This is the html version of the file http://www.nzhis.govt.nz/documentation/mhinc/ak983340.pdf.
G o o g l e automatically generates html versions of documents as we crawl the web.

Google is neither affiliated with the authors of this page nor responsible for its content.
Page 1
Privacy Impact Assessment
and
Commentary
on the
Mental Health Information Project
for
New Zealand Health Information Service
Elisabeth Harding
February 1999
Page 2
Table of Contents
Page
1.
Executive Summary
1
Part 1: Background to the Mental Health Information Project
2.
Introduction
6
2.1
Summary of the Mental Health Information Project
6
3.
National Mental Health Strategy
7
Looking Forward
7
Moving Forward
9
4.
National Mental Health Standards
11
5.
New Zealand Health Information Service
11
6.
"The Mason Report" - Inquiry under section 47 of the Health and Disability Services
Act in respect of certain mental health services (May 1996)
13
7.
Mental Health Commission
13
8.
Legal requirements
15
8.1
Privacy Act 1993
15
8.2
Health Information Privacy Code 1994
17
8.3
Health Act 1956
19
8.4
Hospitals Act 1957
20
8.5
Official Information Act 1982
20
9.
Professional and Ethical Codes of Practice
21
10.
Standards New Zealand
21
11.
Health Research Council Guidelines on research involving personal information
21
12.
Database management
22
13.
Databases and the privacy legislation
24
Page 3
14.
Current monitoring of mental health data
27
15.
Purpose of the Mental Health Information Project
27
16.
Content Mental Health Information Database
28
17.
Conclusion Part 1
29
Part 2: Privacy Impact Assessment
18.
General overview of the project from a privacy perspective
31
19.
Collecting/obtaining information: HIPC Rules 1-4
33
20.
Purpose of collection: Rule 1
34
21.
Source of health information: Rule 2
35
22.
Collection of information from individual: Rule 3
37
23.
Manner of collection: Rule 4
37
24.
NZHIS response to collections issues
38
25.
Collection issues: Discussion
38
26.
Storage and security: Rule 5
40
27.
NZHIS response to the storage and security issues
42
28.
Storage and security issues: Discussion
43
29.
Accuracy: Rule 8
44
30.
NZHIS response to accuracy issues
45
31.
Accuracy: Discussion
45
32.
Retention: Rule 9
46
33.
NZHIS response to retention issues
47
34.
Retention: Discussion
47
Page 4
35.
Use and disclosure: Rules 10 and 11
48
36.
NZHIS response to use issues
48
37.
NZHIS response to disclosure issues
49
38.
Use and Disclosure: Discussion
50
39.
Requests for official information
52
40.
Unique identifiers: Rule 12
53
41.
NZHIS response to unique identifier issues
53
42.
Unique identifiers: Discussion
53
43.
Access and Correction: Rules 6 and 7
54
44.
NZHIS response to access and correction issues
55
45.
Access and correction: Discussion
55
46.
Conclusions
55
47.
Recommendations
60
Bibliography
62
Appendix 1
Health Information Privacy Code Rules
64
Appendix 2
Mental Health Commission Act 1998, section 6
70
Page 5
1.
Executive Summary
1.1
In September 1997, the Minister of Health authorised the New Zealand
Health Information Service (NZHIS) to develop a high level database
containing information on the provision of secondary mental health and
alcohol and drug services. The need to develop such a database flowed
from the acknowledged need for national level information about the
mental health sector.
1.2
In response to this requirement the Mental Health Information Project
(MHIP) was established. The objective of the project is to provide
complete, accurate and timely information on secondary mental health
services.
1.3
This report focuses on privacy implications associated with the
development of a database under the MHIP. It is split into two major parts:
• Part 1 provides a background to the MHIP.
• Part 2 provides a privacy impact assessment of the MHIP.
Part 1
1.4
Part 1 of the report provides a general overview of the MHIP in the context
of:
• National mental health strategy;
• National mental health standards;
• NZHIS;
• The Mason Report;
• Mental Health Commission;
• Various legislative requirements; and
• Professional and ethical codes, Standards New Zealand requirements,
and Health Research Council guidelines.
Further contextual background information is provided on:
• Database management;
• Databases and their relationship to privacy legislation;
• Current state of monitoring of mental health data; and
• Content of mental health information database.
1.5
The following conclusions were reached in relation to Part 1 of this
report:
Page 6
1.5.1
Conclusion 1: The Ministry of Health has made a commitment
to ensure that mental health services are available to those who
need them. In order to monitor the success of implementing this
commitment, it has been considered necessary to measure the
delivery of secondary mental health services by both the public
sector and non-governmental organisations.
1.5.2
Conclusion 2: One of the objectives of the MHIP is to provide a
mechanism for monitoring the implementation of the mental
health strategy with respect to the delivery of secondary care
services.
1.5.3
Conclusion 3: Although there is no statutory requirement for
providers to supply this information, the funding agreement for
1998/99 includes, as part of the performance measures for the
Health Funding Authority (HFA) five year plan, a commitment
from the HFA for "requirement for compliance with the NZHIS
National Mental Health Information System to be included in
1998/2000 service specifications".
1.5.4
Conclusion 4: Providing NZHIS is able to gain the commitment
of the providers, NZHIS is in an excellent position to be able to
carry out the development of a secondary database for the
provision of aggregate data to effectively monitor the delivery of
secondary mental health services.
1.5.5
Conclusion 5: However, NZHIS must ensure that all the
purposes of the database are properly contemplated prior to
implementation and that the mental health service providers are
aware of these purposes so they may be conveyed to individuals
receiving services, and whose information is to be provided.
1.6
Part 2: Privacy Impact Assessment
Part 2 of the report assesses privacy issues in relation to the development
and operation of the Mental Health Information Database.
This part of the report is constructed in the following way:
• General overview of the project from a privacy perspective.
• Collecting/obtaining information: HIPC rules 1-4, with associated
NZHIS response to collection issues and subsequent discussions.
• Storage and security: rule 5, with associated NZHIS response to storage
and security issues and associated discussion.
Page 7
• Accuracy: rule 8, with associated NZHIS response to accuracy issues
and associated discussion.
• Retention: rule 9, with associated NZHIS response to retention issues
and associated discussion.
• Use and disclosure: rules 10 and 11, with associated NZHIS response to
use and disclosure issues and associated discussion.
• Unique identifiers: rule 12, with associated NZHIS response to unique
identifiers issues and associated discussion.
• Access and correction: rules 6 and 7, with associated NZHIS response
to access and correction issues and associated discussion.
1.7
Conclusions to Part 2 of the report:
1.7.1
Conclusion 1: Any centralised database containing identifiable
information raises issues concerning the extent of information
obtained and the purpose of such a database.
1.7.2
Conclusion 2: Overall, the way the project has been developed
indicates that NZHIS is committed to taking a leadership role
with respect to the provision of health information services
generally, and in this instance the implementation of the MHIP.
1.7.3
Conclusion 3: In doing so it has recognised the need to ensure
that its own staff are familiar with the requirements of the Privacy
Act and the Health Information Privacy Code. In addition,
NZHIS has acknowledged that in order to build a trusting
relationship with health service providers, it is important that
NZHIS help providers fulfil their obligations when collecting
information from individuals.
1.7.4
Conclusion 4: NZHIS has taken the potential privacy impacts
seriously and acknowledged the role it needed to play in ensuring
that the providers are aware of the purposes of the information
and their privacy obligation with respect to their patients.
1.7.5
Conclusion 5: Trust in NZHIS and value in the benefits of the
MHIP by both the providers of mental health services and the
individuals receiving those services, will be the deciding factor to
the ultimate success of the project.
1.8
Recommendations (not in any order of priority)
1.8.1
Recommendation 1: NZHIS needs to document its information
management policy regarding the MHIP. This policy should
Page 8
provide an overview of how the information will be protected
from potential privacy intrusions including:
• how NZHIS will ensure that providers are aware of their
obligations when collecting information from individuals for
the MHIP;
• storage and security safeguards in place to protect the
information;
• retention periods for electronic and paper records;
• how accuracy of the information will be achieved;
• restrictions on access to identifiable information by staff of
NZHIS and a policy for dealing with unanticipated requests for
information held on the database;
• protocol for dealing with research projects;
• restrictions on the linking, by NHI number, of information
obtained from the MHIP;
• a procedure enabling individuals to access their personal
information and request correction;
1.8.2
Recommendation 2: NZHIS should consider the possibility of
appointing a group to monitor the implementation of MHIP on an
on-going basis, including monitoring how effective the project is
in supplying the statistics necessary to measure the
implementation of the National Mental Health Strategy. Such a
group could also have responsibility for protecting the
information and considering requests for access for research
projects and official information requests. For example, NZHIS
may chose to invite interested groups to be represented on the
group such as Mental Health Commission, the Office of the
Privacy Commissioner, and mental health consumer groups.
1.8.3
Recommendation 3: NZHIS needs to develop education
materials such as posters and pamphlets, use of web site for both
providers and individuals to gain an awareness and understanding
about the MHIP. These materials should explain:
• the objectives of the project and why specific information
needs to be collected;
• how the information will be protected, and who will be able to
use the information;
• individual's right to access and correct information held by
NZHIS.
Page 9
NZHIS should work with the Office of the Privacy Commissioner
in developing these materials.
1.8.4
Recommendation 4: NZHIS needs to provide on-going training
for staff to ensure that they are aware of how personal health
information should be protected from potential privacy risks.
1.8.5
Recommendation 5: NZHIS needs to consider whether it is
necessary to retain information about deceased persons in an
identifiable form as there will be no need to add further
information to those records.
1.8.6
Recommendation 6: NZHIS needs to ensure that a field is
included on the database to provide an alert where an individual
has requested the correction of information or the inclusion of a
statement of correction. This will alert those considering
disclosing information for research purposes of the possible
inaccuracy of the information.
Page 10
Part 1: Background to the Mental Health Information Project
2.
Introduction
Databases have the potential to monitor and enhance the value of health care
services, consequently improving the outcomes for those receiving such services.
1
Good quality information provides a base for assessing performance of a system.
However, it has also been noted that the usefulness of the databases for planning and
co-ordination of health care and the benefits to the individual concerned should not
be assumed without investigation and informed debate.
2
Over the last 40 years mental health services in New Zealand have shifted from
institutional care toward providing community-based services. During this period
there has been much criticism regarding the delivery of the service including the
lack of provider responsiveness to the needs of consumers, caregivers and their
families.
Over the last four years the Ministry of Health has made significant efforts to
identify the needs to be addressed in the delivery of mental health services. The aim
of the Mental Health Information Project is to provide complete accurate and timely
information on secondary mental health services
3
and alcohol and drug services.
4
2.1
Summary of the Mental Health Information Project
2.1.1
In September 1997, the Minister of Health authorised the New
Zealand Health Information Service ("NZHIS") to develop a
high-level database containing information on the provision of
secondary mental health and alcohol and drug services.
5
The
need to develop such a database flowed from the acknowledged
need for national-level information about the mental health
sector.
6
1
Health Data in the Information Age: Use Disclosure and Privacy; Molla S Donaldson; Kathleen N Lohr, Ed. Committee on
Regional Health Data Networks, Institute of Medicine, National Academy Press, Washington DC (1994) 61. Improving
outcomes may include making available information on access to care, costs, appropriateness, effectiveness and quality of
health care services and health care providers.
2
Medical Record Databases: Just what you Need? Report prepared for the Privacy Commissioner by Robert Stevens, April
1998, 1.
3
Secondary mental health services are defined as services provided by specialist community and hospital based organisations in
the public and private sectors.
4
http://www.nzhis.govt.nz/projects/mental.html
5
Ibid.
6
This statement was made following a pilot project. The object of the pilot project was to ascertain whether information could
be collected in a way that was cost effective and which would have a minimal impact on provider organisations. The pilot
phase confirmed that it was possible to extract and store data and to report on the information obtained from mental health
Page 11
2.1.2
The object of the Mental Health Information Project ("MHIP") is
to provide complete, accurate and timely information on
secondary mental health services. It is intended that this will:
• allow adequate monitoring of the implementation of the
National Mental Health Strategy;
7
• provide a database for research into the provision of mental
health services;
• provide aggregated information to providers, consumer
groups, the Health Funding Agency ("HFA"), the Mental
Health Commission and other interested parties in the health
sector.
2.1.3
Although it was initially contemplated that the database could, in
the future, be used for clinical purposes in the treatment of
individual patients, this proposed use has now been excluded
from the scope of the project.
2.1.4
Information to be collected and collated relates to secondary
mental health services, and drug and alcohol services which are
funded by the HFA. These secondary services are provided by
Hospital and Health Services ("HHS")
8
as either inpatient or
community services, or by non-government organisations
("NGO").
3.
National Mental Health Strategy
Looking Forward
3.1
In June 1994 the Ministry of Health released the document Looking
Forward: Strategic Directions for the Mental Health Services.
9
This
document provided the mental health strategy and outlined the goals,
principles and national objectives that were intended to reshape New
Zealand's mental health services. Acknowledging the shift away from
institutional care towards community-based care as the most cost effective
way of providing mental health services, the Government stated a
commitment to the community based model backed by in-patient services
for acute and secure care.
7
Paragraph 3.
8
Hospital and Health Services were previously referred to as CHEs or Crown Health Enterprises.
9
Page 12
3.2
In Looking Forward the Ministry identified that two of the problems with
the existing mental health service were:
• a lack of provider responsiveness to the needs of consumers, caregivers,
and their families;
• a lack of a systematic database that would show who uses the mental
health services, and a lack of detailed information about who would
potentially use the mental health services.
10
3.3
Two goals were set to guide the work of the mental health services. These
goals were to:
• decrease the prevalence of mental illness; and
• increase the health status of and reduce the impact of mental disorders
on the individual, their family and caregivers and the community.
3.4
Fourteen principles were identified to define the quality standards to be met
by mental health services. The principles which most closely relate to the
need to develop some form of centralised database were those:
• giving priority to cost effective services that provide the best value in
terms of health gains;
• encouraging service provision to be integrated at all levels and to be
focused on achieving maximum wellness and independence for all
consumers.
3.5
Five key strategic directions incorporating the national objectives were set
out in the document. These directions were:
1.
Implementing community-based and comprehensive mental health
services;
2.
Encouraging Maori involvement in planning, developing and
delivering mental health services;
3.
Improving the quality of care;
4.
Balancing personal rights with protection of the public;
5.
Developing a national alcohol and drugs policy.
3.6
The aim of Strategic Direction 3: Improving the Quality of Care
11
was:
• To establish and revise mechanisms for the monitoring of community
mental health needs and services;
10
Ibid. 6-7.
11
Page 13
• To promote co-ordination between all agencies involved in the mental
health system and to ensure that clear lines of accountability exist;
• To develop data collection and analysis systems which provide adequate
information for continued long-term planning within the mental health
system;
• To review and revise if necessary the Government's objectives every five
years.
3.7
Strategic Direction 5: Developing a National Alcohol and Drugs Policy
12
also identifies the need to monitor the effectiveness of the alcohol and drug
services. It was stated that the National Minimum Dataset should be
extended to monitor the performance of these services and to assess their
ability to meet consumer demand.
13
3.8
The Mental Health Strategy Advisory Group 1996 reported to the Minister
of Health in 1996 that the progress towards goals in Looking Forward
needed to be measurable. The Advisory Group recommended the adoption
of a goals and targets approach. Such an approach would involve the
establishment of measurable goals and objectives and the development of
targets and milestones which could be used to map progress towards
objectives.
The Advisory Group generally endorsed the allocation of priority issues and
strategy development. Gaps in the Looking Forward document were
identified in the areas of:
• consumer and Pacific Island perspectives;
• mental health promotion;
• primary mental health;
• child and adolescent mental health; and
• intersectorial issues.
14
Moving Forward
3.9
Three years after Looking Forward the Ministry of Health produced the
Moving Forward: The National Mental Health Plan for More and Better
Services.
15
This document is also referred to as the National Mental Health
Plan (the "Plan"). The purpose of Moving Forward was to ensure that
Looking Forward was implemented, dividing the process into two parts:
12
Ibid. 24.
13
Paragraph 14.
14
Mental Health Strategy Advisory Group - Statement to the Minister of Health, April 1996.
15
Page 14
• First Steps; and
• Next Steps.
3.10
Moving Forward recognised that in the previous three years although more
mental health services had been provided it was difficult to measure the
quality of those services.
3.11
The Plan aimed to achieve more and better mental health services that
worked together with other health and social services so that the right
people got services and those services meet their needs.
16
The document
sets out strategic directions which contain national objectives and targets.
3.12
Specifically, the Plan included an additional strategic direction to cover the
infrastructure necessary for delivering more and better services including
data collection and analysis, Strategic Direction 6: Developing a Mental
Health Infrastructure.
17
3.13
Under First Steps there are three National Objectives for Strategic
Direction 6 and four under Next Steps.
3.14
The most relevant to the development of the MHIP is National Objective
6.2
18
(First Steps):
• To improve the accuracy, timeliness and appropriateness of mental
health data collection, in order to help monitor the achievement of a
number of targets in the National Mental Health Plan.
3.15
Acknowledging that the information currently being collected is limited in
terms of accuracy and coverage
19
the aim of this objective is to collect
national data on services in ways that are consumer based, flexible, timely
and accurate, and to allow access to the information derived from the data
at agreed levels of security.
3.16
The target is that by July 2000 there will be a national health data-
collection process which:
• provides accurate and timely information that can be used to help
monitor a number of targets in the Mental Health Plan;
• includes mental health and drug and alcohol data collection.
16
Ibid. 9.
17
Ibid. 31.
18
Ibid. 32.
19
Page 15
3.17
Under Next Steps the relevant provision is found in National Objective
6.7:
20
• To improve the health status of New Zealanders and to enhance the
quality of mental health decision-making by providing up-to-date
knowledge based on research information.
4.
National Mental Health Standards
4.1
The National Mental Health Standards (Standards) project was funded by
Mental Health Services, Ministry of Health. It was described as a
sub-project of the National Mental Health Strategy Moving Forward. The
Standards apply to all mental health services. Mental health service was
defined as an organisation that provides, as its core business, treatment or
support to people with mental illness or mental health problems.
21
4.2
The purpose of the Standards is to establish a consistent level of care and
support throughout the country. The document includes a form for
conducting self assessment/audit on the implementation of the Standards
and suggests that in addition an external audit be undertaken before 2000.
4.3
Monitoring of the performance in regard to the criteria set out in each of the
twenty standards is the responsibility of the mental health service. The
information obtained is to be used by the provider for improving their
service delivery.
4.4
The Standards and the form for self assessment indicate an intention on the
part of the Ministry for mental health services to monitor their own clinical
service delivery.
5.
New Zealand Health Information Service
5.1
New Zealand Health Information Service (NZHIS) has been given the task
of developing and maintaining the MHIP database.
5.2
NZHIS is a group within the Ministry of Health responsible for the
collection and dissemination of health-related information. It is a health
agency under the Health Information Privacy Code 1994. It is also a public
sector agency and subject to the Official Information Act 1982.
20
Ibid. 47.
21
Page 16
5.3
NZHIS has as its foundation the goal of making accurate information
readily available and accessible in a timely manner throughout the health
sector.
5.4
The vision of NZHIS is to be recognised as the world-leader in the
provision of health information services, and to support the health sector's
ongoing effort to improve the health status of New Zealanders. It sees the
effective and timely use of information as crucial to achieving this vision.
5.5
High quality information is vital to both the provision of services and the
efficient operation of the health and disability support sector. The Health
Information Strategy for the Year 2000
22
provides the framework for the
development and maintenance of health information to meet national
requirements. The strategy aims to ensure that an accurate, timely and
consistent set of data is available nationally, while protecting the
confidentiality of information and avoiding undue compliance and
collection costs on the sector.
5.6
The Ministry of Health has given NZHIS responsibility
23
for:
• the collection, processing, maintenance, and dissemination of health
data, health statistics and health information;
• the continuing maintenance and development of the national health and
disability information systems;
• the provision of appropriate databases, systems and information
products;
• the development and provision of health and disability information
standards and quality-audit programmes for data;
• co-ordination of ongoing national health and disability information