BVS v Sydney Local Health District

[2015] NSWCATAD 171

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

BVS v Sydney Local Health District [2015] NSWCATAD 171

Hearing dates:

29 July 2015

Decision date:

18 August 2015

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

S Montgomery, Senior Member

Decision:

1. The Sydney Local Health District is, within 30 days of the publication of these reasons, to render a written apology to the applicant for disclosing health information about the Applicant to a third person without lawful authority.

 

2. The Sydney Local Health District is to advise the Applicant of the steps to be taken by the agency to minimise the possibility of a similar breach in future.

 3. Otherwise the Tribunal determines not to take any action in the matter.

Catchwords:

Privacy - Health information - health privacy principle - security - access - use - disclosure

Legislation Cited:

Health Records and Information Privacy Act 2002
Privacy and Personal Information Protection Act 1998

Cases Cited:

AF v Minister for Health; Minister for Health v AF [2012] NSWADTAP 16
Director General, Department of Education and Training v MT [2006] NSWCA 270
FM v Vice Chancellor, Macquarie University [2003] NSWADT 78
HP v Hunter New England Area Health Services [2009] NSWADT 186
NK v Northern Sydney Central Coast Area Health Service [2010] NSWADT 258
NS v Commissioner, Department of Protective Services [2004] NSWADT 263

Category:

Principal judgment

Parties:

BVS (Applicant)
Sydney Local Health District (Respondent)

Representation:

Counsel:
P Rooney (Respondent)

  Solicitors:
BVS (Applicant in Person)
Hicksons Lawyers (Respondent)

File Number(s):

1510201

Publication restriction:

A Non-publication Order is made under section 64 (1) Civil and Administrative Tribunal Act 2013 (NSW) in respect of the names of private individuals, and other information which might identify them.

REASONS FOR DECISION

1. The Applicant has applied to the Tribunal for review of a determination by the Sydney Local Health District in relation to a complaint that he made about conduct of an officer of the Respondent. His complaint was brought under the Health Records and Information Privacy Act 2002 ("HRIP Act") and he alleges that the conduct contravened several of the Health Privacy Principles ("HPP's) of the HRIP Act.

2. The names of private individuals, and other information which might identify them, have been anonymised so as to preserve the privacy of their personal affairs. I have also limited my discussion of some issues in order to preserve the privacy of their personal affairs. In these reasons the Applicant is referred to as 'BVS'.

3. On 1 September 2014 BVS completed a Privacy Complaint: Internal Review Application Form seeking an Internal Review in relation to conduct of a Psychiatrist ("Dr. P"). The specific conduct of which he complained was:

"A psychiatrist wrote a letter (without being summoned to do so) where she gave my medical history details on that letter without my permission or written consent'.

4. The letter in issue (“the letter”) was dated 9 April 2014. It was written by Dr. P with the intention that it be delivered to the NSW Police.

5. BVS subsequently provided the following information in relation to his complaint. The information that he provided is in response to questions that are set out on the Privacy Complaint: Internal Review Application Form. He wrote:

…

5.   What is the specific conduct I am complaining about?

That a letter was written by a doctor that states that she looked at my personal file, without my permission or being summonds (sic) to, and then discussing this with other doctors and writing this in a letter for other people to read.

6.   Tick one of the following;-

personal info, security use of personal/health info, and disclosure.

7.   When did the incident occur?

April 2014

8.   When did I hear about incident?

April 2014

9.   …

10.   What effect does this have on me?

The letter has caused me severe stress to the point where I will never trust another doctor with my personal information again nor will I ever go to [the Hospital] ever again, I would rather die rather than be treated at [the Hospital], I can't sleep at night due to this letter, I feel as though my medical and personal life has now been exposed to everyone in which has left me feel very violated to the point of almost being raped. I am now on sleeping tablets from this, I am anxious, untrusting and nervous.

11.   What effect on me in the future?

In will never trust a doctor anymore nor will I neither ever trust that my privacy will be safe and secure, nor will I ever attend [the Hospital] for anything medically again nor do I want to be treated by anyone at [the Hospital] even if it means that I may die.

12.   What do I want to happen?

I want the doctor to be stood down immediately until investigation is conducted. If/when found guilty off claims then I want a written apology from her as well as [the Hospital], I want her immediately terminated for her actions, I want her struck off the registra so she never practices again, I want to be compensated financially (I will be seeking $1 million compensation), and finally a written guarantee that I will never be treated at [the Hospital] again.

13.   …

6. In summary, BVS’ complaints are that Dr. P had unlawfully accessed his personal health information and that Dr. P had inappropriately disclosed his information to other health care professionals and third parties, specifically the NSW Police.

7. The Respondent undertook a review of the circumstances surrounding BVS' complaint. The review concluded that there were no breaches of the relevant Health Privacy Principles. BVS was not satisfied with the outcome of that review and has applied to the Tribunal for an external review of the matter.

Applicable legislation

8. In NSW the HRIP Act regulates "health information" through HPPs. The Privacy and Personal Information Protection Act 1998 ("PPIP Act") regulates general personal information (other than health information) through Information Protection Principles ("IPPs") and also regulates the review of conduct by public sector agencies for both Acts.

9. Section 5 of the HRIP Act and section 4 of the PPIP Act defines "personal information" as:

''information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion".

10. Section 6 of the HRIP Act defines "health information" as follows:

(a)    personal information that is information or an opinion about:

(i)    the physical or mental health or a disability (at any time) of an individual, or

(ii)    an individual’s express wishes about the future provision of health services to him or her, or

(iii)    a health service provided, or to be provided, to an individual, or

(b)    other personal information collected to provide, or in providing, a health service, or

(c)    other personal information about an individual collected in connection with the donation, or intended donation, of an individual’s body parts, organs or body substances, or

(d)    other personal information that is genetic information about an individual arising from a health service provided to the individual in a form that is or could be predictive of the health (at any time) of the individual or of a genetic relative of the individual, or

(e)    healthcare identifiers,

but does not include health information, or a class of health information or health information contained in a class of documents, that is prescribed as exempt health information for the purposes of this Act generally or for the purposes of specified provisions of this Act.

11. It is common ground that the Respondent is and was at all relevant times a health service provider within the meaning of section 4 of the HRIP Act. BVS has never been a patient of Dr. P. He was a patient of the Respondent in the past but is not currently a patient. As a result of the former relationship the Respondent holds health information, as defined in section 6 of the HRIP Act, about BVS.

12. It is also common ground that BVS' former wife (“Ms W”) is a patient of Dr. P. Ms W has been Dr. P’s patient for about 14 years.

13. Section 52 of the PPIP Act allows for the following conduct to be subject to an internal review:

1. the contravention by a public sector agency of a health privacy principle that applies to the agency,

2. the contravention by a public sector agency of a privacy code of practice that applies to the agency,

3. the disclosure by a public sector agency of personal information kept in a public register.

14. Section 55(1) of the PPIP Act provides for a person who has applied for an internal review to apply to the Tribunal for an administrative review of the conduct that was the subject of the internal review application. The Tribunal’s powers set out under section 55 (2) of the PPIP Act are as follows:

(2)    On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders:

(a)    subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b)    an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c)    an order requiring the performance of an information protection principle or a privacy code of practice,

(d)    an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e)    an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f)    an order requiring the public sector agency not to disclose personal information contained in a public register,

(g)    such ancillary orders as the Tribunal thinks appropriate.

(3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997.

(4)    The Tribunal may make an order under subsection (2) (a) only if:

(a)    the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and

(b)    the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency.

...

15. The relevant HPPs in this matter are HPPs 5, 10 and 11. HPP 5 provides:

5 Retention and security

(1)    An organisation that holds health information must ensure that:

(a)    the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and

(b)    the information is disposed of securely and in accordance with any requirements for the retention and disposal of health information, and

(c)    the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and

(d)    if it is necessary for the information to be given to a person in connection with the provision of a service to the organisation, everything reasonably within the power of the organisation is done to prevent unauthorised use or disclosure of the information.

Note: Division 2 (Retention of health information) of Part 4 contains provisions applicable to private sector persons in connection with the matters dealt with in this clause.

(2)    An organisation is not required to comply with a requirement of this clause if:

(a)    the organisation is lawfully authorised or required not to comply with it, or

(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998 ).

(3)    An investigative agency is not required to comply with subclause (1) (a).

16. HPP 10 provides:

10    Limits on use of health information

(1)    An organisation that holds health information must not use the information for a purpose (a "secondary purpose") other than the purpose (the "primary purpose") for which it was collected unless:

(a)    the individual to whom the information relates has consented to the use of the information for that secondary purpose, or

(b)    the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose, or

Note: For example, if information is collected in order to provide a health service to the individual, the use of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose.

(c)    the use of the information for the secondary purpose is reasonably believed by the organisation to be necessary to lessen or prevent:

(i) a serious and imminent threat to the life, health or safety of the individual or another person, or

(ii) a serious threat to public health or public safety, or

…

17. HPP 11 provides:

11    Limits on disclosure of health information

(1)    An organisation that holds health information must not disclose the information for a purpose (a "secondary purpose") other than the purpose (the "primary purpose") for which it was collected unless:

(a)    the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or

(b)    the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or

Note: For example, if information is collected in order to provide a health service to the individual, the disclosure of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose.

(c)    the disclosure of the information for the secondary purpose is reasonably believed by the organisation to be necessary to lessen or prevent:

(i)    a serious and imminent threat to the life, health or safety of the individual or another person, or

(ii)    a serious threat to public health or public safety, or

…

Alleged breaches of the HRIP ACT 2002

18. BVS alleges that Dr. P unlawfully accessed his health information when she looked at his medical records. He further alleges that Dr. P discussed his health information to other health professionals and also disclosed this information in the form of a letter to the NSW Police.

Access to BVS’ health information - HPP 5

19. In order to comply with HPP 5, the Respondent was required to take such security safeguards as were reasonable in the circumstances. In regard to the alleged breach of HPP 5, the Respondent relies on the evidence of Dr. P and its Patient Administration System and Medico-Legal Manager (“Ms Q”).

20. Ms Q provided a statement in these proceedings but was not required for cross-examination. She stated that she has responsibility for coordination of the planning, implementation and management of activities relevant to the Respondent’s electronic Medical Records modules (“eMR”). She is also responsible for advising on policies and procedures regarding medico-legal and privacy issues with respect to aspects of the eMR. She annexed to her statement a copy of the Respondent’s eMR 'Security and Access Policy’ which is intended to provide a set of instructions for the protection of electronic personal health information stored in the eMR and to ensure access is appropriate, with audits to ensure compliance.

21. Ms Q provided an overview of the process involved when a staff member requires access to an eMR. Any staff member who requires access to an eMR must first complete a User Access Form. This form contains a data security declaration form that must be signed by the staff member. The user is not granted access until training and a training checklist is completed. Users are given a user name and a password. The eMR has built-in levels of access based on tasks required for the job and profession.

22. Ms Q stated that retraining of staff, including health practitioners, tends to occur when there is new functionality in the eMR or when staff/managers request additional training for their staff. Privacy training is conducted separately.

23. An auditing tool allows the Respondent to run reports both proactively as well as reactively. In the event of an alleged privacy breach or instance of inappropriate use, reports are sent to the Privacy Officer for investigation. The auditing tool is also used as a tool to identify what an individual user has done in the eMR by date range or via a report as to what users have done to a specific patient record.

24. The Respondent relies on the evidence of Ms Q in support of its contention that it had reasonable security safeguards in the circumstances against loss, unauthorised access, use, modification or disclosure, and against all other misuse. It is submitted that the system provides for a user access audit which logs access to the system, thereby providing a safeguard against misuse. Dr. P had to sign a data security declaration form acknowledging that she agreed to maintain privacy and that she understood her privacy obligations before being granted access to the eMR.

25. The Respondent also relies on the evidence of Dr. P who provided a statement, attended the hearing and was cross-examined. In her statement she Dr. P wrote:

In September of 2014 I was informed that an electronic medical records ("eMR") access audit showed that I had accessed the applicant's electronic medical records on 11 April 2014 at 3:37 pm for a period of five seconds. I understand this audit was done as part of the investigation into the applicant's complaint. I do not specifically recall accessing the applicant's records as I would have cause to access the eMR probably twenty times each working day. It is my belief that I would only have accessed the applicant's eMR for the purpose of determining whether the applicant had a current case worker to whom his behaviours ought to be reported for reasons of treatment and safety. In the event, I do not recall there being a case manager and I did not discuss the matter with any practitioner thereafter.

26. In her evidence before the Tribunal Dr. P said that in a period of five seconds she would not have had time to access more than the cover of BVS’ record and would not have had time to access any of BVS’ clinical information.

27. Dr. P believed she would have accessed BVS’ record to comply with a duty of care to notify any current treating clinician of BVS’ alleged behaviour.

28. Mr Rooney, counsel for the Respondent, submitted that as the eMR was accessed two days after Dr. P wrote the letter she could not have accessed BVS’ information in order to write the letter. Dr. P did not disclose any information from the eMR. Mr Rooney submitted that it was appropriate that Dr. P access the records in the circumstances.

29. Mr Rooney further submitted that the appropriate level of security required in relation to personal information will depend on both the nature of the information and the medium in which it is stored. He referred to the decision in NS v Commissioner, Department of Protective Services [2004] NSWADT 263 in which Judicial Member Higgins found that a database which included a user warning message constituted reasonable steps to prevent an unauthorised access.

30. He further submitted that it would not be reasonable for a hospital to have an information security system in place that prevented a senior medical staff member such as Dr. P from accessing patient information as and when required. He submitted that the steps that were in place to allow access provided a timely reminder on the need for maintaining privacy. Further, he submitted that compliance with the obligation to warn users was satisfied by having Dr. P sign a "user declaration form".

Discussion

31. As is to be expected, BVS has not had access to the Respondent’s system in order to ascertain the circumstances in which Dr. P obtained accessed to his medical record. In the circumstances, I accept Ms Q’s evidence in relation to the security that is in place and I am satisfied that the Respondent’s system has an appropriate level of security to prevent an unauthorised access to the eMR.

32. I also accept that Dr. P accessed BVS’ electronic medical records on 11 April 2014 for a period of five seconds.

33. As Dr. P wrote the letter on 9 April 2014, I accept that she did not access BVS’ medical record to assist her in writing the letter. I also accept her evidence that she most likely accessed the record out a sense of professional duty. She did so notwithstanding that BVS was not her patient.

34. Nevertheless, I do not consider that Dr. P’s conduct in accessing BVS’ medical record amounted to a breach of HPP 5. However, if I am wrong in that view, I am not satisfied that any change to the Respondent’s system is warranted and I do not consider that it is appropriate that any further action be taken in regard to any such breach.

35. For completeness I note that in Tarasoff v Regents of the University of California (1976) 551 p2d 334; 17 Cal 3d 425 the majority of the Supreme Court of California held that mental health professionals have a duty to protect individuals who are being threatened with bodily harm by a patient. Tarasoff concerned a mentally disturbed patient who had confided his intention to kill the victim to a psychologist caring for him in a hospital before he was released. The majority of the Court said:

“[T]he therapist's obligations to his patient require that he not disclose a confidence unless such disclosure is necessary to avert danger to others, and even then that he do so discreetly, and in a fashion that would preserve the privacy of his patient to the fullest extent compatible with the prevention of the threatened danger. …

The revelation of a communication under the above circumstances is not a breach of trust or a violation of professional ethics ... [T]he public policy favoring protection of the confidential character of patient-psychotherapist communications must yield to the extent to which disclosure is essential to avert danger to others. The protective privilege ends where the public peril begins.

Our current crowded and computerized society compels the interdependence of its members. In this risk-infested society we can hardly tolerate the further exposure to danger that would result from a concealed knowledge of the therapist that his patient was lethal. If the exercise of reasonable care to protect the threatened victim requires the therapist to warn the endangered party or those who can reasonably be expected to notify him, we see no sufficient societal interest that would protect and justify concealment. The containment of such risks lies in the public interest.”

36. I considered that issue in NK v Northern Sydney Central Coast Area Health Service [2010] NSWADT 258. I stated at paragraphs [63] – [69]:

63 The Respondent relies upon HPP 10(c)(i) and submits that Nurse W was acting upon a serious and imminent threat to the life of Nurse M.

64 Nurse W was asked by NK to explain what specific threats had been made. She responded:

"No because they were fairly open-ended threats ... you did um... my recollection is that ...um ... that your were ...really distressed by [Nurse M’s] attitude ... um and that you. I seem to recall you saying that you would get even with her that she couldn’t treat you like that."

65 She gave evidence that "there was an implication of threat towards this individual [Nurse M], made towards me" [page 45, transcript 25 November 2009].

66 The Respondent submitted that in considering whether the words used by NK constituted a threat, the actual carrying out of the threat is not required. It submits that in the present circumstances, NK was not required to have threatened Nurse M for Nurse W to have understood at the time of the assessment that a threat was being made.

67 The Respondent also relied upon a report by Dr Lisa Brown. Dr Brown states that the body of legal and psychiatric literature concerning consideration of whether to breach confidentiality and report a potential risk suggests that the threshold is low if a specific potential victim is nominated. Attached to Dr Brown’s report is the article "Twenty Years after Tarasoff: Reviewing the Duty to Protect" Harvard Rev Psychology July/August 1996 by Stuart A Anfang, MD and Paul S Applebaum, MD) ("the Tarasoff article"). In support of the position that a health practitioner has a duty to report such a threat, the Tarasoff article states:

"When a therapist determines, or pursuant to the standard of his profession should determine, that his patient presents a serious danger of violence to another, he incurs an obligation to use reasonable care to protect the intended victim against such danger. The discharge of this duty may require the therapist to take one or more of various steps, depending upon the nature of the case. Thus it may call for him to warn the intended victim or others likely to apprise the intended victim of danger, to notify the police, or take whatever steps are reasonably necessary under the circumstances."

68 However, the Tarasoff article also notes:

It is worth mentioning that in other English-speaking countries such as England, Canada and Australia, the notion of a duty to protect has been discussed but not accepted in case law or statute.

69 However, the Respondent relies on Dr Brown’s report as support for the submission that Nurse W had reasonably discharged her duty to warn, or, pursuant to the Health Privacy Act, she had reasonable grounds to believe that there was a serious and imminent threat to Nurse M. It is further submitted that pursuant to the NSW Health Privacy Manual (Second Edition: Policy Directive: PD2005_593) Nurse W is expected to share information about a client/patient and to focus on client/patient "behaviours that may pose a threat or risk..."

37. I accept that Dr. P believed that if BVS was a patient of the Respondent then she had an obligation to bring her concerns to the attention of his case manager.

38. I note however that Dr. P’s concerns in regard to BVS’ alleged conduct was based on hearsay. She accepted the information that had been given to her by Ms W and Ms W’s social worker. She had no direct knowledge of either BVS or his behaviour. She made assumptions about how he might behave in the future on the basis of a diagnosis that she understood had been made in 2007. Dr. P had not made that diagnosis nor is there any evidence to show that she had checked the accuracy of that diagnosis. BVS in fact asserts that the diagnosis was incorrect.

Use and Disclosure of BVS’ health information to other health professionals - HPPs 10 and 11.

39. In her statement in these proceedings Dr. P stated:

Following the consultation of 1 April 2014 I was next due to see [Ms W] on 10 April 2014. On 9 April 2014 I prepared the letter ... I did not access any health records of the applicant prior to writing that letter or discuss the applicant with any of his treating health practitioners. Where I used the words, "... I therefore, from discussions with colleagues, know something of [BVS’s] behaviour in the past”, I was referring to impressions I retained from a conversation I had with a practitioner who attended upon him in 2007. On that occasion I was asked for assistance from a psychiatry registrar who was working under my supervision that day in one of the hospital departments. Upon ascertaining that the patient was the ex-husband of my patient, I declined to be involved and referred the query to another practitioner. I did not see, meet with or assess the applicant. My further involvement was limited to answering a technical question from the alternative psychiatric consultant who saw the applicant. I had also retained impressions of the Applicant from discussions with [Ms W’s] social worker who had accompanied her to court venues in connection with proceedings involving the applicant. This included an occasion where police officers were required to manage his behaviour.

40. In her evidence to the Tribunal she confirmed that BVS had never been her patient and that she had not had any other dealings with him. Dr. P’s understanding of BVS' current behaviour was obtained from her patient, Ms W, and from Ms W’s social worker.

41. Dr. P confirmed that she did not discuss BVS’ health information with Ms W’s social worker but stated that the social worker had conveyed information to her. She stated that she had had numerous discussions with Ms W’s social worker in regard to Ms W’s health. In the past her colleagues had consulted her for professional advice to provide ongoing care to BVS. She had been made aware of BVS’ behaviour in that context.

42. Mr Rooney submitted that Dr. P did not discuss BVS’ health information with other medical practitioners in order to write the letter and she did not access his records before writing the subject letter. She relied on her recollections of conversations that she had with a psychiatry registrar and with alternative psychiatric consultant in about 2007.

Discussion

43. As noted above, HPP 10 has as its basic rule that an organisation that holds health information must only use it for the purpose for which it was collected, and not use it for another purpose. HPP 10 allows use for any secondary purpose to which the individual consents, and then enumerates other permissible secondary purposes. HPP 11 is in similar terms but relates to the disclosure of health information.

44. The term 'use' is generally seen as referring to the internal use made of personal information by the collecting agency, whereas 'disclosure' is used to describe the act of supplying the information to a third party external to the agency. See for example the discussion in AF v Minister for Health; Minister for Health v AF [2012] NSWADTAP 16 at paragraphs [101] to [104].

45. One of the permissible secondary purposes is where the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose.

46. I understand that the psychiatry registrar was on the Respondent’s staff, whereas the alternative psychiatric consultant was an external consultant.

47. Dr. P recalled having gained an impression of BVS' behaviour from a conversation she had with a psychiatry registrar in 2007 i.e. seven years before she wrote the letter. Her evidence is that when she realised that the clinical case that was being described to her by the psychiatry registrar concerned Ms W’s ex-husband, she declined to be consulted and referred the query to another practitioner.

48. On the evidence before me it is apparent that the discussions between Dr. P and the psychiatry registrar could amount to a use of BVS’ health information. Discussions between Dr. P and the alternative psychiatric consultant could amount to a disclosure of BVS’ health information. However, Dr. P’s evidence shows that the discussions were in the context of providing health services to BVS. In my view, those discussions would fall within the exception i.e. the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use or disclose the information for the secondary purpose.

49. On the evidence before me I am not satisfied that Dr. P discussed BVS’ health information with Ms W’s social worker.

50. I am therefore not satisfied that any breach of either HPP 10 or HPP 11 is established in relation to discussions between Dr. P and the psychiatry registrar and the alternative psychiatric consultant or between Dr. P and Ms W’s social worker.

Disclosure of BVS’ health information to the Police - HPP 11

51. It is common ground that Dr. P wrote the letter with the intention that it be provided to the NSW Police. She did so in circumstances in which she was concerned about Ms W’s mental and physical health and wanted to provide her with support.

52. In the letter Dr. P wrote about what she had been told in regard to BVS’ behaviour and her own observation that Ms W had become increasingly distressed. Dr. P wrote:

Although I have never assessed [BVS] myself, he is well known to the psychiatric service in this area of which I am a part, and I therefore, from discussions with colleagues, know something of [BVS's] behaviour in the past. The history of his behaviour, given to me by [Ms W], is not inconsistent with what I understand of his behaviour in other settings.

I am concerned that this behaviour amounts to harassment and could possibly also qualify as stalking. I am not only concerned that there is immediate distressed caused to my patient but I am also concerned that this behaviour may escalate, as many stalking behaviours do.

53. Dr. P finished the letter by expressing the hope that the Police

“are able to investigate [BVS'] behaviour and take appropriate steps to protect my patient”.

54. In her statement to the Tribunal Dr. P stated:

[Ms W] described to me certain behaviours on the part of the applicant when contact with him was unwanted and perceived as threatening and intrusive thereby causing her distressed, as follows:

(a)   the making of telephone calls to her;

(b)   leaving or giving her gifts, cards and notes including an anniversary card;

(c)   causing her home to be searched three times by Police after telephoning emergency services and saying he was having suicidal thoughts whilst incorrectly reporting that he was at her residence;

(d)   turning up at her home;

(e)   parking outside her home.

By the time of my consultation with [Ms W] on 1 April 2014 I had formed the view that the applicant's pattern of behaviour was posing a very significant risk to [Ms W's] health and safety which was already impacting on her and which carried the risk of escalation in the very short term. I was also of the view on the basis of what I knew of the applicant that his behaviour was likely to escalate and become even more intrusive and potentially dangerous if no limits were placed on his behaviour.

I accordingly formed a view that it was necessary for me to take action within a short time frame to prevent a very significant adverse health outcome for [Ms W]. I had already advised [Ms W] to report her concerns to [the Police] and seek an AVO. However, my understanding from [Ms W] is that although she did so, no action was taken by the Police.

…

From a psychiatric perspective it was important for [Ms W] to deliver the letter to [the Police] herself as opposed to me posting it or otherwise sending it to the Police as this was a means of addressing for her the failure of the Police to act on her previous complaint whilst visibly supporting her through the process, being her advocate and empowering her.

My next consultation was with [Ms W] on 15 April 2014. Within a couple of days of the 10th April she had informed me that she had delivered the letter to [the Police] the same afternoon I had given it to her, and I had been contacted shortly thereafter by a Constable ...

If [Ms W] had not taken the letter to [the Police] herself I would have taken action within the next couple of days because I felt clearly that something had to be done within a very short timeframe, I would have taken the letter myself or I would have encouraged the social worker to accompany her to the police.

55. BVS denied that he has behaved in any manner that would amount to harassment or stalking. He agreed that he made phone calls to Ms W’s house but said that he did so to be able to speak to his children who live there. He denied parking outside Ms W’s home and stated that he could not have done so as he is legally blind and cannot drive a vehicle. He agreed that he had given Ms W an anniversary card in which he expressed his love for her but said that it was in the context of recent amicable communication between himself and Ms W and therefor it was appropriate behaviour.

56. BVS also said that he had received a Court Attendance Notice in March 2014 and was required to attend in relation to an application for an AVO. He therefore contends that the Police had already taken action in regard to Ms W’s complaint. This is in contrast to Dr. P’s evidence that she understood that the Police had not taken any action.

57. Dr. P’s evidence is that she wanted to prevent a serious and imminent threat to the health and welfare of Ms W. She considered that it was necessary for her to take action within a short time frame to prevent a very significant adverse health outcome for Ms W.

58. Mr Rooney submitted that the test to be applied is whether Dr. P had a reasonable belief that disclosure of BVS’ health information was necessary to prevent or lessen a serious and imminent threat to Ms W’s life or health.

59. He further submitted that the evidence shows that Dr. P clearly found Ms W to be distressed. She understood that although Ms W had presented to police, no action had been taken by the police. Dr. P gave Ms W the letter on 10 April 2014 knowing that she would be seeing her again on 15 April 2014.

60. Mr Rooney submitted that the fact that Dr. P provided the letter to Ms W does not diminish the "imminence" of the threat that Dr. P perceived to Ms W. This is because Dr. P would have taken steps within a couple of days to bring the letter to the attention of the Police if Ms W had not done so.

61. Mr Rooney submitted that Dr. P was in a position to judge whether BVS’ actions and conduct towards Ms W constituted a serious and imminent threat to her because Dr. P had treated Ms W for 14 years. Dr. P considered that the threat to Ms W was likely to occur at any moment. In his submission, the fact that Dr. P considered it necessary to write the letter on this occasion is important. There is no evidence that she previously formed the view of Ms W being at imminent risk. Dr. P only took the necessary steps to assist Ms W inform the Police of the escalating problems because of the level of distress that Ms W was conveying to her at the time.

62. The Respondent’s position is that Dr. P reasonably believed at the time that the inclusion of BVS’ information in the letter was necessary to lessen or prevent a serious and imminent threat to Ms W’s life, health or safety. Therefore, it contends that disclosure to the Police fell within the exception to the HPP 11.

Discussion

63. The PPIP Act and HRIP Act is beneficial legislation which must be liberally interpreted in order to achieve its beneficial purpose: Director General, Department of Education and Training v MT [2006] NSWCA 270 at paragraph [49]. Consistently with that purpose, exemptions are to be construed narrowly.

64. In FM v Vice Chancellor, Macquarie University [2003] NSWADT 78, Hennessy DP said:

Serious and imminent threat to life or health

55 Under s 18(1)(c) disclosure of personal information is permitted if "the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person." B gave evidence that he received a written complaint that FM assaulted a student. He said that he was concerned that similar incidents could happen again at the UNSW. Both B and C gave evidenced that they witnessed FM engaging in verbal abuse and physical intimidation of a student. C said that he was concerned that FM would repeat his behaviour at UNSW and was apprehensive that FM might injure someone.

56 While I accept that evidence, I am not satisfied that it founds reasonable grounds for a belief that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of any person. Even if the allegations of FM’s previous conduct could be characterised as a threat to the life or health of any person, (and I am not satisfied that it could) any threat must be both serious and imminent. In this case it was neither. In particular, The Macquarie Dictionary, 3rd edition, The Macquarie Library, relevantly defines "imminent" as "likely to occur at any moment; impending." There is simply no basis on which a person could believe that it was necessary to disclose personal information about FM to prevent or lessen an "imminent" threat to the life or health of any person.

65. It was evident from the evidence of Dr. P that she did not in any way act maliciously. I am satisfied that at all times she was acting in what she regarded as the best interests of her patient, Ms W. I am also satisfied that the level of Ms W’s distress was increasing.

66. However, I am not satisfied that her belief that the disclosure of BVS’ health information was necessary to prevent or lessen a serious and imminent threat to Ms W’s life, health or safety was reasonable.

67. As I have noted above, Dr. P was relying on hearsay that she had received in regard to BVS’ alleged conduct. She accepted the information that had been given to her by Ms W and Ms W’s social worker as correct in circumstances in which she had no direct knowledge of either BVS or his behaviour.

68. On her own evidence she had not delved into the details of BVS’ clinical records. She made assumptions about BVS’ psychological condition based on information about a diagnosis that she had been given seven years earlier. She could not be certain that the diagnosis was correct. In those circumstances, extra caution was required before disclosure of BVS’ health information.

69. In any event, it is my view that the same result could have been achieved without disclosing any of BVS’ health information to the Police.

70. Dr. P could have written a letter to the Police in support of Ms W by reference to Ms W’s circumstances and without disclosing any of BVS’ health information.

71. That being the case, I do not agree that the inclusion of BVS’ health information in the letter was necessary to lessen or prevent a serious and imminent threat to Ms W’s life, health or safety. Therefore, it is my view that disclosure of BVS’ health information to the Police was in breach of HPP 11.

72. The question therefore arises as to what order is appropriate in the circumstances.

73. This Tribunal and the former Administrative Decisions Tribunal have considered the question of compensation under the privacy legislation on a number of occasions: see for example the discussion in HP v Hunter New England Area Health Services [2009] NSWADT 186 at paragraphs [41] to [43].

74. As was noted in HP v Hunter New England Area Health Services, damages are compensatory in that an applicant should be awarded such compensation so as that he/she may be restored to the position that he/she would have been in but for the breach. However, this approach must also be viewed in the context of the $40,000 limit as provided for in section 55(2)(a) of the PPIP Act.

75. In measuring compensation the ultimate guide is the wording of the legislation and its objectives. Compensation should be assessed having regard to the complainant’s reaction and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances.

76. ‘Psychological harm’ in section 55(4) of the PPIP Act is intended to encompass situations where an individual suffered some impairment of the mental states and processes, such as depression and anxiety.

77. Even where an applicant is able to substantiate loss or damage as a result of conduct that contravenes an ‘information principle’, an award of damages under that Act remains a discretionary one. However, compensation for alleged financial loss and alleged psychological and physical harm can only be considered where the Tribunal finds that the alleged loss and harm was ‘because of’ or ‘caused by’ the contravening conduct of the agency.

78. I have set out above the orders that the Applicant has requested. He has not provided any evidence in support of his claim for damages. I therefore have no basis on which I could base such an order.

79. As I have noted, I am of the view that Dr. P acted in what she considered to be the best interests of her patient. Nevertheless, I am satisfied that the inclusion of BVS’ health information in the letter has caused BVS significant distress. It is unclear what other harm he has suffered because he has not provided any evidence to support his claim. In my view, an apology is warranted because of the distress BVS has suffered.

80. In my view it is also desirable to make an order as to future administrative procedures. The Respondent should take appropriate steps intended to reduce the likelihood of a similar breach in the future. At a minimum this should include a reminder to staff of the need for vigilance in relation to the protection of patients’ sensitive health information. This reminder should also be included in training material provided to staff in relation to compliance with the Privacy legislation. Where a staff member believes that the disclosure of health information is necessary to prevent or lessen an "imminent" threat to the life or health of a person, the belief must be reasonable and the need for accuracy of the information that is disclosed should be paramount. Extra caution should be taken in circumstances where the belief is based on hearsay.

Orders

1. The Sydney Local Health District is, within 30 days of the publication of these reasons, to render a written apology to the applicant for disclosing health information about the Applicant to a third person without lawful authority.

2. The Sydney Local Health District is to advise the Applicant of the steps to be taken by the agency to minimise the possibility of a similar breach in future.

3. Otherwise the Tribunal determines not to take any action in the matter.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 18 August 2015