P HYSIOTHERAPY AND PRIVATE SECTOR

PRIVACY PROVISIONS

Presented to

Review of the private sector privacy provisions

Prepared by the

Australian Physiotherapy Association

December 2004
Authorised by

APA President, Katie Mickel

Australian Physiotherapy Association
3/201 Fitzroy Street
St Kilda Vic 3182
Tel: (03) 9534 9400
Fax: (03) 9534 9199
Email: national.office@physiotherapy.asn.au

www.physiotherapy.asn.au

Australian Physiotherapy Association Page 1 of 4

Introduction
The Australian Physiotherapy Association (APA) welcomes the opportunity to
comment on the impact of the private sector privacy provisions on
physiotherapists and their patients. The APA has over 10,000 members, more
than half of whom work in the private sector. Comments in this submission are
confined to issues surrounding access to patient records. This submission
addresses members concerns in complying with privacy legislation in the face
of pressure from health funds, solicitors and third party insurers. It also
addresses the concerns the APA has in keeping our membership properly
informed about their obligations under the privacy act.

Privacy principles in the health sector

All physiotherapy businesses no matter how small are obliged to comply with
private sector privacy legislation. The APA agrees that ensuring health privacy
is important. Health information is sensitive personal information, and the APA
supports patients’ right to control access to that information. The APA is
committed to supporting its members to apply the principles outlined in the
legislation and to consistently protect their patients’ privacy.

Inconsistency in privacy legislation

Physiotherapy Business Australia (PBA), a subgroup of the APA for private
practitioners, is conscientious in informing its members of their obligations
under privacy legislation. Consequently, most full time physiotherapy private
practitioners are well informed about privacy legislation. However, other
physiotherapists who work part-time or move between the public and private
sectors are less likely to be aware of their obligations under privacy
legislation.

Due to the federated structure of the Australian government, private sector

privacy provisions vary from state to state and between the state and
commonwealth. The enquiry specifically asks whether this is a problem; in the
case of physiotherapists the answer is yes. Inconsistency in the legislation
across federal and state jurisdictions creates confusion for members who are
caught in the middle of conflicting information. The wide variety of legislation
also creates difficulties for the APA and PBA in keeping abreast of changing
and sometimes conflicting legislation. Differences in the legislation across
jurisdictions also make it impossible for the APA and PBA to put out a
consistent message to members about their privacy obligations.

Sharing of health information between treating

clinicians
Health professionals often treat patients as part of a multidisciplinary team.
Protocols for sharing of patient information between treating clinicians need to
conform to privacy regulations. As electronic methods of information transfer
become more widely used, there is a need for greater levels of awareness of
how to protect information transferred in this way. The APA urges the Privacy

Australian Physiotherapy Association Page 2 of 4

Commission to ensure that the legislation keeps pace with changes and that
health practitioners receive adequate and ongoing information on privacy in
this rapidly advancing area.

Inappropriate requests for patient records

Requests for legal purposes
Patient access to records under the privacy legislation allows patients to know
what personal information is held about them. The APA supports the right of
patients to obtain a copy of their records however; the APA has concerns
about the way that some solicitors use the privacy legislation to avoid seeking
a properly constructed medical report. Medical records are technically
specialised documents written for the express purpose of providing treatment
and as such, they do not provide information in a format intended for legal
purposes. The medical record without explanatory notes may be
misunderstood by a lay person or in some circumstances misrepresented in
legal proceedings. The APA calls on regulators to place a restriction on the
use of un-interpreted medical records.

The APA speculates that some lawyers request records in order to avoid
paying reasonable costs for a medico-legal report. Whilst federal legislation
allows the practice to charge reasonable costs to cover the expense of
providing records, some state based legislation caps the amount a practice
can charge. The APA contends that some legal firms in Victoria and the ACT
are abusing this loop-hole and requesting records under privacy legislation so
as to shift expenses to the physiotherapist. For some practices, there is a
burden on staff to produce documents for legal proceedings regularly. If the
charge for these documents is below the cost of producing them, it is
unsustainable for the business. Complying with these requests imposes an
unfair cost on physiotherapy businesses. The APA calls on regulators to
ensure that sustainable fees for access can be charged, particularly where
requests are regularly made for the purpose of legal action.

Health insurers and bundled consent

Some health insurance providers insist that members sign a release form
allowing the health insurance company to access any of the patients' records
at any time for any reason. The privacy issues paper refers to this practice as
bundled consent, and the APA believes that this kind of consent is
inappropriate for sensitive health information. While some insurance
companies claim they need access to patient records to combat fraud on the
part of patients or practitioners, the APA believes that individual instances of
fraud can be investigated without resorting to such measures as bundled
consent.

Blanket release forms can be abused by insurance companies and others.

One physiotherapist reported that the employer of a patient had requested
access to patient records to check on whether the patient in fact was
attending exercise classes at the physiotherapist’s gym. The employer
believed they had this right as the patient signed insurance forms giving

Australian Physiotherapy Association Page 3 of 4

access to information. It was clear that access to the information was not for
the intended purpose and the APA advised the physiotherapist to seek a
release from the patient.

In addition, some insurance companies include a release form at the bottom

of each Health Industry Claims and Payments Service (HICAPS) printout,
giving the insurance company access to all information regarding that
particular treatment. The chance that a patient reads the entire HICAPS form
each time they receive treatment is low. Obtaining permission to access
patient records in such a way is a violation of the spirit of informed consent.

Third party insurers

Third party insurers such as workers’ compensation and motor vehicle
insurance schemes also use bundled consent to obtain access to patient
records. Third party insurers often ask physiotherapists to release information
based on information release forms signed by the patient at the start of their
claim, sometimes years earlier. One physiotherapist reported having to track a
patient down overseas to ask if the patient consented to the release of health
information three years after the patient was treated.

Some physiotherapists are aware of the Privacy Commissioner’s opinion that

release forms should be signed for each new piece of information to be
released by the treating therapist. However, other physiotherapists who are
unaware of the Privacy Commissioner's opinion in this regard are
inadvertently leaving themselves open to legal action should a patient object.
Physiotherapists need to be advised by the Privacy Commissioner that a new
consent form signed by the patient must be presented to the therapist each
time a report or records are requested.

The practice of using bundled consent for health information is unacceptable,

yet insurers persist in attempting to obtain patient records without proper
consent. The Privacy Commissioner needs to take action for insurers to cease
this practice.

Conclusion
The review should take the following steps to ensure that patient privacy is
protected and respected.

• Privacy provisions should apply uniformly across the nation. Where

states regulate aspects of privacy, the jurisdictions should not overlap.

• Lawyers must refrain from requesting patient records in legal

proceedings. Reports provide a truer /more accurate clinical picture.

• Patients and physiotherapists need to be more aware of their rights and

obligations under the privacy act. The review should publicise
instances of violations and commissioner's opinions so that patients
and physiotherapists will not be so easily intimidated in to handing over
sensitive information.

Australian Physiotherapy Association Page 4 of 4