Privacy Commissioner John Edwards is required to examine Bills before Parliament and comment if privacy issues arise.
With the Health (National Cervical Screening Programme) Amendment Bill, Mr Edwards took that opportunity, and then some.
The Bill, if passed, would grant broader access to the cervical screening register — one of the most restricted health databases — to register staff, health professionals and screening support services.
Mr Edwards told the health select committee he had no privacy concerns with the Bill — he thought it would promote high-quality screening, assessment and treatment.
However, Mr Edwards then opened fire on the mass of regulations protecting the privacy of health information overall, calling them incoherent and overdue for reform.
He is not the first to make this call.
Several years ago the Law Commission investigated privacy issues in general and the Privacy Act in particular, and in 2011 recommended a separate review of the handling of health information — and separate legislation governing it.
"That legislation should set out a clear framework for who may gather personal health information; who may use it, for what purposes and under what conditions; how the information may be communicated within the health system; how the information may be held and by whom; and how information may be used by health researchers," its report said.
Little has changed in the legal landscape in the past seven years, but technology has accelerated apace.
Health organisations are now using cloud-based storage systems; online health portals are being rolled out for patients to communicate with clinicians; algorithms are increasingly being used for planning and research purposes.
Mr Edwards called for the law to catch up, and be applied consistently across the health system.
"[There is] particular historical context and sensitivity attached to cervical screening," he said.
"By contrast, breast and bowel screening programmes rely on general information provisions including the privacy protections in the Health Information Privacy Code.
"A more coherent approach would apply consistent principles across health information, as opposed to allowing special restrictions to develop out of particular history or societal significance."
Coincidentally, Parliament is also considering a long-awaited Bill revamping the Privacy Act.
That will involve amendments to current health information privacy rules, but not the overall review Mr Edwards, the Law Commission, and Christchurch lawyer Kathryn Dalziel would like to see.
Ms Dalziel, one of the authors of Health Care And The Law, said seven years on from the Law Commission report, even more private health information was now shared, through practice management systems, patient portals, shared care systems and targeting of possible subjects for medical research.
"A lot of those systems have had privacy impact assessments, and they are actually good things for health ... but where patients get concerned or raise privacy issues is because they want protection of their mental health or sexual health backgrounds."
The Health Information Privacy Code was a help, but its regulations — and the broader Health Act — often conflicted with a medical practitioner’s professional obligation of confidentiality, Ms Dalziel said.
"This will be a constant issue as we move in to the sensible health IT system," she said.
"The other thing which needs tidying up across the country is a consistent approach in the development of health IT strategies.
"We do have a board that looks at that, but it is still left up to the different regions as they implement these strategies to implement their own privacy impact assessments, and really this could do with a really good separate health privacy statute."
The Privacy Bill was the ideal time to consider health privacy specifically, Ms Dalziel said.
"The Health Information Privacy Code will need to be amended if the Privacy Bill passes, so some of this will be addressed, but still those fundamental issues of confidentiality and how that works remain in no-man’s land."
Dunedin lawyer Warren Forster, a researcher in this area, also finds the system "massively fragmented" and in need of reform — especially in the area of protecting patient information.
"What we have got to is a series of Band Aids which have been put on problems as they have arisen, and we need to think about whether that is working in the way which it should, or whether we need to redesign it," he said.
"The concern people have is that their information could be used in a way which is against their interests, and also to understand how their information is being used."
In his submission on the Privacy Bill, Mr Edwards has called for an additional privacy principle — algorithmic transparency — to be added to the current principles guiding the use of personal information.
Mr Forster said the principle was fine, but the bigger issue was the information the algorithm was provided with, how it was being used, and whether the categories of information it was applied to were appropriate and useful.
"Tools might not be used to help people but to stream them and discriminate against them," Mr Forster said.
"Even if you have transparency about the tool, what you don’t have is a way to control the inputs, the outputs, the biases that come from the system ... or we might have systems which don’t allow for the effective use of artificial intelligence because our institutional structures don’t go there."
Larger questions such as whether it was unethical not to use private information to improve health care or whether a patient had all rights to their private information were hard to answer and current laws provided no clear answer, Mr Forster said.
"There are a whole bunch of different regulatory regimes, ethical regimes and conduct regimes dealing with health information ... and it’s hard to get a good understanding of it all."
The only thing harder than that might be finding a politician willing to take on the task of sorting the issue out.
