Which privacy issues need to be considered when the business circumstances...

View printable version of this page

Question: Which privacy issues need to be considered when the business circumstances of a health service provider change?

Answer: When changing business circumstances, a health service provider may need to consider differing privacy issues, depending on:

• The nature of the changes that are to occur, for example whether these include an amalgamation of like services with other providers, a takeover by one provider of another’s business, or the closure of a provider’s business; and
• the way in which the health information will be handled under the changed arrangements.

For example, if the changing circumstances mean that the health information stays with the original health service provider, but they now intend to use and disclose that information for different purposes than was the case previously, then under National Privacy Principle 2 (NPP 2) the provider may need to seek the consent of the individuals concerned before the new uses and disclosures occur.

If the changes mean that the original health service provider is to transfer the information to a new legal entity, then the original provider will need to consider whether they need consent to pass the information on – especially where the information will be used or disclosed for purposes different to those carried out originally. The new provider will need to consider its privacy obligations, which may include giving notice (under NPP 1) to the individuals concerned that the provider is going to collect their information.

Please refer to the relevant NPPs. For more information on the handling of health information when there is a change in business circumstances, see Guidelines on Privacy in the Private Health Sector.