The Australian Government’s Office of the Australian Information Commissioner has released a new Guide to Health Privacy (September 2019). The Guide is:
… written to help health service providers comply with their existing obligations under the Privacy Act 1988 (Privacy Act). It should be read in conjunction with the Privacy Act and the Australian Privacy Principles (APP) Guidelines.
Paramedics are not specifically mentioned in the guide (see in particular p. 1 and p. 3 examples of health service providers are listed). Even so a health service is (p. 3):
… an activity performed in relation to an individual that is intended or claimed (expressly or otherwise) by the individual or person performing it:
- to assess, maintain or improve the individual’s health
- where the individual’s health cannot be maintained or improved — to manage the individual’s health
- to diagnose the individual’s illness, disability or injury
- to treat the individual’s illness, disability or injury or suspected illness, disability or injury
- to record the individual’s health for the purpose of assessing, maintaining, improving or managing the individual’s health
There can be no question that paramedics who conduct a patient assessment, diagnose and treat their illness or injury and keep patient care records are providing a relevant health service.
Health information (p. 4) means:
- information or an opinion about:
- the health, including an illness, disability or injury, (at any time) of an individual
- an individual’s expressed wishes about the future provision of health services to him or her
- a health service provided, or to be provided, to an individual
that is also personal information
- other personal information collected to provide, or in providing a health service to an individual. This includes personal details such as a patient’s name, address, admission and discharge dates, billing information and Medicare number…
Examples of health information include:
- information about an individual’s physical or mental health
- notes of an individual’s symptoms or diagnosis and the treatment given…
Again there can be no question that information recorded on a paramedics patient care record is health information.
The Guide deals with embedding privacy into health practice, collecting, using, disclosing, giving access to and correcting health information. Relevantly to readers of this blog is what the guide says about sharing health information.
The guide reminds practitioners (at Chapter 3, p. 2) that they can disclose information:
… about a patient:
- for the primary purpose for which you collected it, or
- for a secondary purpose in certain circumstances…
The primary purpose is the specific main activity for which you collected the information.
Any other purpose is a ‘secondary purpose’. Information can be disclosed for a secondary purpose where:
- the patient would reasonably expect you to use or disclose the information for that purpose,
- the purpose is directly related to the primary purpose of collection.
The guide gives the following examples:
Example: Referral to a specialist
When a GP refers a patient to a specialist, most patients would expect the GP to disclose personal health information in the referral letter, and would expect the specialist to disclose information arising from the consultation back to the GP.
This general expectation reflects this common information handling practice in the health system. In addition, GPs and specialists usually advise their patient that they will contact the other practitioner in connection with the referral, and these discussions further inform a patient’s reasonable expectation of when you will disclose the health information.
Example: Treating team
A multi-disciplinary team approach to health care is common and usually involves sharing a patient’s health information within a ‘treating team’. It is important that the patient understands when and what information will be shared within a treating team, and who is part of the team. Once you have discussed this with your patient, there will be a reasonable expectation that health information will be disclosed within the treating team (provided the patient has not expressed concerns), and team members will not need to get the patient’s consent to uses and disclosures. If the patient has expressed concern about disclosures to certain team members, then you are likely to need consent to share information with that practitioner.
I suggest that it would be consistent with those examples to consider that a person would expect a paramedic to share health information with the treating team at a hospital. In that case the practice of paramedics giving a handover to hospital triage nurse or ED doctor and handing over a copy of the patient care record would not be a breach of privacy.
The concept of the treating team however may be complicated. First as discussed in my earlier post Giving feedback to paramedics (April 1, 2017) a paramedic who has treated a patient but who is no longer involved in their care is not, I would argue, any longer part of the treating team. Accordingly giving feedback to paramedics about how a patient was treated, their diagnosis, prognosis and outcomes after they have left the paramedic’s care is not sharing information with the treating team that is relevant to advancing the patient’s care.
Second, as discussed in my post Paramedics reading letters addressed to other treating health professionals (January 17, 2019) if a doctor has put a letter in a sealed envelope addressed to another practitioner the prima facie inference must be that the information is only intended for that other practitioner. Neither the doctor, and more importantly the patient, might expect that information to be shared. Before one opens the letter one cannot know what is in it and whether it is in fact relevant to paramedic practice. By putting the letter in a sealed, addressed envelope, the author is by implication indicating that in his or her view the paramedic who may be called to transport the patient is not part of the treating team.
Finally, I still fail to see how ambulance services, or paramedics, can justify installing cameras to record health information for subsequent broadcast – How are reality ambulance shows legal? (Updated) (October 9, 2018). There can be no legitimate patient care interest in sharing information with a television producer, or TV audience. Whatever value there is in these programs, it is not directly related to the primary purpose (the provision of paramedic care to the patient) for which the information was obtained.
And in response to the potential argument that such material is not used without consent, it is not the use that is the problem. If the information is shared with the television crew, eg there is a discussion with the producer to determine what they may want to use, or a camera operator who discusses the case with the paramedics after the case, then the breach of privacy has occurred even if the footage never makes it onto TV.