Sophie: Practices can disclose health information for the purposes of providing health care to a patient. It's really quite simple the test is ‘are you actually doing something to provide a health service to that patient?’
A secondary purpose is anything other than the primary purpose, which is a typical lawyers answer, but the primary purpose being the provision of healthcare. So for any use other than the provision of healthcare… so a first example might be if you want to use some health information which could be as simple as a patient's email address to send them marketing information, for example, information about diabetes checks for 40 to 45 year old checks or prostate checks things like that - That's a secondary purpose. So it's not providing health care, but it's sort of related to it. So that's a really good distinction of when a practice can disclose health information and when they must disclose health information. And I think there's probably some confusion out there as to the provisions about when a practice can, or health provider can, disclose information for a secondary purpose. The assumption by some general practitioners is that they must disclose information in those circumstances but it's not a ‘must’, it's a ‘can’, it's a ‘may disclose’.
There's very few circumstances in which a practice or health care provider must disclose health information, and that's really with the court order or with the patient's direction, then you have to follow that directive. If there's a court order or a subpoena, and they’re two slightly separate things, then you must comply with that because that's an order of the court. But otherwise, it's not mandatory, it's permission that you can disclose in certain circumstances.
Another question that we get is whether you have to include information from My Health Record if you get an order from the court, or if you get a subpoena. If you are issued with a subpoena, you don't have to provide copies of information that's in My Health Record, the subpoena is usually for the patients’ health record and that can just be, for a general practitioner, the record they hold for that patient. It doesn't include any material that's in My Health Record. And the primary reason for that is My Health Record, as we know, is a summary of what should ordinarily be in a patient's record. If on the other hand you are issued with a court order, which is a court order made under the My Health Record’s legislation for provision of information in the My Health Record, then you would need to provide that information.
Can practices disclose information to third parties? That really depends on what information we’re talking about. So if we're talking about general health information, or if we’re talking specifically about information in My Health Record, My Health Record is actually more restrictive than the rules and legislation that applies to provision or disclosure of information generally in Victoria, New South Wales, the ACT - any of the states and territories. So broadly speaking, just looking at the general provisions in relation to health information and not My Health Record, a practice may disclose – they’re permitted to disclose - information to third parties in certain circumstances. So one example is if there's a serious threat to an individual's health or safety, a serious threat to the public health or safety, for a law enforcement function, again, that could be to provide information… I use example of if there's a siege and someone's been taken hostage, potentially providing information that might identify that person.
If you're a medical practitioner and you're facing a complaint or disciplinary proceedings, you can use it, it says in the legislation, really for the purposes of your professional indemnity insurance. What that means is you can use that health information to respond to a claim has been made against you. If a patient makes a complaint, clearly you need to access their record to be able to respond to the complaint. My Health Record is a little bit stricter, so you can for example, disclose information in My Health Record if there's a serious threat to an individual, but you need to notify the [Australian] Digital Health Agency of that and you need to use and disclose that information within five days of making that notification. That's quite different to the provisions under the general legislation. You can disclose information in My Health Record if there's a threat to the public without notifying the Digital Health Agency and without that time that time frame of five days. You can disclose information again or use information for the purpose of responding to a complaint against you, so again, for the purpose of your professional indemnity insurance. But you can't - and this is quite a significant difference - you can't disclose information to a law enforcement agency or a government agency without a court order. So any information in My Health Record cannot be disclosed to a third party without a court order.