Connecting the Dots: Clarifying Health Information Privacy in the Primary Care Sector HINZ 2008 Sebastian Morgan-Lynch Policy Adviser (Health) [email_address] (04) 474 7593

The HIPC in a Nutshell Only get it if you really need it Get it straight from the people concerned Tell them what you’re going to do with it Be nice when you’re getting it Take care of it once you’ve got it They can see it if they want to They can correct it if it’s wrong Make sure it’s right before you use it Get rid of it when you’re done with it Use it for the purpose you got it Only disclose if you’ve got a good reason Be careful with unique identifiers

Only get it if you really need it

Get it straight from the people concerned

Tell them what you’re going to do with it

Be nice when you’re getting it

Take care of it once you’ve got it

They can see it if they want to

They can correct it if it’s wrong

Make sure it’s right before you use it

Get rid of it when you’re done with it

Use it for the purpose you got it

Only disclose if you’ve got a good reason

Be careful with unique identifiers

Whose data is it? Agencies have obligations (purpose and openness) Individuals have rights (access and correction) Ownership is a bundle of rights, but not helpful to talk about ‘owning’ information Also, privacy law focuses on awareness rather than consent However both consumers and clinicians can have a valuable sense of ownership over information about them – don’t want it misused Trust is harder to regain than it is to lose

Agencies have obligations (purpose and openness)

Individuals have rights (access and correction)

Ownership is a bundle of rights, but not helpful to talk about ‘owning’ information

Also, privacy law focuses on awareness rather than consent

However both consumers and clinicians can have a valuable sense of ownership over information about them – don’t want it misused

Trust is harder to regain than it is to lose

What are the advantages of primary care information management? Generally high level of consumer trust Sensible data-use models -- keep the rich data at the outskirts, aggregate and analyse the anonymous data in the middle Strong ethical framework for clinicians Cost-effective and appropriate way to spend money on improving outcomes Face–to–face communication

Generally high level of consumer trust

Sensible data-use models -- keep the rich data at the outskirts, aggregate and analyse the anonymous data in the middle

Strong ethical framework for clinicians

Cost-effective and appropriate way to spend money on improving outcomes

Face–to–face communication

What are the risks for primary care information management? High level of spending means high need for accountability Accountability needs lots of data – PHO PMP, CBF Database etc Auditor-General report, Oct 2008 – “the information currently collected about PHOs’ and DHBs’ performance may need to be amended” Large amounts of data are a tempting target for other uses – rule 10 Once data is in the system, no further obligations to inform consumers– rule 3 Danger that if consumers discover, or decide, that their data is being misused, that useful programs will be lost or data will not be provided Is technology becoming the focus rather than the patient?

High level of spending means high need for accountability

Accountability needs lots of data – PHO PMP, CBF Database etc

Auditor-General report, Oct 2008 – “the information currently collected about PHOs’ and DHBs’ performance may need to be amended”

Large amounts of data are a tempting target for other uses – rule 10

Once data is in the system, no further obligations to inform consumers– rule 3

Danger that if consumers discover, or decide, that their data is being misused, that useful programs will be lost or data will not be provided

Is technology becoming the focus rather than the patient?

What are the risks for primary care information management? Do GPs understand what happens with consumer information? Perception of high complexity Busy, stressed Lack of easily accessible information If they do, do they have the time or inclination to explain it to their patients? High staff turnover Pressure to get patients through Concern that knowing too much will just alarm them What resources are available Leaflets, training from OPC Web resources HIPC and “On the Record” Guidance material on PHO extraction and results repositories coming soon

Do GPs understand what happens with consumer information?

Perception of high complexity

Busy, stressed

Lack of easily accessible information

If they do, do they have the time or inclination to explain it to their patients?

High staff turnover

Pressure to get patients through

Concern that knowing too much will just alarm them

What resources are available

Leaflets, training from OPC

Web resources

HIPC and “On the Record”

Guidance material on PHO extraction and results repositories coming soon

Case Study: Testsafe Regional Results Repository Repository for test data for Auckland, Waitemata and Counties Manukau DHBs Started with secondary providers Moved to primary providers in December 2005 Testsafe Privacy Framework Audit Random/directed Break glass Governance RISSP, RISG, RPAG Purposes Primary/secondary Opt-off Provider/patient Locked access

Repository for test data for Auckland, Waitemata and Counties Manukau DHBs

Started with secondary providers

Moved to primary providers in December 2005

Testsafe Privacy Framework

Audit

Random/directed

Break glass

Governance

RISSP, RISG, RPAG

Purposes

Primary/secondary

Opt-off

Provider/patient

Locked access

Case Study: Testsafe Privacy Issues Notification (rule 3) Obligations fall on collecting agency – is this: Primary Care provider? Testing agency? DHB (Testsafe)? Security (rule 5) Obligation to keep health information safe (Testsafe) Obligation to ensure health information that is passed on is treated with appropriate care Secondary use/disclosure (rules 10/11) Terms (“secondary” vs “directly related”) Why are tests carried out – immediate benefit vs future benefit Wider use of information (service planning, population monitoring, health outcomes) Controls on secondary uses (governance)

Notification (rule 3)

Obligations fall on collecting agency – is this:

Primary Care provider?

Testing agency?

DHB (Testsafe)?

Security (rule 5)

Obligation to keep health information safe (Testsafe)

Obligation to ensure health information that is passed on is treated with appropriate care

Secondary use/disclosure (rules 10/11)

Terms (“secondary” vs “directly related”)

Why are tests carried out – immediate benefit vs future benefit

Wider use of information (service planning, population monitoring, health outcomes)

Controls on secondary uses (governance)

Public Health Data and Informed Consent Trust is a key resource Currently very high – 92% in UMR survey Public involvement very low HISAC initiatives 48% awareness of NHI Signficant risk to integrity of e-health agenda if public ignored Legal obligation to inform patients falls at point of collection Emphasis on primary care data means this hits GPs hard GPs need to be aware of what is happening with their patients information or they will refuse to pass it on GPs are effectively gatekeepers, a function consistent with their privacy obligations Secondary users of health information need to take primary healthcare needs for understanding seriously Even where informed consent is not a legal requirement, many of same considerations apply

Trust is a key resource

Currently very high – 92% in UMR survey

Public involvement very low

HISAC initiatives

48% awareness of NHI

Signficant risk to integrity of e-health agenda if public ignored

Legal obligation to inform patients falls at point of collection

Emphasis on primary care data means this hits GPs hard

GPs need to be aware of what is happening with their patients information or they will refuse to pass it on

GPs are effectively gatekeepers, a function consistent with their privacy obligations

Secondary users of health information need to take primary healthcare needs for understanding seriously

Even where informed consent is not a legal requirement, many of same considerations apply

Contact Telephone: Wellington (04) 474 7590 Auckland (09) 302 86 80 Enquiries hotline: 0800 803 909 Email: [email_address] Internet address: http://www. p rivacy. o rg.nz Cartoons (c) Chris Slane, www.slane.co.nz

Telephone: Wellington (04) 474 7590

Auckland (09) 302 86 80

Enquiries hotline: 0800 803 909

Email: [email_address]

Internet address: http://www. p rivacy. o rg.nz