Privacy law is constantly evolving, and it is crucial for all staff working in a medical practice to understand their legal obligations to ensure personal and sensitive information is appropriately collected, used, and stored, to protect their practice from reputational damage and costly penalties.

In this article, we cover privacy requirements, breach protocols, and safe data collection and storage to help you navigate this complex area.

What information is regulated?

In Australia, any data that is “personal information” falls within the scope of Australia’s privacy law framework. Personal information is defined as ‘information or an opinion about an identified individual, or an individual who is reasonably identifiable.’ This can include a person’s:

1. name;
2. phone numbers;
3. drivers licence details;
4. health information; and
5. religious beliefs.

Sensitive information, which includes medical information, is subject to more strict requirements than other personal information and greater care should be taken with this information.

The Privacy Act 1988 (Cth) sets out requirements surrounding personal information and sensitive information. All medical businesses must be compliant with this law.

What is a Privacy Policy?

Currently all medical businesses, and entities classified as an Australia Privacy Principle Entity (APP Entities) are required by law to have a privacy policy. This policy must be freely available, most commonly on a website, and must be tailored to reflect the operations and practices of the business.

A privacy policy informs third parties of:

1. what personal information you collect;
2. how that information is held;
3. what you use that information for;
4. whether you will disclose personal information to any overseas recipients; and
5. other required matters.

Collection and Storage of personal information

The Privacy Act 1988 (Cth) includes a number of requirements around the collection and storage of personal and sensitive information. Unless an exemption applies, APP Entities should only collect personal and sensitive information with consent and only if collection of that information is reasonably necessary for or directly related to its functions or activities.

AAP Entities must take reasonable steps to ensure the personal information (including sensitive information) they hold is protected from misuse, interference, loss, unauthorised access, modification, and disclosure. Good data hygiene and regularly updated policies and procedures around collecting and storing personal information are necessary to ensure compliance.

An APP Entity is required to destroy or de-identify information when it holds personal information about an individual, and

1. the business no longer needs the information for any purpose for which the information may be used or disclosed by the business under the Privacy Act;
2. the information is not contained in a Commonwealth record; and
3. the business is not required by or under an Australian law, or a court/tribunal order, to retain the information.

What do you do if there is a data breach?

APP Entities must notify the Office of the Australian Information Commissioner (OAIC) if they have reasonable grounds to suspect that an Eligible Data Breach has taken place. An Eligible Data Breach is where there is unauthorised access to, disclosure of, or loss of, personal information held by an APP Entity and such access, disclosure, or loss is likely to result in serious harm to individuals the information relates to.

Between July 2023 and December 2023 more than 20% of data breach notifications were made by Health Service Providers, more than double every other sector (Australian Government, 2024). It is vital for health and medical practices to have a carefully considered procedure in place for dealing with a data breach before it happens.

A report to the OAIC does not need to be made if the entity takes action which reasonably prevents the serious harm. This can include reaching out to any persons affected and informing them of the scope of the breach and what actions they should take to protect themselves. However, a decision not to report a data breach on this basis must be made carefully.

In the event of a data breach, the business must as soon as practicable provide a statement to the Privacy Commissioner sharing:

1. the identity and contact details of the business;
2. a description of the eligible data breach that the business has reasonable grounds to believe has happened;
3. the particular information concerned;
4. recommendations about the steps that individuals should take in response to the eligible data breach that the business has reasonable grounds to believe has happened; and
5. any other required information.

(Data Breach Statement)

Businesses need to take reasonable steps to provide the information in the Data Breach Statement as soon as practicable after it is prepared:

1. to either all individuals whose personal information was the subject of the data breach;
2. to either all individuals who are at risk from the eligible data breach; or
3. if neither option above is practicable, by publishing a copy of the Statement on its website and taking reasonable steps to publicise the contents of the Statement.

Next Steps

Ensuring you are compliant with privacy laws is a proactive and crucial step in safeguarding your business. 

We note that the Australian Government has recently introduced privacy reforms, to be implemented in tranches, focusing on enhancing the protection of personal information and establishing new privacy related offences. It is important that these be considered in addition to the current privacy compliance obligations.

We encourage you to seek professional legal advice around your practice’s needs with regard to privacy.

Hillhouse Legal Partners has extensive industry knowledge and expertise in the medical sector working with clients on these issues. To discuss your practice’s privacy requirements, please contact Craig Hong, Hillhouse Legal Partners, Director on (07) 3220 1144 or email craig@hillhouse.com.au.

References

Australian Government. (2024, February 22). Notifiable data breaches report July to December 2023. Retrieved from Australian Government Office of the Australian Information Commissioner