GKK v The Sydney Children's Hospitals Network

[2024] NSWCATAD 367

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

GKK v The Sydney Children’s Hospitals Network [2024] NSWCATAD 367

Hearing dates:

4 October 2024

Date of orders:

11 December 2024

Decision date:

11 December 2024

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

J Sullivan, Senior Member

Decision:

Pursuant to s 55(2) of the Privacy and Personal Information Protection Act 1998 (NSW), the Tribunal decides not to take any action on the matter.

Catchwords:

ADMINISTRATIVE REVIEW – Health Records and Information Privacy Act 2002 (NSW) – request for access (HPP 7) and amendment (HPP 9) - “authorised representative” in respect of child’s health information – effect of Family Court orders - capacity of child – applicable exclusions under the Government Information (Public Access) Act 2009

Legislation Cited:

Administrative Decisions Review Act 1997 (NSW)

Children and Young Persons (Care and Protection) Act 1998 (NSW)

Civil and Administrative Tribunal Act 2013 (NSW)

Family Law Act 1975 (Cth)

Government Information (Public Access) Act 2009 (NSW)

Health Records and Information Privacy Act 2002 (NSW)

Privacy and Personal Information Protection Act 1998 (NSW)

State Records Act 1998 (NSW)

Cases Cited:

Bailey v Commissioner of Police [2023] NSWCATAP 103

Choi v Commissioner of Police, NSW Police Force [2020] NSWCATAD 95

Crewdson v Central Sydney AHS [2002] NSWCA 345

Davison v NSW Department of Education and Training [2013] NSWADT 25

EHW v Secretary, Department of Education [2022] NSWCATAD 140

FCZ v Illawarra Shoalhaven Local Health District [2023] NSWCATAP 71

FNJ v Commissioner of Police, NSW Police Force [2022] NSWCATAD 130

Re Woolley; Ex parte Applicants M276/2003 by their next friend GS (2004) 225 CLR 1

Shi v Migration Agents Registration Authority (2008) 235 CLR 286

Snape v Commissioner of Police (No 2) [2022] NSWCATAP 244

YY & GG v Minister for Community Services [2002] NSWCA 247

Texts Cited:

None Cited

Category:

Principal judgment

Parties:

GKK (Applicant)
The Sydney Children’s Hospital Network (Respondent)

Representation:

Solicitors:

Applicant (Self represented)
Crown Solicitor (Respondent)
B Viset (Privacy Commissioner) (Intervenor)

File Number(s):

2024/00231637

Publication restriction:

Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW), publication or broadcast of the name of the Applicant or of her child is prohibited.

Pursuant to s 64(1)(b), 64(1)(c) and 64(1)(d) of the Civil and Administrative Tribunal Act 2013 (NSW), the confidential materials, the transcript and recording of the confidential hearing in the proceeding on 4 October 2024 and the contents of paragraphs in these Reasons marked ‘[Not for Publication]’ are not to be published or released to the Applicant or the public.

REASONS FOR DECISION

Background

1. GKK seeks administrative review of conduct of The Sydney Children’s Hospital Network (SCHN). The issues before me are whether SCHN breached Health Privacy Principles 7 and 9 (HPP 7 and HPP 9) in the Health Records and Information Privacy Act 2002 (HRIP Act).

Confidentiality orders made by the Tribunal

2. Confidentiality and non-disclosure orders were previously made by the Tribunal:

1. on 15 July 2024, under s 64(1) of the Civil and Administrative Tribunal Act 2013 (CAT Act), prohibiting disclosure of the applicant’s name, or of her child, and assigning the pseudonym ‘GKK’; and

2. on 14 August 2024:

1. under s 59 of the Administrative Decisions Review Act 1997 (NSW) (ADR Act), to exclude confidential materials from the material filed by SCHN under s 58 of that Act; and

2. under s 64(1)(c) and (d) of the CAT Act, prohibiting publication or disclosure of that confidential material.

Opening remarks

3. GKK was self-represented at this hearing. These proceedings arise from a presentation to the Emergency Department at the Randwick Children’s Hospital (the Hospital) by her child in March 2021, who was aged 10 at the time. The Hospital is part of SCHN.

4. I am required to consider the conduct of SCHN in dealing with GKK’s application to obtain and amend their records relating to that presentation, including entries made in relation to GKK.

5. That there have been ongoing court proceedings in the Family Court and orders made by that Court, to which I must refer. GKK has also presented evidence relating to a victims compensation order made in her favour in 2022. However, this Tribunal has no jurisdiction to either revisit or question the Family Court orders made, even though GKK believes them to be wrong. Nor am I required to adjudicate on domestic matters between GKK and her former partner, or regarding other family incidents alleged or actual. To the extent that facts are relevant to the matters requiring my determination, they are set out below.

Submissions and Hearing

6. GKK filed the application to the Tribunal (A1), together with submissions and accompanying attachments (A2).

7. SCHN filed s 58 documents (R1), an Affidavit of Nadine Ghassibe sworn 29 July 2024 (R2) and written submissions (R3). Ms Ghassibe is the Health Information Manager and also the Privacy Contact Officer for SCHN.

8. The Privacy Commissioner was an intervenor, provided written submissions in respect of HPP 7 (PC1), and appeared at the hearing via its solicitor. The Privacy Commissioner has a right to appear and be heard in proceedings before the Tribunal under s 55(6) of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act).

Facts

9. GKK is separated from her husband, and the mother of two children.

10. On 24 March 2021, one of her children was taken by his father to the Emergency Department of the Hospital. At the time, GKK was living at the family home, and the children were living elsewhere with their father. The father had been contacted by the child’s school who raised concerns about him after speaking at him at school that day. GKK said the father telephoned her to say he was taking the child to hospital, but he did not tell her which hospital that was. Nor did he pick her up on the way to the hospital as (she said) he told her he would.

11. The child presented to the Hospital accompanied by his father, and he was there assessed by health professionals. GKK was not contacted by the Hospital despite being recorded on the Hospital’s records – at that time – as the relevant contact person (and “Next of Kin”) for the child.

The Family Court Orders

12. At some earlier time, an Apprehended Violence Order (AVO) was taken out against GKK by the father. GKK said she accepted that AVO because she did not have legal representation, it contained the “minimum” restrictions for an AVO, and she thought it would appease or “calm down” the father and reduce the risk of further domestic violence against her, or against her children who were with him at that time. She said the AVO expired in 2020, but it was not in evidence.

13. GKK states that the Hospital’s records of her child’s presentation, together with that AVO, formed the basis for interim orders made by the Family Court in July 2021 (Interim Orders). The Interim Orders include the following orders:

Pending Further Order, it is ordered that:

1. The children [names/details]… shall live with the Father.

2. The mother be and is hereby restrained by injunction from telephoning and / or entering into or upon the premises at which the Father and the children may be residing.

14. GKK says she was in complete shock about the Interim Orders when they were made. She says her husband had a lawyer and 2 barristers, and she had no lawyer. She says the father had abducted her children before the hospital presentation, had kept them away from school for long periods of time, and lied to the Family Court.

15. Orders 4 and 5 of the Interim Orders required the parties to appoint an expert to prepare a report in relation to various matters concerning the children. By order 12, the matter was adjourned to November 2021 for ongoing case management. SCHN did not receive any more recent orders of the Family Court prior to the hearing, as GKK had advised that further orders made by the Family Court in 2024 did not include any parenting orders. That matter is discussed further below.

16. On 1 October 2021, GKK applied to SCHN (Randwick) for access to her child’s health records relating to his presentation at the Hospital. She requested records for the period from 24 March 2021 “to present date” (i.e. to 1 October 2021). Her application to SCHN attached the 2021 Interim Orders and attached her hand-written statement which included the following passage:

According to whatever happened in Emergency I was told that my husband would not be returning with my children and he has since 27^th July 2021 acquired full parenting rights and responsibilities and I have been charged and an AVO. I have not been able to have a conversation with my children about what happened .. at Emergency at Randwick and I have been advised that I am unable to contact my husband or children.

17. GKK said that the parts of her letter italicised (by me) above were incorrect, because of why she accepted the AVO (discussed above), and because she doesn’t now accept that her husband was correct in telling her that, at that time, he had “full parenting rights and responsibilities”.

18. On 5 October 2021, GKK was removed from or “end-dated” in SCHN’s Patient Management system (SCHN PM)/electronic medical records system (eMR) as the child’s “Next of Kin”. She was also removed from or “end dated” in SCH Randwick’s Patient Management system (iPM) as the child’s “person to contact”.

19. Also on 5 October 2021, GKK was informed by SCHN that, due to the Family Court orders (i.e. the Interim Orders), the records requested would not be released to her. She was informed that she should seek legal advice and subpoena the records from the Family Court.

20. On 21 December 2023, GKK again applied to SCHN under the HRIP Act requesting access to her child’s hospital records relating to his presentation at the Hospital in 2021 (R1, Tab 9).

21. The specific records requested were:

Notes upon presentation to Emergency, Discharge letter, anything related to 24 and 25 March 2021.

22. On 22 January 2024, SCHN decided not to provide the information requested. The reason provided was as follows (my emphasis):

We are unable to process your Application to Access Patient Healthcare Records in regards to [child].

We do not have you showing on our system as being Next of Kin & the court orders provided by yourself do not state you have shared parental responsibility.

If you do require the medical record’s [sic], please contact your solicitor and have the medical records subpoenaed.

23. Further correspondence followed regarding the status of the Interim Orders and whether GKK maintained parental responsibility for the child. In that correspondence, GKK said she had “shared parental responsibility” and that there was “no current order to take away parental responsibility”: R2 at pp 18a-18b. No updated orders were provided in support of that claim.

24. On 1 March 2024, GKK applied for an internal review. The application read, in part (my emphasis):

[6] Details of conduct complained about

The personal information about my child [xx] is inaccurate. I have been removed as the Next of Kin on the Hospital record of my child without my authorisation and consent. There should be a record of who authorised and removed my name as I am the mother of the child and have always been listed as an immediate family member to whom health information is to be disclosed. This has been the case since birth as my child has needed to attend a clinic every twelve months.

The security of health information about my child has been compromised as I have requested information about the presentation of my child at Emergency at Randwick. There should have been an alert raised when the child presented to Emergency. At the time of the Emergency presentation my child had been abducted by the other parent. I am seeking the requested information about that presentation but I have been refused.

There were no Parenting orders at the time of presentation that I am seeking information. There are current orders that do not prevent my parental responsibility to my child however the Hospital has prevented this.

[7] When did the conduct occur

In the period since my child presented to Emergency on [date] March 2021 somebody has amended the records.

[8]    When did you first become aware of this conduct?

- /01/2024

How did you become aware of the conduct?

Telephone enquiry

[9]. You need to lodge this application within 6 months of the date you have written at Q.8

I discovered that I have been removed as Next of Kin when I tried to make an enquiry.

[10]    What effect did the conduct have on you?

This conduct by the Hospital has reinforced and continued the domestic violence I experienced by the other parent and I have been aggrieved by this conduct and this conduct harms my child

[11]   What effect might the conduct have on you in the future?

I now have to try to correct this and try to reinstate my role in the health and wellbeing of my child which should not have been removed by the hospital without court orders

[12]   What would you like to achieve from this review?

I seek the outcome of being reinstated as the Next of Kin which should never have been removed and I would appreciate an apology and review of what happened at the Emergency presentation on [date] March 2021 and why my child was not flagged upon presentation when he had been abducted by the other parent on [prior date] March 2021.

…

25. On 24 May 2024, SCHN provided GKK with its “Report of Internal Review under Health Records and Information Privacy Act 2002.” The internal review found that there had not been a breach of HPP 7. It is now accepted by SCHN that the internal review should also have dealt with HPP 9 but did not. The internal review request encompassed that aspect.

26. On 24 June 2024, GKK lodged an application for administrative review with the Tribunal. That application was within time. The grounds for the application for review were articulated as follows:

My child, [name, DOB] had been abducted on [date] and presented to SCH Randwick Emergency on 24.03.21 with the other parent, [father]. There were no court orders at the time, and SCH, Randwick has refused to provide details of the Emergency presentation, as [child] lived with [father]. The subsequent orders of 27.07.21 were for shared parenting and parental responsibility, live with the father, based on the Emergency discharge as the only evidence. SCH, Randwick has excluded me from healthcare decision making and next of kin.

Further Family Court orders

27. In May 2024, further Family Court orders were made. A copy was provided to the Tribunal by GKK after the hearing, as ordered by the Tribunal. In summary, the May 2024 Orders provided that:

THE COURT ORDERS THAT:

1   The applicant father have sole parental responsibility for the children …

2   The children live with the father.

3   [GKK was only permitted to see the children, under independent supervision at a nominated venue, four times a year for half an hour each visit until they reached the age of 14 years, after which time with the mother “is to accord with each of the children’s wishes”.]

The actions of SCHN

28. Ms Ghassibe was cross-examined and I allowed GKK some leniency in her questions. However, I restricted various questions asking “why” something was done, or what would have happened in hypothetical situations. As explained to GKK, questions that went to the validity or merits of SCHN’s actions are not matters for the Tribunal, nor are these proceedings a vehicle for seeking answers to questions a person might have in seeking an explanation by SCHN as to why particular action was taken: see Davison v NSW Department of Education and Training [2013] NSWADT 25 at [3]; see also Choi v Commissioner of Police, NSW Police Force [2020] NSWCATAD 95; Crewdson v Central Sydney AHS [2002] NSWCA 345.

29. GKK was added as a person-to-contact on 24 August 2021. At all times, GKK remained on the child’s record as the parent.

30. On 5 October 2021, two things occurred:

1. GKK was end-dated as the point-of-contact (Next of Kin).

2. A social alert was also recorded.

31. The relevant policy documents applicable to SCHN were annexed to Ms Ghassibe’s Affidavit. They include policies to deal with social alerts and what is needed to amend or remove such an alert.

32. Their procedures required that any current Family Court Order provided to them be added to their records. Accordingly, when the letter was received from GKK, which attached the Interim Orders, they were scanned into their system. Ms Ghassibe explained that if any Court orders or parenting orders were received by SCHN, the team reviewed them. If the Court order stated that there was to be no contact, or limited contact, between the parent and the child, then they “end-dated” the relevant parent unless and until different, updated, orders were received by them.

33. Ms Ghassibe explained that there are different types of alerts:

1. Social alerts could be raised if SCHN received supporting documentation – this could include Family Court orders (including parenting orders), AVOs, Bail Condition records and similar matters. A “social alert” was a notification to the clinical team. It meant that there was something that needed to be looked at.

2. Clinical alerts could also be added if raised by the clinical team.

34. On 22 February 2022, an additional alert was added. Ms Ghassibe explained that it was standard practice for whoever entered the entry or made changes that the date that there was an “audit trail” showing the date, time and signature of whoever made the change and/or made the record. However, it did not necessarily explain why that was done, only that it occurred. That social alert was also added on to the other child; she explained that it was “probably just picked up that it related to two children and not just the one”.

35. GKK asked “What process is in place to interpret Family Court orders?” and “Was the decision to end date me made without any legal understanding of the orders?”

36. Ms Ghassibe explained that the Orders were released to the information team. That team consisted of administrative staff and health managers. They were not lawyers. The interpretation of the orders was based on the history and knowledge of the subject matters, and by applying their policies and procedures. She conceded that specific legal advice was not obtained but that, under their policies and procedures, the receipt of a Family Court Order restricting parental access would lead to a decision to end-date the parent the subject of the order. She said:

We are a health service. If a parent gives us an order, and it is up-to-date and current, we add it.

37. It stopped access to the records, and ended the relationship of that parent being the person to contact upon a child’s presentation. She confirmed that the end-dating of GKK was prompted by the letter received from GKK.

38. If there was a new Court order, or different parenting orders received by SCHN, then the relationship and the alert would be removed or updated as appropriate to reflect any change.

39. GKK asked questions asked about her husband’s (incorrect) email address on the child’s record, whether the Hospital had contacted the child’s school, whether the Hospital was aware that the child was on GKK’s Medicare card and not the father’s, whether the Hospital had received information from other government departments including Victim’s Services, or from other child case worker reports (and if not, why not). In regard to these matters:

1. Ms Ghassibe said that not every government department notifies SCHN of every interaction regarding claims or domestic violence or abuse. In any event, if there was a requirement to do so, and it was not done, then that was outside the control of SCHN.

2. She also said that SCHN can only update its records based on the information that it receives. That information is necessarily entered without “second-guessing” or conducting a forensic review into the information provided.

40. As explained to GKK in correspondence with SCHN, upon the presentation of a child with a parent at a Hospital, there was no requirement under their policies to notify the other parent of their attendance.

CONSIDERATION

Jurisdiction and scope of this review

41. The Tribunal’s administrative review jurisdiction is engaged because the contravention of an HPP that applies to an agency is conduct to which Part 5 (Review of certain conduct) of the PPIP Act applies: HRIP Act, s 21(1)(a); and

1. SCHN is an “agency” for the purposes of both the HRIP Act and the PPIP Act;

2. GKK is “aggrieved” by the conduct of SCHN; and

3. GKK made an application for internal review under s 53 of the PPIP Act.

42. GKK is therefore entitled to an administrative review of conduct “that was the subject of the [internal review] application under s 53”: PPIP Act, s 55.

43. The scope of the Tribunal’s administrative review application is limited to a review of SCHN’s conduct that was the subject of the application for an internal review.

44. On administrative review, the Tribunal’s task is to “decide what the correct and preferable decision is having regard to the material then before it:” ADR Act, s 63. The assessment of what is the “correct and preferable decision” is made as at the time the Tribunal makes its decision: YY & GG v Minister for Community Services [2002] NSWCA 247 at [25]. The Tribunal is not restricted to a consideration of the material that was before the primary decision-maker: see Shi v Migration Agents Registration Authority (2008) 235 CLR 286 at [98]-[99].

Relevant legislation

45. In NSW, the Government Information (Public Access) Act 2009 (NSW) (GIPA Act), PPIP Act and HRIP Act all allow access to information that may not be more widely available under the State Records Act1998 (NSW). They also closely regulate the collection, use, disclosure and protection of that information, and impose obligations to ensure it is accurate. Key to all this legislation is the need to protect the privacy of individuals. “Health information” records contain a highly sensitive type of personal information because they often reveal more intimate, private and comprehensive details about a person than can be found in any other records.

46. As an agency that holds “health information”, SCHN must comply with the HPPs, which are set out in Schedule 1: s 11(1) of the HRIP Act.

47. Section 3 of the HRIP Act provides:

3   Purpose and objects of Act

(1)  The purpose of this Act is to promote fair and responsible handling of health information by—

(a)  protecting the privacy of an individual’s health information that is held in the public and private sectors, and

(b)  enabling individuals to gain access to their health information, and

(c)  providing an accessible framework for the resolution of complaints regarding the handling of health information.

(2)  The objects of this Act are—

(a)  to balance the public interest in protecting the privacy of health information with the public interest in the legitimate use of that information, and

(b)  to enhance the ability of individuals to be informed about their health care, and

(c)  to promote the provision of quality health services.

48. Section 6 of the HRIP Act defines “health information”:

6   Definition of “health information”

In this Act, health information means—

(a)  personal information that is information or an opinion about—

(i)  the physical or mental health or a disability (at any time) of an individual, or

(ii)  an individual’s express wishes about the future provision of health services to him or her, or

(iii)  a health service provided, or to be provided, to an individual, or

(b)  other personal information collected to provide, or in providing, a health service, or

(c)  other personal information about an individual collected in connection with the donation, or intended donation, of an individual’s body parts, organs or body substances, or

(d)  other personal information that is genetic information about an individual arising from a health service provided to the individual in a form that is or could be predictive of the health (at any time) of the individual or of a genetic relative of the individual, or

(e)  healthcare identifiers,

but does not include health information, or a class of health information or health information contained in a class of documents, that is prescribed as exempt health information for the purposes of this Act generally or for the purposes of specified provisions of this Act.

49. HPP 7 (cl 7 of Sch 1 of the HRIP Act) regulates access to health information and provides:

(1) An organisation that holds health information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information.

…

(2) An organisation is not required to comply with a provision of this clause if –

(a) the organisation is lawfully authorised or required not to comply with the provision concerned, or

(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998)

50. HPP 9 (cl 9 of Sch 1 of the HRIP Act) deals with the accuracy of health information and provides:

An organisation that holds health information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.

51. The contravention of an HPP by a public sector agency is “conduct” to which Part 5 of the PPIP Applies: s 21 of the HRIP Act.

52. In the case of a child (minor), an authorised representative may do the act on the person’s behalf. Sections 7 and 8 of the HRIP Act provide (my italics):

7   Capacity

(1)  An individual is incapable of doing an act authorised, permitted or required by this Act if the individual is incapable (despite the provision of reasonable assistance by another person) by reason of age, injury, illness, physical or mental impairment of—

(a)     understanding the general nature and effect of the act, or

(b)    communicating the individual’s intentions with respect to the act.

(2)  An authorised representative of an individual may do such an act on behalf of an individual who is incapable of doing that act.

…

8   Definition of “authorised representative”

(1)  In this Act, authorised representative, in relation to an individual, means—

…

(c)     a person having parental responsibility for the individual, if the individual is a child, or

(d)     a person who is otherwise empowered under law to exercise any functions as an agent of or in the best interests of the individual.

(2)  A person is not an authorised representative of an individual for the purposes of this Act to the extent that acting as an authorised representative of the individual is inconsistent with an order made by a court or tribunal.

(3)  In this section—

child means an individual under 18 years of age.

parental responsibility, in relation to a child, means all the duties, powers, responsibility and authority which, by law, parents have in relation to their children.

53. Section 22 of the HRIP Act deals with the interaction between the HRIP Act and the GIPA Act as follows:

22 Government Information (Public Access) Act 2009 not affected

(1)  Nothing in this Act affects the operation of the Government Information (Public Access) Act 2009.

(2)  In particular, this Act does not operate to lessen any obligations under the Government Information (Public Access) Act 2009 in respect of a public sector agency.

(3)  Without limiting the generality of subsection (1), the provisions of the Government Information (Public Access) Act 2009 and the Privacy and Personal Information Protection Act 1998 that impose conditions or limitations (however expressed) with respect to any matter referred to in HPP 6 (Information about health information held by organisations), HPP 7 (Access to health information) or HPP 8 (Amendment of health information) are not affected by this Act, and those provisions continue to apply in relation to any such matter as if those provisions were part of this Act.

54. Section 5 of the GIPA Act provides that there is a presumption in favour of disclosure of government information unless there is an overriding public interest against disclosure.

55. Section 9(1) of the GIPA Act provides that:

A person who makes an access application for government information has a legally enforceable right to be provided with access to the information in accordance with Part 4 (Access applications) unless there is an overriding public interest against disclosure of the information.

56. Under s 14(1) of the GIPA Act, it is to be conclusively presumed that there is an overriding public interest against disclosure of any government information described in Schedule 1. Clause 10 of Schedule 1 states:

10   Care and protection of children

It is to be conclusively presumed that there is an overriding public interest against disclosure of information contained in a report to which section 29 of the Children and Young Persons (Care and Protection) Act 1998 applies.

57. Where material is not subject to a conclusive overriding public interest against disclosure under s 14(1) of the GIPA Act, the public interest test in s 13 must be applied to the information. This is found in s 13 of the GIPA Act:

There is an overriding public interest against disclosure of government information for the purposes of this Act if (and only it) there are public interest considerations against disclosure and, on balance, those considerations outweigh the public interest considerations in favour of disclosure.

58. Section 12 of the GIPA Act provides as follows:

12   Public interest considerations in favour of disclosure

(1)  There is a general public interest in favour of the disclosure of government information.

(2)  Nothing in this Act limits any other public interest considerations in favour of the disclosure of government information that may be taken into account for the purpose of determining whether there is an overriding public interest against disclosure of government information.

Note—

The following are examples of public interest considerations in favour of disclosure of information—

(a)  Disclosure of the information could reasonably be expected to promote open discussion of public affairs, enhance Government accountability or contribute to positive and informed debate on issues of public importance.

(b)  Disclosure of the information could reasonably be expected to inform the public about the operations of agencies and, in particular, their policies and practices for dealing with members of the public.

(c)  Disclosure of the information could reasonably be expected to ensure effective oversight of the expenditure of public funds.

(d)  The information is personal information of the person to whom it is to be disclosed.

(e)  Disclosure of the information could reasonably be expected to reveal or substantiate that an agency (or a member of an agency) has engaged in misconduct or negligent, improper or unlawful conduct.

(3)  The Information Commissioner can issue guidelines about public interest considerations in favour of the disclosure of government information, for the assistance of agencies.

59. Section 14(2) of the GIPA Act provides:

(2)  The public interest considerations listed in the Table to this section are the only other considerations that may be taken into account under this Act as public interest considerations against disclosure for the purpose of determining whether there is an overriding public interest against disclosure of government information.

60. And clause 3 of the Table in s 14 of the GIPA Act relevantly provides:

3   Individual rights, judicial processes and natural justice

There is a public interest consideration against disclosure of information if disclosure of the information could reasonably be expected to have one or more of the following effects—

…

(a) reveal an individual’s personal information,

(b) contravene an information protection principle under the Privacy and Personal Information Protection Act 1998 or a Health Privacy Principle under the Health Records and Information Privacy Act 2002,

…

(g)  in the case of the disclosure of personal information about a child—the disclosure of information that it would not be in the best interests of the child to have disclosed.

The scope of this review

61. The complaints before me relate to the following conduct of SCHN:

1. In respect of HPP 7 – refusing GKK’s application for access to her child’s medical records; and

2. In respect of HPP 9 – removing GKK from SCHN’s systems as the child’s “next of kin” and contact person, which is said to constitute use of the child’s health information without taking reasonable steps to ensure that it was accurate.

The limitations of this administrative review

62. Various complaints made by GKK regarding the actions of SCHN regarding the presentation of the child do not fall within the scope of this administrative review. For example, complaints about why GKK was not contacted for her input and perspective on the child’s condition and presentation are not part of the reviewable conduct. Nor (as outlined above) is the Tribunal required to be involved in a determination of any issues regarding abduction of the children, domestic violence, or whether or not SCHN knew (or should have known) about additional information communicated by GKK to other agencies.

63. The facts as known to SCHN, and the manner in which the health information was retained, updated and controlled by them (in particular, in denying access to GKK) are the relevant matters for my consideration.

Was there a breach of HPP 7? (Access to the child’s health information)

Whose information is it?

64. The “individual” referred to in the definition of “health information” in s 5 of the HRIP Act is the person to whom a health service was provided or whose physical health is the subject of the information.

65. The record before the Tribunal was that of the child. It was the child, not GKK, who was “the individual to whom the health information relates” within the meaning of HPP 7.

Did the child have capacity?

66. As found above, the information was that of the child, not of GKK.

67. The child was under 18, and was therefore a minor. He was 10 at the time of the presentation to the Hospital, and 13 at the time GKK lodged the request now under review for access to his health information.

68. Minors have the right to privacy for their healthy information and to make their own decisions regarding their privacy where they have the capacity to do so. A parent does not automatically have access to their children’s health information; rather, it is necessary to assess the young person’s capacity – in other words, whether they understand the general nature and effect of a particular decision or action and are able to communicate their intentions or consent.

69. I agree with the submissions of SCHN that whether a child has capacity to do an act will vary between different individuals, and depends on the nature of the act or decision that is involved:

1. As noted by McHugh J in Re Woolley; Ex parte Applicants M276/2003 by their next friend GS (2004) 225 CLR 1 at [102]-[103] (regarding parents seeking to make immigration decisions on their children’s behalf):

[102] Legal capacity is usually determined on the basis of the ability of the individual to understand the nature and consequences of a particular situation. Children are presumed to be incompetent at birth and gradually to acquire legal competence for various purposes at different stages of their development until they reach the age of majority (18), in which case they are presumed to have full legal capacity. The capacity of the child varies according to the gravity of the particular matter and the maturity and understanding of that child.

[103] Parents in their capacity as guardians of an infant child have the power under the common law to make decisions on behalf of the child, provided that the child does not have the competence to make the decision. Thus, where a child lacks capacity, the ordinary rules of the common law authorise the parent or guardian of the child to act on the child’s behalf. Parental authority diminishes as the child’s legal competence emerges. The parent’s authority is at an end when the child has sufficient intellectual and emotional maturity to make an informed choice.

2. And in the same case, Gummow J said at [154]:

In Marion’s case [a reference to Secretary of the Department of Health and Community Services v JWB and SMB (1972) 175 CLR 218], it was held that the capacity of a child who is not yet aged 8 years to give informed consent to acts which require consent as a condition of their legality does not depend upon any fixed age rule; capacity turns upon the attainment of the child of sufficient understanding and intelligence to understand fully what is proposed. In this way, pending the attainment of legal majority, the legal capacity of a particular child will vary according to the gravity of the particular matter and the maturity and understanding of that child.

70. I find on the balance of probabilities, based on the information before me (including the confidential materials discussed below), that the child did not have the capacity to fully understand these matters as at the date of the presentation. At that time, he was 10. I also find, on the balance of probabilities, that upon that child attaining the age of 13 he still did not have such capacity. I note that SCHN’s own procedures on the application form at R1, Tab 9 differentiates between children below and above the age of 14.

GKK is not an authorised representative of her child

71. In any event, regardless of whether or not the child had capacity, I find that GKK was not an “authorised representative” of the child.

72. Section 8(3) of the HRIP Act defines parental responsibility, in relation to a child, to mean “all the duties, powers, responsibility and authority which, by law, parents have in relation to their children”.

73. It was clear that, at the time of the hearing, GKK did not have all the powers which, by law, parents have in relation to their children. Despite her submission to the Tribunal at the hearing that she had “shared parenting”, this is incorrect. In documentation said to be in support of her claim (A2 at p 27), “Shared parenting” was described as the type of decision, but the decision itself was that “the Children shall live with the father”. More importantly, the Interim Orders, as well as the 24 May 2024 Orders, restricted – and continue to restrict - her access to her children.

74. Accordingly, GKK did not have “parental responsibility”, and was not an “authorised representative” of her child. And so she is not entitled to be provided with access to her child’s health information.

75. This is consistent with the following comments in FCZ v Illawarra Shoalhaven Local Health District [2023] NSWCATAP 71 (FCZ), where the Appeal Panel of this Tribunal upheld the decision at first instance:

49 Section 7 of the HRIP Act provides that, where an individual lacks capacity to make a request for or consent to the disclosure of their health information by reason of their age, an “authorised representative” may do wither [sic] act on behalf of the individual. The authorised person includes a person who has parental responsibility for the child.

50 FCZ contends that “any” amount of parental responsibility is sufficient and she had a degree of such responsibility. Therefore, the Tribunal was incorrect to find that she did not.

51 There is no doubt the terms of the Family Court’s order was to grant ‘sole parental responsibility’ to the father. Notwithstanding FCZ’s contention that the child was named on her Medicare card and correspondence from Medicare, or that the father did not have decision-making power of vaccinations, or that the father was to consult with FCZ about long-term decisions relating to her daughter, and FCZ was not excluded from having access to her daughter, the order set out above is in our view unequivocal. That is particularly so in view of the statutory presumption of “equal shared parental responsibility” created by the Family Law Act 1975 (Cth), which was rebutted in FCZ’s Family Court proceedings, and an order for sole parental responsibility was made. The Senior Member went to great lengths to explain her reasoning for finding that FCZ did not have parental responsibility to be an ‘authorised representative’ for the purposes of s8(1)(c) of the HRIP Act at [64] – [66]:

64. This is for the reason that under the 2015 Orders, FCZ does not have parental responsibility for her daughter: she does not have, in respect of her daughter, “all the duties, powers, responsibility and authority which, by law, parents have in relation to their children”. By reason of the 2015 Orders, FCZ was aware that her ex-husband had sole parental responsibility for her daughter and that he had the authority under the 2015 orders to make all final long-term decisions for their daughter including health decisions. 

65. Further, FCZ did not file any evidence that demonstrates that FCZ had parental responsibility at the time she made her request for the Confidential Documents or that she has parental responsibility now.

66. Even if FCZ’s contention that the ability to make short-term decisions about her daughter fell within the meaning of “parental responsibility” was correct, I am not satisfied that FCZ has authority to make short-term decisions about her daughter. FCZ provided no evidence that she makes short-term decisions about her daughter or that she has such authority given the totality of the 2015 Orders, including those about access to her daughter.

76. The decision to not release the requested information is correct.

77. I also note:

1. SCHN has other obligations under the HRIP Act (discussed below) to ensure that information is relevant, accurate and up-to-date. They have consistently followed their own procedures to update the health information and their records as further information was provided to them. In this context, Family Court orders involving the child must be recorded as a priority.

2. The Interim Orders were recorded because it was information provided by GKK, and it was entered onto their system. Accordingly, in considering and dealing with the earlier request for information, as well as the December 2023 request the subject of this decision, the “up to date” records clearly removed her not only as “Next of Kin” but, relevantly, supported their finding that she was not an “authorised representative” of her child.

3. GKK’s submissions that the child was on GKK’s Medicare card, and not that of the father, are of no material relevance in the circumstances: see FCZ at [51]. Nor does the “statutory presumption” relating to shared parenting under the Family Law Act 1975 (Cth) operate to displace the operation of orders of the Family Court.

Further limitations under the GIPA Act

78. I have found above that there is no breach of HPP 7 as GKK is not an authorised representative of the child to whom the “health information” relates.

79. Even if this were not the case, any obligation of SCHN to provide the child’s health information is also subject to “any conditions or limitations” imposed on accessing government information by the GIPA Act: s 22(3) of the HRIP Act.

80. The first step is to test if there is any conclusive presumption against disclosure under the GIPA Act. I have found there is not, for the following reasons.

81. [Not for Publication]

82. [Not for Publication]

83. [Not for Publication]

84. I therefore find that there is no conclusive presumption against disclosure.

Public interest test

85. The public interest test in the GIPA Act next requires the identification of factors in favour or and against disclosure, and to attribute weight to them: Snape v Commissioner of Police (No 2) [2022] NSWCATAP 244 at [91]-[93]; Bailey v Commissioner of Police [2023] NSWCATAP 103 at [91]-[92].

Public interest considerations favouring disclosure

86. As submitted by the Respondent, there is a general public interest in favour of disclosure which must be taken into account. In addition, the following are factors favouring disclosure:

1. GKK has a legitimate interest in accessing her child’s health information (as a parent); and

2. GKK has concerns about how SCHN managed her child’s presentation (including the failure to contact her), and believes that disclosure of information would aid her understanding of those events.

87. And in respect of personal factors under s 55(1)(a), GKK also wishes to test the veracity of documents produced to the Family Court, in proceedings which may be or are continuing.

88. I agree with the submissions of the Respondent that the above matters should only be given moderate weight, in circumstances where there is some uncertainty as to the degree to which GKK has parental responsibility for the child: see also EHW v Secretary, Department of Education [2022] NSWCATAD 140 at [86]-[87].

Public interest considerations against disclosure

89. The Respondent has submitted that cl 3(a), (b) and (g) of the Table to s 14 of the GIPA Act apply as disclosure of the information requested could reasonably be expected to:

1. reveal personal information of an individual (here, the child): cl 3(a)

2. contravene an HPP in the HRIP Act (here, HPP 11): cl 3(b); and

3. have the effect of not being in the best interests of the child: cl 3(g).

90. The most relevant provision is clause 3(g), in respect of which the Privacy Commissioner also made submissions. And upon my review of the evidence, including the confidential materials, I conclude that providing access to GKK could reasonably be expected to result in the disclosure of information that it would not be in the best interests of the child to have disclosed; and that this is a public interest consideration against disclosure of high significance and high weight.

91. In this case, the evidence of Ms Ghassibe in her Affidavit (at [6]-[8]) was that she had spoken to the SCHN Department Head of the Child Protection Unit, who expressed the view (upon reviewing the records) that disclosure of the requested records to GKK would not be in the best interests of the child, as they contain information that has been provided by the child in confidence to the Child Protection Unit during the hospital attendance. The Child Protection Unit is described as:

A multidisciplinary team of specialist doctors and allied health professionals that are highly skilled in assessing risk of harm, and providing trauma and violence informed care. They provide 24/7 child centred care to children, young people and families in the context of significant child safety concerns.

92. [Not for Publication]

93. [Not for Publication]

94. My conclusion is also consistent with FNJ v Commissioner of Police, NSW Police Force [2022] NSWCATAD 130 at [109], where the Tribunal concluded that a child’s best interests were not served by disclosing personal information provided in confidence, as disclosure would diminish trust in the organisation and make them less likely to seek help.

95. In respect of clause 3(a), the personal information is highly sensitive health information of the child, collected in the course of SCHN providing medical care and services to the child. Thus, I agree that cl 3(a) applies as a weighty public interest consideration against disclosure.

96. In respect of clause 3(b), HPP 11 restricts an organisation that holds health information from disclosing information for a purpose (being the secondary purpose) other than the purpose for which it was collected (being, the primary purpose) unless the individual to whom the information relates has consented to the disclosure of the information for a secondary purpose.

97. [Not for Publication]

98. I accept the Respondent’s submissions that GKK seeks the information for a “secondary purpose” that does not relate to the health care of the child but, rather, to verify its accuracy, and that consent has not been given by the child himself for such a use. Overall, I ascribe a moderate weight as a public interest consideration against disclosure.

Conclusion on the public interest test

99. In this case, upon weighing the factors above, I find that the public interest considerations against disclosure are compelling and that there is an overriding public interest against disclosure. It therefore follows that disclosure of the records to GKK would also not be authorised under the GIPA Act and, as a consequence, no contravention of HPP 7 would arise from SCHN’s refusal to provide the information to GKK even if GKK were an “authorised representative” (which, I have found above, she was not).

Was there a breach of HPP 9? (Accuracy of health information)

100. HPP 9 requires that information not be “used” unless it is complete, accurate and up-to-date. SCHN accepts that the information on their systems was “used” in responding to GKK’s application for access and correction.

101. There is nothing before me that suggests any error or inaccuracy (intentional or otherwise) arising from the entries in the records of SCHN described above.

102. It was based on the information received, including from GKK herself, and in accordance with appropriate policies and processes.

103. In particular:

1. In light of the documentary evidence received from GKK, it was correct and appropriate for GKK to be “end-dated” on their systems;

2. The additions made on 22 February 2022 did not impact on the legal analysis required.

3. Appropriate documentary evidence supported the relevant changes.

104. There is no basis for me to conclude that the information was inaccurate at any relevant time. The changes were based on the Interim Orders and other information provided by GKK herself to SCHN.

105. This provided a more than sufficient basis for the actions that followed. The father remained as the relevant person to contact, GKK was end-dated, and a social alert was added.

106. The social alert could not be removed until SCHN received updated documentary evidence – for example, if the previous Interim Order was superseded or otherwise changed.

107. Despite GKK’s concerns about the lack of legal review of the Interim Orders, I conclude that the interpretation of SCHN was consistent with the Interim Orders, which accords with my finding that she was not an “authorised representative”.

108. HPP 9 requires that SCHN take “reasonable steps” to ensure accuracy. That does not require, as noted above, a forensic analysis or professional testing of the information received. I am satisfied that SCHN took such steps as were reasonable in line with their established procedures; I find those procedures were cautious and protective, which is important and appropriate for all patients and for children in particular.

Orders

109. The correct and preferable decision, having regard to the conduct of SCHN, is that there is no breach of HPP 7 or of HPP 9.

110. I make the following order:

1. Pursuant to s 55(2) of the Privacy and Personal Information Protection Act 1998 (NSW), the Tribunal decides not to take any action on the matter.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 11 December 2024