Comment: Privacy legislation and research

Comment: As I understand Carapetis et al's study, the researchers determine who has a group A streptococcal infection from the laboratory that performs the test (as this infection is not a notifiable disease,1 there is no central source of information). The laboratory may be independent or in a public or private hospital, and may be situated anywhere in Victoria. The laboratory tells them who requested the test and the patient's name and infection status. The researchers then seek assistance from the hospital or doctor requesting the test in obtaining "individual informed consent" from the patient to release clinical information to the researchers. Each institution has required that its own human research ethics committee approve the project, as well as the Department of Human Services (DHS) Ethics Committee, before the laboratory releases information. This accords with the law, but the additional bureaucracy and costs involved will deter much important public health research.

The law: In Victoria, public and private hospitals and their employees have a statutory duty of confidentiality under section 141 of the Health Services Act 1988 (Vic). There is an exception when the patient consents (s 141(3)(a)), but, in Carapetis et al's study, patients cannot be approached until the laboratory gives identifying information. Information may be divulged for medical research without patient consent if an ethics committee "established under the by-laws of the agency" has approved "the use to which the information will be put and the research methodology" (s 141(3)(g)). The giving of information must also accord with Health Privacy Principle (HPP) 2.2(g) in the Health Records Act 2001 (Vic): it must be necessary and "in the public interest"; it is impracticable to seek consent; identifying information is needed; identifying information will not be published; and it must conform with the Guidelines of the Health Services Commissioner.2 The federal Privacy Act 1988 (Cwlth) contains similar provisions.3

Options for change: The Health Services Commissioner has power to issue guidelines varying the subparagraphs of HPP 2, and even to lessen the level of privacy protection, if it is in the public interest to do so.4 However, guidelines cannot override the requirement in the Health Services Act that projects must be approved by the ethics committee "established under the by-laws of [each] agency". There are four options for change:

• The Health Services Act could be amended so that approval of one human research ethics committee is sufficient.

• The Secretary of the DHS could prescribe more diseases as notifiable,1 so that information is available centrally, and access could be authorised by the DHS Ethics Committee.

• The Secretary could request information from pathology laboratories for public health research and supply that to the researchers (laboratories would be protected under section 137 of the Health Act 1958 [Vic]).

• Institutions could amend their by-laws — or ethics committees could adopt a policy — that the institution will follow the approval of the DHS Ethics Committee in public health research.5

The last seems the simplest option, but historically this approach has not been favoured in multicentre trials in Australia.