Wednesday, 22 March 2023

Health Legislation Amendment (Information Sharing) Bill 2023

Council’s amendments

Message from Council relating to amendments further considered.

Debate resumed on motion of Steve Dimopoulos:

That these amendments be agreed to.

Council’s amendments:

1. Clause 4, page 4, after line 26 insert –

“Privacy Management Framework means the Privacy Management Framework established under section 134ZT;”.

2. Clause 4, page 14, line 17, omit “1982.’.” and insert “1982.”.

3. Clause 4, page 14, after line 17 insert –

“Division 6 – Privacy Management Framework

134ZT Minister must establish Privacy Management Framework

(1) The Minister, by order published in the Government Gazette, must establish a Privacy Management Framework for the Electronic Patient Health Information Sharing System as soon as practicable after the day on which this Part comes into operation.

(2) In establishing the Privacy Management Framework, the Minister must consult with the following persons and bodies in relation to whether certain health information or classes of health information should require additional levels of protection under the Privacy Management Framework –

(a) relevant groups and organisations that represent the interests of patients, carers or health care workers;

(b) any relevant public sector body within the meaning of the Public Administration Act 2004;

(c) participating health services.

(3) The Privacy Management Framework must –

(a) specify categories of health information that are sensitive in nature and include a process to safeguard that information; and

(b) include a process to safeguard the identity of patients who may be at risk of harm, including patients who identify as being at risk of family violence; and

(c) include a process to facilitate patients accessing reports that specify who has accessed their health information through the Electronic Patient Health Information Sharing System; and

(d) include a process for regular audits and compliance checks of the Electronic Patient Health Information Sharing System.

(4) The Privacy Management Framework takes effect on –

(a) the day on which it is published in the Government Gazette; or

(b) a later day as specified in the order.

Note

Section 41A of the Interpretation of Legislation Act 1984 provides that the power to make an instrument includes the power to repeal, revoke, rescind, amend, alter or vary the instrument in the exercise of that power.

134ZU Compliance with Privacy Management Framework

Any person who is authorised or permitted under this Part to access the Electronic Patient Health Information Sharing System must comply with the Privacy Management Framework to the extent reasonably practicable.

Division 7 – Independent review of this Part

134ZV Independent review by expert panel

(1) The Minister must cause an independent review of the operation of this Part, including the Privacy Management Framework, to be conducted by an expert panel after the second anniversary of the day on which this Part comes into operation.

(2) The independent review must examine and make recommendations in relation to the following –

(a) whether health information is sufficiently protected;

(b) which health services should be participating health services for the purposes of this Part;

(c) the misuse of specified patient health information;

(d) the costs of compliance and the administrative burden imposed on participating health services by this Part;

(e) whether the Electronic Patient Health Information Sharing System is operating as intended.

(3) The independent review may examine and make recommendations in relation to the following –

(a) current issues and trends relating to health information systems;

(b) data management;

(c) information technology security;

(d) patient privacy;

(e) any other relevant matter.

(4) The independent review must be completed no later than the third anniversary of the day on which this Part comes into operation.

(5) The Minister must cause a copy of a report of the independent review to be laid before each House of Parliament no later than 3 sitting days after the day on which the final report of the independent review is given to the Minister.

(6) The Minister must consider any recommendations made by the independent review, including any recommendations to amend this Act, and within 18 months of receiving the final report –

(a) implement the recommendations made by the independent review; or

(b) advise Parliament why the recommendations have not been implemented.

134ZW Appointment of expert panel

(1) For the purposes of section 134ZV, the Minister must appoint 3 persons to form the expert panel.

(2) The Minister must ensure that each person appointed to the expert panel has experience in one or more of the following –

(a) human rights and privacy matters;

(b) legal and regulatory compliance;

(c) health information systems;

(d) clinical care;

(e) health care quality and patient safety;

(f) consumer or patient advocacy.

(3) The Minister must not appoint a person to the expert panel if the person is –

(a) a current employee or executive officer of a registered political party within the meaning of the Electoral Act 2002; or

(b) a current or former member of Parliament.’.”.

David SOUTHWICK (Caulfield) (10:39): As I began my contribution yesterday, the Health Legislation Amendment (Information Sharing) Bill 2023, in terms of what the bill specifically is trying to do, using technology, using information to ensure that we have patient records being made available for better care, in principle, is something that I think is very, very important. In my initial contribution to this bill I spoke very personally about a situation that happened with my late mother, where by not having information, by not having that information available, unfortunately she passed.

If the opportunity had been there, then I wonder if we would have potentially had a different set of circumstances. So for me information is very, very important, and if I had that opportunity in terms of me, my family, my late parents, then absolutely there would be no doubt that I would want that information to be made available to the health professionals, no question. But the amendment that we put forward was to ensure that there was an opt-out, and the opt-out component was key because it gave the ability at the end of the day to the patient to determine their own choice in terms of patient care, in terms of what they want in terms of information being made available. Every single time – especially when we are talking about health – we need to ensure that the individual, the patient, is put first, and the wishes of that individual always should be paramount and should be absolutely key to any decision that is being made.

I know that we heard the member for Mordialloc, who was effectively attacking and mentioning my contribution, using all kinds of things about scaremongering, fearmongering. It is none of that, it is about patient choice. That is what it is about, that is what our amendment was about. The member for Lowan very well articulated that point; the member in the other house Georgie Crozier, our Shadow Minister for Health, articulated that point. It is really important to stick with the facts here and have the opt-out option. And the Law Institute of Victoria – that is their argument, that is their case, and it is very fair and reasonable for the law institute to have that position, because we saw a data breach only as recently as yesterday in a report on the Canberra Health Services breach of privacy, where members of staff sent records to their union:

In an all-staff email … chief executive Dave Peffer said the records had been sent by a small number of staff to multiple people within one of its industrial partners.

He said the whole mental health clinical records of 13 patients had been ‘deliberately’ emailed to individuals outside the organisation over a period of years.

CEO David Peffer described it as a ‘serious breach … extending back some time’. And here we have an ACT Labor-Greens coalition mental health minister saying:

But we do have policies and procedures about what to do when a breach like this happens, and it has been referred to the police who are conducting an investigation.

The breach was referred to the Australian Health Practitioner Regulation Agency. So here we have a situation where there are protocols that are set up, but nonetheless there is a breach. We have these situations, in this case it was to a union, and it does undermine all of those individuals, particularly when you have got personal and confidential information – this is in relation to mental health and the Royal Commission into Victoria’s Mental Health System. It is very, very serious when this information goes off to a union. So they are the issues, they are the concerns that we have.

Now, if you sign up to something, that is fine. In my case, in my own set of personal circumstances, I would sign up to something knowing the consequences, and I would live with those consequences. That is not to say that I would want data breaches and not to say that I would not want every single element of privacy being put in place wherever possible – we want all of that. But at the end of the day it is my choice, it is patient choice, and that is all we are asking for. If people are not happy for their information to be shared, they should be able to have the opportunity not to do so, and that is why specifically we suggested an amendment about the opt-out, and that is why we have issues with the bill where it stands – not because of what it is trying to do, but unfortunately because of what it is not trying to do. It is what is being left out of the bill that could make it better.

When we talk about bills in this chamber, we always talk about making things better, improving the system. We have got to improve our health system. It is appalling that we had fax machines to send out information when it came to contact tracing in Victoria. We have been so behind in terms of data records and data information and using good systems to be able to ensure we get the best patient care, and I do not think there would be anyone in this chamber that would not want that; I think every single Victorian would want the best patient care and the best records and the best information available. That is not what we are arguing. So when the member for Mordialloc stands up here and he says, ‘The Liberals are scaremongering and fearmongering’ – we are not doing that. We are trying to work together to get the best outcome, and the best outcome is to ensure that if those patients want to be able to opt out, they should be able to opt out. If they have concerns, they should be able to.

We will be talking shortly about the drug-injecting-room legislation, and there are a lot of people that have used the drug-injecting room that I am sure would not want their information shared, that I am sure would not want to sign up to the system, that would want the option to opt out. We should give them that right. We should give them that opportunity. Why on earth is the government on one hand bringing in legislation to so-called ‘protect’ drug users but on the other hand happy for that information to be shared, to not give them the opportunity to opt out, to not give them the opportunity for privacy? There are a number of circumstances – when it comes to family violence, when it comes to drug and alcohol use – in all of these agencies to give the opportunity to the individual to have that right to opt out, and that is all we are asking for. It is very simple. It is a fair amendment that we have proposed and the government has rejected.

I also note, because the government again in their contributions were talking about how wonderful it is and criticising the contributions that we made when the bill was originally before the house in the lower house and saying that we should reflect on our contributions – well, again I would say to the member for Mordialloc and others in this chamber: the reason why it is back here now is because the government did not get it right in the first place. The government took it from the lower house to the upper house. We are now debating this bill because there are amendments, because we, the Greens and others showed the flaws in the bill in the first place. If there were not flaws, if there were not privacy issues, we would not be debating this bill right now. The bill would have gone from the lower house to the upper house, and it would be done. We now have amendments put by the government. The reason why they have been put by the government is because the Greens, the Liberals and Nationals and the independents all had issues with the bill.

It was a bill that was poorly drafted, that did not have privacy protections in place. So now we have got something that is better but is not quite there. That is the issue and that is the flaw that we are dealing with, and the government needs to admit that. It is no use the government turning around and giving us a whack and saying, ‘You should reflect on your initial contributions that you made when it was before the house last time.’ It would not be here if they had gotten it right. They did not get it right. They went quick to the punch. They went out there and poorly drafted a bill without having proper privacy protections. We are back talking about it now because the government jumped the gun, and that is the problem. We see it time and time again when the government jump the gun on legislation and do not get it right, and who suffers – Victorians suffer. We have got to always get this right, and when you are talking about patients, when you are talking about health, you must get it right. There is this opportunity when you have got the opposition willing to work together with the government to get it better; that is what we are striving to do. This is not a political situation. This is trying to improve the situation in our health care for all Victorians. That is why the opt-out position is an important position for all Victorians – to give patient choice. That is why we suggested the amendments, and that is why the amendments should be supported.

Motion agreed to.

The DEPUTY SPEAKER: A message will now be sent to the Legislative Council informing them of the house’s decision.