EXPLANATORY STATEMENT
Personally Controlled Electronic Health Records Act 2012
PCEHR (Information Commissioner Enforcement Powers) Guidelines 2013
Purpose and authority
The Personally Controlled Electronic Health Records Act 2012 (the PCEHR Act) establishes the personally controlled electronic health record (PCEHR) system. The Australian Information Commissioner (the Information Commissioner) has various enforcement and investigative powers in respect of the PCEHR system, under both the PCEHR Act and the Privacy Act 1988 (Privacy Act).
Section 111 of the PCEHR Act provides for the Information Commissioner to make enforcement guidelines outlining how he or she will approach enforcement issues under the PCEHR Act and related legislation (for example, the Privacy Act) (subsection 111(2)). The Information Commissioner must then have regard to these guidelines in exercising his or her investigative and enforcement powers in relation to the PCEHR system (subsection 111(1)). The purpose of these guidelines is to promote transparency in the Information Commissioner’s processes, given the Information Commissioner’s important role in relation to the PCEHR system.
Background
The PCEHR system aims to enable the secure sharing of health information between a registered consumer’s registered healthcare provider organisations, while enabling the consumer to control who can access their PCEHR. A consumer’s PCEHR provides a summary of the consumer’s health information, which is held by the National Repositories Service as well as registered repository operators. Registered repositories may be operated by either private or public sector bodies who must register with the System Operator and comply with any PCEHR Rules that apply to their registration.
The PCEHR Act establishes and regulates the PCEHR system including establishing certain privacy protections. It prescribes the circumstances in which entities can collect, use and disclose health information included in a consumer’s PCEHR. It also allows for the Information Commissioner to seek a range of remedies, including civil penalties, where there is an unauthorised collection, use or disclosure of health information included in a consumer’s PCEHR, or where certain actions occur that might compromise the integrity of the PCEHR system.
The Information Commissioner has investigative powers and functions under both the PCEHR Act and the Privacy Act to carry out these enforcement powers and functions. Enforcement powers in the Privacy Act are also available where a matter is investigated under the Privacy Act. This legislative instrument sets out the Commissioner’s general approach to the exercise of these investigative and enforcement powers and functions.
Consultation
Before making the Guidelines, the Office of the Australian Information Commissioner (OAIC) took the following steps by way of consultation:
- On 28 August 2012 the OAIC posted on its website a draft of the Enforcement Guidelines together with a discussion paper, inviting public comment. The period allowed for public consultation was 3 weeks. The closing date for submissions was 18 September 2012.
- The OAIC wrote to various key stakeholders with information about the draft Guidelines, providing details of how to obtain a copy of the draft Guidelines and inviting public comment. The OAIC also promoted the draft Guidelines through other communication channels such as the OAIC’s email newsletter OAICnet, Twitter and the Rich Site Summary (RSS) news feed from the OAIC’s website.
- The OAIC received 15 non-confidential submissions, and one legal-in-confidence submission as a result of public consultation. One of these submitters was granted an extension of time in which to provide a submission and the final submission was received on 30 November 2012.
- The OAIC made some variations to the draft Guidelines as a result of the consultation process.
Other issues
This instrument commences on the day after it is registered on the Federal Register of Legislative Instruments.
This instrument is a legislative instrument for the purposes of the Legislative Instruments Act 2003.
An item by item description of this legislative instrument is at the Attachment.
Attachment
Item-by-item description of the PCEHR (Information Commissioner Enforcement Powers) Guidelines 2013
Part 1 Preliminary
Clause 1 Name of instrument
Clause 1 provides that this instrument is the PCEHR (Information Commissioner Enforcement Powers) Guidelines 2013 (the Guidelines).
Clause 2 Commencement
Clause 2 provides that the Guidelines commence on the day after the instrument is registered on the Federal Register of Legislative Instruments.
Clause 3 Definitions
This clause defines various terms used in the Guidelines.
It also clarifies that, unless the contrary intention appears, terms used in the Guidelines have the same meaning as in the Personally Controlled Electronic Health Records Act 2012 (PCEHR Act).
Clause 4 Introduction
This clause briefly explains the PCEHR system and the role of the Information Commissioner and the Guidelines in that context.
Clauses 4.1 and 4.2 explain that the Information Commissioner is a statutory office holder appointed under subsection 14(1) of the Australian Information Commissioner Act 2010 (AIC Act). The Information Commissioner performs functions and exercises power conferred on the position by the AIC Act and other Acts. Among other things, this includes performing functions and exercising powers in relation to the PCEHR system.
Clause 4.3 explains that the PCEHR system is established under and regulated by the PCEHR Act, and that it has the purpose of enabling the secure sharing of a consumer's health information between his or her registered healthcare provider organisations. The consumer will have control over who can access his or her health information.
Clauses 4.4 and 4.5 explain how the PCEHR system works.
Clause 4.6 explains that the PCEHR System Operator is responsible for the operation of the PCEHR system.
Clause 4.7 states that the collection, use and disclosure of health information included in a consumer's PCEHR is regulated by the PCEHR Act and regulations and rules made under that Act.
Clauses 4.8 and 4.9 clarify that, in addition to the requirements of the PCEHR Act, participants in the PCEHR system are subject to the Privacy Act 1988 (Privacy Act) and relevant State and Territory privacy laws.
Clause 4.10 describes the functions of Information Commissioner in relation to the PCEHR system. The Information Commissioner has the role of investigating alleged contraventions of the PCEHR Act and addressing such contraventions as appropriate through conciliation, education and enforcement action.
Clause 4.11 sets out the range of avenues by which an alleged contravention of the PCEHR Act may be brought to the Information Commissioner's attention.
Clauses 4.12 to 4.14 describe the role of the Guidelines. These clauses explain that the Guidelines are made under section 111 of the PCEHR Act and set out the Information Commissioner's general approach to the exercise of his or her investigative and enforcement powers in relation to the PCEHR system. Clause 4.14 makes it clear that, despite the general approach provided in the Guidelines, the Information Commissioner maintains discretion to exercise the available powers that he or she considers the most appropriate in the circumstances of each case.
Part 2 General Principles relating to enforcement action and the exercise of investigative powers under the PCEHR Act and the Privacy Act
Clause 5 Types of enforcement powers and investigative powers available to the Information Commissioner
This clause sets out the types of enforcement and investigative powers that the Information Commissioner has in relation to the PCEHR system.
Clause 5.1 explains that there are relevant enforcement and investigative powers available to the Information Commissioner under both the PCEHR Act and the Privacy Act.
Clause 5.2 describes the Information Commissioner's investigative powers under the PCEHR Act. This provision empowers the Information Commissioner to do all things necessary or convenient to investigate an alleged contravention of the PCEHR Act in relation to the PCEHR system. The alleged contravention must be either in connection with a consumer’s health information, or a breach of a civil penalty provision.
Clauses 5.3 to 5.5 describe the Information Commissioner’s investigative powers under the Privacy Act.
Clause 5.3 explains that the Information Commissioner’s investigative powers under the Privacy Act will apply to a contravention of the PCEHR Act in connection with health information included in a consumer’s PCEHR or a provision of Part 4 or 5, as such a contravention will be an ‘interference with privacy’ for the purposes of the Privacy Act.
Clause 5.4 states that the relevant investigative powers and processes that would apply when the Information Commissioner conducts an investigation under the Privacy Act into an alleged contravention of the PCEHR Act are set out in Part V of the Privacy Act.
Clause 5.5 lists a range of investigative powers available to the Information Commissioner under Part V of the Privacy Act. This clause further notes that Part V of the Privacy Act also sets out procedural requirements for an investigation.
Clauses 5.6 and 5.7 describe the enforcement powers that are available to the Information Commissioner under the PCEHR Act. These include the ability to apply to a Court for a civil penalty order, accept a voluntary enforceable undertaking, apply to a Court to enforce an undertaking, or apply to a Court for an injunction.
Clauses 5.8 to 5.10 describe the enforcement powers that are available to the Information Commissioner under the Privacy Act that include the power to make a non-binding determination either dismissing a complaint or finding it substantiated. The determination may include certain declarations relating to appropriate redress or compensation. The Information Commissioner may apply to the Federal Court or the Federal Circuit Court for an order to enforce the determination in certain circumstances. The Information Commissioner may also apply to the Federal Court or the Federal Circuit Court for an injunction to restrain a person from engaging in conduct contravening the Privacy Act (or requiring the person to do any act or thing). Clause 5.9 notes that further enforcement powers under the Privacy Act will commence on 12 March 2014.
Clause 6 Enforcement action - general principles
This clause sets out the general principles that the Information Commissioner will apply when deciding the appropriate enforcement action for the particular circumstances (including whether it is appropriate to take any action).
Clause 6.1 makes it clear that the Information Commissioner will act consistently with general principles of good decision making, as explained in the Best Practice Guides published by the Administrative Review Council. In particular, the Information Commissioner will strive to act fairly, transparently, and in accordance with principles of natural justice (or procedural fairness).
Clause 6.2 sets out the policy considerations that the Information Commissioner will take into account when deciding whether to take enforcement action against a person in relation to the PCEHR system.
Clause 6.3 lists additional factors that the Information Commissioner will also take into account in determining to take enforcement action against a person in relation to the PCEHR system.
Clause 6.4 makes it clear that the Information Commissioner will give individual consideration to any alleged contravention and have regard to all relevant circumstances.
Clause 6.5 states that, in any litigation, the Information Commissioner will act in accordance with the Commonwealth’s model litigant obligations.
Clauses 6.6 and 6.7 set out the Information Commissioner’s general approach to complaints made in relation to the PCEHR system. A complaint received by the Information Commissioner will, unless there is a reason to act under the PCEHR Act, be treated as a complaint made under the Privacy Act, and will be investigated under the provisions of Part V of that Act. The Information Commissioner will attempt to facilitate conciliation between the complainant and the respondent before deciding to take other enforcement action.
Clauses 6.8 and 6.9 set out the general approach to investigations undertaken on the Information Commissioner’s ‘own motion’. An own motion investigation may occur where there has been no complaint under section 36 of the Privacy Act, but the Information Commissioner has nevertheless become aware of a possible contravention. Similar to investigations arising out of a complaint, the Information Commissioner will generally conduct own motion investigations relating to the PCEHR system under Part V of the Privacy Act. Following an own motion investigation, the Information Commissioner may decide to pursue appropriate enforcement action under the Privacy Act or the PCEHR Act.
Clauses 6.10 and 6.11 set out the Information Commissioner’s general approach to conducting investigations under section 73 of the PCEHR Act.
Clause 6.10 provides that when conducting an investigation under section 73 of the PCEHR Act, the Information Commissioner will, so far as practicable, adopt a process that corresponds with the Privacy Act investigative processes.
Clause 6.11 provides that, upon completing an investigation under section 73 of the PCEHR Act, the Information Commissioner may decide to take enforcement action under that Act. The Information Commissioner may also attempt to conciliate the matter between the parties before deciding to take other enforcement action.
Clauses 6.12 and 6.13 explain that the Information Commissioner has the power to disclose to the PCEHR System Operator any information or documents relating to an investigation conducted because of the operation of section 73 of the PCEHR Act, where the Information Commissioner is satisfied that to do so will enable the System Operator to monitor or improve the PCEHR system. Such disclosures may also assist the PCEHR System Operator to exercise its powers under the PCEHR Act.
Part 3 Use of enforcement powers under the PCEHR Act
Part 3 of the Guidelines explains, in more detail, the range of enforcement mechanisms available to the Information Commissioner under the PCEHR Act.
Clause 7 Civil penalties
Clause 7.1 explains that section 79 of the PCEHR Act allows the Information Commissioner to apply to a Court for a civil penalty order against a person who has allegedly contravened a civil penalty provision of that Act. The application must be made within 6 years of the alleged contravention.
Clause 7.2 provides an overview of the civil penalty provisions that are contained in the PCEHR Act.
Clause 7.3 explains that the pecuniary penalty specified in the relevant civil penalty provision is the maximum penalty that can be applied to a person who has contravened that provision and who is not a body corporate. In contrast, if a body corporate contravenes a civil penalty provision in the PCEHR Act, the maximum pecuniary penalty is five times the amount specified in the provision.
Clauses 7.4 and 7.5 describe the Information Commissioner’s general approach to initiating civil penalty proceedings under the PCEHR Act. The Information Commissioner will initiate civil penalty proceedings only in appropriate cases after taking into account the particular facts of the matter, the considerations listed at clause 6.2, the factors listed at clause 6.3 and the Commonwealth’s model litigant obligations.
The Information Commissioner’s general approach is to only seek civil penalty orders in serious or repeated contraventions of the PCEHR Act or Privacy Act and not in situations where the contravention is minor or inadvertent where the person or entity responsible for the contravention has cooperated with the investigation and taken steps to avoid future contraventions.
Clause 8 Accepting and enforcing undertakings
Clause 8.1 explains that section 94 of the PCEHR Act allows the Information Commissioner to accept a written undertaking that a person will, in order to comply with the PCEHR Act, either take or refrain from taking specified action, or that the person will take specified action directed to ensuring future compliance with the PCEHR Act.
Clause 8.2 provides that a person who has given an undertaking may withdraw it at any time. However, the person requires the Information Commissioner’s written consent to do so.
Clause 8.3 provides that the Information Commissioner may, by written notice, cancel an undertaking that has been given by a person and accepted by the Information Commissioner under section 94 of the PCEHR Act.
Clause 8.4 provides that the Information Commissioner may publish on the OAIC website a copy of an undertaking that has been given by a person and accepted by the Information Commissioner.
Clause 8.5 explains that section 95 of the PCEHR Act allows the Information Commissioner to apply to a Court for certain orders if he or she considers that a person has breached an undertaking the person has given. The Court may order that the person comply with the undertaking, that the person make a payment to the Commonwealth or compensate a third party, or any other order that it thinks appropriate.
Clause 8.6 provides that an undertaking must be in writing and must be expressed as being an undertaking under section 94 of the PCEHR Act.
Clause 8.7 states that the individual offering the undertaking must have the authority to negotiate on behalf of, and bind, the respondent.
Clause 8.8 limits the acceptable terms of an undertaking. This clause makes it clear that the Information Commissioner will not accept an undertaking that denies responsibility for an alleged contravention, seeks to justify the respondent's conduct (including by establishing defences), merely undertakes to comply with the law or seeks to impose terms or conditions on the Information Commissioner.
Clause 8.9 sets out what acceptable terms of an undertaking should include. To be acceptable to the Information Commissioner, the terms of an enforceable undertaking should contain a commitment to take action that is a necessary and proportionate response to the contravention, be capable of implementation, include action that can be objectively measured or tested and include a compliance monitoring and reporting framework.
Clauses 8.10 to 8.12 describe the Information Commissioner’s general approach to accepting undertakings, including the relevant factors that the Information Commissioner will take into account when deciding whether to accept an undertaking in a particular case. These factors include the particular facts of the matter, the considerations listed at clause 6.2, the factors listed at clause 6.3, the respondent’s level of acknowledgement of the contravention, whether the undertaking will achieve an effective regulatory outcome and the respondent’s ability to, and intention to, comply with the terms of the undertaking.
Clause 8.11 indicates that the acceptance of an undertaking in one matter should not be regarded as precedent for accepting an undertaking in any future matters.
Clause 8.12 clarifies that the Information Commissioner may accept an undertaking in relation to part of a matter, whilst pursuing other enforcement mechanisms in relation to other parts of the same matter.
Clauses 8.13 and 8.14 set out the Information Commissioner’s general approach in relation to enforcing undertakings under section 95 of the PCEHR Act. The decision to initiate proceedings to enforce an undertaking will be made on a case by case basis after taking into account the particular facts of the matter, the considerations listed at clause 6.2, the factors listed at clause 6.3 of the Guidelines and the Commonwealth’s model litigant obligations.
Clause 9 Injunctions
Clause 9.1 explains that section 96 of the PCEHR Act allows the Information Commissioner to apply to a Court for an injunction that requires a person to do an act or thing, or that restrains a person from doing an act or thing, in order to prevent contravention of the PCEHR Act.
Clause 9.2 notes that the Information Commissioner may apply for an injunction under section 98 of the Privacy Act and that the Information Commissioner will consider whether to use this alternative power to restrain conduct that is also in contravention of the PCEHR Act..
Clause 9.3 clarifies that an injunction that restrains a person from engaging in particular conduct may also require the person to do another act or thing.
Clauses 9.4 and 9.5 set out the Information Commissioner’s general approach in relation to seeking injunctions under either the PCEHR Act or the Privacy Act. The decision to apply for an injunction will be made on a case by case basis after taking into account the particular facts of the matter, the considerations listed at clause 6.2, the factors listed at clause 6.3 of the Guidelines and the Commonwealth’s model litigant obligations. The Information Commissioner’s general approach is to only apply for an injunction for conduct that cannot be adequately resolved by voluntary action or other enforcement mechanisms.
Part 4 Use of enforcement powers under the Privacy Act
Part 4 of the Guidelines describes the enforcement mechanisms available to the Information Commissioner under the Privacy Act.
Clause 10 Determinations
Clause 10.1 explains that the Information Commissioner may, upon completing the investigation of a complaint made under section 36 of the Privacy Act, make a determination under section 52 of that Act that either dismisses the complaint or finds it to be substantiated. A determination that finds the complaint to be substantiated may include certain declarations relating to appropriate redress or compensation.
Clause 10.2 explains that section 55A of the Privacy Act allows the Information Commissioner to apply to the Federal Court or the Federal Circuit Court to enforce a determination against a person or entity.
Clause 10.3 explains that section 62 of the Privacy Act allows the Information Commissioner to apply to the Federal Court or the Federal Circuit Court to enforce a determination against an agency.
Clause 10.4 clarifies that an application under section 62 may only be made if the agency has failed to comply with its obligations under section 58 of the Privacy Act. These obligations include refraining from conduct that has been declared to be an interference with privacy, and to perform any act or conduct that was declared in the section 52 determination to be appropriate redress.
Clauses 10.5 to 10.9 set out the Information Commissioner’s general approach in relation to making determinations under section 52 of the Privacy Act.
Clause 10.5 clarifies that the Information Commissioner has a discretion, upon finding that a complaint under section 36 of the Privacy Act is substantiated, to make a determination or to complete the investigation in some other manner permitted by the Act, including by conciliation between the parties.
Clause 10.6 states that conciliation is intended to be the primary dispute resolution model for complaints. However, it also notes that where it is in the interests of the parties and the broader administration of the Privacy Act, the Information Commissioner may choose to make a section 52 determination.
Clause 10.7 makes it clear that, unlike civil penalty proceedings, section 52 determinations will not only be used for serious contraventions and should not necessarily be seen as a punitive measure.
Clauses 10.8 and 10.9 set out the factors that the Information Commissioner will take into account when deciding whether to make a section 52 determination. These include the considerations listed at clause 6.2, the factors listed at clause 6.3 and the additional factors listed at clause 10.9.
Clauses 10.10 and 10.11 state that a section 52 determination will be published on both the OAIC's website and on the Australian Legal Information Institute’s website and will generally include the name of the respondent. The name of the complainant and any third parties will not be published.
Clauses 10.12 and 10.13 set out the Information Commissioner’s general approach in relation to enforcing the terms of a section 52 determination. The decision to apply for a Court order to enforce a section 52 determination will be made on a case by case basis following consideration of the particular facts of the matter, the considerations listed at clause 6.2, the factors listed at clause 6.3 of the Guidelines and the Commonwealth’s model litigant obligations.
Statement of Compatibility with Human Rights - prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011
PCEHR (Information Commissioner Enforcement Powers) Guidelines 2013
This legislative instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Overview of legislative instrument
This legislative instrument is made under section 111 of the Personally Controlled Electronic Health Records Act 2012 (the PCEHR Act). It describes the Information Commissioner’s investigatative and enforcement powers under both the PCEHR Act and the Privacy Act 1988 (Privacy Act) and sets out the Information Commissioner's general approach to the exercise of these powers in relation to the PCEHR system.
Human rights implications
The legislative instrument engages the following human rights:
Right to protection of privacy and reputation
Article 17 of the International Covenant on Civil and Political Rights guarantees protection from, among other things, arbitrary or unlawful interference with a person’s privacy.
This legislative instrument engages with Article 17 by supporting the enforcement and compliance aspects of the PCEHR system, which include a specific privacy regime for the handling of registered consumer's health information which will generally operate concurrently with Commonwealth, state and territory privacy laws.
In particular, this legislative instrument sets out the Information Commissioner’s general approach when using the available investigatory and enforcement powers. It makes it clear that the Information Commissioner will investigate unlawful interferences with privacy consistently, whether under the Privacy Act or the PCEHR Act. The Information Commissioner will, where appropriate, pursue available enforcement mechanisms against persons who have contravened privacy laws in relation to the PCEHR system.
Right to enjoyment of highest attainable standard of health
This legislative instrument also engages Articles 2 and 12 of the International Covenant on Economic, Social and Cultural Rights by assisting with the progressive realisation by all appropriate means of the right of everyone to the enjoyment of the highest attainable standard of physical and mental health.
This legislative instrument supports the administration of the PCEHR system, the intention of which is to enable a safer, higher quality, more equitable and sustainable health system for all Australians by transforming the way information is used to plan, manage and deliver healthcare services. The PCEHR system arose out of the National E-Health Strategy and National Health and Hospitals Reform Commission report of June 2009, which both identified an electronic health records system as being central to enabling the realisation of many health reform objectives including improved quality, safety, efficiency and equity in healthcare and the long-term sustainability of the health system.
Conclusion
The legislative instrument is compatible with human rights because it advances the protection of human rights.
John McMillan, Australian Information Commissioner