June 2002

Privacy law now becomes personal

By Trish Berry

‘Can I show my clients information I hold about them?’ is a question frequently asked by the Department of Human Services’ funded agencies.

From July 1, the answer will not only be ‘yes’ but agencies will be obliged by law to do so.

From that date the Health Records Act will apply to the handling of all health information across Victoria.

This law includes giving individuals the right to request access to their own health information and its correction if inaccurate, incomplete, misleading or not up-to-date.

Access to information will continue to be provided under the Freedom of Information Act where this law currently applies.

Victoria’s Health Services Commissioner Beth Wilson will administer the new legislation.

She will have powers to investigate complaints, impose compliance notices and impose penalties if a privacy breach is found to have occurred.

To prepare for this new law agencies should:

Look at how and where they record information.

How do you record information? Is it on file? On a laptop computer? On unattached pieces of paper? In more than one place? Do you have duplicate records that are not all maintained as carefully as each other? Ensure that your practices allow you and anyone else authorised to use the information you have gathered, to easily retrieve the most up to date information you have.

Look at how securely they store information.

Who else knows your computer password? Where do you keep the key to your filing cabinet? Do you leave client information on your desk when you are not there? Are you putting unprotected client information on shared computer drives that people not working with your client can get access to? Make sure that you can demonstrate, through your own practices, that you are taking reasonable steps to protect client or staff information from misuse.

Look at who they share information with.

Who do you share information with? Do your clients know? Check that you have their authority, or the authority of law, to share it.

Look at their records and practices from the client’s perspective.

If a client asked to see the information you hold, how easy is it for you to identify what is available? Do you know which information should not be released without consulting other people—because, for example, third parties are named? Is there information that would not be released at all—because, for example, it is prohibited by law? See if your practices can be improved so that any requests from your clients for access can be handled as efficiently and fairly as possible.

Talk to their co-workers.

Talk to your co-workers about office-wide practices such as controlling entry to the office and the capacity for staff to have conversations with clients over the phone or in person without being overheard. Ask your Records Manager about the records retention requirements and the use of shredders for confidential information. Many more ideas for immediate improvements to the way that personal information is handled are likely to emerge from these discussions.

Undertaking these activities means that agencies will be well placed to meet the requirements of the new law.

By preparing for the new law the clients and staff will:

• See that privacy is respected;

• Know more about how their information is handled;

• Have more choices in how their information is handled wherever possible;

• Be aware of their access and correction rights;

• Know how to make a privacy-related complaint.

• For more information visit http://www.dhs.vic.gov.au/privacy or http://www. health.vic.gov.au/hsc/