29 May, 2016
Unlike other non-health businesses in Australia, mandatory data breach notification is already a reality for Australian health organisations participating in the My Health Records system. New eligibility requirements for the Practice Incentive Program (PIP) eHealth Incentive mean that organisations wanting to gain the benefit of the incentive must participate and upload a prescribed number of shared health summaries to the My Health Records system.
It appears therefore that the government is intent on rolling out the digital health record system despite lacklustre take up by patients and health organisations alike.
And so, organisations making the transition to digital health records need to understand their legal and regulatory obligations in handling both My Health Records and more broadly, personal information. The regulatory framework surrounding personal information and digital health records is complex and involves overlapping legislative schemes.
We've broken some of the key obligations down, and set out below a snapshot of what Australian health organisations need to consider below.
Have an up to date privacy policy: Your privacy policy should clearly disclose how the personal information you collect, access and use in your health organisation is managed in accordance with the requirements of the digital health regime and the broader privacy regime. It should also provide guidance on how your organisation manages complaints and unauthorised disclosure. Are you handling Medicare numbers or My Health Records? If so, additional obligations apply.
Remember that a policy is only as good as the procedures behind it – make sure you have detailed procedures so you can effectively manage all the information you are handling.
Achieve technical compliance: Managing sensitive health information such as Medicare numbers or My Health Records requires an added layer of security. If you participate in the digital health system, your organisation must adhere to prescribed guidelines concerning how patient records are accessed, transmitted, stored and used – know these guidelines and make sure you're compliant. This will impact the management of your internal stakeholders, third party service providers and also your patients and customers. Remember that good compliance should include ongoing training and education for your staff as to privacy and the management of information. Know the resources available to assist you – for example, the National E-Health Transition Authority (NEHTA) provides resources to assist your organisation with the transition to digital health.
Have a breach response plan: Mandatory breach reporting is already in place for those participating in the digital health system. A breach response plan plays an important role in the effective management of that information. For those not yet participating in the My Health Records system, it's still essential to have in place an effective breach response plan that responds to breaches of personal information. Your response plan will guide you through the most critical stage of the breach and will determine how your organisation contains, reports and notifies an incident. Make sure your plan is detailed and tested regularly. An effective plan will mitigate the harm caused by a data breach, including reputational damage, resulting customer claims, legal proceedings, and regulatory investigations. The OAIC provides health organisations with a guide to mandatory data breach notification. The published guide is based on the Personally Controlled Electronic Health Record (PCEHR) system, the predecessor to the My Health Records system, however, the guide continues to provide useful guidance.
Clyde & Co advises on the key legal, regulatory and commercial issues that face the healthcare sector around the globe. Our multidisciplinary global healthcare group draws upon expertise across the firm and comprises lawyers who specialise in litigation, projects and construction, real estate, corporate, insurance, intellectual property, commercial, IT, regulatory and employment.
We also advise clients on a broad range of privacy related matters, including in assisting businesses address their legal and regulatory obligations as well as in preparing for and responding to data breaches. We offer fixed price privacy packages to provide certaintly and to help you effectively manage your legal costs.
We are proud to be a privacy partner of the Office of the Australian Information Commissioner's (OAIC) Privacy Awareness Week, which is being held from Sunday 15 May to Saturday 21 May. The week promotes awareness and discussion with business, government agencies and the broader community on how to protect and respect the privacy rights of Australian citizens. We will be sharing a series of updates on privacy throughout the week.
For further information, please contact:
Dean Carrigan, Partner, Clyde & Co
dean.carrigan@clydeco.com
