1 August 2006

The Privacy Commissioner, Karen Curtis, has today released the report of her Office's Review of the Privacy Guidelines for the Handling of Medicare and Pharmaceutical Benefits Scheme (PBS) claims information.

The Guidelines are issued under section 135AA of the National Health Act 1953, and it is a function of the Privacy Commissioner to make the Guidelines under section 27(1)(pa) of the Privacy Act 1988 (Cth).

The Guidelines currently only apply to Medicare Australia and the Department of Health and Ageing. The Guidelines are intended to prohibit agencies from combining Medicare and PBS claims information onto the one database. Such a practice would have the potential to create a rich source of information about individuals' health. The Guidelines also provide rules around how and for what purposes claims information may be used and disclosed by agencies.

"This review has highlighted the importance of this information, as a form of health information," Ms Curtis said.

"My Office has been informed by the valuable submissions made during the extensive consultation process. The review has considered a wide range of views, with the aim of determining how best to weigh the public interest in protecting the claims information, against the public interest in using the information for other purposes, such as research.

"The review findings also reflect my responsibilities, as Privacy Commissioner, to meet the statutory obligations created by the legislation and in a manner consistent with the underlining policy intent of that legislation.

"It became apparent during the review that there is some misunderstanding of how the Guidelines work. Most significantly, the Guidelines do not prevent medical or social researchers from obtaining or linking claims information."

The Privacy Commissioner said, "I will now liaise with Medicare Australia and the Department of Health and Ageing, to make new Guidelines that reflect the findings of this review and are easily understood."

Key findings

Key findings of the review include:

Enhancing consumer choice and access to claims information

A new guideline will be made affording individuals greater control over the handling of their own claims information. This new provision will offer individuals the choice to consent to have their claims information linked by Medicare Australia to facilitate their access in a single report. Currently, Medicare Australia may only provide Medicare and PBS claims information to individuals in separate reports.

Changes to the long term handling of claims information by Medicare Australia

The guidelines currently require that Medicare Australia must delete all claims information after 5 years. If the agency subsequently needs this information, including to provide individuals with access their own records, then it must recover the information from the Department of Health and Ageing.

The review has found that this arrangement imposes an administrative burden on both agencies, reduces the speed with which claims information can be provided to individuals for other valid purposes, and offers little extra privacy protection than could be provided by other arrangements.

Accordingly, the review has found that the guidelines should allow Medicare Australia to retain claims information indefinitely, subject to other protections being afforded:

• All claims information must be stripped of identifying details after 5 years (when it becomes "old information")
• This old information can only be re-linked to identifying details for a narrow range of prescribed purposes, such as to facilitate an individual's access to that information. These purposes will essentially remain unchanged from those currently permitted.

• Medicare Australia must report to the Privacy Commissioner annually on how often it re-links old information with the relevant identifying details and for what purpose.

New privacy regulation on Australian Government agencies

The review has found that an additional guideline is required to ensure that Medicare and PBS claims information cannot be stored on the same database in other Australian Government agencies. Currently, such restrictions only apply to Medicare Australia and the Department of Health and Ageing.

Background

The Privacy Guidelines were first issued by the Privacy Commissioner on 24 November 1993 and came into effect on 15 April 1994. The last comprehensive review of the Privacy Guidelines took place in 1995.

In 2004, the Office began a comprehensive review of the operation of the Guidelines, releasing an Issues Paper in November 2004. The Office received 35 written submissions and conducted open consultation forums in Adelaide, Brisbane, Canberra, Darwin, Hobart, Melbourne and Sydney. At the end of the public consultation process, the Commissioner convened a consultation group to assist the review process.

About Medicare and PBS claims information

The two databases holding Medicare and PBS claims information are close to universal, in that they contain personal and health information on almost all Australian residents. This is unique information which is generally not found in other large government data sources, such as those held by the Australian Electoral Commission, Centrelink or the Australian Taxation Office.

Because of their universality and the high sensitivity of the information they contain, the Medicare and PBS databases warrant some special protective measures. The Guidelines are intended to provide such measures.

Generally, it is not possible to identify an individual's specific condition from Medicare claims information, which indicates visits to a health provider, but does not identify the medical condition. In some cases, however, Medicare claims information could infer what an individual has received treatment for. For example, a Medicare claims classification exists for identifying mental health consultations.

Similarly, in many cases, it would not usually be possible to accurately determine from the PBS claims information an individual's precise medical condition, as one pharmaceutical may be used for a range of different conditions. On the other hand, some medications may only have application for a particular type of disease or a specific condition. For example, during the review, the Office received expert advice that some pharmaceuticals are uniquely identified on the PBS schedule and are only used for specific and highly sensitive conditions.