64.32 Both the Section 95 and 95A Guidelines provide a detailed framework within which HRECs must consider the privacy implications of research proposals involving the use of individuals’ personal or health information. HRECs may approve research proposals seeking to use identifiable personal or health information without consent only on the basis that the public interest in the research substantially outweighs the public interest in maintaining the level of privacy protection provided by the IPPs and the NPPs.
64.33 In considering this balance, HRECs are asked to consider a long list of matters including:
· the degree to which the personal information is necessary for the research;
· the public importance of the research and the likely contribution to the community;
· any likely benefits to individuals or groups;
· whether the research could be achieved within the terms of the IPPs and NPPs and the degree to which this would impact on the scientific value of the research;
· whether the risk of harm to the individual whose personal information is to be used is minimal;
· the study design and scientific credentials of those involved in the research;
· whether access to the information is restricted to appropriate personnel;
· the procedures to be followed to ensure that the information is permanently de-identified before the publication of results; and
· the procedures to be followed at the completion of the study to protect or destroy the information.
64.34 The guidelines also address issues such as: preparing a proposal for approval by an HREC; and procedures to be followed in the collection, use or disclosure of personal or health information for research or the compilation or analysis of statistics.
64.35 The Section 95 and 95A Guidelines do not apply to the collection, use and disclosure of health information by agencies or organisations that are not covered by the Privacy Act. For example, the Act does not apply to state public sector entities, including public teaching hospitals and associated research bodies, where such bodies are established for a public purpose under a law of a state. These organisations, however, may be covered by state legislation.
 National Health and Medical Research Council, Guidelines under Section 95 of the Privacy Act 1988 (2000).
 National Health and Medical Research Council, Guidelines Approved under Section 95A of the Privacy Act 1988 (2001).
 National Health and Medical Research Council, Guidelines under Section 95 of the Privacy Act 1988 (2000), [3.3]; National Health and Medical Research Council, Guidelines Approved under Section 95A of the Privacy Act 1988 (2001), [D.5].
Privacy Act 1988 (Cth) s 6C.
 See, eg, Health Records Act 2001 (Vic) HPPs 1.1(e)(iii), 2.2(g)(iii).