To the Editor: The Victorian Health Records Act 2001 became operational on 1 July 2002. This legislation provides important protection for the individual against misuse of health information through the establishment of Health Privacy Principles. We support the spirit of this legislation, but would like to draw attention to its potential effects on multicentre research and disease surveillance.

We recently began a study to estimate the burden of invasive group A streptococcal disease in Victoria. The study involves identification of patients through laboratory notifications, followed by collection of clinical data — a strategy similar to surveillance of notifiable diseases. The study is funded by the National Health and Medical Research Council. We have sought institutional ethics committee approval, and are obtaining individual informed consent from patients.

Despite approval from the Human Research Ethics Committee of the Victorian Department of Human Services, concerns arising from the new privacy legislation led most Victorian healthcare institutions to also require approval by their own ethics committees. We have now applied to over 30 separate committees, and the process is not yet complete. This has been an enormous drain on resources, has necessitated our establishing complex administrative procedures, and delayed commencement of the project. Moreover, many committees have required that we pay an application fee of several hundred dollars. Some have been uncertain about the implications of the new legislation for our project, and have requested clarification from the Victorian Health Services Commissioner. Despite these processes, some clinicians we have contacted are unwilling to allow their patients to be approached for fear of breaching privacy legislation.

Our protocol is not controversial, and no substantive issues have been raised by any of the ethics committees. While ethical clearance is crucial to the success of the project, we were unprepared for the amount of work, confusion and expense involved. It is possible that these difficulties could discourage other researchers from conducting similar studies in Victoria. Similar concerns have been raised in the United Kingdom since the introduction of new privacy laws.1

The Victorian legislation allows for research and surveillance activities using identifying data if they are in the public interest, or if it is impracticable to seek individual consent. However, the legislation does not provide guidelines on what constitutes public interest or when consent is impracticable. The extent to which this legislation affects multicentre research or surveillance projects needs to be clarified, and a more simplified ethical approval process for surveillance activities identified.