AMA submission on Healthcare Identifiers and Privacy: proposals for legislative support

The AMA appreciates the opportunity to provide comments in response to the Healthcare Identifiers and Privacy: Discussion paper on proposals for legislative support, which is seeking feedback on:

1. legislative proposals to support the establishment and implementation of  national healthcare identifiers; and
2. enhanced arrangements for the privacy of health information.

The AMA understands the Minister for Health and Ageing intends to introduce two separate bills to address each of the issues.

Healthcare Identifiers
The AMA supports the implementation of healthcare identifiers to facilitate the secure and appropriate electronic sharing of a patient's electronic health record between healthcare providers.  Healthcare identifiers are an essential building block towards the national implementation of electronic health records.

Legislation
Unique healthcare identifiers, and the demographic information that will be attached to healthcare identifiers, should be used only to:

• uniquely identify individuals (patients) and healthcare providers; and
• enable healthcare providers to accurately and securely access and share patient health information electronically. 

The AMA supports legislation that achieves these objectives.

In this respect, we would expect legislation supporting the establishment and implementation of national healthcare identifiers to:

• establish the governance arrangements for the Healthcare Identifiers Service;
• set out the precise details/content and use of the demographic information required for healthcare identifiers to be allocated to individuals, healthcare providers and healthcare provider organisations;
• protect the privacy, security and confidentiality of the demographic information held by the Healthcare Identifiers Service;
• prohibit and provide penalties for the unauthorised use of healthcare identifiers and the demographic information held by the Healthcare Identifiers Service; and
• clearly identify who can get access to details and information.

The legislation should specifically preclude clinical information being collected or held by the Healthcare Identifiers Service. 

In addition, the legislation should state very clearly that people are not required to have or declare a healthcare identifier in order to receive a healthcare service or a rebate or benefit for the service to which they would otherwise be entitled.

Implementation of Healthcare Identifiers
There will be many issues that arise with the implementation of healthcare identifiers that will not be covered by enabling legislation. The AMA believes the Department will need to provide the healthcare industry with a documented implementation plan for roll out of healthcare identifiers and consult with stakeholders on the practical aspects of the plan.

Further, given that healthcare identifiers will be automatically allocated to every individual who is known to Medicare Australia, it is critical that the Government undertake a public information and education campaign to ensure the Australian people are fully informed about how and why healthcare identifiers will be used. This should occur well before implementation. 

We recognise that automatic allocation of identifiers to individuals from Medicare records to the Healthcare Identifiers Service should be a relatively smooth administrative process for Government.  However, we anticipate there may be some practical problems for medical practice, particularly if the proposed arrangement for medical practice records to be automatically populated with individual identifiers is delayed or fails.  While there are proposals for alternative methods for medical practices to acquire patient individual identifiers, such as swiping a patient’s Medicare card or contacting the Healthcare Identifiers Service, these will be cumbersome.  We ask that the alternative methods be fully explored in consultation with medical practices to ensure they reduce the administrative burden on already busy practices.

We would be happy to be involved in discussions to assess any practical implications for medical practices in the early days of implementation, and what measures might be taken to mitigate the impact on practice staff and the flow of patients through medical practice receptions. 

The AMA notes that individual healthcare providers will be allocated their identifiers through the proposed national registration and accreditation scheme, and that a single number will be allocated for both purposes. 

The implementation of healthcare identifiers presents a perfect opportunity for Medicare Australia to also implement a new single Medicare provider number system using the healthcare identifier for:

• medical practitioners to retain a single national provider number; and
• each practice location in Australia to receive a location specific identification number.

A single Medicare provider number has been recommended by the Productivity Commission in its Annual Review of Regulatory Burdens on Business: Social and Economic Infrastructure Services Draft report released on 26 June 2009. 

The enhancements to practice management and clinical software and the roll out of any hardware (ie card readers) in order to be HI compliant must be cost neutral to medical practices. There are a number of other practical issues that remain unclear, such as exactly how the doctors’ existing practice records will be populated with the individual identifiers and how new identifier details will be provided for new patients. The impact on already busy medical practices must be kept to a minimum.

The AMA recognises the importance of data security and having robust data protection and healthcare provider authentication measures in place in order to protect personal information from misuse or unauthorised access. We are mindful of the problems that can occur with use of the ‘tokens’ and individual certificates. Loss or damage of the token (i.e. smartcard), expiry and renewal processes will need to occur with minimal impact on practices. The Government should meet the costs of its preferred token for healthcare provider access arrangements.

Enhanced arrangements for the privacy of health information
Medical practitioners take very seriously their obligation to maintain patient confidentiality and they would only consider exceptions to this in very particular circumstances, such as where there is a serious risk to the patient or another person, where the law requires it, for approved research purposes, or where there are overwhelming societal interests.

Any new or changes to existing legal or administrative obligations on healthcare providers that arise from a new national privacy framework must be clearly explained to them.

August 2009