To maintain qualified privilege and surgeon participation, clinical audit databases must adapt to changing regulations and emerging technologies

In this issue of the ANZ Journal of Surgery, the article by Narayanan et al. highlights the value of binational surgical audit databases for clinical research and outcome monitoring. This highquality research is not possible without binational data from the surgeon-reported Australasian vascular audit (AVA). Clinical audit databases are clearly essential for monitoring surgical outcomes, benchmarking surgeon performance, and continually improving the quality of our healthcare system. Uncommon surgical conditions, such as aorto-enteric fistula, identified in complete practice audits such as the AVA, and linked to national health records, provide population-wide outcomes evaluated with minimal cost and effort. However, recent updates to government legislation and policies mandate significant changes to clinical audits. In 2022, several large-scale data breaches impacted millions of Australians’ personal information and raised major public concerns on handling of sensitive and personal data. These breaches, along with changes in the digital environment and community expectations, prompted significant updates to personal and health data governance. Updates to the Privacy Act and the Notifiable Data Breaches Scheme enhanced regulatory requirements around personal and health data breaches. This editorial outlines key national policy changes for clinical registries, data privacy, and qualified privilege, and how these impact surgical audit. The recent loss and subsequent reinstatement of the AVA’s qualified privilege (QP) status highlights legislation deficiencies and prompts surgical societies to adapt to changing audit regulations. Burgeoning big data analytics, cross-jurisdictional record linkage, and artificial intelligence are expanding the volume and use of routinely collected clinical data. Last year, responding to ethical and legal challenges from these emerging technologies, the Australian Commission of Safety and Quality in Health Care (ACSQHC) revised the Framework for Australian Clinical Quality Registries. This new framework outlines essential attributes required for clinical registries, guiding best practice for database establishment and operation, emphasizing data security, robust benchmarking, and reporting. The updated policy integrates accurate, transparent data collection with existing healthcare practices through either government-hosted platforms or external partnerships. Reconsideration of the practicality of expecting complete participation in self-reported surgeon outcomes is needed as automated data collection and benchmarking becomes possible on a population-wide scale. Clinical registries must demonstrate data collected are accurate, align with key clinical priorities, and provide complete coverage of the population of interest, accurately identifying unwarranted clinical outcome variation. Databases must have sufficient analysis systems for timely and objective risk adjustment, and provide regular feedback to appropriate individual, organizations, and the public. High-level technological infrastructure must protect confidentiality and privacy of data, with mechanisms to monitor, identify, and report potential data breaches. Growing community concerns about data privacy must be considered when assessing risks in research and audit. Clinical registries often existing on a continuum between quality assurance (QA) and research, with similar evaluation methods and data. In Australia, QA refers to activities where the primary purpose is to improve the quality of the service delivered, through ‘peer review’, ‘audit’, or ‘quality improvement’. This requires consideration of potential patient, clinician, and community exposures to risk, burden, inconvenience, or possible privacy breaches, irrespective of what an activity is labelled. Threats to personal and clinical data are no longer considered low risk, as data compromise can results in harm. Removing identifying information is insufficient as big data analytics can discover identities within anonymized data, increasing risk of both deliberate and inadvertent reidentification. It is the responsibility of the data custodians to actively manage reidentification risks. This includes controlling data access and limiting the level of identifiers collected. Consent should ideally be obtained to collect personal identifiers and health data and where impractical, the ACSQHC framework encourages opt-out consent to manage potential privacy risks for audit databases. Opt-out consent allows widespread dissemination of project information and data collection, including where data is stored, and provides an option for data not be collected. Custodians of QA databases should be mindful and adapt to changes in data use, legalization, and requirements from professional bodies. Continuing professional development standards for medical registration and training requires clinical audit, reflection, and quality improvement participation. However, surgeons are often concerned about the legal ramifications of participation. In certain instances, audit data can be legally accessed by third parties, such as the Australian Health Practitioner Regulatory Agency (AHPRA), Health Care Complaints Commission (HCCC), or as evidence in medicolegal proceedings, overriding confidentiality and privacy in the interest of public safety. Protecting participants who voluntarily provide outcome data is key to every clinical QA activity. Qualified Privilege legislation, introduced in 1992 as an amendment to the Health Insurance Act 1973, was intended to protect clinicians, encouraging participation in peer review.