National Health Reform Amendment (Independent Hospital Pricing Authority) Bill 2011

Submission to Senate Finance and Public Administration Committee (September 2011)

Submission by Prof. John McMillan, Australian Information Commissioner

(By letter)

Senate Finance and Public Administration Committee
PO Box 6100
Parliament House
CANBERRA ACT 2600

Dear Committee Members
National Health Reform Amendment (Independent Hospital Pricing Authority) Bill 2011
I refer to the letter from Christine McDonald, Committee Secretary dated 26 August 2011.  Thank you for your letter.

The Office of the Australian Information Commissioner (the OAIC) welcomes the opportunity to make these brief comments to the Inquiry into the National Health Reform Amendment (Independent Hospital Pricing Authority) Bill 2011 (the Bill) regarding privacy.

The OAIC notes that Bill will establish the Independent Hospital Pricing Authority (the IHPA).  As the IHPA is a body that will be established for a public purpose under a Commounwealth enactment, the IHPA will be an ‘agency’ for the purpose of the Privacy Act 1988 (Cth) (the Privacy Act: see s 6).

The Privacy Act regulates the handling of ‘personal information’ by agencies (see s 14).  Personal information includes ‘information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion’ (s 6(1)).

Accordingly, the OAIC understands that the IHPA will be subject to the jurisdiction of the Privacy Act, to the extent that it handles personal information.

The OAIC has reviewed the Bill and the relevant explanatory memorandum.  The IHPA will necessarily handle personal information in relation to its general administration as an agency.  However, it is not clear whether the specific legislative functions and activities of the IHPA will involve the collection of personal information, or, for example, the IHPA would only collect de-identified and aggregated statistics.

The OAIC notes that, in addition to the IHPA’s obligations under the Privacy Act, the Bill includes a provision prohibiting officials of the IHPA from disclosing to researchers ‘information [that] is likely to enable the identification of a particular patient’ (s 221). 

The Bill also includes a provision that prohibits the the Australian Commission on Safety and Quality in Health Care, the National Health Performance Authority, and the IHPA from disclosing ‘information that is likely to enable the identification of a particular patient’ without the consent of the patient or their ‘surviving partner’ (s 228).

Accordingly, in the event that the functions and activities of the IHPA require the handling of personal information, the OAIC notes that the IHPA will be subject to obligations under the Privacy Act regarding the collection, storage, use and disclosure of personal information, and there is a clear emphasis in the Bill on preventing the disclosure of identifying information. 
As such, it appears to the OAIC that appropriate privacy safeguards will be built into the regulatory framework governing the IHPA.

If you have any questions, or require any further information, please contact Angelene Falk, Director – Policy [direct contact details redacted].

Yours sincerely

[signed]

Professor John McMillan
Australian Information Commissioner
1 September 2011