FHP v Baig Medical Services Pty Ltd

[2024] NSWCATAD 280

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

FHP v Baig Medical Services Pty Ltd [2024] NSWCATAD 280

Hearing dates:

26 April 2024

Date of orders:

20 September 2024

Decision date:

20 September 2024

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

P French, Senior Member

Decision:

The Tribunal will take no action in the matter insofar as it concerns Baig Medical Services Pty Ltd

Catchwords:

GENERAL JURISDICTION – Health Records and Information Privacy Act 2002 (NSW) – inquiry into a complaint made to the Privacy Commissioner

Legislation Cited:

Administrative Decisions Review Act 1997 (NSW), s 9

Civil and Administrative Tribunal Act 2013; s 29, 30, 64

Health Records and Information Privacy Act 2002 (NSW), s 4, 11, 27, 44, 48, 49, 54, 59

Privacy Act 1988 (Cth), s 6D

Cases Cited:

FHP v Arys Health Pty Ltd [2024] NSWCATAD 27

Texts Cited:

None Cited

Category:

Principal judgment

Parties:

FHP, Applicant
Baig Medical Services Pty Ltd, Respondent

Representation:

FHP, Self represented

S Zain-Mirzan, authorised representative, Respondent

File Number(s):

2023/00045656

Publication restriction:

The disclosure of the applicant’s name is prohibited pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW)
Note: A reference to the name of a person includes a reference to any information, picture or other material that identifies the person or is likely to lead to the identification of the person.

REASONS FOR DECISION

Introduction

1. This decision arises from the finalisation of an inquiry which I have undertaken pursuant to s 49 of the Health Records and Information Privacy Act 2002 (the HRIP Act) into complaints made by FHP (the applicant) to the Privacy Commissioner (the Commissioner) against a private sector person, identified as “Arys Health” within the meaning of Part 6 of that Act which were the subject of a report by the Commissioner under s 47 of that Act (the complaints, the impugned conduct).

2. I commenced this inquiry on 31 May 2023. In a decision published on 30 January 2024 I determined, for reasons given, that insofar as the inquiry concerned Arys Health Pty Ltd, the Tribunal would take no action on the matter. However, also for reasons given, I determined that the inquiry should continue in relation to another entity, being Baig Medical Services Pty Ltd (Baig), which on the evidence as it then stood, appeared to be a private sector person also involved in the impugned conduct that was the subject of the s 47 report: FHP v Arys Health Pty Ltd [2024] NSWCATAD 27 (the earlier decision).

3. However, my further inquiry insofar as it concerns Baig has led me to the conclusion that Baig is not a private sector health service provider to which the HRIP Act applies. It is merely a corporate body through which Dr Baig contracts his services as a General Practitioner to private sector health service providers to which the HRIP does apply. At the material time for this inquiry that was Arys Health Pty Ltd. For this reason, I have determined to take no further action in the matter insofar as it concerns Baig.

4. My further inquiry and findings in relation to Baig have required me to reconsider some of the factual findings I made in relation to Arys Health Pty Ltd in the earlier decision. I have set out my revised findings in the reasons that follow. However, my revised factual findings have not led me to revise my conclusion that no further action should be taken in this matter insofar as it concerns Arys Health Pty Ltd.

5. The essential issue in this respect is that at no stage up to mid-way through this inquiry was the proper respondent to the applicant’s complaints identified by its legal name, Arys Health Pty Ltd. Prior to this the respondent was identified as “Arys Health” which is an informal trading name used by both Arys Health Pty Ltd and Baig in relation to the medical practice conducted by Dr Baig for Wellshare Pty Ltd. In this context, it is not sufficiently clear for the purposes of determining breach of ss 27 and 59 of the HRIP Act to whom the applicant’s and Commissioner’s communications were being directed.

6. It is a serious matter to find a contravention of ss 27 and 59 of the HRIP Act by a private sector person. As at the end of this inquiry I cannot be satisfied to the requisite standard (the Briginshaw standard^[1] ) that Arys Health Pty Ltd, through its medical records management agency, V Plus Corporation Pty Ltd, was on notice, practically as well as legally, as to the applicant’s second complaint and the Commissioner’s section 59 requirement. I remain of the view that it is inappropriate to make adverse findings against Arys Health Pty Ltd or order it to provide a remedy to the applicant in these circumstances.

   1. Briginshaw v Briginshaw [1938] HCA 1938; (1938) 60 CLR 336; the Briginshaw standard applies in this proceeding, because it involves the exercise of the Tribunal’s general jurisdiction, rather than its administrative review jurisdiction (s 29 of the Civil and Administrative Tribunal Act 2012 (NSW) (it does not involve the review of a decision of an administrator; s 30 of the NCAT Act and s 9 of the Administrative Decisions Review Act 1997 (NSW)).

7. Nevertheless, it must be acknowledged that the manner in which the applicant’s requests for his health records were dealt with by various persons under the guise of “Arys Health” is unsatisfactory.

8. Having said that, and despite the applicant’s continuing doubts about the matter, I am confident on the evidence before me that he was provided with a copy of the whole of his extant medical records held by Arys Health Pty Ltd on or about 3 March 2023. That was the object of his requests to Arys Health, the failure to respond to which became the impugned conduct in the complaints before the Commissioner, and then before this Tribunal in this inquiry. At least he has obtained that outcome.

Procedural History

9. I have set out the initial procedural history of this proceeding in my earlier decision.

10. For present purposes it is sufficient to record that upon deliberation following the first hearing in this inquiry, I determined that the inquiry ought to be finalised insofar as it concerned Arys Health Pty Ltd, but I left open the possibility that it ought to continue in relation to Baig. To facilitate consideration of that question I made the following procedural directions:

7.   Insofar as it concerns Baig Medical Services Pty Ltd trading as Arys Health Medical Centre the application is to be listed for a Case Conference to determine whether the inquiry should continue with respect to that organisation and if so, for directions.

8.   The applicant is to file with the Divisional Registrar an ASIC Company Extract for Baig Medical Services trading as Arys Health Medical Centre which sets out its registered address within 7 days of the date of these orders.

9.   The applicant must serve a copy of his application and this decision on Baig Medical Services Pty Ltd trading as Arys Health Medical Centre at its Registered Address within 7 days of the date of these orders.

11. The application insofar as it concerned Baig came before the Tribunal, differently constituted, for a Case Conference on 28 February 2024. The applicant appeared at the Case Conference in person. Baig appeared by telephone by its authorised representative Ms Saira Zain-Mirzan.

12. Although no express order appears in the directions made by the Tribunal at that Case Conference, it is implicit from the directions that were made that the Tribunal concluded that the proceeding should continue insofar as it concerned Baig. In this respect the following directions were made.

1.   The respondent is to file and serve any submissions, statements and evidence (including material related to the retention and deletion of health records of the application (sic) on or before 25 March 2024.

2.   The applicant is to file and serve any material in reply that he wishes to rely upon, including a list of any witnesses required for cross-examination at hearing, on or before 19 April 2024.

3.   The proceeding is listed for hearing (Part Heard) in person on 26 April 2024 at 10am ….

Material considered and hearing

13. I have considered the following material in reaching my determination in addition to the material that was before me in relation to my earlier decision (as identified in that decision):

(i)   a submission in response to direction 1 filed by Baig on 28 March 2024,

(ii)   a submission in response to direction 2 filed by the Applicant on 19 April 2024 (the applicant’s first submission),

(iii)   a further submission in response to direction 2 filed by the Applicant on 19 April 2024 to which various documents were attached (the applicant’s second submission).

14. The applicant attended the hearing in person and gave oral evidence in his own cause under a solemn promise to tell the truth. Baig was represented at the hearing by its authorised officer, Ms Saira Zain-Mirzan, who also gave evidence under a solemn promise to tell the truth.

15. The parties had the opportunity to present their respective cases, to ask each other questions, and to make final submissions to the Tribunal.

Preliminary issues

Recusal application – actual and apprehended bias

16. In his first submission, and at the hearing outset, the applicant submitted that I should recuse myself from continuing with this inquiry on the grounds of actual or apprehended bias. I clarified with the applicant that the grounds upon which that application was made were the same as those which had been raised at the initial hearing in this inquiry conducted on 31 May 2023 in relation to a recusal application he had made then (see paragraphs 7 to 11 of the applicant’s first submission, paragraph 17 of the applicant’s second submission, and paragraphs 25 to 33 of my earlier decision) (first recusal application).

17. I note that my decision in the first recusal application was not the subject of an appeal by the applicant.

18. Having regard to those facts I declined to deal with the recusal application on the basis that it had already been heard and determined in this inquiry.

Dissatisfaction with my earlier decision

19. In his first submissions the applicant states that he is dissatisfied with my earlier decision for the following reasons:

(i)   There was an unreasonable delay between the first hearing (31 May 2023 and the publication of my earlier decision (30 January 2024) (paragraphs 1 to 5 of the applicant’s first submissions),

(ii)   I refused his application to adjourn the hearing of 31 May 2023 (paragraph 12 of the applicant’s first submissions, see also paragraph 17b of the applicant’s second submissions),

(iii)   I allowed Ms Scott of V Plus Corporation Pty Ltd to represent Arys Health Pty Ltd and to attend the hearing of 31 May 2024 by video link (paragraphs 13 to 16 of the applicant’s first submissions, see also paragraphs 15 and 16 of the applicant’s second submissions).

20. While this inquiry continues before me in relation to Baig, the first two issues concern matters that cannot now be changed. With respect to the third issue, my earlier decision sets out in some detail how I reached my conclusion as to Arys Health Pty Ltd being the proper respondent to the inquiry and why V Plus Corporation Pty Ltd (and its authorised officer, Ms Scott) was entitled to represent that entity in the proceeding (see paragraphs 47 to 62 of my earlier decision).

21. Although I have had to revise some factual findings I made concerning Dr Baig and Baig Medical Services Pty Ltd from what is set out in my earlier decision, this does not affect my conclusions as to the proper respondent and V Plus Corporation Pty Ltd’s entitlement to represent Arys Health Pty Ltd in this proceeding. I therefore will not revisit these issues in this inquiry.

22. For the avoidance of doubt, I note that I am only referring to these matters in relation to this continuing inquiry. I do not intend to say or imply anything here about whether the applicant has an avenue of appeal from my decision in relation to these matters.

Dr Baig as a witness

23. On page 13 of his submissions, the applicant states under the heading “[l]ist of any witnesses required for cross-examination at hearing”: “a. the applicant wishes to question Dr M Baig, who has not submitted a sworn statement”.

24. Dr Baig did not provide any statement of evidence, and nor did he appear at the hearing.

25. No direction requiring Dr Baig’s attendance at the hearing was made by the Tribunal, differently constituted, at the Case Conference conducted on 28 February 2024.

26. The applicant did not, prior to the hearing, seek to invoke the compulsory power of the Tribunal to summons Dr Baig to give evidence. While the applicant is self-represented, he may be taken to know of his ability to do so, because I pointed this out to him in my earlier decision (at [65] to [66]).

27. Baig did offer as a representative and witness Ms Saira Zain-Mirzan. At the hearing outset she informed the Tribunal that she had sufficient knowledge to give evidence as to the factual matters contained in Baig’s submissions of 28 March 2024.

28. I understand the applicant to have objected my hearing from Ms Zain-Mirzan rather than Dr Baig. However, in the circumstances, I considered that the only reasonable avenue available to me at the hearing.

29. I acknowledge that this inquiry would have been far simpler to conduct if Dr Baig had participated from the outset or had at least submitted a statement of evidence.

My findings in the earlier decision

30. For reasons that will emerge following, it is necessary to set out at some length the factual findings I made in relation to Arys Health Pty Ltd and Baig in my earlier decision:

2. The applicant’s complaints to the Commissioner related to the failure of “Arys Health” to provide him with access to his health records which he contended were held by an entity of that description. The delegate of the Commissioner found that “Arys Health” had breached ss 27(1) and 27(2)(a) of the HRIP Act and Health Privacy Principle 7(1) by failing to respond to the applicant’s request for copies of his primary health records within 45 days of those requests being made. She also found that “Arys Health” had breached s 59(1) of that Act because of its lack of response to her direction that it provide her with copies of those records. She made four recommendations to “Arys Health” to remedy the breaches found.

3. My inquiry into the applicant’s complaints has led me to the conclusion that there are two ‘private sector persons’ within the meaning of s 4 and Part 4 of the HRIP Act which hold the health records that were the subject of the applicant’s requests. However, this was never appreciated by the applicant when he requested this information from “Arys Health”, and it does not appear to have come to the Commissioner’s attention during her investigation of the applicant’s complaints (she does not refer to it in her s 47 Report). Indeed, that fact did not fully crystalise until the hearing.

4.   “Arys Health” is not a registered business name. It appears to have been an informal trading name used by Arys Health Pty Ltd when it conducted a medical practice up to in or about May 2021. While that company remains registered, it has not conducted a medical practice since May 2021. When Arys Health Pty Ltd’s medical practice was wound up, it engaged a records management agency, V Plus Corporation Pty Ltd, to manage its patient health records. It is V Plus Corporation Pty Ltd which has responded to these proceedings on behalf of Arys Health Pty Ltd, albeit in a somewhat confused and belated way. It has filed evidence and a representative attended the hearing.

5   Dr Mirza Baig was a principal or employed doctor who worked for Arys Health Pty Ltd up until its medical practice was wound up. He is the principal of a company called Baig Medical Services Pty Ltd which trades under the name Arys Health Medical Centre. That business name was registered on 2 September 2021. This medical practice remains a going concern. Arys Health Medical Centre originally operated from the same Pitt Street location as Arys Health Pty Ltd before the latter ceased operation. It now operates from a George Street address. Various documents in evidence show that this medical practice also uses “Arys Health” as an informal trading name.

6.   The applicant sought access to the entirety of his medical records held by “Arys Health”. The evidence leads me to conclude that he first attended the medical practice conducted by Arys Health Pty Ltd on 17 January 2017 and that he last attended the medical practice conducted by Baig Medical Services Pty t/a Arys Health Medical Centre (Baig) for the purposes of a medical consultation on 17 August 2021.

…

53.   This inquiry arises from complaints made by the applicant to the Information and Privacy Commission which were to the effect that ‘Arys Health’ failed to provide him with copies of his complete medical record when he requested this on 6 September 2021 and 22 April 2022. In particular, the applicant complained that he had not been provided with consultation notes arising from his attendance at ‘Arys Health’s’ medical practice on 16 and 17 August 2021.

54.   ‘Arys Health’ provided the applicant with a ‘Patient Health Summary’ on 16 March 2022 in response to his 21 September 2021 request which sets out in summary form each of his attendances at that practice. The applicant’s first recorded attendance was on 17 January 2017. His last recorded attendance was on 16 Mach 2022. The Summary includes entries related to 16 and 17 August 2021. Doing the best that I can with this evidence, I conclude that the Patient Health Summary is an integrated medical record created and/or maintained by Baig that incorporates the attendance of the applicant at the medical practice conducted by Arys Health Pty Ltd and that conducted by Baig. In this respect it is a complete medical record but in summary form.

55.   This inquiry concerns what the applicant contends is ‘Arys Health’s’ failure to provide him with copies of his primary health records. Those records are retained by V Plus Corporation on behalf of Arys Health Pty Ltd in respect of the period 17 January 2017 up to about May 2021, but not after that date. After that date it is Baig that was responsible for the retention of those records.

56. Having regard to these matters, it will be apparent that ‘Arys Health’ is not a proper description of the respondent in these proceedings. It does not denote any legal person. There ought, properly, to be two respondent parties, being Arys Health Pty Ltd and Baig. Pursuant to s 44(1) of the NCAT Act I will therefore order the amendment of the description of the respondent and the joinder of Baig Medical Services Pty Ltd trading as Arys Health Medical Centre as a respondent party to the proceedings.

…

81. There is no issue in this inquiry that Arys Health Pty Ltd and Baig are both ‘private sector persons’ within the meaning of s 4 and Part 4 of the HRIP Act and therefore must comply with the requirements of that Act as ‘health service providers’ within the meaning of that Act.

…

86.   In her Final Investigation Report issued pursuant to s 47(1) of the Act the Privacy Commissioner describes the applicant’s compliant by reference to his requests for his health information as follows:

5.   On 6 September 2021, the Complainant sent a letter to the Respondent requesting access to his health records. In particular, he was seeking consultation notes arising from his attendance at the Respondent’s practice between 16 and 17 August 2021. The Complainant requested that the Respondent provide the following records:

“all charts, test results, consultation notes, (at the information at your office) and referrals, regarding my medical care during this period. Please mail the requested records to me at the above address”.

…

7.   On 2 February 2022, the Complainant lodged a complaint to the IPC about the Respondent’s failure to provide the Complainant with his requested health records. The complaint was registered by the IPC under reference number: IPC22/C000012.

…

11.   Following inquiries from the IPC to the Respondent on 24 March 2022, the Respondent provided the Complainant with a PDF file containing a summary of his health record.

12.   On 29 March 2022, the IPC finalised and closed its complaint (IPC22/C000012).

13.   On 22 April 2022, the Complainant wrote to the Respondent requesting the following information:

“Original (what is recorded in the patient’s medical records. For examples. i.e: all charts, test results, consultation notes and referrals (in the information from your office, pdf document) such as Document imported re.Letter, Letter written re.Doctor’s Notes, Letter written re.Medical Certificate – ARYS HEALTH, Document imported re.Consultation Notes).

Could you please include consultation notes for both days in 16-17 August 2021 and you sent (or attempted to send) an Email to a third party which attached a material linked Diagnostic and Statistical Manual of Mental Disorders (DSM). I rejected you sent any email connected with me on 16 August 2021 without my consent, but when I was leaving your medical practice, you wrote in your note “incomplete”, when I asked a copy, I left your office.

14.   On 1 June 2022, the Complainant wrote to the IPC advising that he still had not received access to their requested health records from the Respondent.

…

19   On 27 October 2022, the Complainantt wrote to the IPC advising that he still had not received the copies of the requested health records from the Respondent. Noting the ongoing delay and failure to provide access to the health records by the Respondent, the IPC proceeded to deal with the failure to provide the access as a new complaint and proceeded by making further inquiries with the Complainant and Respondent. The IPC reference number for this complaint was: IPC 22/C000130.

87.   It is apparent from what is set out above that the complaint that was the subject of the Commissioner’s Report under s 47(1) was the failure of “the respondent” to provide the applicant with access to the whole of his health records within the prescribed period of 45 days from his request. This request particularised medical records related to consultations or interactions the applicant had with Dr Baig on 16 and 17 August 2021, but was not limited to those records.

…

Is the complaint substantiated?

91.   The applicant first made a request for a copy of his health records by sending a letter dated 6 September 2021 addressed to “Dr Baig, Arys Health” to the Pitt Street address. By that time Arys Health Pty Ltd had wound up its medical practice and did not operate from that address. Its medical records were in the custody and control of V Plus Corporation Pty Ltd.

92. The applicant received no response to that letter. Consequently, on 17 November 2021 he sent an email addressed to Dr Baig at [email address] enclosing a further copy of his original request and advising that the HRIP Act requited Arys Health to respond to his request within 45 days of it being made. That is a generic email address that is used by Baig in relation to its medical practice. The applicant received no response to that email.

93.   On 2 February 2022 the applicant lodged a complaint with the Information and Privacy Commission (IPC) about “Arys Health’s” failure to respond to his request for copies of his medical records. That complaint was registered under the reference number IPC22/C000012 (the first complaint). The IPC delegate contacted “Arys Health’ on 3 and 15 March 2022 concerning the complaint and directed Arys Health to respond to the applicant’s request by 18 March 2022. It is not apparent from any of the material before me who, exactly, was involved in those communications on behalf of “Arys Health”.

94.   On 16 March 2022 the applicant attended the Arys Health Medical Centre at its Pitt Street address to inquire about missed calls from that Centre he had received to his mobile phone number. He made inquiries of the receptionist about his request for medical records, which the receptionist referred to Dr Baig. Via the receptionist, Dr Baig requested the applicant to supply a secure email address which he did.

95.   On or about 16 March 2022 a document entitled “Patient Health Summary” was created by Arys Health Medical Centre in relation to the applicant. This document includes a medical profile for the applicant and a short summary of each of his attendances at “Arys Health” between 17 January 2017 and 16 March 2022. I note that the attendances recorded after 17 August 2021 are in relation to the applicant’s requests for health information, not medical consultations. Arys Health Medical Centre provided this document to the applicant in digital form on 24 March 2022 and notified the IPC accordingly. In response to this advice the IPC finalised and closed the applicant’s first complaint.

96.   By letter dated 20 April 2022 addressed to “Dr Baig, Arys Health” at the Pitt Street address, sent by email to [email address] on 22 April 2022, the applicant requested copies of all of his primary health records, including ‘complete consultation notes’ in relation to his attendance on 16 and 17 September 2021. In response, on 26 April 2022, the applicant received from that email address an email under the signature “Arys Health” which advised that his email had been received and “we will send your records as requested by you”. However, those records were not supplied at that time.

97.   This resulted, on 1 June 2022, in the applicant lodging a second complaint with the IPC which was registered under the reference number IPC 22/C000130 on 27 October 2022 after informal attempts by the IPC to resolve the dispute by liaison with “Arys Health” had proved unsuccessful.

98.   Initially “Arys Health” advised the IPC that the applicant’s primary health records were too large to send in the digital format requested by him. This resulted, on 7 July 2022, in the applicant sending an email to [email address] which requested these documents be provided to him on CD Rom. On the same day, Dr Baig replied to that email stating “we have relocated” to George Street and “we will send you the tracking number”. However, the applicant received no further response to his request for his primary health records.

99. The IPC made various attempts to contact “Arys Health” and to obtain a response to the applicant’s complaint during November and December 2022 to which it received no response. This included issuing Arys Health with a requirement to produce applicants health record pursuant to s 59 of the HRIP Act to which no response was received.

…

101. Having regard to the above, there can be no issue in this inquiry that “Arys Health” failed to respond to the applicant’s first and second requests for copies of his medical records within 45 days of those requests being made. Prima facie that is a contravention of s 27 of the HRIP Act (HPP 7(1)). There also can be no issue that “Arys Health” failed to comply with a requirement of the Commissioner to produce those health records to the IPC in accordance with her direction under s 59. Prima facie that is also a contravention of that section. However, this cannot lead easily to a substantiation of the complaint in the context of this inquiry.

102. For the reasons stated above, “Arys Health” is not a proper respondent to this inquiry. It is an informal trading name that was used by Arys Health Pty Ltd and it is also used by Baig. It is not a registered trading name. It therefore does not identify the legal person that lies behind the name, and in the present context, the private sector person to which the obligations imposed by the HRIP Act apply.

…

106. … insofar as the inquiry concerns Arys Health Pty Ltd, I am not satisfied on the material before me that there are sufficient grounds to find a contravention of ss 27 of 59 against that entity because:

(i)   the applicant’s first and second requests for copies of this health records were lodged with Baig. They were not lodged with or otherwise brought to the attention of Arys Health Pty Ltd or V Plus Corporation Pty Ltd by the applicant. His follow-ups of those requests were all directed to Baig, not Arys Health Pty Ltd or V Plus Corporation Pty Ltd. This was because the applicant appears not to have known that two private sector persons held his medical records. I thus cannot be satisfied that Arys Health Pty Ltd was on notice as to the applicant’s requests for his health information.

(ii) the Commissioner’s investigation into the applicant’s complaints directed all communication concerning “Arys Health” to Baig. That appears to be because the Commissioner was also unaware that two private sector persons held the applicant’s health records. I thus cannot be satisfied that Arys Health Pty Ltd was on notice as to the applicant’s complaints, or as to the requirement issued by the Commissioner under s 59.

(iii) with respect to the Commissioner’s s 59 requirement I also consider that this was not issued to a legal person. It therefore does not identify the private sector person, being a health service provider, who is required to comply with the requirement. It appears to me that the requirement is invalid for this reason and no contravention of s 59 could be found against Arys Health Pty Ltd in these circumstances.

(iv)   it is clear from Mr Maloney’s email communication with the Registry of 23 May 2023, and Ms Scott’s oral evidence at the hearing, that V Plus Corporation Pty Ltd did come to be aware of the applicant’s first complaint to the IPC because this was communicated to it by Dr Baig. It is not clear when this was. In any event, to the extent that V Plus Corporation Pty Ltd was involved in responding to that complaint it was doing so to assist Baig. I am satisfied that Arys Health Pty Ltd was never separately identified as a respondent to the complaint.

(v)   For the reasons set out above I am not satisfied that V Plus Corporation Pty Ltd for Arys Health Pty Ltd was ever aware of the applicant’s second complaint or of the Commissioner’s s 47 Report before it became engaged with this inquiry on 19 May 2023. V Plus Corporation Pty Ltd did supply health records it held in respect of the applicant to Baig in late February 2023 or early March 2023 in response to its request for that information. However, I am not satisfied that it knew anything about the context in which that request was made.

107. A contravention of s 27 (HPP 7(1)) by a private sector person cannot be found where the evidence does not establish that a request for health information was properly made to that person.

108.   Turning to a different point, the applicant contends that the health information retained by Arys Health Pty Ltd he was provided with on 3 March 2023 by Baig must be incomplete. That is because those records are limited, and some are in draft form. He also contends that the Patient Health Summary dated 16 March 2022 which he received on 24 March 2022 refers to particular documents, such as prescriptions and referral letters, as each having been created and that copies of some of these are not in the documents provided.

109.   Ms Scott gave evidence under oath that every health record retained by V Plus Corporation for Arys Health Pty Ltd appeared in the digital files attached to the 3 March 2023 [email] and are filed and exchanged in these proceedings. She gave evidence that V Plus Corporation Pty Ltd cannot produce any additional records.

110.   Ms Scott noted that the applicant’s medical profile as recorded in his Patient Health Summary included as the first entry a “warning” to “keep[] the record to a minimum due to personal reasons”, which she interpreted as an instruction the applicant had given to Arys Health Pty Ltd. I understood the applicant to accept that he had, in fact, given such an instruction. It was submitted that this explained why the health records were limited.

111.   In relation to the applicant’s other contentions, there is a partially completed assessment form at page 42 of the bundle filed by Arys Health Pty Ltd which is dated 16 August 2021. However, because of its date, that is a health record created by Baig, not Arys Health Pty Ltd. It may be relevant insofar as this inquiry concerns Baig, but not insofar as it concerns Arys Health Pty Ltd.

112.   Copies of prescriptions and some referral letters referred to in the Patient Health Summary are not in the bundle. Ms Scott suggested that this was likely because it was Arys Health Pty Ltd’s doctor’s practice to record the contents of such documents in the patient health record but not retain copies of these documents. In any event, Ms Scott stated these documents have not been retained in the applicant’s health record. I accept her evidence that this is so.

…

Contentions of the parties

The applicant

31. In his second submission the applicant contends, relevantly, that he has never asserted he was a patient of Baig, and if that was the case, Arys Health Pty Ltd and Baig failed to disclose that fact to him.

32. The applicant continues to assert that “Arys Health” failed to comply with its obligation to him to provide him with access to his primary health records when he requested this. He continues to assert that the health record provided to him on or about 3 March 2023 is incomplete.

33. The applicant continues to seek, by way of partial remedy, an order that Arys Health provide him with a copy of this complete medical record, particularly with respect to what he considers the incomplete records arising from his attendance on 16 and 17 August 2021.

Baig

34. Baig makes the following contentions in its written submission, as supplemented by Ms Zain-Mirzan’s oral evidence:

(i)   Baig Medical Services Pty Ltd is a company (the company) of which Dr Mirza Baig is principal. Baig Medical Services Pty Ltd has never itself conducted a medical practice. It therefore has never created or maintained patient records. It exists only for the purpose ‘billing’ other entities for Dr Baig’s services.

(ii)   The company contracted Dr Baig’s services as a General Practitioner to Arys Health Pty Ltd at 280 Pitt Street until that medical practice ceased operation.

(iii)   Thereafter the company contracted with Wellshare Pty Ltd to provide Dr Baig’s services as a General Practitioner under the auspices of that entity at 428 George Street up to the present.

(iv)   Arys Health Pty Ltd did not wind up its medical practice at 280 Pitt Street until about May 2022 (not 2021). The applicant’s attendances on Dr Baig at Arys Health Pty Ltd on 16 and 17 August 2021 at 280 Pitt Street were thus at a time when he was contracted through his company to provide General Practitioner services on behalf of Arys Health Pty Ltd.

(v) Having regard to (iv) the medical record created by Dr Baig on 16 and 17 August 2021, and the health records created in respect of the applicant prior to those dates, are health records created on behalf of Arys Health Pty Ltd which it was obliged to maintain and administer, including in accordance with the HRIP Act.

(vi)   After Arys Health Pty Ltd wound up its medical practice at 280 Pitt Street, the applicant was not a patient of Dr Baig (either personally or though Wellshare Pty Ltd) at any time.

35. I note that the applicant did not challenge any of the matters set out at paragraph 33(i) to (vi). I am also satisfied that this evidence should be accepted as a matter of fact.

Applicable law

36. I have set out in my earlier decision the law that applies in relation to this inquiry (see paragraphs 74 to 80).

37. For present purposes, it is sufficient to note s 11 of the Act, and the definitions of (or related to) the terms “health service”, “health care provider” and “private sector agency” contained in s 4:

11.   How this Act applies to organisations

(1)   The Act applies to every organisation that is a health service provider or that collects, holds or uses health information

Note: The term organisation means a public sector agency or a private sector person.

(2)   An organisation to whom or to which this Act applies is required to comply with the Health Privacy Principles …

(3)   An organisation must not do a thing, or engage in any practice, that contravenes a Health Privacy Principle ….

health service includes the following services, whether provided as public or private services—

(a)  medical, hospital, nursing and midwifery services,

…

health service provider means an organisation that provides a health service but does not include—

(a)  a health service provider, or a class of health service providers, that is prescribed by the regulations as an exempt health service provider—

… [there is no prescription by the regulation].

(b)  an organisation that merely arranges for a health service to be provided to an individual by another organisation.

private sector person means any of the following that is not a public sector agency—

(a)  a natural person,

(b)  a body corporate,

(c)  a partnership,

(d)  a trust or any other unincorporated association or body,

but does not include a small business operator within the meaning of the Privacy Act 1988 of the Commonwealth, or an agency within the meaning of that Act.

Note—

Small business operator is defined in section 6D of the Privacy Act 1988 of the Commonwealth. Several types of businesses or activities are excluded from that definition. In particular, under section 6D (4) (b) an individual, body corporate, partnership, unincorporated association or trust is not a small business operator if it provides a health service to an individual and holds any health information except in an employee record.

organisation means a public sector agency or a private sector person.

Consideration

38. In order to finalise this inquiry, the Tribunal must pose and answer the following questions:

(i) Is Baig a “health service provider” within the meaning of s 11 to which the HRIP Act applies?

(ii)   If the answer to (i) is “yes”, did Baig provide a “health service” as defined to the applicant?

(iii) If the answer to (ii) is “yes”, is the applicant’s complaint to the Privacy Commissioner which involves an allegation of breach of s 27 of the HRIP Act (HPP 7(1) substantiated as against Baig?

(iii) If the answer to (iii) is “yes” what remedy, if any, ought the Tribunal order pursuant to s 54 of the HRIP Act?

(iii)   Having regard to the evidence that emerged in the conduct of this inquiry insofar as it concerned Baig, do any of the findings reached in the earlier decision insofar as this inquiry concerned Arys Health Pty Ltd require revision?

(iv)   If the answer to (v) is “yes” is the applicant entitled to any remedy as against Arys Health Pty Ltd arising from these revised findings.

39. A ‘health service provider’ is defined in s 4 of the HRIP Act, relevantly, to be an organisation that provides a health service which does not include an organisation that merely arranges for a health service to be provided to an individual by another organisation.

40. Section 11 of the HRIP Act provides that the Act applies to every organisation that is a health service provider or that collects, holds, or uses health information. In this respect “organisation” is defined to mean, relevantly, a private sector person (as distinct from a public sector agency), which includes, relevantly, a body corporate provided it is not a small business operator.

41. The meaning of the term “small business operator” for the purposes of the HRIP Act is found is s 6D of the Privacy Act 1988 (Cth), which provides:

What is a small business?

(1)    A business is a small business at a time (the test time) in a financial year (the current year) if its annual turnover for the previous financial year is $3,000,000.00 or less

…

What is a small business operator?

(3)   A small business operator is an individual, body corporate, partnership, unincorporated association or trust that:

(a)   Carries on one or more small businesses; and

(b)   Does not carry on a business that is not a small business.

Entities that are not small business operators

(4)   However, an individual, body corporate, partnership, unincorporated association or trust is not a small business operator if he, she or it:

…

(b) provides a health service to another individual and holds any health information except in an employee record …

…

42. Baig is a body corporate for the purposes of the definition of “private sector person”. However, whether it is a private sector person in fact depends on whether it is a small business operator within the meaning of the Privacy Act 1988 (Cth). That involves consideration of two issues. First whether Baig had an annual turnover in the previous financial year that is equal to or less than $3,000,000.00 about which there is no evidence. Second, if Baig provides a health service to an individual and holds any health information except in an employee record.

43. The question of whether Baig is a “health service provider” is also posed by s 11(1) of the HRIP Act which requires consideration of the definition of that term and “health service” in s 4 of that Act. In this respect, there is no issue that Dr Baig provides health services, because he provides “medical services”, being those of a General Practitioner. However, his company Baig Medical Services Pty Ltd contracts with other entities for those services to be provided by (or through) those entities.

44. Relevantly to this inquiry, Baig Medical Services Pty Ltd contracted with Arys Health Pty Ltd for Dr Baig’s services as a General Practitioner to be provided to patients of Arys Health Pty Ltd’s medical practice.

45. In those circumstances it appears to me that Baig is not a health service provider because it falls within the paragraph (b) exception in the definition of “health service provider”; that is, Baig merely arranged for a health service (Dr Baig’s services as a medical practitioner) to be provided to a patient by another organisation (Arys Health Pty Ltd’s medical practice).

46. The HRIP Act may apply to Baig on the alternative basis that it “collects, holds or uses health information”. However, despite my findings in the first stage of this inquiry, I am now not satisfied that this is not the case. I am satisfied that at all material times the entity that collected, held, and used the applicant’s relevant health information was Arys Health Pty Ltd. That is because, to the extent that Dr Baig provided health services to the applicant, he did so on behalf of Arys Health Pty Ltd and it was that organisation to which the obligations of a private sector agency attached under the HRIP Act.

47. For completeness I note that for this reason the exception to the application of the HRIP Act is not negatived by s 6D(4)(b) of the definition of small business operator contained in the Privacy Act 1988 (Cth). However, the issue of whether Baig is exempted from the operation of the HRIP Act because it is a small business cannot be taken further in the absence of any evidence of its annual turnover.

48. Nevertheless, for the reasons set out above Baig is not a private sector health service provider to which the obligations imposed by the HRIP Act apply. It did not provide a health service to the applicant at any time. This inquiry should not continue as against Baig for this reason.

49. With respect to the conclusions I have reached above, I must revise the findings I made in my earlier decision as follows:

1. there are/were not two private sector persons which hold the health records that were the subject of the applicant’s requests (paragraphs 2 and 81 of the earlier decision). Only one private sector person, Arys Health Pty Ltd, held those health records,

2. Baig Medical Services Pty Ltd t/a Arys Health Medical Centre did not operate a medical practice from 280 Pitt Street (paragraph 5 of the earlier decision). At all times that Dr Baig operated from that address he was contracted by Baig by provide his services to Arys Health Pty Ltd,

3. Baig Medical Services Pty Ltd does not itself operate a medical practice from 428 George Street (paragraph 5 of my earlier decision). Dr Baig provides General Practitioner services at that address through Wellshare Pty Ltd. However, he continues to use variations of the name “Arys Health” in marketing materials and in communications related to that practice,

4. the medical practice at 280 Pitt Street conducted by Arys Health Pty Ltd did not cease operation in about May 2021 (paragraphs 6 and 91 of my earlier decision). It did so sometime later (probably about May 2022), but in any event Arys Health Pty Ltd was still conducting that practice on 16 and 17 August 2021 when the applicant last attended on Dr Baig in relation to obtaining a health service,

5. the Patient Health Summary provided to the applicant on 16 March 2022 was not “an integrated medical record created and/or maintained by Baig that incorporates the attendance of the applicant at the medical practice conducted by Arys Health Pty Ltd and that conducted by Baig” (paragraph 52 of my earlier decision). It was a summary of Arys Health Pty Ltd’s medical records for the applicant,

6. Baig never provided health services to the applicant and consequently did not become responsible for the retention of any of his health records (paragraph 55 of my earlier decision),

7. the applicant’s first and second requests for copies of his health records were lodged with Arys Health Pty Ltd. Dr Baig was at those times providing his medical services through that entity (paragraph 106(i) of my earlier decision). That must lead to the conclusion that Arys Health Pty Ltd, was, or ought to have been, on notice as to these requests at least on an informal basis, contrary to my finding at paragraph 106(i) of my earlier decision.

50. I now turn to the question of whether my decision to take no action in the matter insofar as it concerns Arys Health Pty Ltd ought to be revisited in light of my further findings in this inquiry with respect to Baig and otherwise as set out above. After careful consideration, and not without some misgivings, I have decided this decision should stand for the following reasons.

51. It now appears that Arys Health Pty Ltd wound up its medical practice at 280 Pitt Street in May 2022. The applicant and the Commissioner attempted to communicate with “Arys Health” after that date, but there is uncertainty as to who in fact those communications were directed to.

52. The applicant received email responses from, or at least on behalf of Dr Baig, but there is no evidence that Dr Baig was an authorised representative of Arys Health Pty Ltd at that time.

53. The evidence I accepted from Ms Scott in the first hearing was that V Plus Corporation Pty Ltd was at that time engaged by Arys Health Pty Ltd to administer its patient health records. I also accepted Ms Scott’s evidence that V Plus Corporation Pty Ltd had no knowledge of the applicant’s second request for health records or the Commissioner’s Investigation of his complaint that these records had not been provided to him.

54. The failure of Arys Health Pty Ltd to respond to the applicant’s second request and to the Commissioner’s second complaint investigation may have arisen from acts and omissions of Dr Baig, or his current practice, in purporting to act in relation to the applicant’s request (but then failing to) including by failing to refer his, and later the Commissioner’s, correspondence to V Plus Corporation Pty Ltd for action. If that was the case, it is not a shortcoming for which Arys Health Pty Ltd can be held responsible.

55. In any event, there is no evidence before me that could satisfy me to the civil standard that Arys Health Pty Ltd via its representative V Plus Corporation Pty Ltd knew of, and failed to act in relation to, the applicant’s second request for his health records at a material time before the applicant’s institution of this proceeding.

56. The essential issue in this respect is that at no stage up to mid-way through this inquiry was the proper respondent to the applicant’s complaints identified by its legal name, Arys Health Pty Ltd. Prior to this the respondent was identified as “Arys Health” which is an informal trading name used by both Arys Health Pty Ltd and Baig in relation to the medical practice conducted by Dr Baig for Wellshare Pty Ltd. In this context, it is not sufficiently clear for the purposes of determining breach of ss 27 and 59 of the HRIP Act to whom the applicant’s and Commissioner’s communications were being directed.

57. It is a serious matter to find a contravention of ss 27 and 59 of the HRIP Act by a private sector person. As at the end of this inquiry I cannot be satisfied to the requisite standard that Arys Health Pty Ltd, through its medical records management agency, V Plus Corporation Pty Ltd, was on notice, practically as well as legally, as to the applicant’s second complaint and the Commissioner’s section 59 requirement. I remain of the view that it is inappropriate to make adverse findings against Arys Health Pty Ltd or order it to provide a remedy to the applicant in these circumstances.

Order

58. For the foregoing reasons, I will take no further action in the matter insofar as it concerns Baig Medical Services Pty Ltd.

**********

Endnote

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 20 September 2024