27 July 2007

The Privacy Commissioner, Karen Curtis, has found that private health insurance company HCF did not breach the Privacy Act when it disclosed the personal and sensitive information of its clients to McKesson Asia Pacific ("McKesson") as part of its 'Helping Hands' program.

"My Office views any suggestion of privacy breaches by organisations with the utmost seriousness," Ms Curtis said.

"It is for this reason that when allegations surfaced in the media earlier this year about HCF having breached client confidentiality, my Office launched an investigation into this matter."

It had been alleged in media reports that HCF had given McKesson the contact details, gender, age, the broad type of mental illness, and the number of hospital admissions for 370 of its members without their consent.

"Following a detailed investigation, my Office is satisfied that HCF met the requirements of the Privacy Act and that McKesson took steps to collect personal information in accordance with its contractual obligations to HCF," Ms Curtis said.

Our investigation established that HCF wrote to members inviting them to participate in the 'Helping Hands' program based on their claims history. The letters described the program's purpose and background, setting out McKesson's role in administering the program and the contact process. Participation in the 'Helping Hands' program was entirely voluntary and involved telephone-based case management and support.

Ms Curtis noted that HCF had notified members via its Annual Report and Fit and Well magazine of its intention to encourage healthy lifestyle choices and introduce health pilot programs for the benefit of members, including for illnesses such as depression and mental illness. In addition, the HCF Privacy Policy advises members that it may use the personal information it collects to provide further health services where the member has consented or would reasonably expect HCF to do so.