New South Wales' Minister for Health, Morris Iemma, recently announced that the New South Wales Health Records and Information Privacy Act 2002 (Act) will commence on 1 September 2004. The Act applies to all health service providers, and also to any other public or private sector organisation that deals with any health information.

Organisations bound by the Act will be required to comply with 15 new Health Privacy Principles (Principles) and also with any health privacy code of practice that is applicable to the organisation. The Principles are similar to, but differ from, both the 11 Information Privacy Principles, and the 10 National Privacy Principles, under the federal Privacy Act 1988. Private sector organisations will also be required to comply with additional provisions relating to retention, amendment, and access to, health information.

The implementation of the New South Wales Health Records and Information Privacy Act 2002 means that health information in Australia may soon be regulated by

  • the Privacy Act 1988 (Cth)
  • the Health Records (Privacy and Access) Act 1997 (ACT)
  • the Health Records Act 2001 (Vic)
  • the Health Records and Information Privacy Act 2002 (NSW), and/or
  • specific health privacy legislation being considered in the Northern Territory.

In an attempt to achieve greater national consistency in health privacy protection across jurisdictions and between the public and private sectors, the Australian Health Minister's Advisory Council's Privacy Working Group released a draft National Health Privacy Code and discussion paper for public consultation in December 2002. The draft Code is to be considered by the next meeting of Health Ministers to be held later this month.

In his most recent annual report, the Federal Privacy Commissioner noted that the development of multiple health records privacy regimes:

'… creates the potential for both Federal and State legislation to be purporting to regulate health service providers … (and) … may result in consumers not knowing where they should go to resolve issues about their health information. It could also create problems for those covered by the legislation, as organisations will not understand their obligations and the standards they have to meet.

The breathing space before the commencement of the New South Wales legislation on September 1 provides a timely opportunity for organisations handling health information to conduct a full review of their obligations, to ensure an appropriate level of compliance.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.