Telemedicine: the high cost of breaching patient privacy regulations

In recent years, we've seen a rapid uptake of telemedicine services across a range of medical conditions, offering convenience for patients and efficiency for practices. However, providing this type of service requires careful consideration of the regulations to safeguard patient privacy and avoid breaching privacy laws, which can carry hefty penalties.

The following case demonstrates the extent to which taking advantage of newer technologies can potentially expose a practice and its employees to situations where strict compliance with privacy and data protection laws is necessary.

Patient enquiry exposes data integrity risk

A seemingly simple enquiry from a patient triggered a series of revelations that a practice was not meeting many privacy requirements. The patient, who had read media reports on patient information being sold to third parties and was concerned about the potential for misuse of their data, had called the practice and requested a copy of their privacy policy.

On realising they didn’t have one, the practice, which had been newly established to provide dedicated telemedicine services, contacted Avant for assistance.

After talking to the practice about their policies and procedures, the medico-legal adviser realised that, in addition to needing advice on the wording of a privacy policy, there were potentially several other areas of the business where the integrity of data they handled was at risk of being compromised. The case was promptly referred to Avant’s Risk Advisory Service (RAS) to work with the practice to identify and rectify any deficiencies.

Identifying key risks and challenges

An assessment conducted by RAS revealed several vulnerabilities within the practice's operations:

• Insecure communication platforms: Practitioners were using channels such as Skype and FaceTime for their patient consultations, without realising these video conferencing services did not provide a secure platform for discussion about sensitive medical matters.
• Outsourced administration: For cost efficiency, the practice was using an external company to handle administration tasks. They had not checked what privacy training or protocols around handling data the staff from this virtual company had received. This posed a significant risk of sensitive medical information being mishandled.
• Cross-border data transfer: The virtual administration service employed staff in other countries, which meant sensitive health data was being sent overseas. This raised concerns about compliance with Australian Privacy Principles (APP), particularly APP 8, which regulates disclosure of personal information outside of Australia, and stipulates that a practice must “ensure that any overseas provider takes relevant steps to protect the information from misuse, interference, loss and unauthorised access, modification or disclosure”.
• Lack of centralised medical records: Individual practitioners were keeping records for their own patients, without making this information available through a secure centralised system. This limited the opportunity to provide continuity of care if one of the specialists were absent. Also, if a patient wanted to talk to someone else, they would have needed to provide their information all over again.

Assessing the issue and implementing change

Prioritising patient privacy and compliance isn't just good practice – it's essential for maintaining integrity and trust in an increasingly digital healthcare environment.

With the guidance of our advisers, the practice was able to navigate the privacy and data protection challenges they were facing in providing telemedicine consultations. Subsequently, with our support, they implemented a range of system enhancements necessary to ensure compliance, including:

• Developing a robust privacy policy.
• Establishing secure communication platforms compliant with privacy regulations.
• Implementing privacy training for all staff members, particularly including anyone who handled patient information.
• Exploring options for centralised medical records management to facilitate continuity of care.

To help them stay on top of the regulatory landscape around safeguarding patient privacy, they were also made aware of the ongoing support available to members through Avant Assist.

Penalties for breaching the Privacy Act can be severe. In addition to the substantial fines that can be imposed, a practice under investigation will have to deal with:

• Cost and stress of defending the practice in a court case.
• Compromised reputation for the business from bad PR.
• Loss of trust for individual doctors from their patients.

This article was originally published in Connect magazine issue 22.

References and further reading

Avant Assist: Resources and services to support you in delivering safe, best-practice care

Medical Board of Australia: Telehealth consultations with patients

More information

For medico-legal advice, please contact us on nca@avant.org.au or call 1800 128 268, 24/7 in emergencies.