MEDICARE AND PHARMACEUTICAL BENEFITS PROGRAMS PRIVACY
GUIDELINES
(AMENDMENT 1996 No 1)
EXPLANATORY STATEMENT
1. Attached are amendments issued by the Privacy Commissioner which amend the Medicare and Pharmaceutical Benefits Programs Privacy Guidelines 1994.
2. The Medicare program and the Pharmaceutical Benefits program have historically been considered and treated as separate programs. In response to concerns about one institution, the Health Insurance Commission (the HIC) holding two databases of potentially sensitive health or health related information about almost all Australians, the National Health Amendment Act 1993 (which inserted the current section 135AA into the National Health Act 1953) required the Privacy Commissioner to issue Guidelines for the Medicare and Pharmaceutical Benefits programs, which, among other things, were required to: prohibit agencies from storing claims data from the two programs in the same database; and prohibit linkage of the two databases except in circumstances to be specified in the Guidelines.
3. The Medicare and Pharmaceutical Benefits Programs Privacy Guidelines were first issued in April 1994. At the time these Guidelines were introduced the Privacy Commissioner made a commitment that they would be reviewed after 12 months. The purpose of these amendments is to affect changes arising from a review of the Medicare and Pharmaceutical Benefits Programs Privacy Guidelines 1994.
4. In summary, the changes to the Privacy Guidelines:
a) amend the record-keeping requirements of the HIC so that it can technically comply with the Guidelines as well as meet privacy standards;
b) state more clearly that all the information required for claims processing may be included on the claims databases without compromising the protection of personal information;
c) clarify requirements for the destruction of linked data;
d) allow some additional use of the Medicare number in encrypted form so that claims data can be accurately reconstructed in permitted circumstances; and
e) set down clear procedures for using claims information for research purposes
5. These amendments have been the subject of wide consultation with affected agencies and professional and health consumer groups.
6. Once the guidelines take effect the Privacy Commissioner will revise and reissue the Annotated Version of the Medicare and Pharmaceutical Benefits Programs Privacy Guidelines 1994, incorporating these amendments and appropriate explanations.
Notes on Proposed Changes
- Interpretation Clause. The Medicare and Pharmaceutical Benefits Programs Privacy Guidelines issued by the Privacy Commissioner in 1994 are referred to as the Principal Guidelines.
2. A commencement date is specified in the body of the amendments, as permitted by section 135AA(8) of the National Health Act. A date has been chosen which is expected to fall a number of calendar days after the last likely date of possible disallowance.
3. Amending Guideline 3 addresses the concerns expressed by the HIC and the Department that "the Commission" could be interpreted to mean the board of Commissioners of the HIC. References to "the Commission" throughout the Principal Guidelines are amended to read "the HIC".
4.1 Guideline 1 of the Principal Guidelines sets rules to ensure that the Medicare and Pharmaceutical Benefits program claims databases are kept functionally separate except in limited, strictly defined circumstances. Guideline 1.7 of the Principal Guidelines requires the HIC both to keep a note of instances where records or information on the claims databases relating to the same patient are compared or combined in accordance with paragraph 1.4(b), (c) or (d); and `to include a flag on the database which refers to that note'. The HIC has advised that it cannot comply with the requirement to include a flag on the database for technical reasons. It was also concerned that the appearance of a flag immediately shows that the subject of the record has had their records matched or combined and may give a false impression to HIC operators that the subject is a cause for concern. The HIC has advised that there are other channels through which individuals can discover if their records have been matched or combined. Amending Guideline 4.1 will amend Guideline 1.7 to relieve the HIC of this requirement. It will require the HIC to specify in a technical report how it will keep an auditable record of instances where records or information relating to the same patient are linked, compared or combined under Guideline 1.4.
4.2 Guideline 1.8 of the Principal Guidelines requires the HIC not to include `personal identification details other than the personal identification numbers referred to in Guideline 2' in the claims databases. As currently worded the Guideline would prevent the Medicare number being included in the Medicare claims database. The HIC advises that including the Medicare number on the Medicare claims database is integral to its method of processing Medicare claims. This amendment would not undermine the policy objective of functional separation of the claims databases. The opportunity has also been taken to make it clear that the Pharmaceutical entitlements number can be included on the Pharmaceutical Benefits claims database.
Amending Guideline 4.2 will therefore amend Guideline 1.8 to permit the Medicare card number to be included in the Medicare claims database; and the Pharmaceutical entitlements number to be included on the Pharmaceutical
Benefits claims database, but not other `personal identification components' (defined in subsection 135AA(11) of the National Health Act). The Amending Guideline also confirms that since the Personal Identification Number (PIN) referred to in Guideline 2 is not defined as a `personal identification component', it will continue to be able to be included in the claims databases.
5. Guideline 2 of the Principal Guidelines sets standards for the maintenance and disclosure of PIN information. Guideline 2.3 of the Principal Guidelines provides that the HIC may give the Department only the internal PIN and no other official patient identifying number in conjunction with de-identified details of claims. The HIC has stated that this means that all reference to Medicare card level activities is lost so that, when the HIC obtains old claims information from the Department, as it is permitted to do under Guideline 4, it cannot apportion claims to Medicare cards where multiple Medicare cards are involved (as, for example, where separated parents have dual custody and children are on both parents' cards). It has proposed that, when providing de-identified claims information to the Department, it be permitted to include the Medicare card number in encrypted form. The Department will not be able to decode this number but the HIC will be able to decode it when it obtains old claims information from the Department, thus enabling it to identify card level activities. Amending Guideline 5 will amend Guideline 2.3 to permit the HIC to give the Department data including the Medicare card number in encrypted form provided that any algorithm enabling the encrypted Medicare card number to be decoded is not given to the Department.
6.1 Guideline 3 of the Principal Guidelines concerns destruction of information. Guideline 3.1 of the Principal Guidelines requires the HIC to destroy Medicare and Pharmaceutical benefits claims information within 5 years `of receipt' except where there is `current action' (defined as an investigation, prosecution, unresolved compensation matter or action for recovery of debt) pending or where the information affects an individual's entitlement to a related service which could be rendered after the expiry of the 5 year limit. The HIC has advised that it records the date of initial processing rather than the date `of receipt'. Amending Guideline 6.1 will amend Guideline 3.1 to refer to the date of initial processing. The definition of `current action' will be omitted and the relevant words incorporated into the amended Guideline 3.1.
Where records or information are linked, compared or combined in accordance with Guideline 1.4 no specific time limit applies other than the general 5 year time limit. Amending Guideline 6.1 will also amend Guideline 3.1 to require the HIC to destroy data that is the product of the linking, comparing or combining of records or information in accordance with Guideline 1.4 within 3 months of the data being brought into existence subject to the same exceptions as apply to the 5 year time limit.
6.2 Amending Guideline 6.2 will amend Guideline 3.2 consequential upon the omission of the definition of `current action'.
6.3 Guideline 3.3 of the Principal Guidelines requires the HIC to establish procedures to ensure that any information retained beyond the 5 year limit set
by Guideline 3.1 is destroyed as soon as practicable after the `current action' has been completed or it is no longer required in connection with an individual's entitlement to a related service. Amending Guideline 6.3 will amend Guideline 3.3 to strengthen the wording so that it requires the HIC to destroy information rather than merely requiring it to establish procedures to do so; and so that it must satisfy the Privacy Commissioner of its adherence to its obligations rather than merely being required to keep the Privacy Commissioner informed of the relevant procedures. It will also change the wording of Guideline 3.3 to take account of the changes to the wording of Guideline 3.1 outlined above and it will require the HIC to destroy information in `current action' cases with 14 months of the completion of the action rather than merely as soon as practicable, as at present.
7. The Principal Guidelines currently deal with disclosure of claims data for research purposes at Guideline 7. Principal Guideline 7 provides that the Guidelines do not prevent the HIC from disclosing claims information for research purposes where the individuals who are the subject of the information have given free and informed consent to the research project. It also permits researchers to whom such information is disclosed to retain that information until the research project is completed (notwithstanding the 5 year time limit that applies to such information in the hands of the HIC) provided that the relevant information is destroyed once the project is concluded. The HIC and Department have noted that information disclosed for the purposes of medical research in accordance with the Medical Research Guidelines issued by the National Health and Medical Research Council under section 95 of the Privacy Act (the NH&MRC Guidelines) is subject to a different regime. They also noted that disclosures are subject to the secrecy provisions in the Health Insurance Act 1973 and the National Health Act.
Amending Guideline 7 amends the Principal Guidelines to make clear that disclosures for research purposes must conform to the secrecy provisions and to make clear that the Guidelines permit disclosures that are made with the consent of the individual or in accordance with the NH&MRC Guidelines. The opportunity has been taken at the same time to place the provision with the other Guidelines imposing obligations on the HIC.
8 1 Guidelines 5 of the Principal Guidelines concerns the use of de-identified claims information. Guideline 5.2 of the Principal Guidelines prohibits the Department from maintaining the de-identified records from the Medicare and Pharmaceutical Benefits claims databases in a combined form on a permanent basis in conjunction with the internal PIN. Paragraph 5.2(a) provides that this does not prevent the use of a new and unrelated number as an identifier of a common record. Paragraph 5.2(b) provides for the temporary linkage of information from both databases in conjunction with the PIN provided that the data so created is destroyed after one month. The Department has suggested that this provision leaves it unclear whether it can in fact maintain combined records on a permanent basis provided that it uses a new and unrelated number. It has also sought the power to use the PIN in encrypted form rather than an unrelated number as an identifier of a common record, on the basis
that it is necessary to convert the PIN to another number on a consistent basis in order to study the utilisation of services by individuals over time.
Amending Guideline 8.1 will amend paragraph 5.2(a) to clarify that nothing in Guideline 5.2 prevents the retention of de-identified records in combined form in conjunction with a new and unrelated number. It will also permit the use of an encrypted form of the PIN as sought by the Department. It is not
considered that this represents any erosion of the privacy standard established by the provision since the Department will still be unable to decode the PIN.
8.2 Amending Guidelines 8.2 and 8.3 will amend paragraph 5.2(b) to clarify that references to the temporary linkage of information in that paragraph are references to such temporary linkage in conjunction with the PIN and not in conjunction with another number as permitted by paragraph 5.2(a).
8.4 Guideline 5.4 of the Principal Guidelines provides that, where the Department discloses claims information in a de-identified form (other than to the HIC in accordance with Guideline 4 or in accordance with procedures established for the purposes of Guideline 6), it must be reasonably satisfied that the recipient is not in a position to re-identify the information. The Department has noted that in releasing claims data it has usually suppressed cells relating to less than 3 providers or less than 6 services. It has argued, however, that there are occasions where to suppress these cells would limit the usefulness of the data for research projects or for consultancy projects being undertaken for the Department. The data in these circumstances would be being released under the secrecy provisions in its own Acts. Amending Guideline 8.4 will amend Guideline 5.4 to make an exception where the de-identified information has been released under those secrecy provisions, specifically section 130 of the Health Insurance Act or section 135A of the National Health Act.
9. Guidelines 6 of the Principal Guidelines concerns name linkage between the two databases. Guideline 6.7 of the Principal Guidelines requires that, where the Department has given the HIC old claims information in accordance with Guideline 4 (such as taking action on unresolved claims or investigating old claims information), it shall keep a central record of that action. The Department currently keeps a record of all requests from the HIC together with details of the dates of the requests but it has suggested that this guideline may require clarification because it gives the impression that the Department maintains a central record containing information about both programs. Amending Guideline 9 will amend Guideline 6.7 to permit the Department to keep a central record for each program, separately.
10. Amending Guideline 10 will omit Part C of the Principal Guidelines, comprising Guideline 7, consequential upon the insertion of new Guideline 4A as set out above.