EXPLANATORY STATEMENT
AMENDMENTS TO THE MEDICARE AND PHARMACEUTICAL
BENEFITS PROGRAMS PRIVACY GUIDELINES
(AMENDMENT 2000 NO. 1)
- Attached are amendments issued by the Privacy Commissioner under s. 135AA of the National Health Act 1953, which amend the Medicare and Pharmaceutical Benefits Programs Privacy Guidelines.
2. BACKGROUND:
3. Under section 135AA of the National Health Act 1953, the Privacy Commissioner is required to issue guidelines relating to personal information held by a federal agency that was obtained in connection with a claim for payment of a benefit under Medicare or the Pharmaceutical Benefits Scheme (PBS). These guidelines seek to provide privacy protection for Medicare and PBS claims information relating to individuals that is held by any agency under the Privacy Act.
4. The key provisions of the guidelines are:
to require the separate storage of Medicare and Pharmaceutical Benefits Program claims information;
to specify the circumstances in which data from the two programs may be linked;
to require the de-identification of claims information over five years old;
to specify the circumstances when old information may be re-identified; and
to specify the circumstances in which de-identified information may be
provided to the Department of Health and Aged Care for policy development,
program monitoring and other purposes.
5. The Health Insurance Commission (HIC), which administers Medicare and the Pharmaceutical Benefits Scheme (PBS), has asked the Privacy Commissioner to amend the guidelines so as to allow the HIC to link data in the Medicare and PBS databases before releasing the information. The HIC proposes that this would only occur where the individual involved has given clear, informed and express consent in writing for the HIC to do so. The guidelines, as they currently stand, do not permit this to occur.
6. Currently, the HIC is permitted to disclose personal information held on the Medicare or PBS data base, with the express or implied consent of the person who is the subject of the information, [section 130(3), Health Insurance Act 1973 (Medicare information) and section 135A(3), National Health Act 1953 (PBS information)].
7. However, the guidelines prevent the HIC from linking the data. They provide (so far as is relevant):
1.1 Medicare claims information and Pharmaceutical Benefits claims information must not be held on the same database. Procedures must not be established which permit claims information from either of these programs to be linked,
merged or combined, other than in the exceptional circumstances listed in Guideline 1.4.
…
1.4 The HIC may link, compare or combine records or information from either database relating, or expected to relate, to the same patient in the following circumstances:
(a) for internal use where that use is:
• authorised or required by law, and is reasonably necessary, in a specific case or in a specific set of circumstances, for the discharge of the HIC's statutory responsibilities in relation to the enforcement of the criminal law or of a law imposing a pecuniary penalty or for the protection of the public revenue; or
(b) for the purpose of external disclosure:
• in a specific case or specific set of circumstances where that disclosure is required by law; or
(c) for the purpose of determining an individual's eligibility for a benefit under one program, where eligibility for that benefit is dependent upon services provided under the other program; or
(d) where the HIC believes on reasonable grounds that the linkage is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.
8. The guidelines make no provision for a person to consent to linkage. As a result, even where an individual has expressly consented to the linkage of his/her Medicare and PBS information prior to disclosure to a third party, the guidelines prevent the HIC from doing so.
9. The need to consider an amendment has arisen mainly as a result of Coordinated Care trials. These trials were established by the former Commonwealth Department of Health and Family Services in order to test a new system of health care for people with multiple or complex care needs. The trials use Care Coordinators and individual care plans to manage health care needs and purchase services by pooling funds from existing Federal, State and joint programs. As part of the trial, in order to obtain a complete picture of an individual's health, data from the Medicare and PBS databases needs to be combined and linked. The Coordinated Care trials provide the HIC with consent forms that expressly direct the HIC to release Medicare and PBS information relating to the participant to the trials. However, under the present system, the actual linkage of data has to be done by the trials, rather than by the HIC prior to disclosure.
10. This restriction caused practical problems. Where consumers taking part in the trials expressly wished for their Medicare and PBS data to be given to them or to an organisation involved, they found it difficult to understand why the HIC could not produce information in a single package. The restriction also led to inefficiencies. Since the HIC could only give them data from the Medicare and PBS databases in separate packages, the organisations running the trials had to put the data together themselves. This was a long and costly process. Feedback from the trials indicates that it would be far more convenient for consumers and efficient for organisations if the HIC itself could combine and customise the data before releasing it.
11. A `second generation' of Coordinated Care trials is scheduled to commence in October 2000 and to run for three years. The HIC has asked the Privacy Commissioner to amend the mandatory guidelines as they relate to data linkage of Medicare and PBS data, with a view to enabling the HIC to provide linked data where the individual involved has given clear, informed and express consent for the HIC to do so.
12. Before issuing or amending the guidelines, the Privacy Commissioner is required by section 135AA(6) of the National Health Act 1953 to `take reasonable steps to consult with organisations (including agencies) whose interests would be affected by the guidelines'. To this end, some 58 organisations and individuals were consulted in early 2000. Of these, 20 provided responses, all in support of the amendment.
13. AMENDMENT:
14. The attached amendment amends Guideline 1.4(b), so that it would read as follows (the proposed additional words are in bold):
1.4 The HIC may link, compare or combine records or information from either database relating, or expected to relate, to the same patient in the following circumstances:
(b) for the purpose of external disclosure:
in a specific case or specific set of circumstances where that disclosure is required by law; or
in the specific circumstance of Coordinated Care trials conducted by the Department between October 2000 and April 2004, where the individual who is the subject of the information has given his/her express and informed consent in writing; or...
Malcolm Crompton Privacy Commissioner
27 June 2000