Amendment to the Medicare and Pharmaceutical Benefits - Programs Privacy Guidelines 1994

Overview

The National Health Act 1953 was amended in 1994 to introduce the Medicare and Pharmaceutical Benefits Programs: Privacy Guidelines 1994, which aim to address the need for privacy safeguards in the handling of personal health information within the Medicare and Pharmaceutical Benefits Programs. The Guidelines were enacted by the Commonwealth of Australia Parliament to ensure that personal health information is managed in a manner that respects the privacy of individuals while allowing for necessary actions such as investigations, prosecutions, and debt recovery. These guidelines were intended to provide a framework for the lawful disclosure and use of health information, balancing the need for privacy with the legitimate requirements of the programs. The Privacy Commissioner issued these amendments to further refine the privacy protocols, ensuring that any old claims information accessed is strictly controlled and deleted after a short period to minimise privacy risks.

Scope and Application

The Medicare and Pharmaceutical Benefits Programs: Privacy Guidelines 1994 apply to the Australian Privacy Commission and the Department of Health, primarily focusing on the handling of personal health information within the Medicare and Pharmaceutical Benefits Programs. These guidelines govern the circumstances under which old claims information can be accessed by the Privacy Commission, ensuring that such information is only obtained for specific purposes such as resolving compensation matters, conducting investigations or prosecutions, recovering debts, determining late lodged claims, and responding to lawful requests from individuals or their authorised representatives. The guidelines also mandate the deletion of such information from databases within three months of its use and require the Privacy Commission to implement special security measures for records obtained under these provisions. Furthermore, they clarify the conditions under which the Department must ensure that de-identified claims information cannot be re-identified when disclosed, and require the Department to maintain a central record of information provided to the Privacy Commission under these guidelines. The geographic reach of these guidelines is national, as they pertain to the Commonwealth level under the National Health Act 1953, and they do not specify any exclusions or exemptions beyond the stipulated purposes for accessing old claims information.

Key Provisions

The legislative instrument amends the Medicare and Pharmaceutical Benefits Programs: Privacy Guidelines 1994, originally published under section 135AA(4) of the National Health Act 1953. The amendments introduce new provisions for obtaining old claims information (Guideline 4) and modifying existing guidelines related to the disclosure of de-identified claims information (Guideline 5.4) and record-keeping (Guideline 6.7). These changes are intended to refine the processes under which such information is accessed and used, ensuring that privacy protections are upheld while facilitating legitimate inquiries and actions by the Commission. The new Guideline 4 stipulates that the Commission may obtain old claims information from the Department upon providing the relevant personal identification number or provider number. This information can be used for various purposes, such as taking action on unresolved compensation matters, investigations, prosecutions, debt recovery, determining entitlement on late lodged claims, and fulfilling requests from individuals or their representatives. Additionally, the Commission may use the information to lawfully disclose it in accordance with relevant secrecy provisions and these guidelines. It is crucial that any records obtained under this guideline are deleted as soon as practicable after the relevant action is completed, with a maximum retention period of three months. Furthermore, the Commission must ensure the security of these records by implementing special arrangements, which are to be detailed in a Technical Standards Report, and maintain a note of the action taken. Under the amended Guideline 5.4, when the Department discloses claims information in a de-identified form, it must be reasonably satisfied that the recipient cannot re-identify the information. This ensures that even when data is shared for purposes such as research or analysis, the privacy of individuals is protected. Guideline 6.7 adds a new requirement for the Department to maintain a central record whenever it provides claims information identified by a personal identification number to the Commission under Guideline 4. This record-keeping obligation supports transparency and accountability in the handling of sensitive information. The legislative instrument also imposes specific obligations on the parties it governs. The Commission must ensure that any old claims information obtained is used solely for the purposes outlined in Guideline 4 and is securely managed. The Department, on the other hand, must ensure that any disclosure of de-identified claims information is done in a manner that prevents re-identification, and maintain detailed records of any information provided to the Commission. Failure to comply with these guidelines could result in breaches of privacy and potentially legal consequences. The penalties for such breaches are not explicitly stated in the legislative instrument, but under the National Health Act 1953, significant non-compliance could lead to civil or criminal penalties, including fines and imprisonment, depending on the severity of the breach.