Privacy: bad for your health?

In reply: We are familiar with concerns such as those expressed by O’Grady and Nolan, and we are grateful for this opportunity to respond, so that readers can consider the views side by side.

Privacy is not new. Ethical obligations of confidentiality in medical settings date back to Hipprocrates. New privacy legislation — Health Records Act 2001 (Vic); Information Privacy Act 2000 (Vic); Privacy Act 1988 (Cwlth) — clarifies these obligations and also sets a higher standard of accountability. (Other states and territories also have legislation or are contemplating it.) The new laws cover all sorts of personal information, but health information is especially delicate. Wrongly handled, it can lead to discrimination — not just embarrassment or loss of dignity. In Victoria, this was recognised by Parliament when it passed the Health Records Act as a separate piece of legislation to deal specifically with health information.

The policy behind the privacy laws is aimed at promoting trust between health service providers and the public by reassuring them that their personal information will be respected, particularly in an electronic age in which information can be speedily transmitted far and wide. If surveys show the public to be wary about the use of their health information for research, it would seem to be in the best interests of the research community to embrace new standards rather than to seek to unravel or avoid them.

Privacy legislation was drafted after extensive consultation, taking into account competing factors and the need to balance respect for privacy with other public interests, including research. Research is very important, and privacy is a cherished and longstanding value. Reputable research can coexist with the recent statutory expressions of privacy, just as reputable research has always coexisted with respect for privacy.

Many data custodians perhaps do not yet realise that privacy laws rarely require an existing legitimate practice to cease completely, but rather may require the practice to be adapted to meet new standards. For example, for researchers seeking to recruit subjects for a study, the data custodian may disseminate the researchers’ initial letter rather than hand over lists of names and addresses to researchers. Once recipients opt in, direct consensual dealings with the researchers proceed as usual. Researchers can always use properly de-identified information, or they may use information with the consent of the subject.

As with all new laws, the privacy laws will become better understood with time and experience. Some data custodians are understandably overcautious, while others have blamed privacy laws for preventing them from providing information in situations in which disclosure is permitted. Many adapt with ingenuity and effectiveness. Privacy Commissioners and the Health Services Commissioner are available to explain the laws.