Summary

“Health information” is defined extremely broadly in the HIPC and includes all medical history, and is not limited to information provided to a health professional by a patient.¹ The information need not even bear directly on a person’s health or on health services they have received, provided it concerns an identifiable individual and was collected in the course of and incidental to the provision of any health service.

Regulation

The management of personal and health information is largely regulated by statute, in the Privacy Act 1993 (Act) and more specifically the Health Information Privacy Code 1994 (HIPC) issued as a code of practice under the Act. The HIPC applies to all agencies providing personal, public health or disability services from the largest hospitals to sole health practitioners.²

Collection of health information is covered by Rules 1-4 of the HIPC, including the purpose of collection (rule 1), the source of the information (rule 2), transparency towards the individual (rule 3) and the manner of collection (rule 4). Together with rule 5 (regarding security and storage of health information), these rules are intended to reinforce individual autonomy and people’s control over their information by requiring transparency of collection and handling.

Content to be collected

With regards to the content of the health information, and more specifically what should be collected as part of a patient’s medical records, the MCNZ recommends keeping clear and accurate patient records that report:³

• Relevant clinical information
• Options discussed
• Decisions made and the reasons for them
• Information given to patients
• The proposed management plan
• Any drugs and other treatment prescribed

The MCNZ recommends that these records are made at the same time as the events occur or as soon as possible afterwards. Upon review of these records, if a practitioner feels they are inaccurate, incomplete or misleading, it is appropriate to augment a record in such cases, making it clear when and by whom the augmentation or annotation was made. The earlier entry however should never be deleted, obliterated or changed.⁴

Ensuring the patient is aware of what is collected about them

Firstly, as a general rule, a health agency should always endeavour to collect the information directly from the individual concerned, and when doing so, an agency must take all reasonable steps to ensure that the individual is aware that the collection is taking place, is aware of who is doing the collection, for what purpose, and with what intentions (if any) to pass the information to others.⁵

The individual should also be told the name and address of the agency which will be keeping the information, and that they have a right of access to it. If practicable because these steps should be taken before the information is collected or as soon as possible afterwards.

There are a number of exceptions to the general rule to collect information directly from the individual concerned. These include if the health agency believes on reasonable grounds that the individual authorises collection of the information from someone else, or if compliance is not reasonably practicable because it would prejudice the interests of the individual or the purposes of collection.

Be aware however, that these exceptions are very fact specific and in the majority of cases patients should be notified about the information collected about them from a third party. In a case before the Human Rights Review Tribunal involving the collection of health information by a doctor about a patient, from the patient’s husband (under a promise of confidentiality), the doctor was found to have clearly breached the patient’s privacy rights in failing to both inform her of this information, and provide her access to it.⁶

In some circumstances there may be a legal obligation to provide an interpreter when explaining things to a person who speaks another language, or who, for instance, is unable to understand spoken English due to physical disability.⁷

In practice, it is recommended that healthcare agencies communicate these matters by the use of leaflets, and by notices on the forms which the individuals use to give the information.⁸

Communication of the purpose of collection

Rule 1 of the HIPC states that health information must only be collected for a lawful purpose connected with a function or activity of the health agency, and the collection of the information is necessary for that purpose. Health information should generally only be collected for purposes related to care and treatment, including the administrative aspects of those activities. Rule 1 does not apply to unsolicited material volunteered to health agencies (eg, irrelevant health information offered by a patient in a consultation), only to material deliberately collected. However, if a practitioner decides to keep that unsolicited information, it is then ‘collected’ and subject to the rest of the HIPC rules.

There may also be secondary purposes of collection, for example, patient records can be used for an audit of competence or training, or for administrative purposes like billing. These purposes will also need to be communicated to the individual.

As noted above, Rule 3 of the HIPC requires this purpose to be clearly explained to the individual concerned. Openness about the purpose of collection can assist health agencies to use and disclose the information in future. Rule 10 and 11 of the HIPC always allow information to be used and disclosed for the particular purpose where doing so was one of the reasons for obtaining the information in the first place. Therefore, communicating the purposes of collection to the individual at the point of collection is of utmost importance. When individuals can understand the purpose and proposed uses and disclosures, they can decide whether they wish to provide information by weighing up the benefits against the consequences of not doing so. An advantage of this is that individuals will be prepared for a use or disclosure which might otherwise come as a surprise to them, which will minimise the risk of a complaint.

References

1. HIPC, Clause 4(1)
2. HIPC, Clause 4(2)
3. MCNZ, Statement on Good Medical Practice, (December 2016)
4. Cole’s Medical Practice in New Zealand (2017)
5. HIPC, Rule 3
6. The Director of Human Rights Proceedings v QD [2010] NZHRRT 3
7. Mental Health (Compulsory Assessment and Treatment) Act (1992), section 6.
8. Cole’s Medical Practice in New Zealand  (2017).