Skip to main content
Skip to secondary navigation
Australian Government - Office of the Australian Information Commissioner - Home

Consultation Paper for the Draft National Patient Charter of Rights; Submission to the Australian Commission on Safety and Quality in Health Care (March 2008)

Our reference: P07/132-1 Dr Nicola Dunbar National Patient Charter of Rights Australian Commission on Safety and Quality in Health Care GPO Box 5480 SYDNEY NSW 2001 Dear Dr Dunbar SUBMISSION ON THE CONSULTATION PAPER FOR THE DRAFT NATIONAL PATIENT CHARTER OF RIGHTS The Office o...

pdfConsultation Paper for the Draft National Patient Charter of Rights; Submission to the Australian Commission on Safety and Quality in Health Care (March 2008)

Our reference: P07/132-1

Dr Nicola Dunbar National Patient Charter of Rights Australian Commission on Safety and Quality in Health Care GPO Box 5480 SYDNEY NSW 2001

Dear Dr Dunbar


The Office of the Privacy Commissioner ('the Office') welcomes the opportunity to comment on the Australian Commission on Safety and Quality in Health Care's Draft National Patient Charter of Rights ('Draft Charter') [1]. The Office's comments specifically relate to matters of information privacy.

About the Office of the Privacy Commissioner

The Office of the Privacy Commissioner ('the Office') is an independent statutory body whose purpose is to promote and protect privacy in Australia. The Office, established under the Privacy Act 1988 (Cth) ('the Privacy Act'), has responsibilities for the protection of individuals' personal information that is handled by Australian and ACT Government agencies, and personal information held by all large private sector organisations, health service providers and some small businesses. The Office also has responsibilities under the Privacy Act in relation to credit worthiness information held by credit reporting agencies and credit providers, and personal tax file numbers used by individuals and organisations.

In regard to the Draft Charter, it is important to note that the jurisdiction of the Privacy Act does not extend to the regulation of public health systems in the states or territories, though health privacy legislation has been enacted for such purposes in some jurisdictions.

Promoting consumer awareness and participation in the handling of health information

The Office takes the view that the Privacy Act complements the existing culture of confidentiality that is fundamental to health service providers' professional practice obligations, including the appropriate handling of individuals' personal health information. At the same time, clear and open communication between health service providers and their patients is considered to be essential to good privacy practice [2].

For example, the Office has recently released a number of information sheets which explain the importance of good communication to managing individuals' reasonable expectations of how their health information may be handled. This is particularly important in regard to clinical contexts where health care is provided in multidisciplinary teams [3], as well as to some instances of quality assurance and accreditation [4].

Awareness of the purposes to which a health service provider uses or discloses a patient's personal information forms a fundamental aspect of privacy. NPP 1.3 gives effect to this principle by requiring an organisation that collects personal information directly from an individual to take reasonable steps to ensure that the individual is aware of:

  • the identity of the organisation and how to contact it;
  • the fact that the individual has a right to access the information;
  • the purpose of collection;
  • the organisations or types of organisations to whom it usually discloses personal information;
  • any law that authorises the collection of the information; and
  • the main consequences of not providing the information.

A similar obligation exists in NPP 1.5 where the information is collected from a third party. Notice is required to be furnished at or before the time of collection or, if that is not practicable, as soon as possible after collection. The Office notes that the draft Charter principles 4, 5 and 6 appear to align comfortably with the requirement that individuals be made aware of how their personal information might be handled.

The Office also notes that many of these principles are consistent with obligations established in the Privacy Act. In particular, the Office notes the importance given to empowering health consumers and ensuring that they are fully informed as to how their personal information may be handled during care (for example in principles 2, 4, 5 and 6). Such principles highlight the alignment between good clinical care and good privacy.

Individual's right to access health information

NPP 6 establishes a general right for individuals to access personal information held about them and to correct that information if they believe it is not accurate, complete or up-to-date. NPP 6 sets out health service providers' obligations in this regard with the aim of facilitating open communication between the provider and the individual.

Given the importance the NPPs place on a patient's legislated right to access personal information about them, the Office suggests that this right could be reflected in the principle 7 ('Privacy'), alongside the discussion of patient expectations with regard to information 'collection', 'use', 'disclosure' and 'storage'.

The right to exercise choice

An important principle underlying health information privacy is the patient's right (wherever practicable) to make informed decisions about the amount and types of information they provide in a health care context [5]. NPP 10 expressly provides that, in general, health information may not be collected unless it is with the consent of the individual (or where another exception applies, such as where the collection is required by law). The Office notes there appears to be a divergence between this concept of informed consent and the Draft Charter's statement that:

'Patients (who are able) are expected to provide information about their history, current treatment, medication and alternative therapies ...' (under Principle 5, 'Information')

While recognising that disclosure by a patient may be necessary for optimum treatment, the Office submits that there may be cases where full disclosure may not be appropriate, or not necessary, given the nature of the patient's ailment or condition requiring attention. In other cases, patients may choose to make informed decisions, for whatever purpose, not to disclose information that may otherwise assist their treatment.

The Office recommends that the draft 'Information' principle (point 5) be phrased in a way that better reflects the principle of empowering patients to be fully informed participants in their healthcare.

Further comments

On page 5 of the Draft Charter, under Principle 7 ('Privacy'), the Office observes that confidentiality of health information, while forming an important part of privacy protection, is one element of privacy. As discussed above, good privacy also involves such matters as the provision of adequate notice, a right to access and a requirement that personal information be accurate and up-to-date. The sentence may benefit from being rephrased to reflect an understanding of privacy in this broader sense.

Promoting national consistency

The Office notes the comments on page 2 of the consultation paper regarding the need to promote consistency between all Australian jurisdictions regarding patient charters.

Similarly, a significant issue in health privacy regulation in Australia is the need for greater consistency, simplicity and clarity, including between jurisdictions. This has been a key theme of the Office's submissions to the Australian Law Reform Commission's current Review of Australian Privacy Law[6]. For example, in order to address this confusion, the Office has supported the proposal that the Privacy Act be the single instrument regulating the handling of health information by all private sector health providers to the exclusion of state or territory legislation [7].

In its broadest sense, the privacy reform agenda therefore seeks to promote national consistency in a way that will clarify and enhance the regulation of health information privacy across jurisdictions. Given its own overarching aims in this respect, the Office welcomes the Commission's proposal for a nationally agreed set of health care principles that incorporate the important principle of privacy.

If more information is needed please contact Mr Brian Kent or Ms Frances Panopoulos in this Office on telephone (02) 9284 9800.

Yours sincerely

Karen Curtis Privacy Commissioner

19 March 2008

[1] Located at$File/Draft%20National%20Patient%20Charter%20of%20Rights%2022%20Jan%202008.PDF

[2] For further information, see the Office's health-specific web resources at:

[3] See Information Sheet 25, Sharing health information to provide a health service available at

[4] See Information Sheet 23, Use and disclosure of health information for management, funding and monitoring of a health service available at

[5] For further information, see NPPs 1 and 10 at:


[7] For further information, refer to Part H of the Office's Submission to the Australian Law Reform Commission's Review of Privacy-Discussion Paper 72 at