10.1.4. Questions about privacy protections and patient consent¶
10.1.4.1. Privacy and patient consent¶
The Commonwealth Privacy Act 1988 and associated Australian Privacy Principles (APPs) in Schedule 1 of that Act set the overarching requirements for the collection and use of all personal information by organisations and entities involved in the Primary Mental Health Care Minimum Data Set (PMHC MDS). A key feature to the operation of the PMHC MDS is based on obtaining client consent to the collection, use and disclosure of their personal information.
Specific responses to two issues commonly raised are provided below.
10.1.4.1.1. (a) Can PHNs collect the required MDS data?¶
Under APP 3, an organisation can collect sensitive information (e.g. health information) where it is reasonably necessary for, or directly related to, its functions or activities, and the individual concerned consents to the collection, or another exception applies.
The “primary purpose” for which PHNs originally collect personal information about clients in the PMHC MDS can be broadly expressed as supporting the role of PHNs managing commissioned services. Use or disclosure by the PHNs of personal information for the secondary purpose of national information would require the individual’s consent.
As commissioners and regional planners, PHNs require a range of data to remunerate service providers as well as monitor overall regional service provision and plan future service improvements. These are all core functions of PHNs and require that PHNs collect and analyse data on what services are delivered, to what clients, at what costs and with what outcomes. Without data, PHNs cannot undertake these functions.
Additionally, most PHNs have set up centralised referral coordination points to which the GP or other referrer forwards client and referral details. This centralised function allows referrals to be processed and services selected to match the client’s needs as well as giving the PHN an efficient method for managing demand.
In line with the Privacy Principles and the PIA, the department expects that the PHNs will continue to collect and upload all non-consented client data into the regional data repository. The department and State and Territory health departments do not have access to the personal information in the regional data repository, only summary reports
10.1.4.1.2. (b) Can PHNs supply the data to the Department of Health and Aged Care and state and territory health departments/agencies?¶
Provision of information to the department and state and territory health departments/agencies is necessary for governments to undertake their role in funding, monitoring and planning future service delivery.
Supply of personal information collected by PHNs to the department and state and territory health departments/agencies is governed by APP 6 which regulates how an organisation may use and disclose the health information that it collects. Under APP 6, if an organisation collects health information for a particular or ‘primary purpose’, it generally cannot use or disclose that information for a ‘secondary purpose’ unless an exception applies. A specific exception under APP 6 allows personal information to be used or disclosed for a ‘secondary purpose’ where there is client consent.
To comply with APP 3, the department is required to obtain the consent of clients before collecting health information. The department relies on PHNs to obtain this consent from a client. An item is included in the PMHC MDS to confirm that client consent for supply of their personal information to the department and state and territory health departments/agencies has been obtained. Any personal information attached to clients for whom the consent flag is not checked as ‘yes’ will not be passed to the department or state and territory health departments/agencies.
PHNs should therefore, by 30 April 2024, ensure that the consent documents and processes they establish include client consent to the provision of personal information to the Australian Government Department of Health and state and territory health departments/agencies.
It is important to note that consent is not required where data supplied by PHNs to the department and state and territory health departments/agencies does not include personal information. This applies, for example, to PMHC MDS Standard Reports that present aggregated, summary statistics on activities commissioned by each PHN.
The Department has prepared a set of standard words that can be used, or adapted as necessary, in any locally developed forms. These are available on the resources section of the PMHC MDS website (https://www.pmhc-mds.com/resources/).