Log in with your email address username.

×

HealthEngine may be in breach of privacy law in sharing patient data

 

This week it was reported an online medical appointment service, HealthEngine, was sharing patients’ private information with a firm of solicitors specialising in personal injury claims.

As reported, HealthEngine, which boasts 15 million annual users, requested details of the patent’s symptoms and medical conditions as part of their booking process. It then passed this information to law firm Slater and Gordon at an average rate of 200 patients per month. This was called a “referral partnership pilot” program, and operated between March and August of 2017.

HealthEngine denies sharing this information without patient consent, stating consent was provided by way of a “simple pop up”. Despite the company’s best efforts, HealthEngine continues to face queries regarding their treatment of patient information.

On the face of it, it appears several Australian Privacy Principles may have been breached.

Did patients provide informed consent?

HealthEngine assures visitors to their website the collection of information is done strictly by consent, and it has provided disclosures of the use of collected information.

For instance, in its Privacy Policy, HealthEngine notes information may be disclosed to third parties “but only for the purpose of providing goods and services to [HealthEngine]”.

HealthEngine also notes disclosure may be made to:

other persons notified to you at the time we collect your personal information, who you give consent to, or to whom we are authorised or required by law to make such disclosure.

In their “Collection Notice” – one of three policies to which patients must agree, HealthEngine further states it may disclose personal information to “third party providers who may be of interest to the patient”, including health insurance comparison providers, finance companies for credit for cosmetic or dental procedures, and providers of legal services.

This appears to contradict their Privacy Policy, which is itself bound by the Australian Privacy Principles.

The Australian Privacy Principles

The Australian Privacy Principles specify requirements regarding how organisations collect and use patient information. These include how and in what circumstances information is shared with third parties. The principles specify all information collected by HealthEngine must be reasonably necessary for the provision of services.

And they must not collect information unless there is consent, the information is necessary for the function of the organisation, or there’s a “permitted health situation”, which means the information must be necessary to provide services to the patient.

Click-wraps and bundled consent

A type of agreement HealthEngine uses to ensure patients using their services agree to the terms and conditions, called the “click-wrap”, involves the patient clicking through the booking process and thereby agreeing to the terms and conditions, links to which are provided.

So the patient is agreeing to three separate sets of agreements (called the “bundled consent”) — the Terms of Use, the Privacy Policy, and the Collection Notice — in the one action. This also means agreeing to secondary use of patient information and the provision of direct marketing, as found in the Collection Notice.

The privacy principles broadly prohibit direct marketing unless there is informed consent. And they require the patient to be provided with a simple way to opt out of direct marketing. HealthEngine assures patients they’re under “no obligation” to provide their information, though accepting these bundled terms is necessary to complete the booking and there is no option to opt out.

Informed consent requires the individual to be able to have a genuine ability to provide or withhold consent. This means having informed knowledge of the impact of their decision. It’s evident that with contradictory policies, bundled consent, and potentially misleading terms, a patient could not make a truly informed decision of the impact of their choice to use HealthEngine as the provider of this service.

Where to from here?

Laws that ought to protect individuals online do exist, but the potential for harm online is neither immediate nor always evident. So, as an immediate recourse to online threats, people need to take greater care with personal information online and ensure they seek recourse when issues arise. This requires being better informed about both the law and and individual’s rights and responsibilities online.

The Australian government also needs to take individual privacy and personal information protection more seriously and crack down on violators.

The ConversationThe establishment of the Office of the eSafety Commissioner was a positive move forward, but effective cuts to funding to the Office of the Australian Information Commissioner has the potential to hinder progress.

Paul Maluga, Sessional Academic, Solicitor, Macquarie University

This article was originally published on The Conversation. Read the original article.

When your patient wants to record the consult

 

You’re getting ready to examine your patient when she tells you she wants to record what you have to say to her. Or perhaps she wants to prop up her smartphone on the desk and film you as well. Or maybe halfway through the consult, you notice the smartphone on her lap, and you have a sneaking suspicion she’s recording you without your permission. How do you react?

With smartphone ubiquity, everyone has a recording device on their person these days. An increasing number of people are asking their doctors whether they can record their conversations – and there have even been cases of patients uploading recordings or videos to youtube. What should doctors do?

First, there’s the legal issue. Is it lawful for the patient to record a consult without the doctor’s permission? The answer to that varies according to the jurisdiction. In the Top End, Queensland and Victoria, patients can record consults without seeking permission from their doctor, as long as the recording is for personal use and not shared with a third party. But in all other jurisdictions, consent from the doctor is required. This was upheld in NSW law in 2014, in a case where a patient secretly made a video recording of a female GP doing an examination for a groin hernia. The patient was charged with an offence under the Surveillance Devices Act 2007 (NSW), for the use of a listening device to record a private conversation to which he was a party.

In all states and territories, consent must be sought from the doctor before publishing or sharing a video or audio recording of a consult. Which means any uploading of videos or recordings to the Internet without your knowledge are illegal, and you should contact your medical insurer if you become aware of this happening.

If a patient asks your permission to record, what should you do? You have the option to decline, and if the patient insists, you may decide to terminate the patient-doctor relationship. But you should also be aware of your duty of care, which means that in such cases you will need to be able to assure continuity of care, and you will still need to treat the patient in cases of emergency.

You need not necessarily be suspicious of a patient who wants to record the encounter. Many studies have shown that retention of information after a consult is poor, and that information retained is often wrongly recalled, in any case. With compliance being a major issue in treatment, it may not be such a bad thing that the patient has an audio record of what you have told him or her.

There should be no need to change the way you do your consults if a recording is made, but it might be wise to ask for a copy, or to make your own simultaneous recording for your patient’s medical records. All electronic communications, such as recordings, text messages or emails can form part of the patient’s medical record.

In the case of a surreptitious recording, it appears to be unlikely that it could be used against you in a case of medical negligence, although the key factor would be whether the probative value of the evidence outweighed the prejudice of admitting it, according to MDA National medicolegal manager Dr Sara Bird.

In any case, it seems that it would be best to make peace with the recording of consults, given the increasing prevalence of people recording their lives and the possible benefits of increased compliance.

Sources: Avant, MDA National

Physician banned for a decade for unnecessary prescribing

A specialist physician has been found guilty of professional misconduct after prescribing anabolic steroids and drugs when there was no therapeutic basis, and for failing to keep adequate records.

Three separate notifications against the specialist physician were made concerning the prescribing of medication and record keeping after a practitioner made a complaint to the Medical Board of Australia.

The case, which was referred to the applicable state’s administrative tribunal, serves as a reminder to physicians to ensure they only prescribe medication for a therapeutic purpose and the importance of keeping good records.

Physician accused of prescribing drugs for body building

The Medical Board alleged that the specialist physician had prescribed anabolic androgenic steroids, human growth hormone (HGH), clenbuterol, clomid and ephedrine to numerous patients looking to lose weight or for body building and conditioning. It was also claimed he prescribed treatments such as iron and frozen plasma infusions, as well as DEXA scans without having a therapeutic indication.

The Medical Board claimed these drugs and treatments were prescribed when there was no therapeutic basis and that the specialist physician unnecessarily exposed patients to potential adverse effects associated with the drugs. Also, that the specialist physician had failed to keep adequate records. These allegations regarded both the specialist physician’s general practice and the specific treatment of two patients.

Honesty is the best policy

The physician didn’t deny he had prescribed the drugs or treatments in question to his patients, but in letters to the Australian Health Practitioner Regulation Agency (AHPRA) and Board, he emphasised that he was providing treatment for a therapeutic purpose and explicitly stated in one letter that “I do not prescribe to body builders.” Reasons given for prescribing such drugs included obesity, anaemia and osteoporosis.

However, it was noted that objective evidence didn’t correspond with the evidence provided by the specialist physician. In particular, the tribunal drew attention to Patient A’s case, where the specialist physician claimed the patient was being treated for obesity.

The tribunal referred to photographic evidence, which clearly revealed that Patient A was not obese, but a body builder. The patient’s prescription history showed that the specialist physician had prescribed – steroids and drugs used for body building and conditioning for five years.

In the witness box, the physician admitted to being Patient A’s steroid supplier for the purpose of body building because he believed it was better for him to prescribe these drugs than for the patient to purchase them on the street.

The specialist physician then admitted to doing the same for more than 20 patients, confirming he didn’t prescribe the medication for a therapeutic reason and therefore proving his previous statements to AHPRA and the Medical Board to be false.

While, initially, the specialist physician denied the clinical records were inadequate, in closing submissions it was conceded that he failed to make adequate notes for patients who consulted him for obesity and weight loss, physical conditioning, body building and for patients who were prescribed various drugs, including anabolic androgenic steroids.

Decision and penalty

The tribunal found that the specialist physician’s actions constituted professional misconduct because he prescribed anabolic steroids, HGH and clenbuterol (among other drugs and treatments) for no therapeutic reason and that this “unnecessarily put patients at risk of the adverse effects of those drugs”.

Not keeping accurate records of patient consultations and treatments it was said, would be “regarded as improper by professional colleagues of good repute and competence” and that “Such conduct was substantially below [the] standard reasonably expected of a registered medical practitioner of an equivalent level of training or experience”.

In its finding, the tribunal stated that the specialist physician’s misconduct was so serious, involved a large number of patients and that the misconduct extended over a substantial period of time, that had his registration not already lapsed, it would have been cancelled. The specialist physician was disqualified from applying for re-registration for 10 years and ordered to pay the Medical Board’s costs.

Ultimately, despite the Medical Board seeking a reprimand against the specialist physician, the tribunal decided the disqualification was significant enough of a penalty.

The specialist physician was also fined $5,000 for sending an abusive letter to the notifying practitioner, as a deterrent to other practitioners from doing the same.

Treating athletes

If you treat athletes you should note that in September 2017, AHPRA and the Australian Sports Anti-Doping Authority (ASADA) reached a Memorandum of Understanding (MOU). The purpose of the MOU is to ensure that AHPRA and ASADA cooperate in the investigation of practitioners who prescribe performance enhancing drugs without a genuine therapeutic need.

Key learnings

  • While this is an extreme example, this decision highlights the importance of making sure when you are prescribing medications that they are therapeutically indicated and do not unnecessarily expose patients to adverse side effects.
  • Be thorough when recording your consultations and prescriptions – note down the therapeutic indication as well as the dosage, frequency and period of prescription.
  • It goes without saying, that it is inappropriate to be derogatory or offensive to notifying practitioners (or patients) who have made a complaint about you to the Medical Board.

This article was originally published by Avant Mutual. You can access the original here.

Psychiatrist’s $64,000 discharge error

A court has found a psychiatrist breached their duty of care to a patient for the injuries she sustained in a car accident while driving home following discharge from the hospital.

The patient alleged that at the time of her discharge, she was excessively tired and/or sedated and should not have been permitted to drive home. She claimed the psychiatrist and admitting hospital’s negligent conduct had caused her to lose control of the car and sustain personal injuries.

In reaching its decision, the court considered a range of evidence from the psychiatrist, hospital, witnesses, experts, as well as medical notes and letters.

Ultimately, the court found the psychiatrist and the hospital each liable for negligence, and apportioned responsibility between them. The hospital and the psychiatrist were ordered to pay the patient $32,167 and $64,333, respectively, plus costs.

The case highlights the risks when discharging patients potentially under the influence of sedating and psychoactive agents, and the importance of conducting and documenting a careful assessment before allowing any unattended patient to drive home.

Car accident following discharge

The patient was a woman with a background as a registered nurse, who had been terminated from her job due to absences because of back pain following a work accident. She visited her GP complaining of depression and feeling suicidal, and was admitted to an acute hospital’s mental health unit for about a month. She was then admitted as a voluntary inpatient, to a private hospital under the psychiatrist.

During her admission, which lasted another month, she suffered both insomnia and daytime tiredness. She was taking multiple psychoactive drugs including antidepressants, opiates and other strong analgesics as well as Stilnox at night.

During a consultation the day prior to the patient’s discharge, the psychiatrist assessed her readiness for discharge in relation to her mental state. The patient was able to assure the psychiatrist she was no longer suicidal and the psychiatrist authorised discharge for the next day.

On the morning of discharge, the patient took her regularly prescribed OxyContin. Prior to discharging her in the afternoon, a nurse completed a driving risk assessment and then returned the patient’s car keys so she could drive the 50 kilometre journey home. Unfortunately, the patient drove off the road and into a wall, quite close to home.

She was taken by ambulance and treated at an acute hospital for her injuries, including pain in her neck, head, shoulder, lower back and leg. She was then re-admitted to the private hospital under the original psychiatrist, where she remained for another month.

Court’s findings

The court heard in the days prior to discharge, the patient was often excessively drowsy and would fall asleep even while sitting eating meals. On the day of discharge, the patient had again fallen asleep over breakfast. Nursing staff had tried to wake her on several occasions, but she kept falling back asleep.

The court noted medical records from the hospital in which staff had reported the patient appeared over-sedated and drowsy. The nurse’s risk assessment completed at the time of discharge, also stated, “reports tiredness lately – Psych aware”.

Given the “overwhelming evidence”, the court found the patient was tired, drowsy and sedated upon discharge.

“I find she was not in a fit state to make a decision about her capacity to drive and find that she relied upon her carers to advise as to whether or not it was safe for her to drive herself home and warn her of the risks of drowsiness,” the court said.

The court concluded the car accident occurred as a result of the patient falling asleep due to tiredness, fatigue or excessive sedation.

Psychiatrist’s grounds for negligence

While the psychiatrist conceded the scope of their duty of care extended to reasonable care of treatment, they sought to deflect liability on the basis of s50 of the Civil Liability Act (CLA), claiming they had acted in a manner which at the time was widely accepted in Australia by peer professional opinion as competent professional practise.

In determining the psychiatrist had breached their duty of care to the patient, the court noted they had granted the patient permission to drive her car and was the sole person with control over whether the patient drove. Based on hospital protocol, staff could only give the keys to the patient with the psychiatrist’s permission.

The court accepted the patient’s evidence she had expressed concern to the psychiatrist about driving due to drowsiness, to which the psychiatrist had responded, “you should be fine to drive.”

The court found that at no stage during the consultation before her discharge, did the psychiatrist discuss how she would travel home. Furthermore, the psychiatrist admitted they left the decision up to the patient as to whether she was fit to drive.

“To leave it up to a psychiatric patient who suffered from pain, fatigue and sedation, which would vary from day to day, to decide whether to she was fit to drive at the time of discharge, is a complete abrogation of the psychiatrist’s duty of care and responsibility,” the court said.

The psychiatrist was also found negligent by failing to review the patient or enquire about her condition on the actual day of discharge, despite her observations of the patient the day before discharge and personal knowledge of the patient’s sedation, as evident in the records and other correspondence.

In a letter to the patient’s insurer, the psychiatrist had reported increased sedation over the last week which the introduction of OxyContin may have caused. Another letter to a neurologist said in the three days prior to discharge, the patient was “excessively sedated” and had some semi-falls.

The court accepted expert opinion that in allowing the patient in such a state to drive unattended, the psychiatrist and hospital breached accepted professional standards, and had not acted in a manner which would be widely accepted by peer professional opinion.

Hospital breaches duty of care

The hospital argued they had relied upon the fact the psychiatrist had authorised the patient to drive, as well as the patient’s own assessment of her capacity to drive and knowledge of the effects of the medication, given she was a registered nurse. The court rejected these defences.

The hospital was found to have breached its duty of care to the patient for permitting her to drive following discharge in circumstances where she was unfit to drive.

No basis for patient’s contributory negligence

The court rejected claims made by the hospital and psychiatrist against the patient that her actions constituted “contributory negligence”, by failing to take reasonable precautions against her risk of harm. The court found the sedating effects of the medications impeded her ability to make a responsible decision in the circumstances.

Key lessons

  • Doctors and hospitals have a responsibility to carefully assess the safety of their patients being discharged from their care. This includes identifying suitable arrangements for transport home and may require prolonging admission if no arrangements can be organised.
  • Doctors should remain aware of the risk of excessive sedation of patients taking psychoactive agents, especially in combination, and carefully assess their risk for harms. In preparing patients for discharge it is good practice to carefully review their use of sedating medications and other risky agents warranting special advice. This of course extends to showing caution when prescribing sedating medication in the community including sleeping tablets, strong analgesics and psychoactive agents, and adequately warning of the risks.
  • Doctors should always carefully document their assessments of patients, especially in higher-risk contexts such as transitioning from care. It is important to record the relevant positive and negative findings which would justify discharge and to outline the discussed options and agreed plan.

This article was originally published by Avant Mutual. You can access the original here.