Access rights and genetic information

21.113 The Privacy Act and other privacy legislation impose constraints on the disclosure of genetic information by doctors and other health professionals to the genetic relatives of their patients. Privacy legislation also provides individuals with rights to access information about themselves.

21.114 NPP 6 of the Privacy Act states that, subject to some exceptions, if an organisation holds personal information ‘about’ an individual, it must provide the individual with access to the information on request.^[148] The Act provides a legally enforceable right for patients to obtain access to their medical records held by private medical practitioners.^[149] However, because these records may also contain information about genetic relatives (such as their probable genetic status) genetic relatives may also seek access under NPP 6.

21.115 In these circumstances, where the information (such as in a family medical history) is ‘about’ a genetic relative who is not a patient, the obligation to provide access to the genetic relative under the Privacy Act may conflict with a health professional’s legal and ethical duties of confidentiality with respect to his or her patient.^[150]

21.116 NPP 6 provides that access may be refused to the extent that ‘providing access would have an unreasonable impact upon the privacy of other individuals’.^[151] Therefore, in some circumstances, a health professional may be entitled to refuse access to part of the records.^[152]

21.117 There are ways in which a health professional may be able to release familial genetic information without disclosing information about any specific person’s own genetic status, for example, by removing the other person’s identifying details.^[153]Health professionals may have latitude, in dealing with requests for access, to recognise a distinction between familial and individual genetic information. Professor Skene has referred to this distinction in the following terms.^[154]

There is the fact that a mutation is in the family; and the fact that a particular person has tested positive for the mutation. The information that is familial is the first kind. A person’s own genetic status is personal information and should generally be kept confidential in the same way as information concerning the patient’s clinical or surgical history. Whether the person choses to disclose his or her own genetic status to family members—or even choses not to know it at all—is a matter for that person alone.^[155]

21.118 The HGSA suggested that health professionals may need more guidance on dealing with access by family members to genetic information held by them.

Medical practitioners would appreciate guidance on access by family members to genetic health information they hold. Having a separate file for each family member is appropriate and laboratories should not record the results of tests on multiple family members on the one report form. It would be very helpful to have advice on how to handle information in a file that has not been disclosed to the person tested eg. the result of a genetic test that the doctor knows reveals non-paternity because he/she also holds information on other family members or where a laboratory has tested multiple members of a family and records inconsistent results in its report. Also, while a senior next of kin should be entitled to access specific information about a deceased person that could be of use in the health care of other family members, it should not be possible to access the whole medical record, which may contain information that the next of kin does not know about relatives, or paternity and other highly sensitive information.^[156]

21.119 The Inquiry has concluded that health professionals would benefit from further guidance on how to deal with requests for access to genetic information held by them.^[157] This issue might usefully be considered in conjunction with the proposed development by the NHMRC of guidelines dealing with disclosure of genetic information by health professionals to the genetic relatives of their patients.

21.120 The discussion above deals with situations in which the information held by a health professional is clearly ‘about’ the genetic relative who is identifiable from the record. However, another situation must also be considered—that in which a genetic relative needs to obtain access to information that is clinically relevant to them but which is not ‘about’ them in terms of NPP 6. While it may be possible for an individual to argue that a genetic relative’s information is relevant to that individual’s health in its familial aspect, the rights under NPP 6 may not be asserted unless the information also identifies the individual seeking access.^[158] The Inquiry has concluded that the Privacy Act should be amended to provide specifically that an individual has a right to access familial genetic information relating to his or her genetic relatives in limited circumstances.

21.121 Individuals sometimes need to obtain access to information relating to genetic relatives, either living or dead, in order to facilitate their own diagnosis and treatment. Yet the relatives (or the personal representative of a deceased relative) may decline to consent to the disclosure of this information. Privacy NSW suggested that the Privacy Act could be redrafted to

explicitly permit access to both health information and tissue samples of the deceased person by a genetic relative. Whilst it might appear unlikely that a next-of-kin would seek to legally challenge such access, the amendment would provide clarification for patients requiring access and the hospital or research institution which holds the genetic samples and health records.^[159]

21.122 The implementation of Recommendation 21–1 would permit health professionals to disclose a patient’s genetic information to a genetic relative, without the patient’s consent, where disclosure is necessary to lessen or prevent a serious threat to the life, health, or safety of an individual. Consistently with that position, genetic relatives should also be entitled to exercise rights of access on their own initiative.

21.123 The Inquiry considers that any such right of access should be limited to situations where the information is necessary to lessen or prevent a serious threat to their life, health, or safety^[160]—that is, in circumstances in which a health professional would be permitted to disclose the information, under Recommendation 21–1, without any request for access.

21.124 The rights of access should be exercisable only in relation to familial genetic information about the siblings, parents or children of the individual (first-degree genetic relatives) on the basis that genetic information is likely to be of sufficient clinical importance to justify disclosure only if the family relationship is very close. Access should be provided by making the information available to the requester’s nominated medical practitioner or genetic counsellor, who can explain the clinical relevance of the information obtained for the individual seeking it.

21.125 Where an organisation receives a request for access to genetic information about an individual’s genetic relatives, the organisation should be obliged to first ask the genetic relatives whether they consent to the organisation providing access, unless it is impracticable to do so. Where consent is not given, access could be refused if providing access would have an unreasonable impact upon the privacy of any individual.^[161]

21.126 The other reasons for refusing access set out in NPP 6 should also apply to requests from individuals seeking access to information about genetic relatives, including that the request for access is ‘frivolous or vexatious’ or that the information relates to legal proceedings.^[162]

21.127 The Inquiry recognises that this recommendation, if implemented, would represent a significant extension of the Privacy Act. For the first time, the Act would provide certain individuals with rights to access information about other people. However, this policy position is a corollary of the shared or familial nature of genetic information (see Chapter 7).

21.128 As in cases where disclosure by a health professional is capable of preventing a serious threat to the life, health or safety of an individual (see Recommendation 21–1), the Inquiry’s recommendation may permit disclosure of genetic information by health professionals that would breach usual duties of confidentiality. However, disclosing information to those relatives when it is clinically relevant to them clearly differs from disclosing it to others. Obligations of confidentiality would remain in respect of the world at large.

21.129 Providing rights to access familial genetic information would not lead to significant or unjustifiable erosion of medical confidentiality. Decisions on access would be made by health professionals who may be expected to have a good understanding of the importance of preserving medical confidentiality and an ability to balance this interest against the clinical consequences of non-disclosure for the individuals involved.

21.130 In order for an individual to request access, he or she would already have to know that the genetic relative was being treated by the particular health professional to whom the request is directed. Health professionals who receive such requests would have ample grounds for refusing to provide access where the information they hold is not important to the health of the individual seeking it.

21.131 The existence of new statutory access rights (and an obligation on health professionals to ask patients to consider consenting to disclosure) may assist health professionals in dealing with conflicting ethical duties to patients and genetic relatives. It may also bring home to patients the fact that they should consider any ethical obligation to share genetic information with their families. Health professionals who chose to disclose information will be better protected from legal action and complaints in relation to the disclosure of familial genetic information.