Definition of ‘health information’

62.5 The Privacy Act defines ‘health information’ as follows:

(a) information or an opinion about:

(i) the health or a disability (at any time) of an individual; or

(ii) an individual’s expressed wishes about the future provision of health services to him or her; or

(iii) a health service provided, or to be provided, to an individual;

that is also personal information; or

(b) other personal information collected to provide, or in providing, a health service; or

(c) other personal information about an individual collected in connection with the donation, or intended donation, by the individual of his or her body parts, organs or body substances; or

(d) genetic information about an individual in a form that is, or could be, predictive of the health of the individual or a genetic relative of the individual.[8]

62.6 Paragraph (d) of this definition was added in response to a recommendation by the ALRC and the Australian Health Ethics Committee (AHEC) of the National Health and Medical Research Council (NHMRC) in Essentially Yours: The Protection of Human Genetic Information (ALRC 96).[9] That Report considered the definition of ‘health information’, as well as the definition of ‘sensitive information’, and concluded that there were circumstances in which genetic information may not fall within the existing definitions. This might arise where the information is not about health, disability or the provision of a health service—as in the case of parentage or forensic testing—or because it is not about the health or disability of an existing individual—as may sometimes be the case with genetic carrier testing, where the information is primarily about the health of future children.[10]

62.7 The ALRC and AHEC recommended that the definition of ‘health information’ should be amended to include ‘genetic information about an individual in a form which is or could be predictive of the health of the individual or any of his or her genetic relatives’.[11] In September 2006, the Privacy Legislation Amendment Act 2006 (Cth) was passed. The Act amended the definition of ‘health information’ in line with the ALRC and AHEC’s recommendation.

62.8 The definition of ‘health information’ in the draft National Health Privacy Code includes a similar list of elements to the Privacy Act definition. The major difference in the draft Code definition is that it expressly includes information or opinion about ‘the physical, mental or psychological health (at any time), of an individual’.[12]

62.9 The definitions of ‘health information’ in the New South Wales Health Records and Information Privacy Act 2002, the Victorian Health Records Act 2001 and the Northern Territory Information Act 2002[13]contain similar elements. The ACT Health Records (Privacy and Access) Act 1997 defines ‘personal health information’ more simply, as follows:

any personal information, whether or not recorded in a health record—

(a) relating to the health, an illness or a disability of the consumer; or

(b) collected by a health provider in relation to the health, an illness or a disability of the consumer.[14]

Issues Paper 31

62.10 In Issues Paper 31, Review of Privacy (IP 31), the ALRC asked whether the definition of ‘health information’ in the draft National Health Privacy Code was appropriate and effective and whether that definition should be adopted into the Privacy Act.[15] The ALRC was interested in receiving views on whether adding the terms ‘physical, mental or psychological’ to the definition of ‘health information’ would be of benefit.

62.11 In its submission to IP 31, the Department of Health and Ageing (DOHA) expressed support for the current definition in the Privacy Act. DOHA noted that the dictionary definition of health includes health of body and mind.[16] The Macquarie Dictionary defines ‘health’ as ‘soundness of body; freedom from disease or ailment’ or ‘the general condition of the body or mind with reference to soundness and vigour’.[17] DOHA was of the view that the words ‘physical, mental or psychological’ included in the draft National Health Privacy Code, were unnecessary.

62.12 The Office of the Privacy Commissioner (OPC) expressed the view that:

The proposed NHPC expressly includes ‘mental and psychological health’ as categories of ‘health information’, though the existing definition of the Privacy Act would already appear to comfortably allow for such an interpretation. In the Office’s view, a common sense interpretation of health information would include information relating to mental health.[18]

62.13 The NHMRC, however, stated in its submission that:

The NHMRC is concerned to ensure that the definitions of ‘health information’ and ‘health service’ in the Privacy Act reflect contemporary and evolving concepts of health and wellbeing.

While many stakeholders would consider that the term ‘health’ encompasses physical, mental and psychological elements, others draw a distinction between physical ‘health’ and mental/psychological ‘wellbeing’. For clarity, therefore, we support incorporation in the Privacy Act of the more expansive definition included in the draft National Health Privacy Code.[19]

62.14 A number of other stakeholders also expressed support for the definition in the draft National Health Privacy Code.[20]

Discussion Paper proposal

62.15 In the Discussion Paper, Review of Australian Privacy Law (DP 72),[21] the ALRC noted that the dictionary definition of the term ‘health’ is broad enough to cover mental and psychological health as well as physical health. The ALRC noted, however, the NHMRC’s comment that a distinction is sometimes drawn between physical health and mental or psychological wellbeing. The ALRC expressed the view that the Privacy Act should be clear on this point, especially given the sensitivity of personal information about mental or psychological health. The ALRC proposed, therefore, that the definition of ‘health information’ in the Privacy Act be amended to make express reference to information or an opinion about the physical, mental or psychological health or disability of an individual.[22]

Submissions and consultations

62.16 A significant number of stakeholders, including the NHMRC, the Department of Human Services, Medicare Australia, the Victorian Office of the Health Services Commissioner, the Australian Privacy Foundation and the Public Interest Advocacy Centre (PIAC), expressed support for this proposal.[23]

62.17 On the other hand, the New South Wales Department of Health was of the view that it was unnecessary to include the term ‘psychological’ in the definition as psychological health is subsumed in the broader term ‘mental health’. The Department noted that the Health Records and Information Privacy Act 2002 (NSW) refers to ‘physical or mental health’.[24]

62.18 Some stakeholders expressed the view that the addition of the words ‘physical, mental or psychological’ did not add anything and that the existing definition of ‘health information’ should be retained.[25] The OPC agreed, noting that the proposal was to ‘explicitly incorporate types of health information that are already recognised implicitly by the current definition of health information’. The OPC expressed concern that the proposed amendment might narrow the definition and reduce its flexibility by introducing a list of the types of health information covered by the Act. In addition, the OPC was concerned that amending the definition of health information in this way would introduce a level of inconsistency between the definition of ‘health information’ in the Privacy Act and the definition of a ‘health service’.[26]

ALRC’s view

62.19 The ALRC notes the strong support among stakeholders for including a reference to mental and psychological health in the definition of ‘health information’. The ALRC is concerned that the term ‘health’ is sometimes interpreted to mean ‘physical health’. Including the terms ‘physical, mental or psychological’ will not narrow the definition of health information, particularly as the existing definition includes ‘other personal information collected to provide, or in providing, a health service’. Rather, the addition of the terms will make it clear that ‘health information’ is not intended to be restricted to personal information about an individual’s physical health.

62.20 The ALRC also notes that, while there is overlap between the terms mental health and psychological health, there are also distinctions drawn between these two areas. For example, the Australian Psychological Society draws a distinction between the work of psychologists, who ‘help mentally healthy people find ways of functioning better’, and psychiatrists, who ‘mainly treat people with mental illness, such as schizophrenia’.[27] It is important, therefore, to include both mental and psychological health in the definition. The Privacy Act should be amended to make clear that ‘health information’ includes information in relation to physical, mental or psychological health. It is preferable to clarify the point by amendment, rather than wait for the issue to arise in the context of a complaint.

Recommendation 62-1 The definition of ‘health information’ in the Privacy Act should be amended to make express reference to the physical, mental or psychological health or disability of an individual.

[8] Ibid s 6. Paragraph (d) was added under Privacy Legislation Amendment Act 2006 (Cth) sch 2, cl 2.

[9] Australian Law Reform Commission and Australian Health Ethics Committee, Essentially Yours: The Protection of Human Genetic Information in Australia, ALRC 96 (2003).

[10] Ibid, [7.75].

[11] Ibid, Rec 7–4.

[12] National Health Privacy Working Group of the Australian Health Ministers’ Advisory Council, Draft National Health Privacy Code (2003), pt 4, cl 1.

[13]Health Records and Information Privacy Act 2002 (NSW) s 6; Health Records Act 2001 (Vic) s 3; Information Act 2002 (NT) s 4.

[14]Health Records (Privacy and Access) Act 1997 (ACT) Dictionary.

[15] Australian Law Reform Commission, Review of Privacy, IP 31 (2006), Question 8–7.

[16] Australian Government Department of Health and Ageing, Submission PR 273, 30 March 2007.

[17]Macquarie Dictionary (online ed, 2007).

[18] Office of the Privacy Commissioner, Submission PR 215, 28 February 2007.

[19] National Health and Medical Research Council, Submission PR 114, 15 January 2007.

[20] Australian Government Department of Human Services, Submission PR 136, 19 January 2007; Centre for Law and Genetics, Submission PR 127, 16 January 2007.

[21] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007).

[22] Ibid, Proposal 57–1.

[23] Australian Privacy Foundation, Submission PR 553, 2 January 2008; Public Interest Advocacy Centre, Submission PR 548, 26 December 2007; Australian Government Department of Human Services, Submission PR 541, 21 December 2007; Medicare Australia, Submission PR 534, 21 December 2007; Office of the Health Services Commissioner (Victoria), Submission PR 518, 21 December 2007; Privacy NSW, Submission PR 468, 14 December 2007; National Catholic Education Commission and Independent Schools Council of Australia, Submission PR 462, 12 December 2007; Pharmacy Guild of Australia, Submission PR 433, 10 December 2007; Carers Australia, Submission PR 423, 7 December 2007; National Health and Medical Research Council, Submission PR 397, 7 December 2007.

[24]Health Records and Information Privacy Act 2002 (NSW) s 6(a)(i).

[25] Confidential, Submission PR 570, 13 February 2008; Office of the Privacy Commissioner, Submission PR 499, 20 December 2007.

[26] Office of the Privacy Commissioner, Submission PR 499, 20 December 2007.

[27] Australian Psychological Society, Psychologists and Psychiatrists <www.psychology.org.au/community
/about/> at 14 April 2008.