Can my health records be used for medical research?
Veterans have launched a class action against the department for ‘mass and routine sharing’ of their medical records over 20 years. How common is this?
In Australia, veterans are embroiled in a legal dispute with the government over the alleged unauthorized sharing of their medical data for research purposes. The conflict arises from a 20-year research initiative called MATES, which utilized veterans' medical records but was halted in 2024 due to privacy concerns. Initially, an Australian Information Commissioner's investigation revealed that the Department of Veterans’ Affairs transmitted veterans' personal information, including names and medications, to university researchers and medical professionals involved in their care without explicit consent.
The investigation concluded that the department had violated veterans' privacy rights. Recently, more veterans have joined a class action lawsuit, alleging "mass and routine sharing" of their medical records over two decades. So, is this an isolated incident, or are we all at risk of similar privacy violations?
Our health records are predominantly stored in electronic medical records, containing identifiers such as names, addresses, dates of birth, and phone numbers, alongside health histories, medications, test results, and vaccinations. These records are either uploaded to the national My Health Record system or collected by government agencies for claims processing.
The latter must adhere to the rules set by the Information Commissioner. Researchers are attracted to health data for statistical and research purposes. The GenV study, conducted in Victoria, utilizes the health and educational data of approximately 120,000 children and parents who have consented to participate. The study aims to uncover insights related to obesity, vaccine safety, asthma treatment, and other significant health issues.
The My Health Record system is designed to facilitate the use of data for research, although this process has not yet commenced. A data governance board is expected to oversee research access to the dataset, with safeguards in place to protect participants' data.
Health data is classified as "sensitive" under Australian law, imposing limitations on researchers' access to it. Researchers can obtain access to health data with the patient's consent, which involves informing them about the proposed use of their information and obtaining their agreement. However, the concept of "consent" can be complex.
In the previous investigation, the Department of Veterans’ Affairs claimed that patients had consented to the sharing of their information with researchers. The Information Commissioner disagreed, stating that the patient's consent only pertained to the collection of data for billing claims and did not extend to sharing the data with researchers.
There are alternative legal pathways researchers can pursue to access health data. One approach is when the research directly relates to the purpose for which the information was originally collected, and the individual reasonably expects that their data may be used for research. Another route is if the collection or use of information is essential for research relevant to public health or public safety, and obtaining consent becomes impractical.
In these cases, the data remains under protection from human research ethics committees, and individuals may have the option to opt-out. Additionally, even when health data is de-identified, it may still be permissible for research use, although the Information Commissioner's office cautions that this approach is not entirely risk-free, and privacy protection remains paramount.
The Australian government is taking steps to enhance protections for veterans' data. The Department of Veterans’ Affairs has emphasized the necessity of adhering to ethical requirements and maintaining trust with veterans. The department's updated ethics procedures, effective since the MATES study was suspended, require potential research participants to be informed that their existing or future entitlements will not be compromised by their involvement in research.
Legal counsel representing the veterans in the class action is seeking compensation for past breaches, with a court date yet to be determined. Ultimately, striking a balance between the benefits of using health information for research and respecting individuals' privacy rights is crucial. Researchers and ethics committees must diligently comply with legal obligations and individuals' reasonable expectations regarding privacy.
Those who harbor concerns about the utilization of their health data may opt-out of the secondary use of My Health Record data scheduled to commence in the future. However, in other situations, comprehending the fine print and seeking clarification about how their data is being utilized are essential measures to safeguard privacy.
Written by urgent.news from The Conversation AU's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
