information to enable the HREC to weigh the public interest consideration in accordance with paragraph D.5 of these guidelines.
A.3.5 An organisation may disclose health information to a collecting organisation for the purpose of research relevant to public health or public safety without submitting a written proposal to an HREC, if the disclosing organisation receives written notification of HREC approval for health information to be collected from it.
[See: paragraph A.2.7 of these guidelines].
Guidance for preparing the written proposal to be submitted to an HREC
A.3.6 In the proposal to use or disclose health information for the purpose of research relevant to public health or public safety, the user or discloser should state:
(a) the aims or purpose of the use or disclosure;
(b) the credentials and technical competence of those seeking to use or disclose the data;
(f) the reasons why de-identified information can not achieve the relevant purpose of the research activity;
(g) the reasons why it is impracticable to seek consent from the individual for the use or disclosure of health information11;
(h) the specific uses or disclosures that will be applied to the health information during the study;
(i) the proposed method of publication of results of the research, including a statement that health information will not be published unless in de-identified form;
(j) the estimated time of retention of the health information;
(k) the identity of the custodian(s) of the health information used or disclosed;
(l) the security standards to be applied to the health information. Standards must be in accordance with NPP 4. (See: Appendix 1).
[Note: In particular, health information should be retained in accordance with the Joint NHMRC/AVCC Statement and Guidelines on Research Practice (See: Appendix 3), and in a form that is at the least as secure as it was in the sources from which the health information was obtained unless more stringent legislative or contractual provisions apply];
(m) a list of personnel within an organisation or organisations with access to the health information to be used or disclosed;
(n) the level of protection that will be applied by those seeking to use or disclose health information to protect that health information. These should include:
(i) the terms of any disclosure agreement between the organisation that holds the health information and the user or discloser, to govern limits on the use and disclosure of the health information.
[See: paragraph A.3.10 of these guidelines]; and
(ii) the proposed methods of disposal of the health information on the completion of the research activity as required by NPP 4.2 (See: Appendix 1); and
(iii) the level of protection that will be applied to protect the privacy of health information where it is made available to others if that is proposed.
A.3.7 An organisation seeking or approached to disclose health information for the purpose of research relevant to public health or public safety, where notification from the collector is not given under paragraph A.2.7 of these guidelines should submit a written proposal to an HREC to
11 The impracticability of obtaining consent for research involving identified genetic information may extend beyond the individual to include relatives of the individual. See: ‘16 Human Genetic Research’ of the National Statement for further information.
disclose the health information. The discloser should retain written notification of the decision of an HREC made in accordance with these guidelines. A copy of this notification should be provided to the collector(s) of the health information.
A.3.8 If those seeking to use or disclose health information propose to use or disclose that information to contact a person, the user or discloser of that information must inform the person:
(a) that his or her health information is being used or disclosed in accordance with the Privacy Act 1988 and these guidelines; and
(b) how his or her health information will be used or disclosed; and
(c) that he or she is free at any time to withdraw consent for further involvement in the research activity;
[See: paragraph 1.12 ‘Principles of Ethical Conduct’, National Statement (1999)] and
(d) of the standards that will apply to protect the privacy of that individual; and
[See: paragraph A.3.6(l) of these guidelines]
(e) of the complaint mechanisms in section G of these guidelines.
A.3.9 Those who seek to use or disclose health information for the purpose of research relevant to public health or public safety must immediately report to the HREC anything that might warrant review of ethical approval of the research proposal.
A.3.10 Health information disclosed under these guidelines, and therefore disclosed in accordance with NPP 2.1(d), must be in accordance with NPP 2.1(d)(iii). (See: Appendix 1).
A.3.11 Once a proposal submitted to an HREC to use or disclose health information for the purpose of research relevant to public health or public safety satisfies the procedural requirements outlined in this section (A.3), the HREC must then weigh the public interest considerations set out in section D.5 of these guidelines.
B.1 Guidelines for the conduct of the compilation or analysis of statistics, relevant to public health or public safety
B.1.1 These guidelines apply to NPP 10.3(d)(iii) for the collection of health information and NPP 2.1(d)(ii) for the use and disclosure of health information, for the purpose of the compilation or analysis of statistics, relevant to public health or public safety. These guidelines provide a mechanism for weighing the public interest in the compilation or analysis of statistics, relevant to public health or public safety against the public interest in protection of privacy. The public interest in the compilation or analysis of statistics activity must substantially outweigh the public interest in maintaining the level of privacy protection afforded by the NPPs (other than NPP 2.1(d)).
B.1.2 It must be necessary to collect, use or disclose health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety. It must be determined that:
(a) the outcome of the compilation or analysis of statistics activity would have an impact on or provide information about public health or public safety; and
(b) the relevant purpose of the compilation or analysis of statistics activity can not be achieved by the collection, use or disclosure of de-identified data12.
B.1.3 It must be impracticable 13 to seek consent from the individual(s) to collect, use or disclose their health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety.
B.1.4 Where an organisation seeks to rely on these guidelines to collect, use or disclose health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety under NPP 10.3(d)(iii) 14 or NPP 2.1(d)(ii), the organisation must be satisfied that the compilation or analysis or statistics activity in which health information is to be collected, used or disclosed has been approved by an HREC for the particular purpose.
12 The NPPs and these guidelines do not apply to de-identified information or statistical data sets, which would not allow individuals to be identified. (OFPC—Guidelines on Privacy in the Private Health Sector).
13 In assessing whether it is ‘impracticable’ to seek consent, this would ordinarily mean more than simply the incurring of some expense or effort in seeking consent. For example, it may be impracticable to seek consent where the organisation is unable to locate the individual, despite making reasonable efforts. (OFPC—Guidelines to the National Privacy Principles).
14 NPP 10.3(d)(iii) and these guidelines are not the only mechanism under which health information may be collected without consent for the purpose of the compilation or analysis of statistics, relevant to public health or public safety. Collection of health information where it is impracticable to seek consent for the purpose of the compilation or analysis of statistics is also authorised under NPP 10.3 (d)(i) and NPP 10.3 (d)(ii). (See: Introduction to these guidelines, page 2 and Appendix 5)
Conditions relating to approval of the compilation or analysis of statistics relevant to public health or public safety given by a human research ethics committee
B.1.5 An HREC must give approval for the collection, use or disclosure of health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, in accordance with these guidelines. The HREC must be constituted and functioning in accordance with the National Statement on Ethical Conduct in Research Involving Humans.
[See: ‘2. Human Research Ethics Committees’, National Statement (1999)]
B.1.6 An organisation may always decline to agree to the use or disclosure of health information it holds for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, even where the collection, use or disclosure of that health information has been approved by an HREC in accordance with these guidelines.
B.2 Procedures to be followed in the collection of health information 15 for the purpose of the compilation or analysis of statistics, relevant to public health or public safety
B.2.1 This section (B.2) of the guidelines applies to the collection of health information under NPP 10.3, for the purpose of the compilation or analysis of statistics, relevant to public health or public safety. A compilation or analysis of statistics proposal must be submitted to an HREC for approval. The compilation or analysis of statistics proposal must follow the procedures set out in this section (B.2) and will be considered by an HREC only if the proposal also satisfies requirements in section B.1 of these guidelines.
B.2.2 An overriding obligation for those who seek to collect health information is at all times to respect the dignity and privacy of the individual.
B.2.3 Collection of health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety must be in accordance with NPP 1.1 and NPP 1.2. (See: Appendix 1).
[See: OFPC—Guidelines to the National Privacy Principles for guidance on the privacy obligations required under NPP 1].
B.2.4 The collector(s) of health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, must give a written proposal for that activity to an HREC. The proposal must include any information necessary for members of that HREC to meet their responsibilities under these guidelines. Guidance on the
15 By definition (Section 6 of the Privacy Act 1988) the term ‘health information’ is also ‘personal information’. Therefore, all health information is information or opinion about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, (See: Key Concepts, pages 8 & 9).
information to be included in the written proposal for collection of health information is set out in paragraph B.2.6 of these guidelines.
B.2.5 The proposal to be submitted to an HREC for a compilation or analysis of statistics activity, involving the collection of health information, must contain a reference to NPP 10. The proposal must state the reasons for believing that the public interest in the proposed compilation or analysis of statistics activity substantially outweighs the public interest in adhering to the other NPPs (other than NPP 10.3(d)). In the proposal, the collector(s) must provide the HREC with the necessary information to enable the HREC to weigh the public interest consideration in accordance with paragraph D.5 of these guidelines.
B.2.6 In the proposal to collect health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, the collector(s) should state:
(f) the reasons why de-identified information can not achieve the relevant purpose of the compilation or analysis of statistics activity;
(g) the reasons why it is impracticable to seek consent from the individual for the collection of health information16.
(j) the security standards to be applied to the health information. Standards must be in accordance with NPP 4. (See: Appendix 1).
[Note: In particular, health information should be retained in accordance with the Joint NHMRC/AVCC Statement and Guidelines on Research Practice (See: Appendix 3), and in a form that is at least as secure as it was in the sources form which the health information was obtained unless more stringent legislative or contractual provisions apply];
(k) a list of personnel within the collecting organisation or organisations with access to the health information collected;
16 The impracticability of obtaining consent for the compilation or analysis of statistics involving identified genetic information may extend beyond the individual to include relatives of the individual. See: ‘16 Human Genetic Research’ of the National Statement for further information.
(l) the level of protection that will be applied by the collector(s) to protect health information disclosed to the collector(s) by the disclosing organisation. These should include:
(a) the terms of any release agreement between the disclosing organisation and the collector(s) to govern limits on the use and disclosure of collected health information.
[See: paragraph B.2.9 of these guidelines]; and
(b) the proposed methods of disposal of the health information on the completion of the statistical activity, as required by NPP 4.2. (See: Appendix 1).
B.2.7 The collector(s) of health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, should provide to the organisation from which the health information is sought, written notification of the decision of the HREC made in accordance with these guidelines. This written notification removes the obligation for the disclosing organisation to submit a written proposal to an HREC to disclose health information for the same compilation or analysis of statistics activity.
[See: paragraph B.3.5 of these guidelines].
A disclosing organisation may still decide to submit a written proposal to an HREC in accordance with section B.3 of these guidelines even if that disclosing organisation receives written notification of HREC approval from the collector(s).
B.2.8 The collector(s) of health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety must immediately report to the HREC anything that might warrant review of ethical approval of the proposal.
B.2.9 Disclosure of health information collected under these guidelines, and therefore collected in accordance with NPP 10.3, must be in accordance with NPP 10.4. (See: Appendix 1).
[See: OFPC Information Sheet 9—2001 Handling health information for research and management for further information on privacy obligations required under NPP 10.4].
B.2.10 Once a proposal submitted to an HREC to collect health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety satisfies the procedural requirements outlined in this section (B.2), the HREC must then weigh the public interest considerations set out in section D.5 of these guidelines.
B.3 Procedures to be followed in the use and disclosure of health information 17 for the purpose of the compilation or analysis of statistics, relevant to public health or public safety
B.3.1 This section (B.3) of the guidelines applies to the use or disclosure of health information under NPP 2.1(d), for the purpose of the compilation or analysis of statistics, relevant to public health or public safety. A compilation or analysis of statistics proposal must be submitted to an HREC for approval. The compilation or analysis or statistics proposal must follow the procedures set out in this section (B.3) and will be considered by an HREC only if the proposal also satisfies requirements in section B.1 of these guidelines.
B.3.2 An overriding obligation for those who seek to use or disclose health information is at all times to respect the dignity and privacy of the individual.
B.3.3 Those who seek to use or disclose health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, must give a written proposal for that activity to an HREC. The proposal must include any information necessary for members of the HREC to meet their responsibilities under these guidelines. Guidance on the information to be included in the written proposal for the use or disclosure of health information is set out in paragraph B.3.6 of these guidelines.
B.3.4 The proposal to be submitted to an HREC for a compilation or analysis of statistics activity, involving the use or disclosure of health information, must contain a reference to NPP 2. The proposal must state reasons for believing that the public interest in the proposed compilation or analysis of statistics activity substantially outweighs the public interest in adhering to the other NPPs (other than 2.1(d)). In the proposal, the user or discloser must provide the HREC with the necessary information to enable the HREC to weigh the public interest consideration in accordance with paragraph D.5 of these guidelines.
B.3.5 An organisation may disclose health information to a collecting organisation for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, without submitting a written proposal to an HREC, if the disclosing organisation receives written notification of HREC approval for health information to be collected from it.
[See: paragraph B.2.7 of these guidelines].
17 By definition (Section 6 of the Privacy Act 1988 ) the term ‘health information’ is also ‘personal information’. Therefore, all health information is information or opinion about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, (See: Key Concepts, pages 8 & 9).
B.3.6 In the proposal to use or disclose health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, the user or discloser should state:
(a) the aims or purpose of the use or disclosure;
(b) the credentials and technical competence of those seeking to use or disclose the data;
(f) the reasons why de-identified information can not achieve the relevant purpose of the compilation or analysis of statistics activity;
(g) the reasons why it is impracticable to seek consent from the individual(s) for the use or disclosure of health information18;
(h) the specific uses or disclosures that will be applied to the health information during the study;
(i) the proposed method of publication of results of the research, including a statement that health information will not be published unless in de-identified form;
(j) the estimated time of retention of the health information;
(k) the identity of the custodian(s) of the health information used or disclosed;
(l) the security standards to be applied to the health information. Standards must be in accordance with NPP 4. (See: Appendix 1).
[Note: In particular, health information should be retained in accordance with the Joint NHMRC/AVCC Statement and Guidelines on Research Practice (See: Appendix 3), and in a form that is at the least as secure as it was in the sources from which the health information was obtained unless more stringent legislative or contractual provisions apply];
(m) a list of personnel within an organisation or organisations with access to the health information to be use or disclosed;
(n) the level of protection that will be applied by those seeking to use or disclose health information to protect that health information. These should include:
(i) the terms of any disclosure agreement between the organisation that holds the health information and the user or discloser, to govern limits on the use and disclosure of the health information.
[See: paragraph B.3.10 of these guidelines]; and
18 The impracticability of obtaining consent for the compilation or analysis of statistics involving identified genetic information may extend beyond the individual to include relatives of the individual. See: ‘16 Human Genetic Research’ of the National Statement for further information.
(ii) the proposed methods of disposal of the health information on the completion of the statistical compilation or analysis activity, as required by NPP 4.2. (See: Appendix 1); and
(iii) the level of protection that will be applied to protect the privacy of health information where it is made available to others if that is proposed.
B.3.7 An organisation seeking or approached to disclose health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, where notification from the collector is not given under paragraph B.2.7 of these guidelines, should submit a written proposal to an HREC to disclose the health information. The discloser should retain written notification of the decision of an HREC made in accordance with these guidelines. A copy of this notification should be provided to the collector(s) of health information.
B.3.8 If those seeking to use or disclose health information propose to use or disclose that information to contact a person, the user or discloser of that information must inform the person:
(a) that his or her health information is being used or disclosed in accordance with the Privacy Act and these guidelines; and
(b) how his or her health information will be used or disclosed; and
(c) that he or she is free at any time to withdraw consent for further involvement in the statistical activity.
[See: paragraph 1.12, ‘Principles of Ethical Conduct’, National Statement (1999)]; and
(d) of the standards that will apply to protect the privacy of that individual;
[See: paragraph B.3.6(l) of these guidelines]; and
(e) of the complaint mechanisms in section G of these guidelines.
B.3.9 Those who seek to use or disclose health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, must immediately report to the HREC anything that might warrant review of ethical approval of the proposal.
B.3.10 Health information disclosed under these guidelines, and therefore disclosed in accordance with NPP 2.1(d), must be in accordance with NPP 2.1 (d)(iii). (See: Appendix 1).
B.3.11 Once a proposal submitted to an HREC to use or disclose health information for the purpose of the compilation or analysis of statistics, relevant to public health or public safety, satisfies the procedural requirements outlined in this section (B.3), the HREC must then weigh the public interest considerations set out in section D.5 of these guidelines.
C.1 Guidelines for the conduct of the management, funding or monitoring of a health service
The Guidelines approved under Section 95A of the Privacy Act 1988 are only authorised to provide guidance for the collection of health information for the purpose of the management, funding or monitoring of a health service19.
For information on the requirements for the use and disclosure of health information for the purpose of the management, funding or monitoring of a health service refer to the OFPC Guidelines on Privacy in the Private Health Sector (Section 2).
C.1.1 These Guidelines approved under Section 95A of the Privacy Act 1988 apply to NPP 10.3(d)(iii) for the collection of health information for the purpose of health service management and provide a mechanism for weighing the public interest in health service management activities against the public interest in protection of privacy. The public interest in the health service management activity must substantially outweigh the public interest in maintaining the level of privacy protection afforded by the NPPs (other than NPP 10.3(d)).
C.1.2 It must be necessary to collect health information for the purpose of health service management. It must be determined that:
(a) the relevant purpose of the health service management activity can not be achieved by the collection of de-identified data20.
C.1.3 It must be impracticable 21 to seek consent from the individual(s) to collect their health information for the purpose of health service management.
C.1.4 Where an organisation seeks to rely on these guidelines to lawfully collect health information for the purpose of health service management under NPP 10.3(d)(iii) 22, the organisation must be satisfied that the health service management activity in which health information is to be collected, has been approved by an HREC for the particular purpose.
19 For the purpose of these guidelines, health service management means the management, funding or monitoring of a health service.
20 The NPPs and these guidelines do not apply to de-identified information or statistical data sets, which would not allow individuals to be identified. (OFPC—Guidelines on Privacy in the Private Health Sector).
21 In assessing whether it is ‘impracticable’ to seek consent, this would ordinarily mean more than simply the incurring of some expense or effort in seeking consent. For example, it may be impracticable to seek consent where the organisation is unable to locate the individual, despite making reasonable efforts. (OFPC—Guidelines to the National Privacy Principles).
22 NPP 10.3(d)(iii) and these guidelines are not the only mechanism under which health information may be collected without consent for the purpose of health service management. Collection of health information where it is impracticable to seek consent for the purpose of health service management is also authorised under NPP 10.3 (d)(i) and NPP 10.3 (d)(ii). (See: Introduction to these guidelines, page 2 and Appendix 5).
Conditions relating to approval of health service management activities given by a human research ethics committee
C.1.5 An HREC must give approval for the collection of health information for the purpose of health service management, in accordance with these guidelines. The HREC must be constituted and functioning in accordance with the National Statement on Ethical Conduct in Research Involving Humans.
[See: ‘2. Human Research Ethics Committees’, National Statement (1999)].
C.1.6 An organisation may always decline to agree to the disclosure of health information it holds, for the purpose of health service management, even where the collection of that health information has been approved by an HREC in accordance with these guidelines.
C.2 Procedures to be followed in the collection of health information 23 for the purpose of the management, funding or monitoring of a health service
C.2.1 This section (C.2) of the guidelines applies to the collection of health information under NPP 10.3, for the purpose of health service management. A health service management proposal must be submitted to an HREC for approval. The health service management proposal must follow the procedures set out in this section (C.2) and will be considered by an HREC only if the proposal also satisfies requirements in section C.1 of these guidelines.
C.2.2 An overriding obligation for those who seek to collect health information is at all times to respect the dignity and privacy of the individual.
C.2.3 Collection of health information for the purpose of health service management must be in accordance with NPP 1.1 and NPP 1.2. (See: Appendix 1).
[See: OFPC—Guidelines to the National Privacy Principles for guidance on privacy obligations established under NPP 1].
C.2.4 The collector(s) of health information for the purpose of health service management must give a written proposal for that activity to an HREC. The proposal must include any information necessary for members of that HREC to meet their responsibilities under these guidelines. Guidance on the information to be included in the written proposal for collection of health information is set out in paragraph C.2.6 of these guidelines.
C.2.5 The proposal to be submitted to an HREC for a health service management activity involving the collection of health information must
23 By definition (Section 6 of the Privacy Act 1988 ) the term ‘health information’ is also ‘personal information’. Therefore, all health information is information or opinion about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, (See: Key Concepts, pages 8 & 9).
contain a reference to NPP 10. The proposal must state the reasons for believing that the public interest in the proposed health service management activity substantially outweighs the public interest in adhering to the other NPPs (other NPP 10.3(d)(iii)). In the proposal, the collector(s) must provide the HREC with the necessary information to enable the HREC to weigh the public interest consideration in accordance with paragraph D.5 of these guidelines.
C.2.6 In the proposal to collect health information for the purpose of health service management, the collector(s) should state:
(f) the reasons why de-identified information can not achieve the relevant purpose of the health service management activity;
(g) the reasons why it is impracticable to seek consent from the individual(s) for the collection of health information24;
(j) the security standards to be applied to the health information. Standards must be in accordance with NPP 4. (See: Appendix 1).
[Note: In particular, health information should be retained in accordance with the Joint NHMRC/AVCC Statement and Guidelines on Research Practice (See: Appendix 3), and in a form that is at least as secure as it was in the sources from which the health information was obtained unless more stringent legislative or contractual provisions apply];
(k) a list of personnel within the collecting organisation or organisations with access to the health information collected;
(l) the level of protection that will be applied by the collector(s) to protect health information disclosed to the collector(s) by the disclosing organisation. These should include:
(i) the terms of any release agreement between the disclosing organisation and the collector(s) to govern limits on the use and disclosure of collected health information.
[See: paragraph C.2.9 of these guidelines]; and
24 The impracticability of obtaining consent for health service management activities involving identified genetic information may extend beyond the individual to include relatives of the individual. See: ‘16 Human Genetic Research’ of the National Statement for further information.
(ii) the proposed methods of disposal of the health information on the completion of the health service management activity, as required under NPP 4.2. (See: Appendix 1).
C.2.7 The collector(s) of health information for the purpose of health service management should provide to the organisation from which health information is sought, written notification of the decision of the HREC made in accordance with these guidelines.
C.2.8 The collector(s) of health information for the purpose of health service management must immediately report to the HREC anything that might warrant review of ethical approval of the proposal.
C.2.9 Disclosure of health information collected under these guidelines, and therefore collected in accordance with NPP 10.3, must be in accordance with NPP 10.4. (See: Appendix 1).
[See: OFPC Information Sheet 9—2001 Handling health information for research and management for further information on privacy obligations required under NPP 10.4].
C.2.10 Once a proposal submitted to an HREC to collect health information for the purpose of health service management satisfies the procedural requirements outlined in this section (C.2), the HREC must then weigh the public interest considerations set out in section D.1.5 of these guidelines.
D. Consideration by human research ethics committees (HRECs)
D.1 Before making a decision under these guidelines, an HREC must assess whether it has sufficient information, expertise and understanding of privacy issues, either amongst the members of the HREC or otherwise available to it, to make a decision that takes proper account of privacy matters. For the review of proposals for the collection of health information for the purpose of health service management, this may necessitate the appointment of additional members with specific expertise in the management, funding or monitoring of a health service.
[See: ‘2. Human Research Ethics Committees’ and ‘18. Privacy of Information’, National Statement (1999)].
D.2 In making decisions under these guidelines, an HREC must consider whether the proposal complies with the relevant NPPs in the course of:
(a) the collection of health information for the purposes of:
(i) research relevant to public health or public safety; or
(ii) the compilation or analysis of statistics, relevant to public health or public safety; or
(iii) the management, funding or monitoring of a health service;
or
(b) the use and disclosure of health information for the purposes of:
(i) research relevant to public health or public safety; or
(ii) the compilation or analysis of statistics, relevant to public health or public safety.
This would include considering whether the purpose of the proposed activity can be achieved using de-identified data and whether it is impracticable to collect, use or disclose health information for the proposed activity with the consent of the individual(s) involved.
D.3 In making decisions under these guidelines the HREC must ensure that the committee has the competence to determine if the public interest in the proposed activity substantially outweighs, or does not substantially outweigh, the public interest in the protection of privacy.
D.4 If the public interest in the proposed research, or compilation or analysis of statistics, or health service management activity does not substantially outweigh the public interest in the protection of privacy, then the activity should not be approved to proceed by the HREC.
Weighing the public interest
D.5 In determining whether the public interest in the proposed activity substantially outweighs, or does not substantially outweigh, the public interest in the protection of privacy, an HREC should consider the following matters:
(a) the degree to which the proposed collection, use or disclosure of
health information is necessary to the functions or activities of the organisation;
(b) the degree to which the research, or compilation or analysis of statistics activity is relevant to public health or public safety;
(c) the degree to which the research, or compilation or analysis of statistics or the health service management activity is likely to contribute to :
(i) the identification, prevention or treatment of illness, injury or disease; or
(ii) scientific understanding relating to public health or safety; or
(iii) the protection of the health of individuals and/or communities; or
(iv) the improved delivery of health services; or
(v) enhanced scientific understanding or knowledge; or
(vi) enhanced knowledge of issues within the fields of social science and the humanities relating to public health or public safety;
(d) any likely benefits to individuals, to the category of persons to which they belong, or the wider community that will arise from the research, or compilation or analysis of statistics, or management of a health service being undertaken in the manner proposed;
(e) in considering benefits to the category of persons to which the individual(s) belong, specific consideration should be given to any likely benefits to individuals that belong to certain categories where the information may be of a particularly personal or sensitive nature; for example:
(i) children and young people; or
(ii) persons with intellectual or psychiatric disability; or
(iii) persons highly dependent on medical care; or
(iv) persons in dependent or unequal relationships; or
(v) persons who are members of collectivities; or
(vi) Aboriginal and Torres Strait Islander peoples; or
(vii) persons whose information relates to their mental or sexual health;
[See: National Statement for further information on considerations relevant to the above categories of persons.];
(f) whether the research, or compilation or analysis of statistics, or management of a health service study design can be satisfied without needing to apply NPP 2.1(d)(ii) and/or NPP 10.3(d)(iii) and the scientific defects in the activity that might arise if the activity was not undertaken in the manner proposed;
(g) the cost of not undertaking the research, or compilation or analysis of statistics, or management of a health service activity (to government, the public, the health care system etc);
(h) the public importance of the proposed research, or compilation or analysis of statistics, or management of a health service activity;
(i) the extent to which the data being sought are usually available to the public from the organisation that holds that data; and
(i) whether the research, or compilation or analysis of statistics activity, involves use of the data in a way that is inconsistent with the purpose for which the data was made public; and
(ii) whether the research, or compilation or analysis of statistics activity requires alteration of the format of the data of a kind that would, if used or disclosed by an organisation, involve a breach of an NPP;
(j) whether the risk of harm to an individual whose health information is to be collected, used or disclosed in the proposed research, or compilation or analysis of statistics, or management of health service activity is minimal, based on the information provided in proposals submitted under paragraphs A.2.6; or A.3.6; or B.2.6; or B.3.6; or C.2.6 of these guidelines;
(k) the standards of conduct that are to be observed in the research, or compilation or analysis of statistics, or management of a health service activity, including:
(i) the study design and the scientific credentials of those involved in conducting that study;
(ii) if the study involves contact with participants, the procedures or controls that will apply to ensure that participants are treated with integrity and sensitivity, including whether questions to be asked or procedures to be employed are intrusive;
(iii) whether access to health information is adequately restricted to appropriate personnel involved in conducting the proposed study;
(iv) the procedures that are to be followed to ensure that the health information is permanently de-identified before the publication of results;
(v) the procedures that are to be followed at the completion of the proposed study to ensure that all data containing health information are at least as secure as they were in the sources from which the data was obtained, including the date when the data will be destroyed or returned. These procedures must be in accordance with NPP 4 (See: Appendix 1).
Recording, notification and monitoring of decisions made by an HREC
D.6 Details of the decision made by the HREC regarding proposals to conduct research, or the compilation or analysis of statistics, relevant to public health or public safety, or health service management must be recorded in accordance with paragraph 2.30 of the National Statement on Ethical Conduct in Research Involving Humans (1999).
Whenever the collection, use or disclosure of health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety, or the collection of health information for the purpose of health service management activities are being considered under these guidelines, the HREC must also record details of the following:
(a) the organisation(s) from which health information is sought;
(b) the data items sought from the organisation(s) and approved by the HREC;
(c) the number of records involved;
(d) the NPP to which the proposal applies (NPP 2 or NPP 10);
(e) how and on what grounds the HREC came to the conclusion that it had sufficient information, expertise and understanding of privacy issues either amongst the members of the HREC or otherwise available to it to make a decision that takes proper account of privacy; and
(f) considerations involved in weighing the public interest in the proposed research, compilation or analysis of statistics, or management of a health service activity against the public interest in the protection of privacy, including why de-identified health information would not achieve the purpose of the approved proposal and why it is impracticable to obtain consent from the individual(s) involved.
D.7 It is an obligation of the HREC to monitor proposals approved in accordance with these guidelines for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety, or for the purpose of the management of a health service in accordance with paragraphs 2.33-2.38, ‘Human Research Ethics Committees’, National Statement (1999).
D.8 When the HREC approves a proposal for research, or the compilation or analysis of statistics, relevant to public health or public safety, or for the management of a health service, it must decide whether the proposed activity should commence within a defined period from the date of approval and whether the project should be completed within a set period, and notify those conducting the study of that decision.
E. Responsibilities of the National Health and Medical Research Council (NHMRC)
E.1 The AHEC will report annually to NHMRC in relation to HRECs generally, based on the annual compliance report completed by HRECs. The annual compliance report will include all decisions, and details of these decisions as required by paragraph D.6 of these guidelines.
E.2 The AHEC of the NHMRC may request at any time, information in relation to paragraphs D.6, D.7 and D.8 of these guidelines.
E.3 When there has been a failure to comply with these guidelines the AHEC of the NHMRC will:
(a) Report details of the failure to the Federal Privacy Commissioner and may name those involved in the particular study or the HREC responsible; and
(b) Where that failure involves health information disclosed by an organisation, inform that organisation of details of the failure.
F. Reports to or for the Federal Privacy Commissioner
F.1 AHEC will annually report to the Federal Privacy Commissioner all details recorded under paragraph D.6 of these guidelines, of the research, compilation or analysis of statistics, or health service management activities conducted under these guidelines and shall provide an evaluation of the operation of these guidelines for the year of reporting. AHEC will also include in its report details relating to the number of complaints made under paragraph G.1 (b) of these guidelines.
F.2 AHEC will also provide to the Federal Privacy Commissioner, at his or her request, additional information about the operation of the guidelines, research, compilation or analysis of statistics, or the management of a health service activities conducted under these guidelines and/or failure to comply with these guidelines.
G. Complaints mechanisms
G.1 Complaints may be made to:
(a) The individual(s), institution(s) or organisation(s) conducting the research, or compilation or analysis of statistics, relevant to public health or public safety, or health service management activity; and /or
(b) HRECs concerning the individual(s) or institution(s) involved in the research, or compilation or analysis of statistics, relevant to public health or public safety, or the management of a health
service, regarding the conduct of an approved activity that may interfere with the privacy of the individual involved,
[See: paragraphs 2.39-2.43 ‘Human Research Ethics Committees’, National Statement (1999)]; and/or
(c) the Federal Privacy Commissioner concerning the collection, use or disclosure of health information by organisations.
Under section 36(1) of the Privacy Act 1988, an individual may complain to the Privacy Commissioner about an act or practice that may be an interference with the privacy of the individual. Where an organisation seeks to rely on these guidelines to:
(i) collect health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety, or the management of a health service; or
(ii) use and disclose health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety
under Section 95A, an individual may complain if the procedures set out in these guidelines are not followed.
G.2 The AHEC of the NHMRC may request at any time, information in relation to G.1 (b) of these guidelines.
H. Date of Review
H.1 The NHMRC will initiate a review of the adequacy and operation of these guidelines two years from the date of issue on 21 December 2001. This review will complement and coincide with any evaluation of the new privacy legislation.
APPENDIX 1
National Privacy Principles
[from the Privacy Act 1988 (Commonwealth), incorporating the Privacy Amendment (Private Sector) Act 2000 (Commonwealth)]