The Australian government is releasing highly sensitive medical records to police through a secret regime that experts say contains fundamentally flawed privacy protections.
The Department of Human Services fields large volumes of requests for Pharmaceutical Benefits Scheme (PBS) and Medicare Benefits Schedule (MBS) data from state and federal policing agencies each year.
The records can paint a detailed picture of a person’s medical history, including, for example, any history of mental health issues, HIV, abortion or sexually transmitted diseases.
But, unlike the controversial My Health Record, no warrant or court order is needed for the department to release the information to police.
The department instead uses a set of internal guidelines to decide how and when it will acquiesce to a police request. It has never made the guidelines public and has actively fought to keep them secret.
The Medical Republic, a specialist medical news publication, recently won a year-long freedom of information battle with the department to secure the release of the guidelines and has shared the document with experts and Guardian Australia.
Lawyers and health privacy advocates were almost universally critical of the laxness of the privacy provisions in the guidelines, which have not been updated since 2003.
“If the road to hell is paved with good intentions, with this process the government has created a four-lane highway,” said Peter Clarke, a barrister at Isaacs Chambers in Melbourne. “The process is the antithesis of proper privacy protections.”
Dr Bernard Robertson-Dunn, the chairman of the health committee at the Australian Privacy Foundation, pointed out that the department’s guidelines had not been updated in 16 years. “So much for taking privacy seriously,” he said.
The department confirmed it has granted 2,677 requests from police for PBS and MBS data in the 12 months from September 2017. It said the information was released for a range of reasons, including for “the identification of deceased persons”.
The internal document released by the department – titled “Guidelines for the release of information where necessary in the public interest” – was heavily redacted. The key paragraphs that were not redacted said releasing private health information was not a decision to be taken lightly.
According to the guidelines, department officials would have to consider whether the disclosure of private health data was necessary and not merely convenient or helpful. They would also have to check whether the information was available through other channels.
Department officials were required to consider whether releasing the private health information was in the public interest as distinct from any private interests of the person seeking the information.
In the guidelines, the “public interest” is broadly defined as anything relating to national security, major crime, the administration of criminal law, or public safety.
The guidelines gave some concrete examples of serious situations where disclosing private health data to police would be in the public interest, such as to assist with investigations into murder, abduction, sexual assault, child molestation, serious drug offences and major fraud.
However, the document also stated that “these examples are not to be read as in any way limiting the circumstances in which the release of information may be regarded as necessary in the public interest”.
Jonathan Crowe, a professor of law at Bond University, said the “broad and vague nature of the guidelines for releasing confidential medical data to police is highly concerning”.
“The definition of ‘public interest’ is particularly open-ended and leaves significant and unchecked discretion to department officials,” he said.
Hank Jongen, a departmental spokesman, said the government took its privacy responsibilities “very seriously” and complied with all the relevant legislation.
He said information on MBS and PBS claims “may be significantly less detailed than the type of information found on a person’s MyHealthRecord” because it did not contain clinical notes made by health services providers.
MBS and PBS data are generally used as administrative records to keep track of government rebates to doctors and patients.
The department is required to report to the privacy watchdog, the Office of the Australian Information Commissioner, when it releases linked MBS and PBS data. But the Medical Republic has previously obtained a copy of several of these annual reports and the department recorded only five disclosures of linked MBS and PBS data to the police in 2016-17.
Privacy experts have called for the department’s privacy provisions to be brought in line with the My Health Record legislation.
The law was changed in 2018 so that police could no longer access My Health Record data without a court order.
“I would have thought the law relating to access to MBS and PBS data should be updated to reflect the decision by the parliament on the My Health Record,” said Malcolm Crompton, a former privacy commissioner of Australia and founder and lead privacy adviser at Information Integrity Solutions.
Dr Chris Moy, chair of the ethics and medicolegal committee at the Australian Medical Association, said the department’s data privacy laws should probably be put to the “pub test” to see if they still met community standards.