Federal Register of Legislation - Australian Government

Primary content

Guides & Guidelines as made
The Guidelines provide for standards to apply to information about an individual’s claims stored in computer databases, under the Medicare and Pharmaceutical Benefits Programs. The National Health Act (section 135AA(5)) requires that the Guidelines must generally specify the ways in which information may be handled, and prohibits linkage of information except as permitted by the Guidelines. The Guidelines seek to ensure that separation is maintained between the two databases.
Administered by: Health
Registered 18 Sep 2008
Gazetted 22 Jan 1997
Date of repeal 19 Mar 2014
Repealed by Health (Spent and Redundant Instruments) Repeal Regulation 2014

MEDICARE AND PHARMACEUTICAL BENEFITS PROGRAMS PRIVACY
GUIDELINES
(AMENDMENT 1996 No 1)

I, KEVIN PATRICK O'CONNOR, Privacy Commissioner, issue the following amendments under section 135AA of the National Health Act 1953, varying the existing guidelines relating to Medicare and Pharmaceutical Benefits Programs information known as the Medicare and Pharmaceutical Benefits Programs Privacy Guidelines 1994.

 

 

Dated 30th October                   1996.

Text Box:


KEVIN PATRICK O'CONNOR

Privacy Commissioner

MEDICARE AND PHARMACEUTICAL BENEFITS PROGRAMS PRIVACY
GUIDELINES (AMENDMENT 1996 No 1)

 

 

1.                The Medicare and Pharmaceutical Benefits Programs Privacy Guidelines 1994 are referred to in the following amendments as the Principal Guidelines and are amended as follows.

 

2.                These Guidelines commence on 1 January 1997, subject to disallowance.

 

3.              Wherever references to "the Commission" appear in the Principal Guidelines, omit "the Commission" and substitute "the HIC".

 

4.1       In Guideline 1.7 omit the words "and include a flag on the database which refers to that note", substitute ". The HIC must identify, in the Technical Standards Report, how the action can be traced.

 

4.2       In Guideline 1.8 omit the words:

 

"Personal identification details other than the personal identification numbers referred to in Guideline 2 must not be included in the claims databases."; and substitute:

 

"Personal Identification Numbers referred to in Guideline 2 may be included in claims databases. Personal identification components must not be included in claims databases except as follows: in the case of the Medicare claims Text Box: 2database, the Medicare number; and in the case of the Pharmaceutical Benefits claims database, the Pharmaceutical entitlements number.".

 

5.        In Guideline 2.3 omit the guideline, substitute:

 

"2.3 A person's Medicare card number in an encrypted form and the internal personal identification number may be provided to the Department in conjunction with de-identified details of claims for payment under the Medicare Benefits Program or the Pharmaceutical Benefits Program. No other official patient identifying number shall be provided except as permitted by Guideline 2.7. Any algorithm enabling the encrypted Medicare card number or the internal personal identification number to be decoded so as to reveal the identity of a patient shall not be provided to the Department in any circumstances although a business algorithm enabling the encrypted Medicare card number or the internal personal identification number to be validated may be provided to the Department.".

 

6.1 In Guideline 3.1 omit the guideline, substitute:

 

"3.1 The HIC shall destroy Medicare and Pharmaceutical Benefits claims information:

 

(a)           in the case of data that is the product of the linking, comparing or combining of records or information in accordance with Guideline 1.4 - within 3 months of the data being brought into existence; or

 

(b)            in any other case - within 5 years of the date of initial processing of the information;

 

unless:

 

(c)           there is an investigation, prosecution, unresolved compensation matter or action for recovery of debt pending which requires that the information be retained beyond whichever of the limits in paragraph (a) or (b) applies; or

 

(d)          the information affects an individual's entitlement to a related service which could be rendered after the expiry of whichever of the time limits in paragraph (a) or (b) applies.".

 

6.2       In Guideline 3.2 omit the words "because current action is pending", substitute "under Guideline 3.1(c)".

 

6.3    In Guideline 3.3 omit the guideline, substitute:

 

"3.3 The HIC shall destroy any information that is retained beyond whichever of the time limits in Guideline 3.1(a) or (b) applies:


 

(a)              Text Box: 3within 14 months of the completion of the relevant investigation, prosecution, unresolved compensation matter or action for recovery of debt referred to in Guideline 3.1(c); or

 

(b)             as soon as practicable after the circumstances referred to in Guideline 3.1(d) no longer apply;

 

as the case requires, and the HIC must satisfy the Privacy Commissioner, upon request, that it has adhered to its obligations under this guideline.".

 

7.        After Guideline 4, insert the following new guideline:

 

"4A. Use of Identified Claims Information for Research Purposes

 

4A.1 Disclosure of Medicare and Pharmaceutical Benefits claims information for medical research must conform to the secrecy provisions in the Health Insurance Act 1973 and the National Health Act 1953. In addition identified claims information may only be disclosed for research if :

 

(a)              the HIC is satisfied that the individuals who are the subject of that information have given their free and informed consent to the use of that information in the research project; or

 

(b)       the disclosure is made for the purposes of medical research to be conducted in accordance with the Medical Research Guidelines issued by the National Health and Medical Research Council under section 95 of the Privacy Act 1988.

 

4A.2 These Guidelines do not prevent a researcher to whom information has been disclosed in accordance with guideline 4A.1 from retaining that information once it becomes old information provided that at the conclusion of the research project the researcher either returns the information to the HIC for destruction or securely destroys the information."

 

8 1     In Guideline 5 omit the Paragraph 5.2(a), substitute "(a) Nothing in this Guideline prevents the retention of de-identified records from both programs in a combined form in conjunction with an encrypted form of the internal personal identification number or a new and unrelated number.".

 

8.2     In Subparagraph 5.2(b)(iii) after "temporarily linked", insert "in conjunction with the personal identification number".

 

8.3     In Paragraph 5.2(b) omit "where there is no practicable alternative (such as linkage via an unrelated number)", substitute "in conjunction with the internal personal identification number where there is no practicable alternative".

 

8.4     In Guideline 5.4, add at the end "unless the de-identified information has been released under section 130 of the Health Insurance Act 1973 or section 135A of the National Health Act 1953."


 

Text Box: 49.      In Guideline 6.7 omit the guideline, substitute:

"6.7 Where the Department has given the HIC Medicare claims information or Pharmaceutical Benefits claims information identified by the personal identification number in accordance with a request under Guideline 4, the Department shall keep a central record for each program of that action.".

10.    In Part C omit the Part.