Uber Health is a new non-emergency patient transport service which has recently launched in Australia. Uber Health allows health professionals and organisations to schedule, manage and pay for rides for their patients, caregivers and staff to and from their clinic, hospital or health service. Australia will be the first market outside the USA to trial the new platform.
This article was originally published in the Lexis Nexis Health Law Bulletin Volume 31 No 1.
What is Uber Health?
Uber Health describes itself as:
Uber Health is designed to improve patient accessibility to healthcare and address inefficiencies and monetary losses arising from missed appointments. Although access to healthcare appointments in Australia is mostly free, the reality is that the cost of healthcare is incurred by Australian taxpayers. Missed medical appointments are placing an increased strain on the country’s healthcare system, both in terms of financial and resourcing constraints. Uber Health attempts to address these issues whilst capitalising on the need for patient transportation.
There is no requirement for patients to download the Uber app or to even have a mobile phone or credit card — alerts are sent via text message or landline calls with details of the ride provided in more than 20 languages. Health service providers can schedule rides on behalf of patients, caregivers, and staff to take place immediately, within a few hours, or up to 30 days in advance, which allows for transportation to be scheduled for follow-up appointments while still at the healthcare facility. The service is likely to be of particular benefit to Australia’s elderly population to get to and from their medical appointments.
Privacy risks
The potential privacy issues arising from the use and/or storage of health information are obvious. In relation to this issue, Uber ANZ has stated:
Uber has stated that its drivers would not be informed if a trip was booked through Uber Health and that data on Uber Health trips will only be accessible to 'those who need it to support the patient', presumably in an emergency. Whether or not these statements offer adequate reassurance to the Australian public or health professionals in relation to the privacy of health information remains to be seen, particularly given the recent hacking of Uber’s data reported by The New York Times and noting that in 2021, Uber3 was found by the Australian Privacy Commissioner (APC) Angelene Falk, to have breached a number of the Australian Privacy Principles contained in Sch 1 of the Privacy Act 1988 (Cth) (Privacy Act) in relation to the cover up of a cyber-attack.4
Further, many Australians (more than 2.5 million) have opted out of the federal government’s My Health Record5 due to security concerns following early issues which prevented clinical use and recently, the South Australian Ambulance Service announced that the personal details of 28,000 patients was stolen when a storage device was stolen from a consultancy firm.6
The recent hacks of Optus and Medibank Private resulting in personal data and in the latter case, sensitive information about health claims of almost 10 million current and former customers has highlighted the risks involved in the storage of personal and health information and prompted legislative reform. The amendments set out in the Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022, which passed both Houses of Parliament on 28 November 2022 and became law on 13 December 2022, significantly increase the maximum penalty that may be imposed for a serious or repeated privacy breach.
Under the new scheme, the maximum penalty for a body corporate under the Privacy Act has increased from $2.5 million to either $50 million, three times the value of any benefit reasonably attributable to the privacy breach, or 30% of the entity’s adjusted turnover for the relevant period (whichever is highest).7
The amendments also:
- render it an offence for a body corporate to engage in a system of conduct or pattern of behaviour that results in multiple failures to give information, answer a question or produce a document or record when required (punishable by up to $66,600)8, and
- increase the penalty that may be imposed for a failure to comply with a notice issued by the APC, from $4440 for individuals and $22,200 for bodies corporate, to $13,320 for individuals and $66,600 for bodies corporate.
Under the new scheme, the APC will also be given the power to:
- issue infringement notices,9
- obtain information regarding an actual or suspected data breach,10
- share information with other Commonwealth enforcement or complaint authorities, State or Territory authorities with functions of protecting the privacy of individuals, or foreign government authorities with functions of protecting the privacy of individuals,11
- disclose information where it is in the public interest to do so,12 and
- where the APC determines that an entity has breached an individual’s privacy, require that entity to:
- engage a suitably qualified independent adviser to conduct a review of the entity’s acts or practices, the steps the entity has taken to ensure the privacy breach is not repeated or continued, and any other matter specified by the APC that is relevant to the entity’s acts or practices or to the complaint,13 and
- publish a statement about the conduct that constituted the privacy breach, including what the conduct was and what steps the entity has taken to ensure it is not repeated. 14
Risks to patient health
In addition to privacy issue, another potential area of concern is the medical risk to patients during a trip. Uber currently offers 'Uber Assist', a service for transportation of disabled or mobility-challenged people. Uber Assist drivers are required to complete independent training from a third-party organisation about how to help riders into vehicles, however Uber Health drivers are not required to undertake any additional training.15
Uber has stated that the healthcare organisations arranging the rides are instructed to never book Uber Health rides for patients who could present a medical risk during a trip, including emergency patients and patients with infectious diseases.16 State ambulance services already contract non-urgent patient transport to third party transport providers and more than 9600 people were transported to medical care by taxis organised by Ambulance Victoria in 2020–21. However, in 2018 Ambulance Victoria faced scrutiny for ordering a taxi to take a woman with acute appendicitis to hospital.17
Conclusion
Whilst there are numerous potential benefits to Uber Health’s new non-emergency patient transportation service, it remains to be seen whether issues relating to patient privacy and medical risk become real issues for Uber Health, its drivers or its users. The amendments to the Privacy Act certainly provide significant financial incentives to Uber and other large corporations to take measures to protect against privacy breaches.
1 E Elsworthy 'One in 10 Australians didn’t trust the government with their health data. Will they trust Uber Health?', 19 August 2022, 'Smart Company', accessed 24 January 2023, www.smartcompany.com.au/industries/health/australians-health-data-uber-health/
2 Above n 1.
3 Uber Technologies Inc. and Uber B.V.
4 Australian Government, Office of the Australian Information Commissioner, 'Uber found to have interfered with privacy', accessed 7 November 2022 at www.oaic.gov.au/updates/news-and-media/uber-found-to-have-interfered-with-privacy .
5 Australian Government, Australian Digital Health Agency, '9 out of 10 Australians have a My Health record', accessed 7 November 2022 at www.myhealthrecord.gov.au/news-and-media/australians-to-have-my-health-record#:~:text=While%20the%20opt%2Dout%20period,any%20stage%20if%20they%20choose .
6 Government of South Australia, SA Health, 'Data incident', accessed 7 November 2022, www.sahealth.sa.gov.au/wps/wcm/connect/public+content/sa+health+internet/about+us/our+statewide+services/sa+ambulance+service/data+incident+-+sa+ambulance+service#:~:text=SA%20Ambulance%20Service%20(SAAS)%20has,unfortunately%20the%20data%20remains%20unrecovered .
7 Privacy Act 1988 (Cth), s 13G.
8 Privacy Act 1988 (Cth), s 66(1)(1AA).
9 Privacy Act 1988 (Cth), s 80UB.
10 Privacy Act 1988 (Cth), s 26WA.
11 Privacy Act 1988 (Cth), s 33A.
12 Privacy Act 1988 (Cth), s 33B.
13 Privacy Act 1988 (Cth), s 51(1AAA).
14 Privacy Act 1988 (Cth), s 52(5A).
15 Uber, accessed 24 January 2023, www.uber.com/au/en/drive/melbourne/get-started/ .
16 M Ward 'Uber moves into healthcare with Australian patient transport service', Sydney Morning Herald, 19 August 2022, accessed 24 January 2023, www.smh.com.au/healthcare/uber-moves-into-healthcare-with-australian-patient-transport-service-20220818-p5batt.html .
17 The Age, Aisha Dow, 'Ambulance Victoria orders taxi to take woman with acute appendicitis to hospital', 5 June 2018, accessed 7 November 2022, www.theage.com.au/politics/victoria/ambulance-victoria-orders-taxi-to-take-woman-with-acute-appendicitis-to-hospital-20180604-p4zjfp.html.
