Mr David Roberts Chair Australian Health Ministers’ Advisory Council PO Box 344 RUNDLE MALL SA 5000 Attn: Practitioner Regulation Subcommittee

Enquiries: Siobhan Jenner Tel: (02) 8688 8576 Our ref:08/0495 Your ref:

Dear Mr Roberts

Re: Consultation Paper: National Registration and Accreditation Scheme for Health Professionals: Proposed Arrangements for information sharing and privacy

Thank you for the opportunity to provide a submission on the Consultation Paper. As you will be aware, in NSW there are two privacy laws which govern information about health care professionals, the Privacy and Personal Information Protection Act 1998 (PPIP Act) and the Health Records Information Privacy Act 2002 (HRIP Act). As you will also know, privacy legislation in NSW, Victoria and the Commonwealth has been subject to review by respective law reform bodies in those jurisdictions.

Privacy NSW’s responses to the Australian Law Reform Commission’s Discussion Paper 72, Review of Australian Privacy Law (DP 72) website.http://www.lawlink.nsw.gov.au/lawlink/privacynsw/ll_pnsw.nsf/pages/PNSW_publications#15 and to the New South Wales Law Reform Commission’s Consultation Paper 3, Privacy Legislation in New South Wales have supported the proposed development of Uniform Privacy Principles (UPPs) for the protection of personal and health information by private and public sector bodies throughout Australia. If accepted by government, this would mean that personal and health information held by NSW public sector agencies would be subject to UPPs in the PPIP Act, and personal and health information held by private sector organisations would be subject to the UPPs in the Privacy Act 1988 (Cth) (Privacy Act) and applicable health regulations. In our view, these measures would go a long way toward achieving consistency in dealings with personal and health information by the public and private sector and would have particular importance in the development of national schemes involving exchanges of personal or health information. However, we are mindful of the fact that such measures may be not be implemented for some time and that in the given case there are strong public policy reasons for the timely development of a National Registration and Accreditation Scheme for Health Professionals (the scheme), pending possible changes to the national privacy landscape.


5 Governance and the Privacy regime

In my view, any scheme which involves exchanges of personal or health information by government agencies, should be underpinned by a robust governance structure, comprised by legislation together with business rules which clearly identify complaint mechanisms relating to information exchanges. We are therefore pleased to note that this has been identified in the Consultation Paper as one of the principles upon which the scheme is contingent and which will be reflected in the proposed national legislative framework.

While we note that there is a separate section at Section 5 in relation to privacy protection which discusses the appropriate privacy model for the scheme, We suggest that legislation which regulates dealings with personal or health information should incorporate privacy protections into the provisions, so that privacy protection is ‘built in’ not ‘bolted on’. I suggest that if the proposed legislation mirrors the information flows described in the Consultation Paper there would therefore little need for a separate section referring to the National Privacy Principles or any other set of privacy principles. This would be contingent upon the inclusion of provisions with respect to security and first party access and amendment rights. Such a model would avoid legal questions about the intersection the proposed national law with State or territory privacy statutory regimes. In addition, clearly prescribed information exchanges in the national law would be less likely to be affected by proposed changes to the Privacy Act referred to above.


3.8 & 7.2 Workforce planning and research

The Consultation Paper suggests that if personal or health information is ‘de-identified’ it will not constitute personal information and may therefore be disclosed to for research and statistical purposes, such as workforce planning. We suggest that the Committee exercise caution in this regard as it is possible that practitioners may be ‘re-identified’ by the publication of such data, particularly in circumstances where a practitioner lives or practises in a small community, if they have a distinctive area of specialisation or some other characteristic which would render their identity obvious to some third parties. We therefore suggest that practitioners be made aware that their information may be made available for research or workforce planning so that they may be able to voice their concerns about possible re-identification and so that steps may be taken, such as grouping easily identifiable practitioner information with larger groups to limit the possibility of re-identification.


4 Publicly available information

We acknowledge that the national scheme will require a balancing of interests between the protection of the general public and expectations on the part of practitioners that certain information will not be made publicly available. I suggest that the national legislation clearly enunciates a hierarchy of access rights necessary to achieve that balance.

As you are aware, personal information held by health registration boards on public registers in New South Wales is subject to the public register provisions in Part 6 of the Privacy & Personal Information Protection Act 1998 (NSW). These provisions limit the disclosure of personal information from public registers to the general public (section 57) and allow for the suppression of personal information in certain circumstances (section 58). The public register provisions prevail to the extent of any inconsistency in the law under which a public register is established (section 59). In our view, the proposed national legislation should specifically address any intention to override or derogate from the public register provisions and in Part 6 of the PPIP Act.


7.1 Criminal record checking

As you may be aware the spent convictions provisions in the Criminal Records Act 1991 (NSW) provide that certain convictions need not be declared by the an individual, subject to certain exemptions. We suggest that only information which is not deemed spent under the applicable law States or territories legislation should be collected unless there is a compelling reason to do otherwise.


7.9 Law enforcement agencies

While we support proposal relating to the exchange of information for law enforcement purposes in circumstances where there is an alleged breach of the national scheme legislation and or matters relating to the enforcement of a law we contend that the national legislation should include limitations similar to those which appear in section 23 of the PPIP Act:

(5) A public sector agency (whether or not a law enforcement agency) is not required to comply with section 18 if the disclosure of the information concerned:

(a) is made in connection with proceedings for an offence or for law enforcement purposes (including the exercising of functions under or in connection with the Confiscation of Proceeds of Crime Act 1989 or the Criminal Assets Recovery Act 1990 ), or
(b) is to a law enforcement agency (or such other person or organisation as may be prescribed by the regulations) for the purposes of ascertaining the whereabouts of an individual who has been reported to a police officer as a missing person, or
(c) is authorised or required by subpoena or by search warrant or other statutory instrument, or
(d) is reasonably necessary:

(i) for the protection of the public revenue, or
(ii) in order to investigate an offence where there are reasonable grounds to believe that an offence may have been committed.
(6) Nothing in subsection (5) requires a public sector agency to disclose personal information to another person or body if the agency is entitled to refuse to disclose the information in the absence of a subpoena, warrant or other lawful requirement.