If you work in the healthcare industry you have a huge responsibility when it comes to managing sensitive patient information, whether you’re a big software vendor or a single physiotherapist, everyone needs to follow the same rules, and there are some pretty serious consequences for not doing it properly.  Do you know what your obligations are and if you’re doing a good job? Check this episode out to find out!   Who is Anna Johnston Anna Johnston is one of Australia’s most respected experts in privacy law and practice. She has qualifications in law, public policy and management, and 26 years’ experience in legal, policy and research roles.  Anna has a breadth of perspectives and a wealth of experience to dealing with privacy and data governance issues. She is the former Deputy Privacy Commissioner for NSW, so she knows the regulator’s perspective and since 2004 is the Director for consulting firm “Salinger Privacy”. Anna has been called upon to provide expert testimony before various Parliamentary inquiries and the Productivity Commission, spoken at numerous conferences, and is regularly asked to comment on privacy issues in the media.   Anna holds a first class honours degree in Law, a Masters of Public Policy with honours, a Graduate Certificate in Management, a Graduate Diploma of Legal Practice, and a Bachelor of Arts, plus a number of other relevant and well regarded certificates and industry associations.  In this Episode you’ll learn Key TakeAways When it comes to privacy law in Australia, the same laws and consequences apply to everyone dealing with healthcare information - whether they are a big institution of a single doctor. While Data Privacy breaches do happen they are often the result of lack of education and or the best intentions in mind, not so much because of malicious intent Often AI is trained on data that was collected not for the intention of training the machine, so the concept of informed consent is a tricky one  The simple “tick this box to agree” actually isn’t enough and more emphasis needs to be put on clearly communicating clearly with the person who’s data is being collected The expectations of patients data privacy holds the health and medical industries to the highest levels of scrutiny meaning that breaches are to be reported to the Price  Commissioners office and the patients whose privacy has been breached   Links Anna Johnston Twitter - @SalingerPrivacy  Anna Johnston LinkedIn - https://www.linkedin.com/in/anna-johnston-ba188410a/ Notifiable Data Breaches Scheme - https://www.oaic.gov.au/ndb  GDPR - https://www.oaic.gov.au/privacy/guidance-and-advice/australian-entities-and-the-eu-general-data-protection-regulation/  MSIA - https://msia.com.au/  Salinger Privacy - https://www.salingerprivacy.com.au/  My Health Record (Formerly PCEHR) - https://www.myhealthrecord.gov.au/  NDIS - https://www.ndis.gov.au/  National Health and Medical Research Council - https://www.nhmrc.gov.au/    Transcript [ She has qualifications in law, public policy and management and 26 years experience in legal policy and research roles. Anna has a breadth of perspectives and a wealth of experience in dealing with privacy and data governance issues. She's the former deputy privacy commissioner for New South Wales.So she really knows regulatory perspective well, and since 2004 is the director for consulting firm Salinger Privacy Anna holds a first-class honours degree in law, a masters of public policy and honors a graduate certificate in management a graduate diploma of legal practice Anna Bachelor of Arts plus a number of other relevant and well-regarded certificates and Industry associations, Anna no longer practices as a solicitor so I am allowed to tell the occasional lawyer joke apparently which is great because that's what I'll probably do Anna thanks so much for joining. [ [ [  [ [ [ [ [ [ [ [ [ [ So you might be a one-person physiotherapy business, you know or an independent Locum you uncovered by the federal privacy act. So regardless of your size all Health Service Providers are covered. Outside the health sector, there is an exemption for small businesses. But that exemption does not apply to health service providers. So the health sector is already called out for I guess expectations of a high level of privacy protection for businesses no matter their size in the health sector just because of you know, patient's expectations. And so I think one of the things that makes the health sector different is patient expectations, so it's not that the type of privacy risks or privacy issues are different for health technology, for example, technology design as for any other type of Technology design, but the difference is that patients expectations about the protection of their Health Data are much higher. There's just this sort of intuitive if it's my health information. It must be kept absolutely private, but also the consequences of privacy breaches tend to be higher when you're talking about health information compared with say, you know, The Accidental disclosure of someone's credit card details. Yeah, there are some financial risks. But those risks can be resolved, you know relatively straightforward way. I don't want to minimize those risks, but it's quite a different story in terms of the repercussions individuals can face if their health information is disclosed without Authority. So that might be it could be discrimination embarrassment implications for their employment implications for insurance and all the rest. That's what makes the challenges for people working in technology into the health sector and technology so much higher not that as I said, not that. The nature of the Privacy risks themselves are terribly different. It's just that the expectations are higher and the consequences are worse if you have a data breach. [ [ So your business as usual. We basically call that a privacy audit but regardless of which one of those we doing. We ask the same kind of questions and regardless of whether its the design of the software. It might be the design of a business process. It might be the design of a paper form. It doesn't have to be, you know, a high-tech project to need this kind of review. So regardless of the nature of the project we tend to ask the same questions so you know can and should we collect this data can and should we use it for this particular purpose who can we disclose it to? How do we keep it safe? So when we look at a new project, for example, we look at two broad things one is data flows and the other is data governance. So when what I describe as data flows what we're looking at is. What personal information is being collected? How is it going to be used? Who will it be disclosed to so those three points collection use and disclosure and for each of those we then ask is this going to be appropriate meaning is it going to be lawful? So is it going to comply with the Privacy principles that govern collection use and disclosure but not just is it going to be lawful? Is it going to meet your customers? You know your patients expectations. Is it going to be proportionate to a legitimate business need and is there critically, is there a more privacy-protective way you can achieve that business objective? Yeah, so always trying to come up with you know, helping our clients come up with the most privacy-protective design of a technology of a form of whatever it is but in a way that still achieves the businesses objectives. So once we've settled those questions about authorizing the data flows and making sure that there are lawful and appropriate then we look at data governance. So we usually start with looking at transparency. So have you communicated clearly to your customers about those data flows? You know how their personal information is going to be collected used and disclosed so that they actually understand what's going to happen. You know, I talk about the no-surprises rule no one likes to be surprised what's going to happen with their data and if they have if they're going to have choices is there a really easy way for them to manage those choices? You know, is it as straightforward as a swipe left or right on the app to say yes or no to something and one thing that's really important is in terms of transparency is for organizations to separate out what we see is three different things but often bundled together. So those three things are your privacy policy a collection notice explaining. At the point of collection what it is you're doing with the person's information and a consent mechanism if you're going to rely on consent, so those three things serve three quite different purposes, but especially online. The design practices often companies will jumble the three all together into one long legalistic confusing document and then they make users just tick agree [ [ [ [ It's accidents and it's oversights and its people simply not understanding what their obligations are. Understanding that there are alternative ways to design things. So absolutely. Yeah. I very very rarely see privacy breaches arising from deliberate misconduct. Yeah. It's much more coming from a place of ignorance and sometimes people trying to do the right thing, you know trying to be helpful in trying to help the clients but accidentally doing the wrong thing. [ [ [ [ There's always this challenge of Law and policy keeping up. The first point I'd make is that privacy laws are designed deliberately. They're drafted deliberately to be technology-neutral and format neutral. So the idea is that they shouldn't actually be always playing catch-up. We've tried to anticipate in the drafting of our privacy laws technologies that haven't even been thought of yet and our starting point with those laws is Broad framed general kind of principles and it's all about respecting humans autonomy and dignity. So sort of one answer is the law is keeping up because it's it was already anticipating new technologies and that those new technologies should be being managed Under the Umbrella of existing laws and policies. But at the same time obviously the law is constantly being challenged in terms of how workable it is in practice and certainly with artificial intelligence the ethical and legal implications are something that not just in Australia but governments around the world are grappling with right at the moment. So there are projects trying to come up with legal and ethical frameworks to cover AI here in Australia the federal department of innovation and industries been working on something there are projects in the EU there are projects in the US There's a lot of activity going on at the moment and lots of those projects around the world are focusing on things like the fairness of AI as well as transparency. So in particular in Europe some of your listeners. May have heard of the GDPR are already. So that's a privacy law in Europe that was recently reformed the general data protection regulation and one of the reforms that was introduced is what you might call a right to algorithmic transparency. So that means that's kind of the laws way of trying to ensure that algorithms developed from AI from machine learning and from AI will be fair and accountable in terms of the impact of decision making that is made or decisions made based on those algorithms. So there's kind of a right to human review of computers decisions and there are rights to ask companies to pause or stop the processing and we would call that using or disclosing someone's personal information in order to ask for an explanation of well you know, how is this algorithm? Working so why you know, why was I denied health insurance or why is it why my premiums going up and my next-door neighbors are going down for example. [ You know that having that in a black box is not you know, and then just you know, let's ask the computer and wait to see what. Is it so much ambiguity there? [ You know, we're going to pay your claim or we're not going to pay your claim or whatever it is. You know based on some kind of calculation of risk of that disease developing for example, or you know, if the algorithm can't be explained to a court if it can't be explained to a judge. How is anyone going to be able to determine whether that algorithm was working in a fair and accurate way so one of the really critical privacy principles is it's called the data quality principle or the accuracy principle and it says that each of us has the right to ensure that only accurate relevant up-to-date complete not misleading information is used in decision-making about us and that obviously. Becomes more critical, you know the rubber hits the road where the decision is going to impact us negatively. So the decision is going to be you don't get the insurance or we don't pay your claim. You don't get the job. You don't get access to housing you don't get access to credit for example, and so if you've got decisions made in a black box and no one can explain how they're made because. Yeah, there was some machine learning going on in the AI system came up with its own algorithm. How can anyone test how can a court test whether or not that decision making and the data on which it was based was, you know accurate Fair relevant up-to-date Etc. So that's certainly one big challenge for AI that the sort of the transparency and the accountability for it and I think the other Big Challenge or the other area where AI poses a challenge in terms of compliance with Privacy Law is the lawfulness of the data flows in the first place. So, you know, it's when I was talking about when we do a privacy review we're looking at the data flows meaning what personal information is collected, how it's used who it's disclosed to and in the world of AI your ability to lawfully collect use or disclose data. It's extremely hard to rely on consent as your lawful mechanism consent isn't is by no means not this by no means the only lawful mechanism. There are lots of ways under the Privacy principles that allow companies and governments to collect use and disclose personal information. But quite often consent is what organizations try to rely on but in AI it's really challenging. So if you think about do you do example AI is being used to diagnose some health conditions? Yeah, much of the data. Used in the first place to train the machine learning that will create the AI will create the algorithm that training data what we call a training data will have been collected for some other purpose. So it will have been years worth of data collecting about real hospitals being treated in real patients being treated in real hospitals. That and that becomes the training data set for the machine learning. So it's fairly likely that the patients in the past were not asked to consent but that time to sometime in the future use of their data for this quite different purpose. [ [ It's based on historical data. And typically you don't go back and you don't have the ability to go back and ask for everyone's consent. It's very difficult to rely on patient consent as the lawful basis for health information to be collected used or disclosed for AI purposes. As I said, it's not the only possibility but quite often companies work on the assumption that consent is going to be their legal mechanism and it turns out not to be.Kind of the pragmatic solution for them, but I don't think that that's something that's particularly. Well understood yet. [ [ There is this kind of structured way to work through thinking about those issues and the National Health and Medical Research Council has guidelines on you know how to set up a human research Ethics Committee and what a properly constituted committee looks like and all of the factors that they need to, you know, there are guidelines about how they need to reach their kind of decision making, so it's not as simple as simply you know, those the tick a box mandatory terms and conditions. That's not going to constitute a valid consent in Privacy Law. So that's just not the right legal mechanism in the most in the majority of cases for artificial intelligence kind of development.  [ [ So it can't be included in mandatory terms and conditions, for example, an opt-out model is not consent. For example, so as I said consent is not the only legal mechanism. There are plenty of other mechanisms. But if that's the one you're relying on you need to be really careful to get that right and another thing is to make sure that your technology has been designed with privacy in mind. So we talked about this concept of privacy by design which is all about baking your privacy controls into the design of systems from. The beginning rather than trying to you know retrofit them in later and I think well what I find usually is a lot of effort goes into the cybersecurity side of things, you know, keeping out the external Bad actors and that's obviously incredibly important but our particular kind of expertise and our skill set is focused more on the internal actors so when you are whether you're designing tech your configuring it implementing it you need to think about your customers but also about your staff or your trusted users your trusted insiders. So making sure that Tech is designed so that its staff or other authorized users only see the absolute minimum amount of personal information about your customers or your patients that they really need to do their job, you know, the legislation says that you have to do this a lot of people come back and say oh, we've got a code of conduct for our employees. We make the more sign it so that's okay. The law says that that is not enough and you know case law comes basically the law that comes from Court decisions and tribunal decisions backs that up that just having you know, letting all staff see all patient records but saying oh, but they signed a code of conduct that's not going to be enough You won't be complying with your privacy legal obligations if that's all you're doing. So you need the same things like role-based access controls, but there's a whole bunch of other privacy controls that can be built into Tech design and it will depend on the kind of product you're or service that you're designing But depending on what it is you're doing, you know, if you're if you've got a data analytics project and using a data warehouse, for example, we would look at filtering out certain data fields. And then we'd look at masking other data fields from the view of particular user groups. If you think about something like an E-health record system, you would limit the search functionality to prevent misuse, you know, the kind of scenario we’re usually looking at is, you know, could a staff member look up health information about their partner or their ex-partner or their next-door neighbour so you might put in a test that users need to pass before they can even access customer records. For example, rather than just enabling any user to do a global search against any customer or patient name, so there’s plenty of different things you can do. So we use 8 privacy design strategies to help guide Our advice to our clients when we're reviewing technology design software design and sometimes the solution lies in the design of their technology itself, but quite often it's outside the technology so the solution might be or a mix of you know, staff training policies and procedures back to that transparency issue. So how you communicate with your customers. There are lots of different angles we can come from when we're trying to mitigate privacy risks. [ I think it's evident that it that it's something that's important to everyone from that single physio, you mentioned right through to the big organizations have got a lot more structure and process to handle this stuff and even they get it wrong a lot too. So having a dedicated focus in that like you guys is particularly interesting so Thank you for sharing your thoughts and insights on that particular topic. [