The personal medical records of asylum seekers have been handed over by International Health and Medical Services (IHMS) to Australia’s immigration department for “political purposes” and potentially in breach of privacy laws, according to leaked internal briefing notes from within IHMS.
The revelations are contained in the meeting notes of a clinical directors’ meeting at IHMS on confidentiality in September 2013, obtained by Guardian Australia.
They raise further concerns about the role of the detention health provider IHMS, which delivers healthcare services to asylum seekers on the mainland and in detention centres on Christmas Island, Nauru and Manus Island, and its relationship with the immigration department.
In response IHMS and the immigration department strongly denied they had inappropriately provided or sought access to asylum seekers’ medical records.
The briefing document, written by a senior IHMS clinician, outlines the way that the immigration department has sought access to confidential medical records of asylum seekers for what he describes as “political purposes”.
In a part of the presentation titled “areas of concern”, the clinician notes that data is passed to the department beyond the immediate medical needs of asylum seekers.
“Such an example is passing on updated medical information on clients who are in hospital – in most cases the department wants the information for ‘political’ reasons and not for reasons of health and welfare of the client.
“Not only might this be considered a breach of confidentiality but it might also be considered contrary to the Privacy Act,” the briefing paper said.
It continues: “The reason that IHMS collects data is for the healthcare of the client and if we provide information to others for other reasons it could be considered as a breach of Privacy Act.”
The clinician also flagged passing over medical data for “compliance checking” as another area of concern, because it was being provided for administrative reasons and not medical ones.
“Unfortunately, when this information is provided, it is not provided in de-identified way and so could be considered a breach of confidentiality. If the information is provided in de-identified manner, one could argue that this does not breach confidentiality – and, in my view, this is how the information should be provided.”
Another key area of concern is the provision of information to foreign government departments – such as those on Nauru and in Papua New Guinea – relating to Australia’s offshore detention centres there.
“I do not believe that clients have provided consent to have their personal information given to foreign governments and this would certainly be a breach of confidentiality. In addition, it would be a breach of the Privacy Act.”
Under Australian privacy law, an organisation cannot disclose personal data to a third party for a purpose other than the primary purpose of collection.
Because the purposes of using the data outlined above do not appear to relate to purely medical reasons, the clinician concludes that in some circumstances breaches may occur.
Breaches of confidence are also potentially actionable separately in civil proceedings, where confidential information has been obtained and divulged to a third party without the consent of the provider.
The sharing of asylum seekers’ records may also be at odds with the code of conduct set down by the Medical Board of Australia (pdf). The code states that good medical practice involves “appropriately sharing information about patients for their healthcare, consistent with privacy law and professional guidelines about confidentiality”.
But despite the concerns about the practice, immigration department officers continued to demand access to asylum seekers’ records.
A separate email obtained by Guardian Australia confirms that immigration department officers have in the past sought inappropriate and direct access to asylum seekers’ medical data through IHMS’s records system Chiron.
A September 2013 email, sent two weeks after the clinician’s briefing notes, said: “We are aware that your local DIBP [Department of Immigration and Border Protection] counterparts are repeatedly requesting access to Chiron to further the contract monitoring program. This has been vetoed by both Michael Shelton (DIBP’s contract manager) and our IT people as being inappropriate and unmanageable.”
The email, written by an IHMS business analyst, continues: “Chiron contains confidential information related to each client, and is ‘live’ – any person with access to it could potentially modify or delete a healthcare record. At the moment, Chiron cannot be viewed in ‘read only’ mode and access cannot be limited to those records under review for the monitoring activity. This would put us in serious breach of our professional and contractual obligations.”
The analyst adds that the problem has “arisen from numerous sites.”
A spokeswoman for IHMS said: “IHMS abides by Australian, PNG and Nauruan privacy requirements. IHMS follows the Australian privacy legislation in its dealings in the other countries due to the more stringent nature of Australian law (spearheaded by the Privacy Act 1988 (Cth).
“The observance of privacy and confidentiality is embedded in IHMS practice through policies and procedures that have been developed by IHMS and approved by the department.
“When any personal information is shared with the commonwealth of Australia, both IHMS and the commonwealth (usually the Department of Immigration and Border Protection and its predecessor organisations) will only access the information when such access is lawful and necessary.”
A spokesman for the immigration department said: “The department takes its privacy obligations very seriously and strongly refutes allegations that transferee or detainee data has been inappropriately accessed or provided to other parties.
“The sharing of detainee health information is allowed in certain circumstances under law. These circumstances include conducting audits of IHMS performance, contract monitoring or responding to parliamentary, ombudsman and Australian human rights enquiries.”
“Detainees and transferees are advised of the possible disclosure of their health information for lawful purposes and are also asked to provide written consent for the sharing of their health information when required.”
The immigration department’s approach to privacy and how it manages personal records has been raised previously by oversight bodies.
In February 2014 it was responsible for the largest government data breach, when the personal details of almost 10,000 people in immigration detention were publicly exposed online.
It also accidentally exposed the personal details of world leaders attending the G20 summit in November 2014, and did not notify those affected of the breach.
An external accountability task force has now been set up to monitor and implement privacy safeguards within the department.