Today’s question is:

…  about a relatively new program that Queensland Ambulance Service (QAS) rolled out to their paramedics. The program itself is actually a Queensland Health program that has existed for a while, but QAS paramedics have just been granted access to it recently – The Viewer.

My questions are, should The Viewer be used by paramedics to follow-up on patients for educational purposes? Does this require patient consent? And if follow-up is allowed without patient consent, to what extent can The Viewer be used? Below is some background information on The Viewer and extracts from QAS training modules on The Viewer.

The Viewer is a Queensland Health application that collates all of a patient’s information in one place, so that staff can easily see a patient’s history and personal information. This includes information such as pathology results, mental health data, discharge summaries, operation notes, medical images, care plans, etc.

Through emails to staff and education material, the QAS have stated that this program is available for paramedics to use when providing direct patient care and for patient follow-up. Below is an extract from the QAS education module for The Viewer, describing the ‘authorised’ uses.

 When Can I Use The Viewer

  • Providing direct patient care
    • Providing clinical care to patients
    • Reviewing care plans to plan patient disposition
    • Reviewing discharge summaries to understand recent admissions
    • Advanced Care Planning (AHD, ARP, Statement of Choices)
  • Patient Follow-up
    • Clinicians may use The Viewer to undertake patient follow up on patients who they provided direct patient care for.
    • This must only occur during rostered shifts. Officers must not be accessing The Viewer after hours and from their private residence.
    • Follow up should occur within a reasonable time frame and with limited use.
    • For example, within 4-6 weeks after the incident occurring and on limited occasions. That is, reviewing a patient’s information daily could be considered in appropriate[sic].

When Can’t I Use The Viewer

  • Looking up yourself, family, friends, etc
  • People you have not treated
  • Because of curiosity
  • Do not use on days off
  • Post exposure (e.g. needle stick injury)

I believe The Viewer is a great tool for paramedics when trying to ascertain a medical history from a patient, as a lot of patients are not medically literate. Without comprehensive discharge summaries and health records, the medical history given to a paramedic can be quite lacking. It is also very useful to understand patients who have complex medical needs, and any care plans they may have in place. I can see when a paramedic is ‘providing direct patient care’ that the use of The Viewer would be acceptable as it is covered under IPP 9 – Use of personal information only for relevant purpose in the Information Privacy Act 2009 (Qld).

I am concerned though that the use of The Viewer for ‘patient follow-up’ might contravene the disclosure of private information laid out in the Information Privacy Act 2009 (Qld).

A few years ago, I read your blog post titled ‘Giving feedback to paramedics’ (1 April 2017), and when this new authorised use of The Viewer was announced I was curious as to how it related to the privacy laws. I understand that your post was referring the Privacy Act 1988 (Cth), and that the response from the Office of the Australian Information Commissioner also only referred to the Commonwealth Act. However, I have not been able to find a clause in the Information Privacy Act 2009 (Qld) that seems to differ enough from the Privacy Act 1988 (Cth) to allow such a disclosure of personal information. The Information Privacy Act 2009 (Qld) does state in IPP 11 – Limits on disclosure that the agency controlling an individual’s information may disclose it to an entity if “…(b)the individual has expressly or impliedly agreed to the disclosure”. It appears patient consent would allow for this disclosure, but QAS have not stated in any of their training that patient consent is required. In fact, all the material seems to imply that patient consent is not required. Below are some quotes from training videos made by QAS personnel.

“…one of the things that really excites me about The Viewer is the ability to follow-up our patients, and I think that’s vital for us to develop our clinical acumen and diagnostic accuracy.”

“…couple of weeks down the track you can go online, look your patient up, have a look for a discharge summary [to find out the discharge diagnosis]. [Which would be] enormously beneficial for you in making your future decisions about patient care.”

I would also like to note the section in the QAS training which states The Viewer cannot be used ‘because of curiosity’. If access to The Viewer for ‘patient follow-up’ is allowed without patient consent, what type of access would be allowed before it crossed over into ‘curiosity’.

My short answer is that the Viewer could not lawfully be used for ‘follow up’ if that means going online to ‘look for a discharge summary [to find out the discharge diagnosis]’.  I think that is clear from the Terms and Conditions of the Viewer and the provisions of privacy law.

The Terms and Conditions

There is much public information about the Viewer – see https://www.health.qld.gov.au/clinical-practice/innovation/digital-health-initiatives/queensland/the-viewer.  An online brochure says users

… must accept the Terms and Conditions when registering for the HPP. Queensland Health will conduct audits to ensure appropriate use of the information is being adhered to.

Penalties apply for inappropriate access and use of the HPP including possible deregistration.

A website containing patient resources, under the heading Privacy and Security says:

Eligible health practitioners may only access records within the Health Provider Portal (HPP) for the purpose of providing care or treatment to a patient.

Appropriate use of the information is defined by the Hospital and Health Boards Act 2011 and Privacy Act 2009.

Penalties apply to health practitioners for inappropriate access and use of information, including possible deregistration.

These Terms and Conditions must be accepted when registering for access to the HPP.

Similar information is contained in the resources for practitioners.

The terms and conditions are available online. They say that the purpose of the portal is to ‘… facilitate the care or treatment of an individual by a Prescribed Health Practitioner acting in that capacity and in accordance with section 161C(2)(a) of the Act’. ‘The Act is the Hospital and Health Boards Act 2011 (Qld).

Clause 2.1(b) says:

You may access and use the Application, to view, use and display the Content for your professional use when necessary in accordance with the Purpose. You must not access or use the Application for any other purpose.

Inserting the relevant definitions to expand that clause it reads:

You may access and use the Application, to view, use and display the Content for your professional use when necessary, in accordance with the care or treatment of an individual by a Prescribed Health Practitioner acting in that capacity and in accordance with section 161C(2)(a) of the Hospital and Health Boards Act 2011 (Qld). You must not access or use the Application for any other purpose.

Section 161C(2) says:

A prescribed health professional must not access information contained in a prescribed information system unless—

(a)        the information is necessary for the prescribed health professional to facilitate the care or treatment of an individual; or

If you have no further care of a patient, that is you have treated them and are no longer involved in their care, then following up to see if your diagnosis or treatment was correct may be useful and perhaps of benefit to some future patient, but you are not providing ‘care or treatment’ to that individual. Accessing the information is not necessary to ‘facilitate the care or treatment of an individual’ as you are no longer involved in the care or treatment of that individual.

Privacy

In my earlier post Giving feedback to paramedics (1 April 2017) I quoted from an email I received from the Australian Information Commissioner who said ‘The Australian Privacy Principles (the APPs) contained in the Privacy Act 1988 (Cth) (the Act) … do not apply to State or Territory public health bodies.’  In Queensland the relevant law is the Information Privacy Act 2009 (Qld).  Information Privacy Principle 10 says:

An agency having control of a document containing personal information that was obtained for a particular purpose must not use the information for another purpose unless—

(a) the individual the subject of the personal information has expressly or impliedly agreed to the use of the information for the other purpose;

A patient gives information to their health care practitioner so that practitioner can provide appropriate care. It is part of that purpose that paramedics pass that information onto the triage nurse and treating practitioners to provide continuity of care. But the information that the patient provides, and the opinions that are recorded by the treating team (eg diagnosis) and information about ongoing care are provided so that those providing care can do so. Those that were involved in the patient’s care but who are no longer caring for the patient have no need to access that information. If they do for their own purposes eg ‘to develop our clinical acumen and diagnostic accuracy” then that is another purpose and needs the patient’s consent.

In that earlier post I said that ‘one could argue that closing that information loop was directly related to the primary purpose of their health care’ but I on re-reading that post I am even less persuaded by that argument. But even if that were true with respect to the privacy principles it is not true with respect to the Hospital and Health Boards Act 2011 (Qld) s 1612(C)(a). 

Follow up might be relevant if a GP or a community paramedic wanted to know if the patient had gone for their specialist appointment or had their tests so they can see if they need to remind the patient, or see if there is some reason that they have not done so or to see if the results will impact on the future care plan. Accessing the information by a paramedic with no expectation that they will treat the patient again, is in no way accessing the information ‘to facilitate the care or treatment of an individual’

QAS policy

Interestingly the QAS on its webpage ‘Patient information’ says:

Request from a medical practitioner on behalf of a patient

Only a medical practitioner treating the patient may request the patient’s eARF.

The medical practitioner must provide:

  • evidence of medical practitioner’s identity and qualification
  • signed and current authority from the patient.

Presumably there are times when an ambulance crew treat a patient who was being attended to by a good Samaritan doctor who stepped up before the ambulance got there.  QAS would not provide access to the record by the doctor who said ‘I just wanted to know how that person got on’ without the patient’s express consent. Presumably that doctor could now look up the patient’s record on The Viewer but it would be equally inappropriate to do so.

Conclusion

I fail to see how QAS or anyone could read the terms and conditions and/or the Act and argue that reviewing a patient that you have treated is permitted. There is nothing in the are terms of access or the Hospital and Health Boards Act 2011 (Qld) s 1612(C)(a) that support the statements that:

Clinicians may use The Viewer to undertake patient follow up on patients who they provided direct patient care for.

This must only occur during rostered shifts. Officers must not be accessing The Viewer after hours and from their private residence.

Follow up should occur within a reasonable time frame and with limited use.

For example, within 4-6 weeks after the incident occurring and on limited occasions. That is, reviewing a patient’s information daily could be considered in appropriate[sic].

In the circumstances described the information is being accessed because the paramedic is ‘curious’ as to what happened and whether their diagnosis and treatment was accurate. They are not seeking access to care for an individual. It may be useful information to allow paramedics ‘to develop our clinical acumen and diagnostic accuracy’; it may be ‘enormously beneficial for you in making your future decisions about patient care’ but it is not about care of the patient whose information is being accessed or any identified ‘individual’. Access would be for a secondary and impermissible purpose.

Presumably QAS have had some legal advice to which I am not privy, but based on what I have been told is the information provide by QAS, the QAS position is wrong.

For related posts see:

This blog is made possible with generous financial support from the Australasian College of Paramedicine, the Australian Paramedics Association (NSW), Natural Hazards Research Australia, NSW Rural Fire Service Association and the NSW SES Volunteers Association. I am responsible for the content in this post including any errors or omissions. Any opinions expressed are mine, and do not necessarily reflect the opinion or understanding of the donors.