AQB v Health Care Complaints Commission
[2013] NSWADT 209
•24 September 2013
Administrative Decisions Tribunal
New South Wales
Medium Neutral Citation: AQB v Health Care Complaints Commission [2013] NSWADT 209 Hearing dates: On the papers Decision date: 24 September 2013 Jurisdiction: General Division Before: Naida Isenberg, Judicial Member Decision: The application is dismissed
Catchwords: Complaint to Health Care Complaints Commission - disclosure of complaint to subject of complaint Legislation Cited: Health Records and Information Privacy Act 2002
Privacy and Personal Information Protection Act 1998
Administrative Decisions Tribunal Act 1997Category: Principal judgment Parties: AQB (Applicant)
Health Care Complaints Commissioner (Respondent)Representation: AQB (Applicant in person)
Crown Solicitors Office (Respondent)
File Number(s): 133111
reasons for decision
Background
In 2012 'AQB', the Applicant, was a patient at St Vincent's Hospital ('St Vincent's'). Subsequently the Applicant complained to the Respondent, the Health Care Complaints Commission ('HCCC') about her treatment at St Vincent's. In the HCCC complaint form the Applicant signed a consent authorising the Respondent to access her personal health records for the purpose of handling the complaint. On 11 October 2012 the Respondent provided a copy of the complaint to the Chief Executive of St Vincent's.
The Applicant became aware that the Respondent had provided a copy of her complaint to St Vincent's. On 19 February 2013 the applicant applied to the Information and Privacy Commission for review of the Respondent's conduct in releasing her health information to St Vincent's. The application was forwarded to the Respondent.
The Respondent conducted a review of its conduct and found that it had not breached the use and disclosure principles in relation to the applicant's personal information or health information because:
the applicant consented in writing to the Respondent providing her complaint to St Vincent's;
the disclosure of information to St Vincent's was directly related to the purpose for which it was collected;
the use and disclosure were reasonably necessary for the exercise of the Respondent's complaint-handling functions; and
the Respondent was not required to comply with cls 10 and 11 of Sch. 1 of Health Records and Information Privacy Act 2002 ('HRIP Act') in relation to its complaint-handling functions.
On 15 April 2013 the applicant lodged an application for review of the Respondent's conduct under s.21 of the HRIP Act and s.55 of the Privacy and Personal Information Protection Act 1998 ('PPIP Act'), alleging that the Respondent had breached several principles of those Acts.
CONSIDERATION
It was altogether unclear to me why the Applicant now complains about the Respondent having referred her complaint to St Vincent's. In particular, it was unclear how the Applicant might have expected the Respondent to investigate her complaint without disclosing her concerns to St Vincent's, and how she might have expected St Vincent's to respond without that information. At the Planning Meeting the Respondent asked me to dismiss the application on the basis that it was misconceived or lacking in substance: s.73(5)(g)(ii) Administrative Decisions Tribunal Act 1997. In the circumstances of the matter I declined to do so, so that the Applicant might have the opportunity to have a better understanding of the Respondent's conduct, which, for the reasons given below, I find did not breach of any of provisions of the HRIP Act or the PIPP Act.
Use/disclosure directly related to purpose of collection and Applicant's consent
Sections 17(a) and 26(2), PPIP Act and cls.10(1)(a) and 11(1)(a), Sch. 1, HRIP Act provide that a public sector agency that holds personal/health information must not use the information for a purpose other than that for which it was collected unless the individual to whom the information relates has consented to the use of the information for that other purpose. The consent signed by the Applicant operates to avoid what otherwise might be a breach of ss.17 and 18, PPIP Act. Similarly, in relation to use and disclosure of health information, cls. 10(1)(a) and 11(1)(a), Sch. 1, HRIP Act excuse disclosure where there has been consent.
Further, s.17(b) and 18(1)(a), PPIP Act and cls.10(1)(b) and 11(1)(b), HRIP Act relevantly provide that a public sector agency that holds personal/health information must not use/disclose the information for a purpose other than that for which it was collected unless the use/disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure. I find that the use/disclosure of the Applicant's personal and health information was directly related to the purpose for which the information was collected, that is, as part of the Respondent's complaint handling functions. At the time, because of her written consent, the Respondent had no reason to believe the Applicant would object to the disclosure: s.18(1)(a) PPIP Act and cls.10(1)(b) and 11(1)(b), Sch. 1, HRIP Act.
Use/disclosure reasonably necessary to exercise complaint handling functions
Section 24(2) PPIP Act provides that an "investigative agency" - which definition includes the Respondent - is not required to comply with s.17 if the use of the information concerned for a purpose other than the purpose for which it was collected is reasonably necessary in order to enable the agency to exercise its complaint handling functions or any of its investigative functions: cls.10(1)(j) and 11(1)(k), Sch. 1, HRIP Act are in similar terms.
Even if the Respondent's use/disclosure in this matter was not for the primary purpose for which the information was collected, which I find is not the case, s.24(2) PPIP Act and cls.10(1)(j) and 11(1)(k), Sch. 1, HRIP Act avoid the relevant use/disclosure prohibitions.
Respondent not required to comply in relation to complaint handling functions
Clauses 10(3) and 11(3), Sch. 1, HRIP Act provide that the Respondent (and some other agencies) is not required to comply with a provision of this clause in relation to their complaint handling functions and their investigative, review and reporting functions. I find the use/disclosure of the Applicant's health information was in relation to the Respondent's complaint handling functions.
Use/disclosure lawfully authorised
Section 16(3) of the HCC Act provides that a person against whom a complaint made is to be notified of the complaint and the HCCC may give a copy of the complaint to the person against whom the complaint is made. I find that pursuant to s.16(3) the Respondent was authorised to provide the Applicant's complaint to St Vincent's. I find that the use/disclosure of the Applicant's personal and health information by the Respondent was lawfully authorised: s.25 PPIP Act and cls.10(2) and 11(2), Sch. 1, HRIP Act.
DECISION
The application is dismissed
**********
Decision last updated: 24 September 2013
0
0
3