- an authorised employee of a healthcare provider who requires access to IHI records to assist with patient administration
- an authorised employee of a contracted service provider of the healthcare provider who requires access to IHI records to assist with patient administration.
If a healthcare provider organisation is authorised to collect IHIs for a particular purpose, an employee or an employee of a contracted service provider is also authorised to collect IHIs on their behalf, where their duties involve, or are reasonably connected to, implementing that purpose.[2]
Healthcare providers may only collect IHIs for the purpose of communicating or managing health information, as part of providing healthcare to a patient. It is an offence under the HI Act to collect an IHI from the HI Service for another purpose.[3]
Healthcare providers may collect IHIs for their existing patients through a bulk download from the HI Service. In this process a batch file with each patient’s identity details is provided to the HI Service and the HI Service will attempt to match the information with IHIs for those patients. The HI Service will only return IHIs when an exact match is found. If an exact match is not found, an error message will be returned to the healthcare provider.
Compliance tips
Healthcare providers should only download their patients’ IHIs if this is necessary for communicating or managing health information as part of providing the patient with healthcare. Healthcare providers should carefully consider whether they need to collect IHIs for patients who have not used their services for a long time.
Healthcare providers must ensure that they transfer batch files securely, for example as an encrypted file. If unsure of the requirements, providers may wish to contact the HI Service Operator for further information.
Disclosing ‘identifying information’ to the HI Service
The HI Act also authorises healthcare providers to disclose ‘identifying information’ of a healthcare recipient to the HI Service for the purpose of the HI Service assigning them a healthcare identifier, and for the purpose of the HI Service Operator disclosing the healthcare recipient’s healthcare identifier to the healthcare provider (s 16 HI Act).
‘Identifying information’ is defined in s 7 of the HI Act and includes the individual’s name, address, date of birth, sex, Medicare number, Department of Veterans’ Affairs file number (if applicable) and order of birth in the case of a multiple birth.
Compliance tip
When collecting IHIs from the HI Service, healthcare providers should not provide any more information than is generally needed to uniquely identify each patient (name, sex and date of birth).
Where the details provided are insufficient to uniquely identify the patient, the HI Service will request further identity details such as the patient’s Medicare number or Veterans’ Affairs number.
What notice do I have to provide?
State and territory healthcare providers may be required under their state privacy or information handling legislation to give notice when collecting a patient’s personal information, such as an IHI. Information about the collection of a patient’s IHI could be included as part of a collection notice and also in the healthcare provider’s privacy policy.
Using and disclosing Individual Healthcare Identifiers
Authorised uses and disclosures
Healthcare providers may only use or disclose an IHI for a purpose permitted under the HI Act, that is, to communicate or manage health information as part of:
- the provision of healthcare to the patient
- the management (including investigating or resolving complaints), funding, monitoring or evaluation of healthcare
- the provision of medical indemnity cover for a healthcare provider
- the conduct of research that has been approved by a Human Research Ethics Committee
- lessening or preventing a serious threat to an individual’s life, health or safety or to public health or safety
- purposes authorised under another law.[4]
The use or disclosure of an IHI for any other purpose is an offence under the HI Act.[5]
If a staff member uses or discloses an IHI for any unauthorised purpose when carrying out their employment duties, they may have committed an offence. The healthcare provider organisation, however, may still be accountable for a breach of privacy.[6]
The HI Act allows the disclosure of an IHI as required or authorised by law. For example, a provider may be legally compelled to disclose an individual’s IHI if issued a subpoena by a court for the provision of information.
Prohibited uses and disclosures
The HI Act expressly prohibits IHIs from being used or disclosed for the purpose of communicating or managing health information as part of:
- underwriting a contract of insurance that covers the healthcare recipient
- determining whether to enter into a contract of insurance that covers the healthcare recipient (whether alone or as a member of a class)
- determining whether a contract of insurance covers the healthcare recipient in relation to a particular event, or
- non-healthcare related employment purposes.[7]
Records of access to the Healthcare Identifier Service
To ensure that a record of every access to the HI Service is maintained, healthcare providers are required to do either one of the following:
- give the HI Service enough information to identify, by name, the authorised user making the request. That information may be given as, for example, part of the data sent to the HI Service from the healthcare provider’s practice management software. In this case the provider does not need to keep its own record of individual staff members’ access
- keep its own retrievable record of each occasion an individual authorised user has accessed an IHI. The record must include either:
- the staff member’s name, or
- other information that can be used to identify the staff member.[8]
If the provider keeps its own records, it only needs to inform the HI Service of the identity of the organisation, rather than the identity of the individual authorised user requesting the IHI, when accessing the HI Service.
The healthcare provider must retain the relevant records for as long as a staff member is authorised to access IHIs from the HI Service, and for seven years from the day after they cease to be authorised.[9]
If the HI Service makes a written request for the access record, the organisation must provide a copy to the HI Service with 14 days of receiving the request. It is an offence under the HI Act for a healthcare provider to intentionally not comply with such a request.[10]
Quality of personal information
Handling IHIs
All state and territory government healthcare providers should have procedures in place to ensure that their records of personal information are accurate. In many cases they will be specifically required to do so by state or territory privacy or information handling legislation.
Healthcare providers must have systems and processes in place to ensure that:
- they are referencing patient records with the correct identifier
- the information that they are referencing with the identifier is accurate, complete and up-to-date.
Security of personal information
State and territory healthcare providers must take reasonable steps to protect the healthcare identifiers they hold from misuse, loss, and unauthorised access, modification or disclosure.[11]
Additionally, many state and territory healthcare providers will similarly be required to have data security procedures in place under state or territory privacy or information handling legislation. Providers should integrate information security safeguards for healthcare identifiers into their systems and processes.
In order to participate in the HI Service, healthcare providers are required to have IT systems that incorporate minimum standards and security features. Healthcare providers should ensure that their software conforms with these requirements. Further information is available from the HI Service Operator.
Compliance tip
It is good privacy practice to implement audit trails within an organisation’s internal systems of individual staff member access to patients’ personal information, including IHIs (after they are initially downloaded from the HI Service), to prevent and detect improper use or disclosure. (This would be in addition to the requirement under the Regulations outlined above for healthcare providers to either keep a record, or notify the HI Service, of each individual user’s access to the HI Service).
Anonymous and pseudonymous healthcare
IHIs do not alter the way in which anonymous and pseudonymous healthcare services are provided. When a patient is receiving healthcare services on a pseudonymous basis, patients can also choose to be issued with a pseudonymous IHI.[12] Patients should not be refused treatment because they do not wish their healthcare provider to access their IHI.[13]
Footnotes
[1] See s 29(1) of the HI Act which says that any breach of the HI Act or Regulations in connection with an IHI or an individual’s identifying information is a breach of the Privacy Act. Section 29 brings state and territory authorities into the jurisdiction of the OAIC for the handling of IHIs.
[2] See s 36A of the HI Act
[3] See s 14 of the HI Act and r 10 of the HI Regulations. A penalty of up to 50 penalty units ($11,100) may apply.
[4] See s 26(5) of the HI Act.
[5] See s 26 of the HI Act. A person convicted of this offence may be imprisoned for two years or fined 120 penalty units ($26,640), or both. If a body corporate is convicted of this offence, a court may impose a fine of up to 600 penalty units ($133,200).
[6] See s 29 of the HI Act
[7] See s 14(2) of the HI Act
[8] See r 12 of the HI Regulations
[9] See r 12(4) of the HI Regulations
[10] See r 12(5) of the HI Regulations. A penalty of up to 50 penalty units ($11,100) may apply.
[11] See s 27 of the HI Act
[13] See Explanatory Memorandum to the Healthcare Identifiers Bill 2010, p. 5
