Disclosure of confidential information for research
Information that could identify, or potentially be used to re-identify an individual patient is protected by privacy and confidentiality legislation. While Queensland Health employees may have access to patient information for the provision of health care, accessing this information for research is not permitted without lawful authorisation.
In Queensland, lawful authorisation to disclose confidential information for research purposes occurs via:
- Consent from the individual to whom the information relates or a substitute decision maker;
- Under Part 7 Confidentiality, Section 150 of the Hospital and Health Boards Act 2011 (HHBA); or,
- Approval under Chapter 6, Part 4 Research of the Public Health Act 2005 (PHA).
The Queensland Health Guideline for Disclosure of Confidential Information for Research provides further information regarding the legal protections applicable to confidential and personal information, and the pathways available for disclosure.
Consent mechanism
The best practice and preferred method for seeking disclosure of confidential information is with the informed consent of the person to whom the information relates, or where applicable, through a substitute decision maker.
The Hospital and Health Board Act 2011 (HHBA) Part 7 Confidentiality outlines the permitted disclosures of confidential information, specifically disclosure with consent.
Hospital and Health Boards Act
For research where it is not practicable or possible to seek patient consent for the use of confidential information, applications for ethical and governance review require:
- A waiver of consent, granted by a Human Research Ethics Committee (HREC) during ethical review; and,
- Lawful authorisation, granted by the Data Custodian(s) during the governance review process.
A waiver of consent considers the ethical principles outlined in the National Statement and does not provide lawful authorisation to disclose confidential information or override state or national privacy and confidentiality laws.
Waiver of consent
Where research involves the use of patient information without their consent, the Human Research Ethics Application (HREA) must include a request to the HREC for a waiver of consent. The HREA and the research protocol must clearly outline the justification for the waiver of consent according to the National Statement on Ethical Conduct in Human Research 2023 Chapter 2.3 Qualifying or waiving conditions for consent.
Lawful authorisation
A lawful authorisation to disclose confidential information without patient consent must be established during the research governance review process. All requests for disclosure of confidential information without patient consent require evidence of data custodian approval.
The research protocol and any associated data management plan should detail the requested disclosure of confidential information, with clear alignment to the justification for the waiver of consent provided in the HREA.
Section 150 Permission
The Hospital and Health Boards Act 2011 (HHBA) Section 150 provides for the disclosure of confidential information for the purposes of evaluating, managing, monitoring or planning health services. These provisions are only applicable for disclosures from one designated person to another designated person. In most cases, a designated person refers to a Queensland Health employee, however the full definition of a designated person is provided in the HHBA Section 139A Meaning of a designated person.
Applications for disclosure of confidential information via Section 150 will require evidence of data custodian approval. Each Metro North Health site has their own data custodian. A copy of the signed data custodian check list is required to be submitted with your SSA.
PHA Approval
The Public Health Act 2005 (PHA) Chapter 6 Part 4 Research outlines provisions for the disclosure of confidential information without consent from the individual to whom the research relates.
Researchers applying for access to identifiable or potentially re-identifiable information held by Queensland Health where patient consent has not been obtained may be required to submit a PHA application for approval by the Director General of Queensland Health.
A data custodian may also request a PHA approval is granted before disclosing any confidential information.
A copy of the PHA Grant Approval letter is required to be submitted with your SSA.
Data custodians
All requests to use confidential information without patient consent require evidence of data custodian approval. In general, data custodians are responsible for either:
- Hospital and Health Service (HHS) or individual Hospital level data.
- State-wide or Queensland Health level data.
Each Metro North facility has their own data custodian. Queensland Health staff can find more information below:
- Royal Brisbane and Women’s Hospital
- Surgical, Treatment and Rehabilitation Service (STARS)
- The Prince Charles Hospital (TPCH)
- Redcliffe Hospital
- Caboolture Hospital
The Office of Research and Innovation, Clinical Planning and Service Strategy maintain a Data Custodian contact list for research applications made in accordance with Chapter 6 Part 4 of the Public Health Act 2005.
Statistical Services Branch
The Statistical Services Branch (SSB) collects, processes, analyses and disseminates statistics on the health of Queenslanders and their use of health services. SSB is the Data Custodian for the following data collections:
- Queensland Hospital Admitted Patient Data Collection (QHAPDC)
- Perinatal Data Collection (PDC)
- Registry of Births, Deaths and Marriages data
- Queensland Trauma Registry (QTR)
- Queensland Health Non-Admitted Patient Data Collection (QHNAPDC)
SSB also offers a data linkage service to researchers and Queensland Health staff for approved projects.
NHMRC guidelines under section 95 of the Privacy Act 1988
Section 95 of the Privacy Act provides a process that acknowledges that in some circumstances the right to privacy must be weighed against justifiable interests that may benefit society as a whole.
The conduct of medical research can be one of these circumstances. Section 95 of the Privacy Act allows the NHMRC, with approval of the Federal Privacy Commissioner, to issue guidelines for the protection of privacy in the conduct of medical research.
It is a condition of approval of the section 95 guidelines that the Federal Privacy Commissioner must be satisfied that the public interest in the promotion of medical research outweighs, to a substantial degree, the public interest in privacy.
The section 95 guidelines establish a process by which HRECs may approve medical research proposals that involve the use or disclosure of personal information held by Commonwealth agencies without consent from the individual concerned.
To approve a proposal, the HREC must decide that the public interest in the research outweighs, to a substantial degree, the public interest in the protection of privacy.
The NHMRC has also issued the section 95A guidelines, which establish a process by which HRECs may approve proposals that involve the collection use or disclosure of health information held by private sector organisations without the consent from the individual concerned.
Queensland Civil and Administrative Tribunal
For patients who cannot consent for themselves, but are eligible to participate in clinical trials, it is a requirement to seek QCAT approval for the study before it commences.
Pre-approval planning
The design and conduct of high quality research benefits from comprehensive planning for all stages of the research lifecycle.