Now that COVID-19 Alert Level 2 has come into effect, physiotherapists have much greater freedom to see patients in face-to-face clinical consultations. But normal service hasn’t resumed yet– Ministry of Health orders require healthcare providers to take specific actions to prevent and control infection during Alert Level 2. Guidance on how those orders apply to physiotherapists can be found here.

This article considers how physiotherapists should deal with personal information about their patients during Alert Level 2 and considers two key aspects:

• What personal information should physiotherapists collect and how should that information be collected?
• How may personal information be used or disclosed?

Collection of information
During Alert Level 2, the COVID-19 Public Health Response (Alert Level 2) Order 2020 (the Order) sets specific record keeping requirements for businesses or services that cannot operate without physical contact or close proximity between people. Because many clinical physiotherapy services require physical contact or close proximity, physiotherapists must keep records to enable contact tracing of people who enter their workplace or use their services.

Essentially this requires physiotherapists to collect and maintain the following information about their patients and other people who enter their workplace:

1. the person’s full name:
2. their residential address:
3. an effective means of communicating with them (for example, an active phone number or email address):
4. the date on which, and the times at which, the person arrived and left the relevant places.

In the case of patients, collection of this information is usual and unexceptional as it forms part of the information that clinical physiotherapists generally record during their consultations. However, the obligation to collect and keep information about others who enter the workplace, such as their staff, the friends or family of their patients, contractors, and visitors, is new.

The order does not specify for how long this information must be kept. The Ministry of Health has advised that it should be kept in a secure place for 2 months and then destroyed. However, this advice would not require the destruction of information kept for another lawful purpose, for example as part of a patient record or an employee file.

Physiotherapists should consider how this information will be collected safely and securely during Alert Level 2. For example, if a paper register is used, the writing instrument should be sanitised after every use and visitors should sanitise their hands before and after writing their details.

In addition to the mandatory information detailed above, before providing services to patients, physiotherapists should collect information that will assist them to protect their own health and safety and that of their colleagues. For example, the Board’s guidance advises that physiotherapists should screen for COVID-19 symptoms before seeing patients in person. Asking risk assessment questions of people with unknown COVID-19 status assists physiotherapists to determine the need for personal protective equipment, among other things. Ministry of Health guidance advises that the risk assessment questions may change during Alert Level 2 if ongoing surveillance shows continued decrease (or increase) in cases.

Recent news media reports have incorrectly suggested that the collection by businesses of information about medical conditions or symptoms would infringe privacy. In fact, personal information may be collected for lawful purposes from the individual concerned where the individual is informed of the purpose for collecting the information and how it will be used or disclosed. Although supply of this information is voluntary, the patient should be made aware that a face-to-face-consultation may not be available if the requested information is not provided.

Given the risks associated with exposure to the COVID-19 virus, asking these questions is entirely appropriate and there is no tenable argument that the collection of this information would intrude to an unreasonable extent upon the personal affairs of the individuals concerned.

Disclosure and use of information
When the Government declared a state of national emergency on 25 March 2020, the Civil Defence National Emergencies (Information Sharing) Code 2013 (the Code) came into effect.

While the Code remains in force, an agency (which includes a physiotherapist) may collect, use, or disclose personal information relating to an individual without the individual’s permission if the agency believes on reasonable grounds the collection, use or disclosure is for a permitted purpose in relation to the emergency. A ‘permitted purpose’ is a purpose that directly relates to the government or local government management of response.

Such a purpose is likely to include contact tracing to identify individuals who may have been exposed to COVID-19 and ensure they are appropriately managed and treated.

However, the Code will apply only until 12:21 p.m. on Thursday, 11 June 2020. After that date, the requirements of the Privacy Act concerning the collection, use and disclosure of personal information must be met. This means that the conditions for use or disclosure of personal information set out in Rules 10 and 11 of the Health Information Privacy Code 2020 (HIPC) must be satisfied before health information is used or disclosed.

In general, the use of health information is permitted where the information is used for the same purpose for which it was collected, or for another purpose authorised by the individual concerned. The disclosure of health information is permitted if the agency reasonably believes that disclosure is one of the purposes for which the agency obtained the information, or if the disclosure is authorised by the individual concerned.

This requirement should be met if physiotherapists tell the individuals concerned at the time of collection that the purpose of collecting their personal information is to assist in the management of the COVID-19 pandemic. Those individuals should also be told the information may be disclosed to the Ministry of Health or the District Health Board on request.

If there is a need to use or disclose personal information but the individual concerned has not been made aware of the purpose of collection, or has not authorised its use or disclosure for that purpose, a ‘serious threat’ exemption may apply in an emergency. An exemption in Rule 10(1)(d) HIPC permits the use of personal information if a health agency believes on reasonable grounds such use is necessary in order to prevent or lessen a serious threat to public health, or an individual’s life or health.

A similar exemption in Rule 11(2)(d) HIPC permits the disclosure of personal information if a health agency believes on reasonable grounds such disclosure is necessary in order to prevent or lessen a serious threat to public health, or an individual’s life or health.
Although the law permits personal information to be used or disclosed without the authorisation of the individual concerned in the above circumstances, physiotherapists should consider following up with the individual and notifying them as soon as reasonably practicable. Open disclosure helps preserve the trust and confidence that is essential to a good physiotherapist-patient relationship.