Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

OAIC seeks comment on PCEHR privacy, data breach investigations

Australians invited to agree or disagree with Information Commissioner’s proposed enforcement of the Personally Controlled Electronic Health Records System (PCEHR)

The Office of the Australian Information Commissioner (OAIC) is requesting feedback from the Australian public on its draft Enforcement Guidelines for the Personally Controlled Electronic Health Records System (PCEHR) Act.

To help Australians prepare comments, the OAIC has published a consultation paper (PDF) called eHealth record system OAIC Enforcement Guidelines on its website.

Read: Privacy commissioner to regulate eHealth system

According to the draft Enforcement Guidelines, the OAIC has a range of enforcement powers following an investigation into alleged contraventions of the PCEHR Act including the power to seek a civil penalty from the courts, seek an injunction to prohibit or require particular conduct and the power to accept enforceable undertakings.

“The OAIC also has a role in accepting data breach notifications from certain e-health records system participants,” read the Guidelines.

The OAIC’s intended approach to PCEHR Act enforcement activities include:

  • Complaints will generally be accepted under the Privacy Act and investigated using the investigative powers and processes contained in Part V of the Privacy Act. The OAIC will attempt to facilitate conciliated outcomes between the parties and, where appropriate, will pursue enforcement mechanisms available under either the PCEHR Act or the Privacy Act.

  • OAIC own motion investigations will generally be conducted under the Privacy Act using the investigative powers and processes contained in Part V.

  • The Commissioner retains a discretion to investigate conduct using the investigative power in section 73(4) of the PCEHR Act where the Commissioner considers it appropriate. In such cases, the Commissioner will adopt an investigative process which, wherever possible, mirrors the investigative process contained in Part V of the Privacy Act.

The Guidelines include two questions for Australians as part of the consultation.

“Do you agree with the Commissioner’s proposed approach to eHealth record system enforcement?”

“Do the OAIC’s draft Enforcement Guidelines set out the Commissioner’s proposed approach in a clear manner which is informative for PCEHR system participants? If not, how can they be improved?” read the Guidelines.

Comments on the draft Guidelines must be made by Tuesday, 18 September 2012.

Australians can have their say by email consultation@oaic.gov.au or by post to GPO Box 5218, Sydney NSW 2001.

Follow Hamish Barwick on Twitter: @HamishBarwick

Follow Computerworld Australia on Twitter: @ComputerworldAU, or take part in the Computerworld conversation on LinkedIn: Computerworld Australia

Recommended

  1. Australian government releases big data issues paper

  2. Think Tank: Tips for IT strategic planning success

  3. From CMO to CEO: Anametrix’s Pelin Thorogood

    CMO

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

References show all
Comments are now closed.
Related Whitepapers
Latest Stories
Community Comments
Latest Blog Posts
Whitepapers
  • Clearing the Clouds for Midmarket Businesses
    Cloud computing promises to help midmarket companies reduce cost and complexity in the IT equation – and gain the flexibility and agility they need to thrive. Yet charting a clear course to the cloud isn’t always easy. In this paper, we aim to clear the clouds. We examine different cloud computing models, discuss the types of requirements that each can best address, and consider what midmarket businesses should look for in a cloud solutions provider.
    Learn more »
  • Appropriate Backup Applications for Accelerated Virtualisation Projects
    As virtualisation increasingly becomes an investment priority, a recent EDG survey has found that the associated operating expense can easily become too high a hurdle. In this paper, leading IT organisations quantify the role of inappropriate data-protection as a large obstacle to a stable virtualisation implementation. Read more to find how to optimise your backup applications to meet the present protection requirements.
    Learn more »
  • Detecting APT Activity with Network Traffic Analysis
    Today’s successful targeted attacks use a combination of social engineering, malware, and backdoor activities. This research paper will discuss how advanced detection techniques can be used to identify malware command-and control (C&C) communications related to these attacks, illustrating how even the most high-profile and successful attacks of the past few years could have been discovered.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Recent comments