However, where consent cannot be obtained, the Privacy Act allows you to use or disclose a patient’s genetic information if each of the following conditions are met:
- you collected the information in the course of providing a health service to the patient
- you reasonably believe that the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of a genetic relative of the patient
- you use or disclose the information in accordance with the guidelines to the s 95AA guidelines
- in the case of disclosure — your disclosure is to a genetic relative of the patient.
A genetic relative is an individual who is related to the patient by blood, including but not limited to a sibling, a parent or a descendant (s 6(1) of the Privacy Act). The s 95AA guidelines state this should include relatives no further removed than third-degree relatives.
Although the Privacy Act allows you to use or disclose a patient’s genetic information when the above four conditions are met, you are not compelled to do so.
Lessening or preventing a serious threat
You can only use or disclose a patient’s genetic information if you reasonably believe that the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of a genetic relative of the patient. This means there must be a reasonable and justifiable basis for the belief; it cannot be merely a genuine or subjective belief. The use or disclosure would also not be considered necessary where it is merely helpful, desirable or convenient. For a further explanation of the terms ‘reasonably believes’ and ‘necessary’ see the APP guidelines, Chapter B: Key concepts.
A ‘serious’ threat to the life, health or safety of a genetic relative is one that poses them significant danger. It could involve harm to their physical or mental health, and could include a potentially life threatening situation or one that might reasonably result in other serious illness.
When deciding whether a threat is serious, you should consider both the likelihood of it occurring and the severity of the resulting harm if it materialises. A threat that may have dire consequences but is highly unlikely to occur would not normally be a serious threat. However, a potentially harmful threat that is likely to occur, but at an uncertain time, may be a serious threat, such as a genetic mutation that increases the risk of developing a certain cancer. Disclosing this information to genetic relatives may help the relatives take preventative or mitigating action.
Section 95AA guidelines
When using or disclosing genetic information without consent, you must do so in such a way that is consistent with the s 95AA guidelines. These legally binding guidelines are issued by the National Health and Medical Research Council and approved by the Australian Information Commissioner under s 95AA of the Privacy Act.
The guidelines outline what factors you should consider when determining if a use or disclosure of genetic information is necessary to lessen or prevent a serious threat to the life, health or safety of a patient’s genetic relatives. They also provide guidance on matters such as good ethical practice; what to do when the patient or genetic relative is a child; contacting relatives; and what information should be provided to relatives. Appendix 2 to the guidelines includes a sample privacy leaflet, consent form and letter to relatives.
Giving notice to patients
Under APP 5, you must take reasonable steps to notify a patient of certain matters when you first collect personal information. The matters for notification include why the information is being collected and who it may be disclosed to. For details see the APP guidelines, Chapter 5: APP 5 — Notification of the collection of personal information.
You should advise patients in your privacy collection notices of the possible use or disclosure of their genetic information without consent. The s 95AA guidelines provide a sample privacy notification leaflet at Appendix 2.