11 May 2005

"Most people consider that health information about them is quite sensitive. When my Office became aware that the personal information of patients may have been inappropriately disclosed by doctors to CAMM Pacific via Health Communications Network Limited's (HCN) Medical Director software, I chose to investigate," said Privacy Commissioner, Karen Curtis.

"The issue was brought to my attention by journalists, late last year, who alleged that CAMM Pacific and HCN were breaching the Privacy Act. At the time, CAMM Pacific was conducting a study which aimed at collecting data about the promotional activity sponsored by pharmaceutical companies.

"CAMM Pacific received information via HCN who in turn received it from doctors via the Medical Director software that many of them were using.

"It was also alleged that an extraction tool that removed information from the Medical Director software was faulty because it extracted the patient information of all doctors working in group practices, even those who had not elected to participate in the extraction exercise.

"Following my Office's investigation I have found that the patient information transferred from doctors to CAMM Pacific, via HCN's Medical Director software, is de-identified and therefore does not fall within the definition of personal information outlined in the Privacy Act.

"However, participating doctors are identified by CAMM and HCN on a consent based arrangement. I am satisfied that if a medical practice accidentally transfers the de-identified patient records of a non-consenting doctor that HCN cannot identify that doctor and does not use that de-identified patient information.

"I have therefore concluded my investigations into CAMM Pacific and Health Communications Network Limited (HCN) and have found that that they have not breached the Privacy Act.

"I'd like to acknowledge the co-operation my Office received from both CAMM Pacific and HCN during our investigations. Both organisations appear to take privacy seriously and are to be commended for this.

"By law, health information is accorded a high level of privacy protection and if people have concerns that this may not be occurring they should contact my Office," said Ms Curtis.

Background:

Privacy Act definition of personal information

The National Privacy Principles (NPPs), in the Privacy Act, regulate the collection, use, disclosure and security of personal information held by many private sector organisations.

Personal information is information or an opinion (including information or an opinion forming part of a database) whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion (section 6).