28.07.2010
21.4 The collection of family medical history is an established part of medical practice. When providing a health service, health professionals may need to collect family medical history in order to diagnose a patient’s condition accurately. Information about the medical history of genetic relatives assists health professionals in providing effective health services to their patients. Such information may assist in diagnosis; the provision of medical advice about genetic risk to the patient or to present or future children; treatment or prevention; and genetic counselling. If this information is not collected the medical care or advice provided to the patient may be compromised.
21.5 This information may relate to the health, or age and cause of death, of individuals who are closely genetically related to the patient. It may also include social medical history; for example, information regarding marital status; health of spouse, children and other household members; and what social support is available.[3]
21.6 Family medical history takes on particular significance in the practice of genetic medicine.[4] Genetic diagnosis is not always possible from a sample or information provided by one person and it may be desirable to test genetic relatives as well as the patient. Such testing may be necessary to establish inheritance patterns correctly, to confirm the mutation in at least one other affected member of the family (as part of developing a ‘family-specific’ genetic test) or to determine susceptibility for families at risk.[5]
21.7 Even if genetic relatives are not tested, the verification of a genetic diagnosis usually involves the provision of information from or about relatives. This is often referred to as the compilation of a ‘family pedigree’.
The information to construct the ‘family pedigree’ may come from living relatives; death registers; autopsy results; cancer or other registers; medical records of relatives who have died; deposits of stored tissue; or other research studies.[6]
Application of privacy legislation to collection
21.8 The Privacy Act imposes constraints on the collection of genetic information by doctors and other health professionals about the genetic relatives of their patients.[7] National Privacy Principle (NPP) 1 of the Privacy Act provides that an organisation must not collect personal information unless the information is necessary for its functions, and that it must collect personal information only by lawful and fair means and not in an unreasonably intrusive way.[8] Individuals must be informed about various matters such as their access rights, the purposes of collection, and to whom the organisation usually discloses information of that kind.[9] In general, an organisation must collect personal information about an individual only from that individual, rather than from any third party, unless it is not ‘reasonable and practicable’ to do so.[10]
21.9 NPP 10.1 of the Privacy Act provides that an organisation must not collect sensitive information (including genetic and other health information) unless the individual has consented. The principle then sets out the circumstances in which an organisation may collect sensitive information without consent. In some circumstances, the collection of family medical history by health professionals without the consent of the family members to whom the information relates would breach NPP 10.1.
21.10 This position was remedied by a Temporary Public Interest Determination (the Temporary PID) issued by the federal Privacy Commissioner on 21 December 2001,[11] and by final Public Interest Determinations (PIDs) issued on 15 October 2002.[12] In issuing the PIDs, the Privacy Commissioner concluded that the public interest in taking social, family or medical history outweighed to a substantial degree the public interest in full adherence to the NPPs because history taking is central to good health care and services. Strict compliance with NPP 10.1 would jeopardise public health and be an ‘unrealistic curtailment’ on the ‘core and essential practices’ of health providers.[13]
21.11 The effect of the PIDs is to ensure that an organisation can collect social, family or medical history from an individual (a consumer) about another individual (a third party) without breaching NPP 10.1 where collection is
necessary for the organisation to provide a health service directly to the consumer; and
the third party is a member of the consumer’s family or household, or the third party’s information is otherwise relevant to the consumer’s family, medical or social history.[14]
21.12 Unlike the Temporary PID, the final PIDs do not exempt organisations from their obligations to adhere to NPP 1.5. As a result, organisations remain obliged to take reasonable steps to ensure that third parties are informed about the collection of information.[15]
21.13 Issues concerning the collection of health information about genetic relatives will also arise under state and territory privacy legislation, which contains privacy principles similar to those in the federal Privacy Act. For example, the Health Records Act 2001 (Vic) contains provisions requiring an individual’s consent to the collection of health information about that individual.[16] Under the Act, organisations must collect health information about an individual only from that individual (if it is reasonable and practicable to do so)[17] and individuals must be informed about the circumstances of collection where health information about them is collected from someone else.[18]
21.14 Collection by health professionals of family medical history without the consent of family members may breach some or all of these provisions. In response, the Victorian government has promulgated regulations to permit health service providers to collect health information from a person about another individual where the information is reasonably necessary to ensure that health services are provided safely and effectively to the person.[19]
21.15 Importantly, the PIDs and the Victorian regulations apply only to situations in which a health service is provided directly to the individual (the patient) from whom family medical history is sought. The information must also be collected directly from the individual being treated in order to come within the terms of these exemptions.
21.16 In some circumstances information about genetic relatives is collected in order to facilitate the diagnosis or treatment of someone other that the patient. This may be done to give genetic relatives an opportunity to become aware of their genetic risk and to access genetic counselling and medical advice. Information collected from patients may then need to be verified through contact with other sources, such as the treating doctors of those genetic relatives. The PIDs and the Victorian regulations do not authorise these forms of indirect collection of information about genetic relatives. These limitations are particularly relevant to the operation of genetic registers, as discussed in Chapter 22.
21.17 However, at least in relation to the collection of family medical history where this is necessary to provide a health service directly to the person providing the history, the PIDs have removed constraints on established medical practice that would otherwise exist. To this extent, the PIDs recognise the shared nature of family medical histories, including genetic information, and provide an appropriate framework for collection of this information.
[3] See Privacy Commissioner Temporary Public Interest Determination No. 2001–1 2001 (Cth), 3.
[4] Many submissions referred to the clinical importance of collecting medical information about the genetic relatives of patients. See G Suthers, Submission G026, 30 November 2001; Confidential Submission G030CON, 17 December 2001; Peter MacCallum Cancer Institute, Submission G104, 20 February 2002; Human Genetics Society of Australasia, Submission G050, 14 January 2002.
[5] See L Skene, ‘Patients’ Rights or Family Responsibilities? Two Approaches to Genetic Testing’ (1998) 6 Medical Law Review 1, 5–6.
[6] Ibid, 6.
[7] Patients themselves need not comply with the Privacy Act NPPs in their collection, use and disclosure of information about their genetic relatives provided this is for the purposes of their ‘personal, family or household affairs’: Privacy Act 1988 (Cth) s 16E; Health Records Act 2001 (Vic) s 13.
[8]Privacy Act 1988 (Cth) NPP 1.1–1.2.
[9] Ibid, NPP 1.3.
[10] Ibid, NPP 1.4. In order to determine whether it is ‘reasonable and practicable’ to collect information indirectly, the federal Privacy Commissioner has recommended balancing a number of factors. These include: whether it is possible to collect the information directly; whether a reasonable individual might expect information about them to be collected directly or indirectly; how sensitive the information is; the cost to an organisation of collecting directly rather than indirectly; the privacy consequences for the individual if the information is collected indirectly rather than directly; and what is accepted practice: Office of the Federal Privacy Commissioner, Guidelines to the National Privacy Principles (2001), OFPC, Sydney, 22.
[11] The date the NPPs came into force under the Privacy Amendment (Private Sector) Act 2000 (Cth).
[12]Privacy Commissioner Public Interest Determination No. 9 2002 (Cth); Privacy Commissioner Public Interest Determination No. 9A 2002 (Cth). A Public Interest Determination (PID) may be issued by the Privacy Commissioner, on the application of an interested person, where an act or practice may beach the NPPs but the public interest in doing the act, or engaging in the practice, substantially outweighs the public interest in adhering to NPPs: See Privacy Act 1988 (Cth) Pt VI. PID 9A gives PID 9 general effect to apply to all health service providers.
[13]Privacy Commissioner Public Interest Determination No. 9 2002 (Cth), 17.
[14] Ibid.
[15] However, it may not be necessary to take such steps where the third party is already aware of the relevant matters or where steps could be taken but it is unreasonable to do so. The Privacy Commissioner has stated that deciding what steps are reasonable involves making a judgment based on the situation as a whole and balancing a number of possible factors including: a third party’s expectations and existing knowledge about the collection of information; the practicalities of providing notice to the third party; conflicting legal obligations, such as legal professional privilege and the obligations of confidentiality on the organisation; and the costs of providing notice to a third party: Ibid, 9.
[16]Health Records Act 2001 (Vic) Health Privacy Principle 1.1(a).
[17] Ibid, Health Privacy Principle 1.3. See also Health Records and Information Privacy Act 2002 (NSW), Health Privacy Principle 3(1).
[18]Health Records Act 2001 (Vic) Health Privacy Principle 1.5. See also Health Records and Information Privacy Act 2002 (NSW) Health Privacy Principle 4(2).
[19]Health Records Act 2001 (Vic) Health Privacy Principle 1.1(i); Health Records Regulations 2002 (Vic) r 8. The information collected is exempt for the purposes of Health Privacy Principle 1.5, meaning that the organisation need not inform the third party about the collection.