With the launch of the NZ COVID Tracer app, the power to unite against COVID-19 is now literally in the palm of our hands. The Government has assured us we will retain control of our data – and that it will be secure. But many businesses are still operating old-school contact tracing registers, and the fact remains that there is an abundance of personal information floating around right now. So where does the power to collect this type of information arise from, and what precisely can it be used for?
In this article we look at how the law walks the line between ensuring the flow of information necessary to protect public health in a pandemic situation while ensuring that individuals’ right to privacy is protected as much as possible. We also look at what that law means for health practitioners.
Special law in a national emergency
On 25 March 2020, the Government declared a state of national emergency. Along with a variety of other unique powers, the declaration of a state of national emergency triggered the operation of the Civil Defence National Emergencies (Information Sharing) Code 2013 under the Privacy Act (the Code). The Code is designed to assist with managing and responding to a Civil Defence emergency, like the COVID-19 pandemic. It gives agencies greater legal authority to collect, use or disclose personal information without getting the individual’s authorisation first – but only where certain criteria are met. So, if the individual is involved in the national emergency (which, given the nature of the COVID-19 pandemic, we probably all are), the collection, use or disclosure relates to the response to the COVID-19 pandemic and any disclosure is only to an agency involved in the response, agencies can collect, use, or disclose personal information without authorisation.
But the Code only applies during the national state of emergency and for 20 days after it is lifted – until 2 June 2020. So, while New Zealand is at Alert Level 2, the COVID-19 Public Health Response (Alert Level 2) Order 2020 sets requirements for collecting our information. In particular, the Level 2 Order requires businesses and services to keep records of staff and requires businesses where food or drink is sold to keep records to enable contact tracing of customers or clients who enter the workplace or use its services.
Ok, so how might this apply to me in my personal capacity and me as a health practitioner?
The obvious application of the Code – and a key purpose of the Level 2 Order – is contact tracing to identify individuals who may have contracted COVID-19 and ensure they are appropriately managed and treated. But there are other possibilities, too, like assisting in law enforcement that relates to COVID-19. Health providers and health practitioners are at the heart of the COVID-19 response. Many, like doctors, nurses and pharmacists, are on the frontline providing essential services. As we move down the alert levels, the wider health sector is gearing up again, with dentists, physiotherapists, chiropractors, optometrists and more back to work – and they may find themselves in situations where issues relating to the Code or the Level 2 Order arise. We look at some of these issues below.
It is important to be able to disclose information that could assist with the pandemic response
What could a practitioner do if a patient presented for an appointment with symptoms that may suggest infection with the virus, but the patient refuses to have a test and tells you they do not want to know if they have the virus or not because they must get back to business? In this scenario the practitioner likely has significant information about the person that could assist the Ministry of Health to ensure the correct steps are taken, including the person’s name and contact details. Under the Code, it is lawful for the practitioner to provide that information to the Ministry of Health without the patient’s authorisation and you are permitted to do so anonymously – you just need to say so in your email to the Ministry.
But the rules change as we progress through recovery
However, the Code will only apply until 2 June 2020, and the Level 2 Order does not apply to the provision of health services, so after 2 June “normal” privacy law will apply. So if you find yourself in a situation where you feel you need to inform the Ministry about a situation, or you’re approached and asked to disclose information about your patients for the purposes of contact tracing, you need to turn your mind to what legal authority you have that would allow appropriate disclosure in the circumstances. This may include section 22C of the Health Act if you have received a request from a relevant agency, or one of the exceptions in Rule 11 of the Health Information Privacy Code 1994 (the HIPC). The HIPC is designed to protect patient privacy – but it’s also designed to allow for information to be shared and used where necessary to keep people safe. Every situation will be different, and it’s impossible to address them all here. One possibility is that relevant contact details of the person may be able to be disclosed to a Medical Officer of Health if you believe it is necessary to do so to prevent or lessen a serious risk to public health or safety, or the health of the person concerned (and it is not practicable in the circumstance to seek the person’s authorisation). The key is, before you use or disclose information, even if it seems obvious, stop and think: what is my legal authority to do so?
Finally, don’t forget your important role as a health practitioner
Trust and confidence is essential to the therapeutic relationship, and patient safety could be at risk if it is undermined. Also, these days people expect to have control over their personal information – and when they don’t have that control, they expect to know why, and how that information has been used. For this reason, the Privacy Commissioner encourages agencies that collect, disclose or use personal information without individual authorisation to follow up with individuals to notify them once this is reasonably practicable. It might not always be possible – and it might not always be a good idea – but it’s important to consider it.
If you have questions about privacy and how to manage information during the COVID-19 response, Claro’s specialist lawyers can help.
For further information contact Andrea Lane.
This article is intended to provide a summary of the subject covered only and is necessarily general and brief. It is not intended as legal advice and nothing in the article should be relied upon without getting specific professional advice.
