Disclosure of genetic information to at-risk relatives: recent amendments to the Privacy Act 1988 (Cwlth)

Sharing genetic information among at-risk relatives, and the rights and obligations of health care professionals in this context, have been debated over recent years.1,2 It was one of the matters investigated by the Inquiry into the Protection of Human Genetic Information, conducted by the Australian Law Reform Commission (ALRC) and the Australian Health Ethics Committee (AHEC) of the National Health and Medical Research Council (NHMRC).3 Following recommendations from that inquiry, privacy legislation has recently been amended,4 empowering health professionals operating in the private sector to disclose genetic information to a genetic relative where there is a serious threat to the life, health or safety of that person. Here, we outline this development and its implications for health professionals in Australia.

Genetic test information about an individual reveals information not only about themselves, but also about their blood relatives. This information may therefore be valuable to other family members potentially at risk, for example to ensure regular screening. The shared nature of genetic information has created tension among established principles of medical ethics, in particular between principles of individual autonomy and privacy, which put the patient in control of disclosure of personal genetic information, and the more communitarian interest in preventing harm to others. From an individual rights perspective, other family members would not be entitled to have access to this information without the patient’s consent, even if that were in their health interests. However, persuasive arguments have been made for a more family- or community-oriented view of genetic information, in which information should be shared for the benefit of all family members.1 This approach is supported by key international instruments, including the UNESCO Universal Declaration on the Human Genome and Human Rights (1997) and International Declaration on Human Genetic Data (2003), which expound the principles of “common heritage”5 and “solidarity”,5,6 and put these forward as a foundation for the development of law and policy in this area.

In Australia, privacy obligations on health care professionals stem from common law duties of confidentiality,7 as well as from statutory principles regulating the collection, storage and use of information under legislation. At common law, health professionals owe a duty to their patients to maintain the confidentiality of information provided by the patient. Breach of this duty may result in damages in tort, contract or for equitable breach of confidence, and may also be the basis for disciplinary proceedings. There are a number of exceptions to the common law duty of confidentiality, including a “public interest” exception: its application remains untested in this situation, but according to established precedents it would not appear to allow the disclosure of genetic information to at-risk genetic relatives.

Common law protection is augmented by legislation. Federally, the Privacy Act 1988 contains privacy principles which, inter alia, regulate the disclosure of personal information: Information Privacy Principles (IPPs) applying in the public sector and National Privacy Principles (NPPs) applying in the private sector. Similar principles are contained within relevant state and territory legislation.8,9 The effect of this legislation is to prohibit disclosure of personal information without the person’s consent.

An exception to this has been allowed under federal privacy legislation in special circumstances where disclosure of information is necessary to protect against serious and imminent harm (NPP2.1(e)(i)). This has very limited application in the context of genetic risk, given that most genetic conditions take time to manifest, and the potential harm is unlikely to be imminent. This means, for example, that information about a positive genetic test result for familial adenomatous polyposis could not be disclosed to that person’s relatives without the person’s consent, even though it would be in their health interests to do so. In practice, people can usually be persuaded about the need to share such information, but cases do arise where relevant genetic risk information is not willingly shared. In the absence of consent, a health professional would be in breach of the individual’s statutory privacy rights if this information were disclosed to a genetic relative.

The ALRC/AHEC Inquiry recognised this as a problem. Some submissions suggested there should be greater latitude for disclosure to genetic relatives, given that the adverse health consequences of some genetic conditions may be both serious and preventable. Others expressed the view that the position with regard to disclosure in such circumstances should at least be clarified.3 The Inquiry took the view that there needed to be some loosening of the constraints on disclosure of personal information in the case of genetic information, because of the potential benefit of this information to family members.3 In particular, it recommended in its report, Essentially yours, that the Privacy Act should be amended to permit a health professional to disclose genetic information about his or her patient to a genetic relative of that patient, where that disclosure is necessary to lessen or prevent a serious threat to an individual’s life, health or safety, even where the threat is not imminent (Recommendation 21-1). Further, the ALRC/AHEC recommended that the NHMRC develop guidelines, in consultation with the Office of the Federal Privacy Commissioner, to assist health professionals to approach decisions about the disclosure of genetic information to genetic relatives,3 and to provide them with additional protection from complaints or litigation. It was recommended that the guidelines should address the circumstances in which disclosure to genetic relatives is ethically justified or required, and the need for patients to be counselled about the disclosure of information in these circumstances (Recommendation 21-2). The Inquiry observed that implementation of these recommendations would leave the common law obligations of confidentiality intact, and that it would not foreclose the possibility that disclosure permitted by the Act as revised may still be actionable at common law. They saw this as appropriate, as the prevailing legislation was more restrictive of disclosure than the common law, and it was anticipated that the common law would develop in a similar way in light of these legislative reforms.3 The report noted that, for consistency, amendment would also be needed to the equivalent IPPs which apply to health professionals working for Commonwealth Government agencies, and recommended that the state and territory governments consider enacting parallel legislation.3

The federal government, in its response to the Essentially yours report, endorsed recommendation 21-1.10 In fact, this was one of the first aspects of the report to be legislatively implemented under a package of amendments to the Privacy Act introduced under the Privacy Legislation Amendment Act 2006 (Cwlth). The amendment to NPP2.1 provides that disclosure of genetic information to genetic relatives must be conducted in accordance with guidelines to be issued by the NHMRC and approved by the Privacy Commissioner.11 The Act has also introduced a definition of “genetic relative”: an individual who is related to the first individual by blood including, but not limited to, a sibling, a parent or a descendant of the first individual.12 Notably, the amendments do not make it obligatory for health care professionals to make such disclosure. The amending Act came into force on 14 September 2006; however, the operation of the disclosure provisions is predicated on the existence of guidelines yet to be developed by the NHMRC, and approved by the Privacy Commissioner under s. 95AA of the Act.

This amendment goes some way towards protecting health professionals from legal consequences if they divulge genetic information to relatives who would benefit from this information, without the consent of the patient. However, the limitations of this amendment must be noted. Firstly, it only confers protection from statutory liability under the Privacy Act, and does not purport to affect the common law obligation of confidentiality. Potentially, such conduct could still amount to a breach of the common law duty of confidentiality, depending on how the “public interest” exception is interpreted in the future,3 although, in practice, there have been very few common law actions for breach of confidentiality in a medical context. Secondly, the amendments are limited to the Privacy Act’s NPPs applying in the private sector. An equivalent amendment is needed to the Act’s IPPs applying to doctors or other health professionals working for Commonwealth Government agencies. Further, for comprehensive national coverage, parallel state and territory legislation would also be needed, as recommended in the Essentially yours report.

Thirdly, the legislation does not go as far as some professional guidelines,13 and some commentators have argued that an even more liberal approach is warranted.1,14 A compelling argument can be made in favour of the law recognising that even genetic information that does not involve a “serious risk” should be regarded as familial such that it can be shared, without one family member having a veto over that information. In this way, the familial aspect is shared — ie, that a mutation is present in the family — but the particular genetic status of any family member who has been tested can be kept confidential.1,14

These qualifications notwithstanding, the legislation represents a significant advance in protecting doctors from statutory liability if they make such disclosure. As noted, the legislation does not seek to compel disclosure, and questions will inevitably arise as to the rights of aggrieved relatives who would have expected to be informed but were not. In the absence of clear precedents,3 there is no valid basis to suggest that a doctor could be liable for non-disclosure. The enabling guidelines are likely to play a key role in clarifying expectations as to the appropriate circumstances where disclosure should be made, especially in view of the very broad definition of “genetic relative”.12 The guidelines are currently being developed by the NHMRC, and there will be a process of public consultation before they are finalised next year. Once issued, these guidelines ought to be accompanied by an effective education campaign, so that the practices of health professionals accord with community expectations. In the interim, this process of legislative change, and the inevitable discussion that it will generate, are likely to raise awareness regarding these issues and ultimately promote an environment in which disclosure is brought within the mainstream of accepted, even expected, clinical practice.

These amendments mark the beginnings of change to disclosure laws in the health care setting, reflecting the growing understanding of the familial nature of genetic information. It is important that health professionals, particularly those working in the field of genetics, are aware of this change, so that they can modify their disclosure practices accordingly.