Veterans’ MATES Program Privacy Breach

The Veterans’ MATES program is the Veteran’s Medicines Advice and Therapeutics Education Services program. It is a DVA program delivered by the University of South Australia (UniSA) with the stated aim of improving the use of medicines and related health services in the veteran community.

How does it work?

DVA pays for medical services and for prescription medicines obtained using DVA health care Cards.

Personal information, medical treatment received, and medicines dispensed (Repatriation Prescription Benefits Scheme (RPBS)) are recorded for billing purposes by Medicare, part of Services Australia. Consent for this purpose is implied by a person using their DVA Gold, White or Orange Cards to access treatment or medicines.

The Veterans’ MATES program has been operating since 2004 – about two decades. The personal medical and prescription information collected in the billing process is forwarded to the University of South Australia (UniSA) who are contracted to undertake MATES research, produce educational material and to contact individual veterans’ doctors and pharmacists where intervention is considered necessary.

UniSA separate personal information from the treatment and medicine information. Research is conducted using the de-identified information.  UniSA will match the deidentified information with the medical data only where considered necessary to enable contact with a veteran’s treating professional.

The Privacy Act 1988 (Cth) requires informed consent of individuals for the collection and use of their personal information.

Any medical or health research requires approval by an Ethics Committee; in this case, the Departments of Defence and Veterans’ Affairs Human Research Ethics Committee [the Ethics Committee]

The Privacy Breach

In February 2016, a Veteran (known as ADJ) requested DVA to stop sharing their personal and medical data with the Veterans’ MATES program as they had never consented to sharing personal data with others or its use for this purpose. An extensive exchange between ADJ and DVA commenced.

In April 2018, DVA stated its position was that ADJ’s consent was not required, that DVA would continue to use ADJs data, and that DVA would not revisit the matter.

In October 2018, ADJ made a privacy complaint under the Privacy Act to the Office of the Australian Information Commissioner (OAIC) and an investigation was initiated in 2020.

On 23 April 2023, in the case of ‘ADJ’ and Secretary to the Department of Veterans’ Affairs, the Commissioner determined that:

“The respondent (DVA) has interfered with the ADJ’s privacy by:

• failing to obtain Veteran’s consent to collect information for the MATES program, and
• using the Veteran’s personal information for secondary purposes and must not repeat or continue with such conduct.”

And required that:

• DVA provide a written apology to the complainant, specifically acknowledging that the DVA interfered with the complainant’s privacy; and
• DVA must pay the $5,000 to the Veteran for non-economic loss.”

The OAIC also stated in the determination, noting that the case was started four years previously:

“The Department now [April 2023] has robust processes in place for ensuring that …participants in the MATES Program are [now] aware that they can, at any time, revoke their consent to the use and disclosure of their personal information as part of the MATES Program.”

After the OAIC determination

In July 2023,  the OAIC determination prompted some media attention and interest in the Veteran Community.

• Many veterans were unaware of the sharing of this information for this purpose.
• Many veterans were particularly distressed not just by remote outsiders having access to their personal information, but also the prospect of an uninvited intrusion into their confidential and sensitive information, particularly with disclosures of sexual abuse, rape, terminations, substance abuse and mental health issues.

There has been a steady trickle of new information being revealed as a result of FOI requests, questions from MPs and from stakeholders. There is some evidence of incomplete or misleading statements made by DVA during the OAIC hearing, to the Ethics Committee, and in Senate Estimates:

• Personal, medical and medicine information, related to the veteran’s treatment and personally paid for by the veteran and not billed to DVA, was also collected by DVA and included in the MATES Program. The OAIC Hearing was not informed of this.

• The OAIC statement made in April 2023 that, DVA “now has robust procedures in place ensuring participants in the MATES program are now aware they can revoke their consent to participate in the MATES program at any time”. As of February 2024, there has been no program to advise the estimated 300,000 DVA Cardholders.

• A DVA briefing that the OAIC decision was an isolated case and did not indicate a system-wide issue with the MATES Program is clearly false. The OAIC stated that DVA use of the veteran’s personal information for secondary purposes [i.e. MATES] “interferes with privacy and must not repeat or continue with such conduct.” All cardholders are affected.

• The breach has been described as “inadvertent”. From date of first complaint in February 2016 until the OAIC decision in April 2023 (over six years), DVA appears to have deliberately and purposefully brought the weight of its legal resources in denying the veteran’s request and arguing against the veteran (ADJ).

In August 2023, UniSA paused involvement in the MATES Program pending confirmation from DVA that appropriate consents were in place.

In October 2023, UniSA formally suspended their participation.

On 5 February 2024, the Ethics Committee formally withdrew the ethics approval of the DVA’s Veterans’ MATES Program.