FZK v Northern Sydney Local Health District

[2024] NSWCATAD 289

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

FZK v Northern Sydney Local Health District [2024] NSWCATAD 289

Hearing dates:

8 July 2024

Date of orders:

1 October 2024

Decision date:

01 October 2024

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

A Christie, Senior Member

Decision:

(1)   The decision under review in respect of the health information redacted on the pages numbered 257‑258 of the 353 page bundle with the document name “[Applicant]_RNSVolume1” is affirmed.

(2) Pursuant to s 55(2)(c) of the Privacy and Personal Information Protection Act1998, within 14 days of the publication of these reasons for decision the Respondent must provide the Applicant with their health information previously redacted on pages 133‑134 and 229 of the 239 page bundle with the document name “[Applicant]_LowerNorthShoreVolume1_30April 2024” by giving the Applicant a copy of that health information.

Catchwords:

ADMINISTRATIVE LAW – administrative review – privacy – health information – access request under HPP 7 – establishing and application of public interest considerations under the Government Information (Public Access) Act 2009

Legislation Cited:

Administrative Decisions Review Act (1997)

Children and Young Persons (Care and Protection) Act 1998

Government Information (Public Access) Act 2009

Health Records and Information Privacy Act 2002

Mental Health Act 2007

Privacy and Personal Information Protection Act 1998

State Records Act 1988

Cases Cited:

Commissioner of Police (NSW) v Camilleri [2012] NSWADTAP 19

Flack v Commissioner of Police, New South Wales Police [2011] NSWADT 286

Leech v Sydney Water Corporation [2010] NSWADT 298

Neary v State Rail Authority

Searle Australia Pty Ltd v PIAC

Category:

Principal judgment

Parties:

FZK (Applicant)
Northern Sydney Local Health District (Respondent)

Representation:

Solicitors:
Applicant (Self‑Represented)
Crown Solicitor (Respondent)

File Number(s):

2024/00162913

Publication restriction:

The publication or broadcast of the name of the Applicant is prohibited pursuant to section 64(1)(a) of the Civil and Administrative Tribunal Act 2013.

REASONS FOR DECISION

Introduction

1. In these reasons for decision the name and gender of the Applicant have been anonymised so as to preserve their privacy. The Applicant is referred to as the “Applicant” or “FZK”. In addition, where any other individual is incidentally referred to in these reasons, other than as a witness or a named representative of the Respondent they are also anonymised in the same manner.

2. The Applicant seeks a review of the Respondent’s conduct which they alleged amounts to a breach of the Health Records and Information Privacy Act 2002 (“HRIP Act”). In particular, these proceedings concern an alleged breach of one of the Health Privacy Principles (“HPPs”) set out in Schedule 1 of the HRIP Act.

3. The Applicant’s complaint is that the Respondent, the Northern Sydney Local Health District, in breach of HPP 7 failed to provide to the Applicant with certain of the Applicant’s health information which the Applicant had requested pursuant to HPP 7.

4. The Respondent claims that it refused to disclose the health information in question to the Applicant on the basis of certain overriding public interest considerations against disclosure, based on the Respondent’s application of certain provisions of the Government Information (Public Access) Act 2009 (“GIPA Act”) to the HRIP Act and the Applicant’s access request under HPP 7.

The Complaint

5. The Applicant identified the conduct which is the subject of these proceedings related to their request for their health information in their medical records in the following terms:

“I requested access to my medical records, however, NSLHD [the Respondent] refused to provide full access, made some redactions on the files sent to me, but couldn’t provide any valid reasons to support the redactions.”

6. The Applicant alleges that the Respondent’s conduct (see paragraph 5 above) breaches HPP 7 (access to health information).

7. At the first case conference on 27 May 2024 the scope of the Applicant’s “Application for review” before this Tribunal was discussed and Order 2 of the Tribunal’s Orders and Directions of that date cast the Applicant’s complaint to be determined by the Tribunal in these proceedings as follows:

“The Applicant’s privacy complaint is limited to the Respondent’s refusal to provide [them] with three [sic] digital pages of health information (which has been redacted from the health information provided to [them]). The remedy sought by the Applicant is the provision of that redacted information to [them].”

The Internal Reviews

8. As a result of the Respondent’s first initial internal review decision, significantly more health information and medical records were provided to the Applicant by the Respondent. This first internal review decision recommended, in summary and most relevantly that:

1. an apology be issued to the Applicant;

2. the medical records in question be reassessed by the Respondent and access provided to the Applicant to the fullest extent allowable under the law;

3. clear explanation be provided to the Applicant of the lawful basis relied on by the Respondent where information is redacted in the Applicant’s health information/medical records; and

4. the Respondent implement business improvements to minimise the risk of the conduct occurring again, including conducting refresher training and education to staff to process requests for access to health information.

9. In correspondence dated 12 April 2024 the Respondent confirmed to the Applicant that all of these recommendations (noted in paragraph 8 above) were underway.

10. In correspondence to the Respondent after the first internal review conducted by the Respondent (as regards the original conduct of the Respondent in not releasing many of the medical records/Applicant’s health information), the Applicant requested that the Respondent:

“… provide full access, without redaction, to my medical records, or:

1. Provide detailed reasons why they rely on GIPA provisions, aka, why work contacts are personal information, and what risk and harm, to whom, and from whom

2.   A certificate from the Secretary showing such a report has been made for Care Act”

11. As a result of (and after) this first internal review decision the Respondent provided significant additional medical records and health information contained in them to the Applicant. However, parts of the Applicant’s health information over five (5) digital pages of the Applicant’s medical records were redacted and not provided to the Applicant (see paragraph 49 below for details of the “Redacted Information”).

12. After subsequent correspondence from the Applicant requesting the release of the Redacted Information or a detailed explanation of why such was redacted, the Respondent appears to have conducted a further, or second, internal review.

13. The second internal review of the Respondent (after most, but not all, of the Applicant’s health information was released to the Applicant) confirmed in the Respondent’s correspondence dated 30 April 2024 that the subsequent decision to withhold or redact certain health information (i.e. the “digital pages” referred to in Order 2 of the Tribunal’s Orders of 27 May 2024) from the otherwise substantial number of medical records provided to the Applicant was “sustained”:

“These redactions have been sustained because they relate to collateral personal third‑party information, posing a potential risk of harm and for which disclosure may damage personal, professional, or family relationships.”

14. The Respondent explained in further correspondence also dated 30 April 2024, relating to its second internal review decision and in a response to the Applicant’s email dated 29 April 2024, most relevantly as follows:

“I note the records have been provided to you with certain redactions because the Health Records and Information Privacy Act 2002 (HRIP Act), Health Privacy Principle 7(2)(b), permits an organisation to not provide an individual with access to health information if not providing that information is permitted under an Act or any other law. Therefore, we refer to the Government Information (Public Access) Act 2009 (GIPA Act) and public interest considerations against disclosure.

Where we have referred to certain clauses of the GIPA Act we have relied upon the advice of clinicians to support the reasoning for those redactions.”

15. The second internal review decision found that there was no breach of HPP 7 in respect of the Redacted Information.

16. Neither of the internal review decisions were provided to the Tribunal and my comments in respect of the internal review decisions are based on the submissions of the parties and the correspondence that was provided to the Tribunal which summarises the findings of those internal review decisions.

17. Given that only the Redacted Information is now in dispute and submissions have been made and evidence provided by both the Applicant and the Respondent as regards the reasons for these limited redactions, the Tribunal was not unduly inconvenienced by the failure to submit the internal review decisions in these proceedings.

Background

18. In October 2023 the Applicant made an application to the Respondent for access to their health information contained in their medical records held by the Respondent.

19. In January 2024 the Respondent provided the Applicant with a copy of certain of the Applicant’s health information/medical records but with numerous redactions and omissions of health information throughout the copies of the medical records provided by the Respondent to the Applicant.

20. At the end of January 2024, after correspondence between the Applicant and the Respondent, the Applicant filed an application with the Respondent for the first internal review of the Respondent’s decision to redact (or not provide) a significant amount of the Applicant’s health information contained in their medical records. In the Respondent’s first internal review decision in April 2024, the Respondent found that it had not provided access to the Applicant to all health information/medical records that should have been made available to the Applicant in response to the Applicant’s request under HPP 7 and, therefore, the Respondent had breached HPP 7.

21. The first internal review decision also found that “there were instances where information was justifiably redacted in accordance with clause 3(a) and (f) of the Table to s14 of the GIPA Act”.

22. Consistent with the recommendations of the first internal review decision the Respondent reassessed the Applicant’s health information and medical records and provided them with significantly more health information and medical records in late April 2024. The Respondent submits that the Applicant was, by the end of April 2024, provided with some 732 pages of their medical records in which there were only a few instances where the Applicant’s health information had been redacted (i.e. the Redacted Information).

23. After further correspondence between the Applicant and the Respondent, on 2 May 2024 the Applicant filed an application for administrative review by this Tribunal of the Respondent’s conduct. As noted in paragraph 7 above, after the first case conference in this matter, the Tribunal issued Orders on 27 May 2024 which limited the Applicant’s privacy complaint and thus the scope of these proceedings.

Applicable legislation

24. Section 11(1) HRIP Act provides that every “organisation” that is a health service provider or that collects, holds or uses health information is subject to the HRIP Act. “Organisation” is defined in s 4(1) HRIP Act to include a public sector agency providing health services. Organisations to which the HRIP Act applies are, pursuant to s 11(2) HRIP Act, required to comply with the HPPs.

25. There is no dispute that the Respondent is subject to the HRIP Act and is required to comply with the HPPs. Section 11(3) HRIP Act provides that an organisation (i.e. the Respondent in this case) must not do anything or engage in any practice that contravenes an HPP.

26. Section 21(1) HRIP Act provides for complaints to be made against a public sector agency (in this case the Respondent) in relation to conduct of that agency which is alleged to be a contravention of an HPP (HPP 7 in this case). These complaints are to be made pursuant to Part 5 of the Privacy and Personal Information Protection Act 1998 (“PPIP Act”). For that purpose, pursuant to s 21(2) HRIP Act, a reference in Part 5 PPIP Act to “personal information” is taken to include (and is to be read as) “health information” as defined in the HRIP Act.

27. Section 3 HRIP Act sets out the purpose and objects of the HRIP Act and, most relevantly, s 3(2) HRIP Act sets out the objects of the HRIP Act as:

“(2)   The objects of this Act are:

(a)   to balance the public interest in protecting the privacy of health information and the public interest in the legitimate use of that information, and

(b)   to enhance the ability of individuals to be informed about their health care, and

(c)   to promote the provision of quality health services.”

28. Section 5 HRIP Act defines “personal information” in the same terms as the PPIP Act:

“(1)   … information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. …”

29. “Health information” is defined in s 6 HRIP Act, in summary and most relevantly, as:

“…

(a)    personal information that is information or an opinion about -

(i)   the physical or mental health or a disability (of any kind of an individual), or

…

(iii)   a health service provided, or to be provided, to an individual, or

(b)   other personal information collected to provide, or in providing, a health service …”

30. As noted in paragraph 26 above, Part 5 PPIP Act makes provisions for the review of conduct of a public sector agency (i.e. the Respondent in this case) that is alleged to have contravened one or more HPPs. Section 52 PPIP Act defines “conduct” to include the contravention of an information protection principle that applies to a Government agency. In relation to health information under the HRIP Act s52 PPIP Act this is to be read as a contravention of an HPP that applies to that agency.

31. Section 53 PPIP Act gives a person aggrieved by the conduct of the public sector agency the right to seek an internal review of that conduct by that agency. Where a person (i.e. the Applicant in this case) is dissatisfied with the findings of an agency or the actions taken by an agency flowing from that internal review, s 55 PPIP Act (read as relevant to the HRIP Act and health information) provides that the person can then seek external review by the Tribunal of the conduct complained of.

32. In such a review, in addition to the powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act (1997) (“ADR Act”), the Tribunal’s powers to take action are specified in s 55(2) PPIP Act are, in summary and most relevantly, as follows:

“…

(2)   on reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make one or more of the following Orders:

…

(b)   an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection [or health privacy] principle …,

(c)   an order requiring the performance of an information protection [or health privacy] principle …,

(e)   an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, …

(g)   such ancillary Orders as the Tribunal thinks appropriate.”

33. Section 22 HRIP Act relevantly provides:

“(1)   Nothing in this Act affects the operation of the Government Information (Public Access) Act 2009 …

(3)   Without limiting the generality of sub‑section (1), the provisions of the Government Information (Public Access) Act 2009 and Privacy and Personal Information Protection Act 1998 that imposed conditions or limitations (however expressed with respect to any matter referred to in …, HPP 7 (access to health information) … are not affected by this Act, and those provisions continue to apply in relation to any such matter as if those provisions were part of this Act.”

34. Clause 7 of Schedule 1 Health Privacy Principles to the HRIP Act (i.e. HPP 7) provides, most relevantly:

“(1)   An organisation that holds health information must, at the request of the individual to whom that information relates and without excessive delay or expense, provide the individual with access to the information …

(2)   An organisation is not required to comply with the provision of this clause if:

(a)   the organisation is lawfully authorised or required not to comply with the provisions concerned, or

(b)   non‑compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1988).”

35. Section 9 GIPA Act provides, most relevantly:

“(1)   A person who makes an access application for Government information has a legally enforceable right to be provided with access to the information … unless there is an overriding public interest against disclosure of the information. …”

36. Section 10 GIPA Act states that the GIPA Act is not intended to prevent or discourage the publication or giving of access to Government information as permitted or required by or under any other Act or law and s 13 GIPA Act provides:

“There is an overriding public interest against disclosure of Government information for the purposes of this Act if (and only if) there are public considerations against disclosure and, on balance, those considerations outweigh the public interest considerations in favour of disclosure.”

37. Section 14 GIPA Act addresses the “public interest” considerations against disclosure and notes, most relevantly:

“(1)   It is to be conclusively presumed that there is an overriding public interest against disclosure of any Government information described in Schedule 1.

(2)   The public interest considerations listed in the Table to this section are the only other considerations that may be taken into account under this Act as public interest considerations against disclosure for the purpose of determining whether there is an overriding public interest against disclosure of the Government information. …”

38. The relevant public interest considerations from the Table in s 14 GIPA Act submitted by the Respondent as being against disclosure of part of the Redacted Information in these proceedings are:

“3   Individual rights, judicial processes and natural justice

There is a public interest consideration against disclosure of information if disclosure of the information could reasonably be expected to have one or more of the following effects:

(a)   reveal an individual’s personal information, …

(f)   expose a person to a risk of harm or of serious harassment or serious intimidation, …”

39. The Respondent also submits that part of the Redacted Information is also subject to a conclusively presumed overriding public interest against disclosure under Schedule 1 Clause 10 (“care and protection of children”) of the GIPA Act, as follows:

“It is to be conclusively presumed there is an overriding public interest against disclosure of information contained in a report to which s 29 of the Children and Young Persons (Care and Protection) Act 1998 [(“CYPCP Act”)] applies.”

40. Section 105 GIPA Act imposes the onus on the agency (i.e. the Respondent in this case) to justify its decisions:

“(1)   In any review under this Division concerning a decision made under this Act by an agency, the burden of establishing that the decision is justified lies on the agency, …”

41. Section 29 of the CYPCP Act provides, most relevantly:

“(1)   If, in relation to a child or young person or a class of children or young persons, a person makes a report in good faith to the Secretary or to a person who has the powers or responsibility to protect the child or young person or the class of children or young persons –

…

(e)   a person cannot be compelled in any proceedings to produce the report or a copy of or extract from it or to disclose or give evidence of any of its contents, and

(f)   the identity of the person who made the report, or information from which the identity of that person could be deduced, must not be disclosed by any person or body, except with –

(i)   the consent of the person who made the report, or

(ii)   the leave of a Court or other body before which proceedings relating to the report are conducted,

…

(1A)   A certificate purporting to be signed by the Secretary that a document relating to a child or a young person or a class of children or young persons is a report to which this section applies is admissible in any proceedings and, in the absence of evidence to the contrary, is proof that the document is such a report.

…

(3A)   The protections given by this section to a person who makes a report apply to –

(a)   any person who provided information on the basis of which the report was made, in good faith, to the person, and

(b)   any person who otherwise was in good faith concerned in making such a report or causing such a report to be made,

in the same way as they apply in respect of the person who actually made the report.

…

(6)   In this section –

…

report includes a report under subsections 24, 25, 27, 120, 121 and 122.

…”

42. As the Respondent has made submissions only in respect of “mandatory reporting” under s 29 CYPCP Act, I note below the relevant provisions of s 27 CYPCP Act entitled “Mandatory reporting”:

“(1)   This section applies to –

(a)   a person who, in the course of his or her professional work or other paid employment delivers health care, welfare, education, children’s services, residential services, or law enforcement, wholly or partly, to children, and

(b)   a person who holds a management position in an organisation the duties of which include direct responsibility for, or direct supervision of, the provision of health care, welfare, education, children’s services, residential services, or law enforcement, wholly or partly, to children, and

…

(d)   a registered psychologist providing a professional service as a psychologist.

(2)   If –

(a)   a person to whom this section applies has reasonable grounds to suspect that a child is at risk of significant harm, and

(b)   those grounds arise during the course of or from the person’s work or role specified in subsection (1),

it is the duty of the person to report, as soon as practicable, to the Secretary the name, or description, of the child and the grounds for suspecting that the child is at risk of significant harm.

…”

43. While not legislation, as per Ms Frost’s Statement at [5], the New South Wales Health Privacy Manual for Health Information (as at March 2015) (“Manual”) “provides operational guidance regarding the legislative obligations imposed by the [HRIP Act]”. In summary and most relevantly, I therefore note the key provisions of the Manual for these proceedings (including those of s 12 which was attached to Ms Frost’s Statement):

“3.1   Who is bound by the Manual?

The Manual applies to all people who work within the NSW public health system. These include, but are not limited to, staff members, contractors and other health care providers who, in the course of their work, have access to personal health information. …

The Manual applies to NSW Health, which covers:

● Local Health Districts (LHDs) …

12.3.1   Reasons for refusing access

The HRIP Act access provisions focus on individual’s accessing their own medical and health information. As such, it will be rare to refuse access …

12.3.1.1   The disclosure of information could reasonably be expected to reveal another individual’s personal information

…

In some circumstances, it will be reasonable to provide access to third party information, such as:

● where this information is already known to the patient,

● where the third party has provided their consent,

● where there is no reason for the health service to believe that disclosure of the third party information would unreasonably reveal another individual’s personal information. …

12.3.1.2   The disclosure of information could reasonably be expected to expose a person to a risk of harm

…

In rare circumstances where the treating health practitioner considers access could be prejudicial to the physical or mental health of the patient or to another person, the health record may be referred to a third party such as an independent health practitioner for assessment. If this occurs, the health record plus the assessment should then be referred to the Department Head or Director of Medical Services for review and a decision made as to whether the applicant should be granted access to all or part of the health records. …”

The Respondent’s case

44. The Respondent relies, in large part, on the evidence of Ms Jenna Frost. Ms Frost is an Occupational Therapist with a Bachelor of Applied Science (Occupational Therapy) who has worked with the North Shore Ryde Mental Health Service since 2010 in various roles, including Team Leader of the Ryde Assertive Outreach Team and, at the relevant time, was acting Manager of Acute Community Services within the North Shore Ryde Mental Health Service. Ms Frost’s evidence was provided by way of a statement filed with the Tribunal on 18 June 2024 (“Statement”). Ms Frost also attended the hearing on 8 July 2024 (“Hearing”) and was cross‑examined by the Applicant.

45. The Respondent’s solicitor, the Crown Solicitor represented by Ms Mattes, also provided both written submissions (filed with the Tribunal on 18 June 2024) and oral submissions made during the Hearing on behalf of the Respondent (“Submissions”).

The Statement of Ms Frost

46. Ms Frost’s evidence is that she never met the Applicant nor had any direct involvement in the provision of services or care to them but was asked by the Health Information Services (a unit of the Respondent) (“HIS”) to review the Applicant’s medical records to determine if they should be provided to the Applicant.

47. Ms Frost states that this review request was made by HIS in accordance with usual practice where any of the requested records (i.e. the Applicant’s health information) “might include sensitive information”. In such cases, Ms Frost noted that it is usual practice that a manager review the records to identify any sensitive information that should not be released.

48. Ms Frost states that:

“The NSW Health Privacy Manual for Health Information provides operational guidance regarding the legislative obligations imposed by the Health Records and Information Privacy Act 2002. Section 12 of the Manual outlines procedures to support compliance with the Act with respect to patient access to health information.” [A copy of Section 12 of the Manual is annexed to Ms Frost’s Statement].

49. On 18 December 2023 Ms Frost undertook a review of the Applicant’s medical records at the request of the HIS and states that she has knowledge of the information that was redacted from the Applicant’s records before being provided to the Applicant being, as per Ms Frost’s evidence, certain redactions on (collectively the “Redacted Information”):

“a.   Pages 133‑134 and 229 of the 239 page bundle with the document name “[Applicant]_LowerNorthShoreVolume1_30April 2024”
[(“A Redacted Information”)]; and

b.   Pages 257-258 of the 353 page bundle with the document name “[Applicant]_RNSVolume1” [(“B Redacted Information”)]”.

50. Ms Frost’s evidence is that the medical records from which the health information has been redacted (as noted above in paragraph 49) are “progress notes that form part of the applicant’s electronic medical record, maintained in the program “Powerchart””. Ms Frost explains that these progress notes record interactions that the health service provider has with the “consumer” (i.e. the Applicant in this case) and about the consumer. These typically includes notes of interactions with the consumer, the consumer’s family members, support services, other health service providers such as GPs, as well as information about legal matters such as proceedings and orders under the Mental Health Act 2007.

51. In summary and most relevantly, in relation to each of the Redacted Information, Ms Frost’s evidence is that:

1. The redacted portions of pages 133-134 and 229 (i.e. the A Redacted Information) reveal the personal information of a number of individuals who are not the Applicant. Ms Frost states that:

“the evidence I give … is based on my general experience in the provision of mental health care and services, and the concerns that I have about the release of the information of this nature”.

2. Ms Frost does not have direct knowledge of the Applicant or any of the individuals noted in the A Redacted Information.

3. Where there is engagement with individuals (such as those in the redacted portions of these pages) there is a general expectation that the information they provide will be dealt with confidentially, as far as it is possible to do so because the individuals will often have concerns about maintaining their relationship with the consumer (i.e. the Applicant in this case) as well as concerns about ensuring their own privacy is respected.

4. Ms Frost also expressed concern that the release of this A Redacted Information (i.e. provided by third parties) to a consumer might damage relationships that the consumer has with those individuals which may, in turn, trigger a change or have a detrimental impact on the consumer’s mental health.

5. Ms Frost also expressed her concern that the release of this A Redacted Information (as provided by third parties) has the potential to put these third parties at risk “particularly if the consumer disagrees with the information or opinion that has been provided, or feels some sense of betrayal or grievance about the communication”.

6. As regards the redactions on pages 257-258 (i.e. the B Redacted Information), Ms Frost’s evidence is that this is information relates to a risk of harm report under the CYPCP Act. Ms Frost further notes that where such mandatory reporting obligations arise under the CYPCP Act, the usual process is to complete the mandatory reporting form online and details of and from this report should be included in the progress notes, including a record of the specific concerns raised in the report and the “pathway” by which the report has been progressed.

7. Any information in the progress notes that relates to the mandatory reports under the CYPCP Act should be clearly identified as such within those notes. It is Ms Frost’s experience that the Respondent’s staff are very familiar with the regime for making mandatory reports and, in particular, the protections afforded to mandatory reports and strict confidentiality conditions that apply under the CYPCP Act.

52. In the Statement Ms Frost does not directly address or relate either (a) her general concerns and experience summarised above to the Redacted Information or (b) her reasoning for determining that, in accordance with those comments, the Redacted Information should not be provided to the Applicant.

53. Ms Frost’s evidence in the Statement as to general practices and her general experience does not clearly apply such general concerns or practices to the specific Redacted Information in question in this case or fully explain why and how her general concerns and experience apply to the Applicant and thus why, in this specific case, there is an overriding public interest against its disclosure.

54. Under cross‑examination Ms Frost confirmed that she was not the Applicant’s treating clinician/health care professional and, in fact, had not met and had no knowledge of the Applicant’s specific circumstances, diagnosis, medical history or care, other than what was in the file provided to Ms Frost for her review by HIS.

55. Ms Frost also confirmed under cross‑examination that (a) she was not a trained or qualified psychiatrist or psychologist and (b) the usual practice to determine whether or not to provide access to health information was to follow the procedures and processes set out in the Manual (i.e. in determining whether or not to release relevant health information to the individual who had requested it).

56. Under cross‑examination Ms Frost confirmed that a certificate of the Secretary pursuant to s 29 CYPCP Act had not been obtained as regards the B Redacted Information.

The Submissions

57. The Respondent submits that the right to access health information under HPP 7 is not absolute. The Respondent notes that HPP 7(2) confirms that an organisation (i.e. the Respondent) is not required to comply with HPP 7(1) if that organisation is lawfully authorised or required not to comply with it or non‑compliance is otherwise permitted (or necessarily implied) or reasonably contemplated under any Act or any law.

58. The Respondent further submits that it was “required” to refuse access to the Redacted Information as there is an overriding public interest against disclosure of that information and the provisions of the GIPA Act impose conditions or limitations with respect to accessing Government information by operation of s 22 HRIP Act which applies with respect to the Redacted Information as if they were part of the HRIP Act. That is, the GIPA Act does not permit the disclosure of information that is subject to an overriding public interest against disclosure and such applies to HPP 7 requests too.

59. The Respondent submits that there is an overriding public interest against disclosure of the Redacted Information (i.e. the redacted health information) under the GIPA Act on the following grounds:

“a. with respect to pages 133-134 and 229 [the A Redacted Information] – because there is an overriding public interest against disclosure applying the public interest test, in particular, due to the application of cll.3(a) and (f) of the Table 2 s 14 as public interest considerations against disclosure; and

b. with respect to pages 257-258 [the B Redacted Information] – as there is conclusively presumed to be an overriding public interest against disclosure by application of s 14 Sch 1 cl 10 of the GIPA Act.”

60. Referring to Ms Frost’s evidence, in particular at [10] of the Statement, the Respondent submits that it should be apparent to the Tribunal on reviewing the A Redacted Information (pages 133‑134 and 229) that they record communications between Lower North Shore Community Health of the Respondent and third parties and that, therefore, there is an overriding public interest against disclosure of the A Redacted Information when applying the public interest test under s 13 GIPA Act.

61. The Respondent also submits, most relevantly and in summary, that:

1. After briefly noting the mechanics of applying the “public interest test” under s 13 GIPA Act and the limitation on public interest considerations against disclosure that can be considered when applying the s 13 GIPA Act public interest test, the Respondent notes the approach to be adopted to s 14 GIPA Act is as detailed in the Appeal Panel decision in Commissioner of Police (NSW) v Camilleri [2012] NSWADTAP 19 (a GIPA Act case).

2. After considering the public interest considerations in favour of disclosure, the public interest considerations against disclosure of the A Redacted Information (in this case) are because it could reasonably be expected to:

“a.   reveal an individual’s personal information – cl 3(a); and

b.   expose a person to a risk of harm, or serious intimidation – cl 3(f).”

3. After referring to Ms Frost’s evidence (paragraph [9] of the Statement) and noting that it should be apparent to the Tribunal on review of the relevant pages in the Confidential Bundle, that the personal information of individuals other than the Applicant is included in the A Redacted Information.

4. Citing Ms Frost’s evidence of the importance of maintaining confidentiality, the Respondent submits this as a basis to support redaction of the information under cl 3(a) of the Table in s 14 of the GIPA Act.

5. As regards cl 3(f) of the Table in s 14 GIPA Act, exposing a person to risk of harm or serious harassment or serious intimidation, this applies as a public interest consideration against disclosure of the A Redacted Information (pages 133-134 and 229). After referring to Ms Frost’s evidence of her general experiences in paragraphs [12] and [13] of the Statement, the Respondent submits that:

“… it is also open to the Tribunal to draw an inference, from the review of the information, that disclosure of the information could reasonably be expected to give rise to relevant risks to individuals, including the applicant. In the respondent’s submission, this is a further weighty consideration against disclosure.”

6. As regards the B Redacted Information (pages 257‑258), there is a conclusive presumption of an overriding public interest against disclosure as per s 14(1) and Schedule 1 cl 10 GIPA Act as the information is relating to or taken from a mandatory report subject to s 29 of the CYPCP Act.

7. After noting the specific statutory provision of s 29 CYPCP Act and referring to Ms Frost’s evidence at paragraphs [15]‑[18] of the Statement the Respondent asks the Tribunal to review the relevant pages and the B Redacted Information in the Confidential Bundle and states that “it will be apparent to the Tribunal from the face of the record, that it is information to which s 29 of the CYPCP Act applies”. Based on this the Respondent concludes that there is a conclusive presumption of an overriding public interest against disclosure and no further consideration need be made (i.e. there is no need to consider the public interest considerations in favour of or weigh them up against those against disclosure) and therefore the Respondent was “required” to refuse the Applicant’s request to access to this information.

The Applicant’s case

62. After some discussion of an “Interlocutory Application”, which pursuant to Order 2 of the Tribunal on 27 May 2024 is not the subject of the Tribunal’s enquiry for these reasons for decision, the Applicant replies to the Respondent’s submissions and evidence in their written submissions filed with the Tribunal on 4 July 2024 and oral submissions made during the Hearing and submits, most relevantly and in summary, that:

1. The Respondent’s submissions rely on the Statement of Ms Frost to support its claim that the disclosure of the A Redacted Information could reasonably be expected to expose the Applicant and third parties to risk and harm and damage to relationships. However, Ms Frost acknowledges at [4] of the Statement that she has no direct involvement in the provision of services to the Applicant and she therefore “does not have relevant knowledge that is required to assess what information could reasonably be expected to cause harm to the Applicant or third parties”.

2. Given (1) above and that Ms Frost has never met the Applicant, Ms Frost also does not have the factual knowledge in the case of the Applicant to determine whether any relationship, on a personal or professional basis, existed between the third party and the Applicant in the first place that could be at risk if the A Redacted Information was released to the Applicant.

3. The Respondent also relies on the Statement of Ms Frost to support the claim that a mandatory report was made under s 29 CYPCP Act but, in fact, in order to claim this the Respondent should have obtained a certificate evidencing such signed by the Secretary as per s 29(1A) CYPCP Act. Despite the Applicant requesting the Respondent to provide such a certificate the Respondent did not provide such certificate and relies simply on the evidence of Ms Frost as to this matter, which evidence does not establish this.

1. Without a certificate signed by the Secretary under s 29(1A) CYCP Act Ms Frost’s evidence as to this issue is merely her opinion without factual basis or the relevant knowledge. The certificate of the Secretary should have been submitted in order to evidence this.

2. In considering whether there is a public interest consideration against disclosure, the Respondent has failed to note that the individuals whose personal information is said to be disclosed in the A Redacted Information are known to the Applicant.

3. Also, the assessment of the confidentiality issues referred to by Ms Frost in her Statement is not relevant to the Table 14 of s 14 GIPA Act clauses 3(a) and (f) which the Respondent submits lead to an overarching public interest consideration against disclosure. That is, Ms Frost’s confidentiality evidence is not relevant to whether the A Redacted Information is the personal information of a third party or whether its release will cause harm or serious risk to the Applicant or another individual.

4. The Statement of Ms Frost relates to her general views, opinions and general experiences but does not specifically relate to the Applicant or the Applicant’s specific circumstances as noted above. Ms Frost does not know, has not met and was never involved in the medical care of the Applicant.

5. In the absence of a certificate from the Secretary under s 29(1A) CYPCP Act, the Respondent relies on the opinion and view of Ms Frost rather than establishing by objective evidence the conclusive presumption of an overriding public interest against disclosure is enlivened because the B Redacted Information is, in fact, information from a “mandatory report” under the CYPCP Act.

6. Without the Respondent having established any of the public interest considerations against disclosure, let alone that they are, on balance, overriding public interest considerations against disclosure, the Redacted Information withheld from the Applicant is a breach of HPP 7 and the Applicant requests the immediate access to/disclosure of the Redacted Information to them.

Considerations

63. When seeking to rely on the GIPA Act public interest considerations against disclosure under the s 14 GIPA Act Table to refuse access under an HPP 7 access request, the Respondent must first establish that the disclosure in question “could reasonably be expected to” have the nominated effect. That is, the effect specified for the relevant Table clauses relied on by the Respondent (in this case, s 14 Table cls 3(a) and (f)).

64. After considering a number of cases which had considered the phrase “could reasonably be expected to” in the context of the public interest considerations against disclosure in the s 14 GIPA Act Table, the Tribunal in Leech v Sydney Water Corporation [2010] NSWADT 298 concluded at [25]:

“[25]   … the test to be applied is an objective one, approached from the viewpoint of the reasonable decision‑maker:  Neary v State Rail Authority. Something which could reasonably be expected is something which is more than a mere possibility, risk or a chance. It must be based on real and substantial grounds and it must not be purely speculative, fanciable, imaginary or contrived: Searle Australia Pty Ltd v PIAC.”

65. That is, as held in Flack v Commissioner of Police, New South Wales Police [2011] NSWADT 286 at [42], the public interest considerations against disclosure in the Table in s 14 GIPA Act require an objective assessment as to whether the claimed effects could be expected to arise. This is ultimately a question of fact to be established to the relevant standard of proof, on the balance of probabilities. This is supported by s 105 GIPA Act where the burden of establishing that the agency’s decision is justified lies on the agency.

66. Ms Frost’s evidence with respect to the confidentiality of the A Redacted Information and the impact that releasing such confidential information may have on people providing information to the Respondent does not specifically address the public interest consideration against disclosure claimed by the Respondent when applying in cl 3(a) of the Table in s 14 GIPA Act. That is, it does not fully address if (and why) the A Redacted Information is the personal information of others.

67. As a result, the submissions of the Respondent and Ms Frost’s evidence have not established, on the balance of probabilities, that the A Redacted Information is the personal information of others (i.e. other than the Applicant) and thus that the release of the A Redacted Information to the Applicant could reasonably be expected to reveal an individual’s (other than the Applicant’s) personal information. This public interest consideration against disclosure is not made out and therefore does not come into the balancing against public interest considerations in favour of disclosure of the A Redacted Information as regards providing access to it under HPP 7.

68. As regards the claimed public interest consideration against disclosure under cls 3(f) of the Table in s 14 GIPA Act, Ms Frost’s evidence and the Respondent’s submissions do not establish, on the balance of probabilities, that the release of the A Redacted Information could reasonably be expected to expose a person (the Applicant or another) to a risk of harm or serious harassment or serious intimidation.

69. As noted in section 3 of the Manual, the Respondent is to apply the guidance in the Manual. Specifically in this case, section 12.3 (which was attached to Ms Frost’s Statement) provides clear guidance (see section 12.3.1.2) as to how this potential public interest consideration against disclosure is to be assessed and determined by the Respondent. Failure to follow the prescribed procedures in the Manual and to provide the evidence of such leads, in the absence of any other compelling evidence to the contrary, to the Respondent in this case being unable to establish to the relevant standard of proof that the release of the A Redacted Information could reasonably be expected to have the claimed effect. That is, there was no evidence or submissions that the “treating health practitioner consider[ed that] access could be prejudicial to the physical or mental health of the patient or to another person” or that the “Department Head or Director of Medical Services” had this consideration referred to them for review and their decision and reasons as to whether the Applicant should be granted access to their health information in this case.

70. In the absence of the clear procedures set out in the Manual being followed (and evidence being submitted as to the outcome of such considerations), significant and substantial alternative evidence (which was not provided in this case ) that the claimed effect could reasonably be expected from the release of the A Redacted Information would be needed to establish that this result could reasonably be expected and, even then, there may still be a concern as to why the clear guidance as to procedure set out in the Manual on this specific area was not followed.

71. Ms Frost’s evidence and the Respondent’s submissions were not sufficient or specific enough to establish that the relevant effects could reasonably be expected from the release of the A Redacted Information. Ms Frost’s evidence is that she was not the treating health practitioner of the Applicant, had no role in diagnosing or treating the Applicant and, in fact, had never met the Applicant.

72. The consideration of the public interest consideration against disclosure for the B Redacted Information is, however, different from the above considerations. In respect of the B Redacted Information the Respondent has claimed that such is subject to a conclusively presumed overriding public interest against disclosure under Schedule 1 Cls 10 (Care and Protection of Children) GIPA Act. Therefore, if it is established that the information in B Redacted Information is information related to or from a report to which s 29 CYPCP Act applies then no further investigation need be made and, on that basis, the Respondent is entitled to withhold access to the B Redacted Information from the Applicant. However, in this case the Respondent bears the burden of establishing that the information contained in the B Redacted Information is, in fact, information related to or from a report to which s 29 CYPCP Act applies.

73. The submissions of the Respondent and evidence of Ms Frost are limited as to this, perhaps due to the public nature of such and their desire not to disclose the relevant information inadvertently through open submissions or evidence.

74. Based on the Respondent’s submissions and Ms Frost’s evidence on this alone I may have determined that the Respondent had not established that the B Redacted Information was in fact information related to, about, extracted or summarised from a report to which s 29 CYPCP Act applies. However, after reviewing the B Redacted Information in the Consolidated Bundle, as the Respondent requested that the Tribunal should do, it is evident on its face that the B Redacted Information is information to which s 29 CYPCP Act applies.

75. In summary, on the basis of materials and evidence before me, I am satisfied that: (1) the public interest considerations against disclosing the A Redacted Information have not been established (that is, that the claimed effects could be reasonably expected to arise); and (2) the conclusive presumption against disclosure of the B Redacted Information is established (primarily on the face of the information included in the Confidential Bundle) and therefore the Respondent is entitled to refuse access under HPP 7 to this information to the Applicant.

Orders

1. The decision under review in respect of the health information redacted on the pages numbered 257‑258 of the 353 page bundle with the document name “[Applicant]_RNSVolume1” is affirmed.

2. Pursuant to s 55(2)(c) of the Privacy and Personal Information Protection Act1998, within 14 days of the publication of these reasons for decision the Respondent must provide the Applicant with their health information previously redacted on pages 133‑134 and 229 of the 239 page bundle with the document name

“[Applicant]_LowerNorthShoreVolume1_30April 2024” by giving the Applicant a copy of that health information.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 01 October 2024