The latest article from our hepatitis C post-cure project explores the issue of electronic health record sharing surrounding hepatitis C in light of new health information sharing laws in the state of Victoria.
These new laws introduce an electronic patient health information sharing system to enable public hospitals and other specified health services to share people’s health information, including information about hepatitis C. The system doesn’t provide people with the choice to opt out of information sharing and doesn’t require consent from people before their health information is shared. The new laws were particularly concerning for vulnerable groups who often experience stigma or discrimination in healthcare settings, such as people with hepatitis C or people who use illicit drugs.
Our article, entitled ‘Between public and private: Electronic health record, health privacy principles, and hepatitis C’ and published in the Journal of Law and Medicine, explores these concerns through the rubric of health privacy principles.
Crucially, the laws made the electronic patient health information sharing system exempt from some of Victoria’s Health Privacy Principles that protect the privacy of a person’s health information. These include the principles that an organisation should collect health information about a person directly from that person and that, if an organisation collects health information about a person from someone else (including a participating health service), the person should be made aware of their right to gain access to that information. Under the new laws, a person won’t have a right to access and correct information on the electronic patient health information sharing system. This may raise concerns for people who have been cured of hepatitis C.
The laws do mandate a ‘Privacy Management Framework’ for the electronic patient health information sharing system that will specify what categories of health information are sensitive in nature and include a process to safeguard that information, as well as a process that enables patients to obtain reports on who has accessed their health information. Our research finds, however, that ‘there is no indication of whether the legislated privacy management framework will adopt a rights-based as opposed to instrumentalist approach to privacy protection in electronic health information-sharing.’
Our research also finds that there is a lack of clear guidance from the body empowered to handle health complaints in Victoria, the Health Complaints Commission, on privacy and confidentiality surrounding health records for people with (a history of) hepatitis C, despite having the legislative power to issue guidelines in this respect. In particular, the Commission has not issued guidelines on the other Health Privacy Principles that do apply to the electronic patient health information sharing system, such as those around use and disclosure of health information. This may increase the risk of privacy breaches and may disempower potential complaints who are not aware of their health privacy rights and what to do if their rights are breached. Our research therefore recommends that the Health Complaints Commission ‘issue guidelines that apply to electronic health information – and to health information more generally – so that privacy is protected when it comes to the use and disclosure of people’s health information.’
Finally, it is important that people can access their own health records, but many Victorians currently have to resort to freedom of information requests to access their own health information. Our research also recommends that the Victorian Government ‘simplify the process for individuals to access and correct their health records’, including removing the legislative barriers to accessing electronic health record information.
As we conclude:
Individual privacy needs need to be weighed against the collective interest in access to health information and […] the interests of eliminating hepatitis C cannot assume prevalence over individuals’ interests in the privacy of their health information; the two interests need to be balanced.