21 August 2023

A bitter pill — when you have to trade privacy for basic healthcare

Tessa Loftus

The last week saw the appearance of an issue that, to a privacy professional, rings considerable alarm bells in relation to issues of collection, consent and basic ‘reasonableness’. Consumer advocacy group Choice has released a report about a chain of medical clinics in NSW, Queensland and Victoria that will only bulk-bill patients who sign up to their app and rewards program. As a result, these patients are faced with a choice: pay a $90 out-of-pocket fee per appointment, or consent to their personal, health and even location information being shared with unknown third parties for marketing, research and other purposes.

Whether this action by the medical provider is deemed to be legal or not, it nonetheless raises considerable ethical concerns about privacy and access to services.

Privacy law in Australia is largely based around the notion of consent — that a balance is struck between what an organisation requests of me and what I am willing to provide, with the assurance that my personal information will be kept securely and handled in accordance with the Australian Privacy Principles.

However, this notion of consent strains considerably when there is an uneven distribution of power between myself and the organisation collecting my information, such as when I need to access a service. The current Australian Community Attitudes to Privacy survey found that “only 32% [of people] feel in control of their privacy, and half believe if they want to use a service, they have no choice but to accept what the service does with their data.” As we have noted previously, “where personal information must be provided to use public facilities or to access government services, there is no possibility of a valid ‘consent’ to data processing.”

In this instance, the service in question is not a government service, so the same equation does not necessarily apply. Or does it? A privately run GP clinic is not a government service, although it does receive a percentage of its funding via Medicare rebates, which makes it (in my mind) a borderline case. But more importantly, access to medical care is a serious and important social issue (not to mention a human right), and the ability to get it in a way that is timely and affordable is not in any way comparable to “do I want to swap my personal information for a $10 voucher from my supermarket”. There is a larger issue at play here.

Australia is currently in the middle of a GP crisis, with insufficient doctors available to meet the needs of our population. Only 42.7% of Australian GPs offer bulk billing, with this number dropping below 33% outside of Sydney and Melbourne. In many areas, particularly regional areas, GP services have huge wait lists or have closed their books to new patients. As with many access-to-services issues, these problems disproportionately affect low-income earners, older people and people with complex health issues or a disability. This therefore raises the question: Is it possible to give valid consent when the option is ‘or not access healthcare’?

One of the solutions that has been recommended by many privacy professionals (over many years) is a ‘fair and reasonable’ test, which sets boundaries around what is acceptable, without reference to consent. The final report on the current review of the Privacy Act does recommend amending the Act such that “the collection, use and disclosure of personal information must be fair and reasonable in the circumstances.” It also recommends that “the kind, sensitivity and amount of personal information being collected, used or disclosed” must be taken into account, as must “whether the collection, use or disclosure is reasonably necessary for the functions and activities of the organisation.”

These detailed requirements would be useful in this kind of circumstance, when we might want to ask “is it legal when a business unreasonably asks people to trade their privacy (and possibly dignity and autonomy) for access to affordable healthcare?” But for now, the question is: when will we see the law reform that might enable us to ask this question? The answer… is up to the Attorney-General.