Projects that require access to patient information, including medical records (eMR/powerchart) and/or databases held locally by departments, must comply with the Health Records and Information Privacy Act 2002 (HRIP Act). The Act outlines how NSW public sector agencies and health service providers must manage personal health information. The HRIP Act sets out 15 Health Privacy Principles (HPPs) for the collection, use and disclosure of personal health information. Within the HPPs are exemptions for certain types of activity, for example, health management and research, which may allow you to access or use personal health information without seeking consent.
In addition to the HRIP Act, four statutory guidelines expand upon the HPPs within the HRIP Act. Their purpose is to guide organisations in their handling of health information and provide more detailed information regarding the scope of the HPPs. By law, both the statutory guidelines and the exemptions must be complied with. Failure to do so constitutes a breach under the Act.
Applying this to your ethics application
The statutory guideline on research requires research proposals to be submitted and reviewed by the Human Research Ethics Committee (HREC). The statutory guideline sets out the procedure for the preparation of proposals.
Organisations seeking to use or disclose health information (without the individual’s consent) must comply with the guideline if they want to rely on the research exemption in HPP 10(1)(f) or 11(1)(f) schedule 1 HRIP.
Proposals will only be approved once the committee determines, as set out in the guidelines, whether the public interest in the research substantially outweighs the public interest in maintaining the level of privacy otherwise afforded by the HPPs.
It is important to note that the Act applies to both the use and disclosure of information. Medical record review involves use of health information, usually without consent, therefore you must address this in your application. For LNR projects, this information is in section 7 of the LNR form.
Applying this to your governance application
As part of the governance review process, a declaration of support (ie. sign-off) is required from the supporting department from which researchers are accessing patient medical records or databases. This includes access via the electronic medical records (eMR) system.
Access to Medical Records/eMR
Health practitioners have access to medical records for the provision of clinical care. As stated above, the use of medical records for research is a secondary purpose, for which patients may not have provided consent.
Access to records for a purpose other than clinical care, without the appropriate authority, is a serious breach of the NSW Health Code of Conduct, and use of eMR is randomly audited.
Process for Health Information Services sign-off
The nominated representative for access to medical records or eMR is the Manager of HIS. This ensures that in the event of audit there is documented approval for data use outside of the usual access terms and conditions.
HIS should sign the SSA or LNRSSA document.
If your research requires use of medical records from multiple NSLHD sites you may submit your SSA/LNRSSA to the District HIS Manager otherwise requests should be directed to the site HIS Manager.
You should allow at least 7 days to obtain HIS sign-off.
HIS Contact Details
If your study involves access to medical records, HIS requires you to follow their standard practices for record retrieval documented in the HIS Process: Research Factsheet.
Access to medical records can only commence once you have both HREC approval and SSA authorisation for your study.
Accessing Supporting Departments and Local Department Databases.
For access to local, departmental databases you should approach the relevant data custodian, when writing the protocol, to discuss the requirements of the study and how they may be required to support the study. This may include time requirements to pull and de-identify data.
Once there is agreement with the data custodian, ask that they sign the Declaration by Data Authority in the SSA/LNRSSA. You should clearly indicate for which department and database is being accessed (ie. the data custodian’s name and department must be legible in the form).
The Performance Unit and Maternity Database are the two commonly requested support units. Contact the department directly to clarify requirements.
NSLHD Performance Unit
If you require admitted patient data (eMR) or Emergency Department data (FirstNet) then the assistance of the Performance Unit will be required.
From March 2015 the NSLHD Performance Unit has introduced a new process for research data requests pertaining to Royal North Shore Hospital and Ryde Hospital. Major changes include the introduction of a Research Data Request Form and a standard fee of $135.74 for the provision of data (additional fees may apply).
Email the Performance Unit at [email protected] for a Research Data Request Application Form.
eMaternity is the NSW wide clinical database that records maternity care from booking-in, through labour and birth, discharge and community midwifery care.
The original 'ObstetriX' database was de activated in 2017 and Researchers are now required to request maternity data using 'eMaternity' database.
At NSLHD the Maternity clinical database is managed by the data custodian, Kristen Rickard ([email protected]) or ph: 02 946 32177.