Biotechs to be affected by new Vic privacy laws

Victoria's new health privacy legislation would substantially impact upon the local biotechnology industry, a leading lawyer has predicted.

Allens Arthur Robinson special counsel Karin Clark said any organisation that handled information relating to the health of a person would be affected by the Victorian Health Records Act when it comes into effect on July 1.

The Act covers such areas as the work of research institutes, clinical trials and the collection of genetic information - anything that can be traced back to an individual.

Clark said a provision making the law retrospective could also prove costly for businesses unless they started to prepare for the changes now.

"They have got three months to implement it, so there's still plenty of time," she said.

"They need to audit their information flows, look at what sort of health information they have, how it is used and how it is stored.

"I'd also recommend the appointment of a dedicated privacy officer."

On December 12, 2001, Commonwealth private sector privacy laws came into effect covering the collection, use, disclosure and maintenance of health information in research activities.

Clark said that while many elements of the new Victorian laws mirrored those at the Federal level, there were a number of variations that could create confusion.

This meant that while many organisations may have already put privacy compliance programs in place to address the Commonwealth Privacy Act, they could still be caught out at a state level.

She said one important difference was that small businesses with a turnover of $3 million or less where exempt from the federal privacy laws, but not from the Victorian laws.

The state laws were also retrospective in most cases, whereas the federal laws were not.

"The Victorian Health Services Commissioner will have audit rights, whereas the Federal Privacy Commissioner does not, so in reality the Victorian law has more bite," Clark said.

She said that in areas where the two laws could co-exist, organisations were expected to abide by both.

But where they overlapped or clashed, the Commonwealth legislation would override the state laws.

Clarke said that under the Victorian Health Records Act, organisations must be able to demonstrate all health information had been collected with consent.

Organisations also had to advise people they had the right to access their own information and had to be informed of every subsequent use of that information.

Other areas of difference between the two Acts mean that:

• Individuals have no right of access under the Victorian Act if health information has been given by a third party in confidence, with a request that it not be communicated to the individual concerned.
• There are restrictions on the transfer of health information to another party outside Victoria in certain circumstances.
• Information relating to people who have been dead for up to 30 years can be accessed under the Victorian Act.

The Victorian Health Services Commissioner will have the power to serve compliance notices on organisations that breach the Act and to impose fines of up to $300,000 if they continue to flout the law.

Clark said that although the Victorian laws are not yet enforceable, the government is encouraging organisations to implement them on a voluntary basis in order to build up their familiarity.

More information:

http://www.aar.com.au/privacy/pages/health.htm

http://healthrecords.health.vic.gov.au