KJ v Wentworth Area Health Service

[2004] NSWADT 84

CITATION:	KJ v Wentworth Area Health Service [2004] NSWADT 84
DIVISION:	General Division
PARTIES:	APPLICANT KJ RESPONDENT Wentworth Area Health Service
FILE NUMBER:	033242
HEARING DATES:	19/11/2003
SUBMISSIONS CLOSED:	11/19/2003
DATE OF DECISION:	05/03/2004
BEFORE:	Montgomery S - Judicial Member
APPLICATION:	Privacy - information protection principle - disclosure to third party
MATTER FOR DECISION:	Principal matter
LEGISLATION CITED:	Administrative Decisions Tribunal Act 1997 Privacy & Personal Information Protection Act 1998
CASES CITED:
REPRESENTATION:	APPLICANT In person RESPONDENT R Reitano, barrister PRIVACY COMMISSIONER L Blamey, legal officer
ORDERS:	1.I declare that the Wentworth Area Health Service has contravened the Information Protection Principles provided for by sections 10 and 19 of the Privacy & Personal Information Protection Act 1998. ; 2.The Wentworth Area Health Service is ordered to refrain from collecting personal information from the Applicant without informing her of the purposes for which the information is being collected and the intended recipients of the information;; 3.The Wentworth Area Health Service is ordered to refrain from disclosing the Applicant’s health information without her informed consent;; 4.The Application is otherwise dismissed.

1 The Applicant in these proceedings applied to the Tribunal under the Privacy and Personal Information Protection Act 1998 (“the Privacy Act”) for a review of certain conduct by employees of the Wentworth Area Health Service (“the Agency”). The Agency is a public sector agency as defined by the Privacy Act. It is not in dispute that the information and opinions, which is the subject of this application, are “personal information” under the Privacy Act. I have agreed not to identify the Applicant by name because of the personal nature of the information. In these reasons I refer to the Applicant as “KJ”. I have also agreed that some other individuals involved in this matter should not be identified in order to minimise the likelihood of identifying KJ, and other individuals who have sought to have their identities concealed.

Jurisdiction

2 Section 55 of the Privacy Act and section 37 of the Administrative Decisions Tribunal Act 1997 (“the ADT Act”) give the Tribunal jurisdiction to review the conduct about which KJ has complained.

Status of Privacy Commissioner

3 Under section 55(7) of the Privacy Act, “The Privacy Commissioner has a right to appear and be heard in any proceedings before the Tribunal in relation to a review under this section.” The Privacy Commissioner made written submissions in this case.

4 In FM -v- Vice Chancellor, Macquarie University [2003] NSWADT 78 the Deputy President of this Tribunal found that the words of section 55(7) of the Privacy Act do not confer the burdens and benefits of party status on the Privacy Commissioner. The Privacy Commissioner has a right to intervene in proceedings and be heard.

Background

5 KJ was treated for cancer at the Nepean Cancer Care Centre (“the NCCC”) during 2000 and 2001. The NCCC is a unit of Nepean Hospital and is part of the Agency. KJ was referred to the NCCC by her general practitioner. During this time KJ consulted the NCCC's psychologist (“the Psychologist ”) and, in the Psychologist’s absence, the NCCC's psychiatrist (“the Psychiatrist ”). Both the Psychologist and the Psychiatrist during the course of their consultations with KJ placed notes on KJ's general medical file. KJ's general medical file was kept by the NCCC and contained information personal to KJ and in particular matters relevant to her treatment.

6 On 24 April 2003 KJ complained to the Agency that at no time was she informed about what records were being created about her, how they were to be used or to whom they were to be disclosed. Additionally KJ complained about a letter that the Psychiatrist had written to the surgeon who had operated on KJ and that letter was copied to another medical practitioner who the Psychiatrist understood to be KJ's general practitioner. KJ subsequently obtained copies of her medical records from the NCCC, and discovered that psychological information about her had been placed on her general medical file. Copies of correspondence contained on the file also indicated that the Psychiatrist had written to persons outside the NCCC, providing them with information about KJ.

7 KJ asserts that these actions were a violation of her privacy and trust and were in contravention of specific provisions of the Privacy Act.

8 On 24 April 2003 KJ complained to the Agency that at no time was she informed about what records were being created about her, the purposes for which the records were being created or to whom they were to be disclosed. Additionally KJ complained about letters that the Psychiatrist had written to KJ’s surgeon and copied to the medical practitioner. The Agency treated KJ's letter of 24 April 2003 as an application for internal review under section 53 of the Privacy Act. On 25 July 2003 the Agency’s Client Liaison Officer reported to the Agency’s Privacy Contact Officer in relation to her investigation of the complaint. On 21 August 2003, the Agency’s Privacy Contact Officer prepared a report in relation to KJ's complaint.

9 The Client Liaison Officer’s report proposed administrative changes to better inform patients about the multi-disciplinary nature of care and the general practice of the whole treating team having access to patient information; a proposal to have patients sign a consent to the information being shared; a proposal for an information sheet for patients about the role of the psycho-oncology team; and the availability of in-service education about privacy & confidentiality. The Privacy Contact Officer agreed that these proposals are appropriate.

10 The Privacy Contact Officer concluded that KJ

"... was not aware, or did not appreciate that this category of personal information about her and about which she is particularly concerned, would form part of the medical record available to all the treating team. Had she been, and had the reasons been explained to her, she may or may not have consented, but it is evident she was not aware and did not have the opportunity to consider the matter and therefore I am satisfied that her complaint is substantiated in this respect."

11 The Privacy Contact Officer also agreed to a notation on KJ's NCCC file and the removal and separate storage of notes concerning KJ's psychiatric/psychological information. On 26 August 2003 the Acting Chief Executive Officer of Agency wrote to KJ formally apologising to her for what had happened.

12 KJ is dissatisfied with the Agency's conduct of the Internal Review and the outcome of that review. She is also dissatisfied with the Agency's apology. KJ has returned to the NCCC to consult a medical oncologist and will continue to do so in the future. Her file has therefore become active again and it is important to her that this matter comes to a satisfactory conclusion.

Orders sought from the Tribunal

13 KJ asserts that the Agency’s actions in relation to her psychological information contravened several of the Information Protection Principles (“IPPs”) contained in Part 2 Division 1 of the Privacy Act. The Application before the Tribunal seeks a number of orders with respect to the alleged breaches of the IPPs and how the Agency deals with KJ’s information. KJ seeks:

a) a ruling as to whether the Agency contravened the Information Protection Principles of the Privacy Act;

b) an order that the Agency restrain from collecting personal information from patients without informing them of the purposes for which the information is being collected and the intended recipients of the information;

c) an order that the Agency restrain from disclosing patients' health information without their informed consent;

d) an order that the Agency be required to permit her to place on her medical record file a note about her privacy complaint; and

e) an order that the Agency restrain from using the patient registration form as the means to obtain patient consent to the use and disclosure of their psychosocial information.

14 The Application also asks the Tribunal to refer the general issue of privacy protection of patient information within multidisciplinary treating teams for consideration by the responsible Minister and the Privacy Commissioner.

15 Prior to the hearing, the Agency agreed to KJ’s request that KJ’s psychological information, collected from her by the Psychiatrist and the Psychologist, be separated and securely stored and access restricted. KJ asks the Tribunal to make an order that access to this information be restricted to the Psychiatrist and the Psychologist.

16 The Agency intends to place on KJ’s general medical file a suitable, non-detailed notation indicating that notes concerning psychiatric/ psychological information have been removed. The Agency also agreed to KJ’s request that she be permitted to place a note about her privacy complaint on her file.

Alleged Contravention of Information Protection Principle 3 (section 10)

17 KJ asserts that the Agency has acted in contravention of IPP 3, by the Psychiatrist’s and the Psychologist’s action in placing their clinical notes on her general medical record file (and thus making them available to others at the NCCC) and the Psychiatrist’s action in sending a letter about KJ to two outside doctors and placing a copy on her file without informing her. IPP 3, contained in section 10 of the Privacy Act provides:

“10 Requirements when collecting personal information

If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following:

(a) the fact that the information is being collected,

(b) the purposes for which the information is being collected,

(c) the intended recipients of the information,

(d) whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided,

(e) the existence of any right of access to, and correction of, the information,

(f) the name and address of the agency that is collecting the information and the agency that is to hold the information.”

18 KJ does not assert any contravention of IPP 3(a). Whilst she says that she was not specifically informed that information would be collected, she nevertheless knew that information would be collected and kept and that she had no objection to this collection. She stated that the making and keeping of records by individual doctors falls within her experience.

19 However, with respect to IPP 3(b), KJ stated that she believed that that the Psychiatrist and the Psychologist collected the information for the sole purpose of their future consultations with KJ. KJ submitted that because of the sensitivity of this information, it was reasonable to assume that the information would be kept separately and would be accessible by only the Psychiatrist and the Psychologist. KJ stated that neither the Agency nor the staff of the NCCC did or said nothing to disabuse her of this expectation. In support of the submission that her expectation was reasonable KJ referred to the NSW Department of Health's policy document, Information Privacy Code of Practice, 2nd edition, 1998 (“the Code”), made under section 31 of the Privacy Act. Clause 8.1 of the Code states:

“8 SPECIAL INFORMATION CATEGORIES

8.1 Sensitive records

Although all personal health information should be considered sensitive, there is an expectation in the community that certain categories of highly sensitive information which are potentially stigmatising should be treated with particular care. Clients/patients of certain services such as … mental health … have special needs due to the sensitive nature of this information. The client/patient may indicate that their information regarding a particular condition is particularly sensitive. ... Care will be taken to ensure that access to the records of these clients/patients is strictly controlled”.

20 With respect to IPP 3(c), KJ stated that, with one exception, she was not told of the intended recipients of the information. KJ said that the Psychologist told her that she would speak to the Psychiatrist about her. KJ had no objection to the Psychiatrist and the Psychologist sharing information about her between themselves as they were both dealing with her psychological issues and KJ trusted them with the information. However, KJ said that she was not told and that she did not expect that the information would be shared with anyone else.

21 KJ said that it did not occur to her that the Psychiatrist and the Psychologist would make her psychological information available to doctors, nurses, the dietician and the physiotherapist who were treating her physical illness - most of whom she did not know very well and some of who she held in little regard. KJ said that had she been asked, she would not have given her consent to the wider sharing of the information.

22 KJ consulted the Psychiatrist and the Psychologist for temporary help with her distress caused by her diagnosis and treatment. KJ said that she did not expect that once she ceased using their services, their records would continue to be available to all health workers KJ might consult in the future at the NCCC or Nepean Hospital, regardless of the reason for the consultation. She asserts that this continuing disclosure of her psychological information to as yet unknown people for the rest of her life is an unacceptable intrusion into her life. KJ argues that she alone should decide the type and extent of information disclosure is in her best interests and necessary for her optimal care.

23 In support of this submission KJ referred to the Code which states at Clause 7.1:

“7 OTHER ACCESS

7.1 Health care providers

Other than in the circumstances set out below, health care providers have no greater right of access than any other third party, and access for any other purpose must be sanctioned by one of the exceptions listed in this Code.

Any health care provider in the public health system currently involved in the continuing care or treatment of a client/patient may access the health record of that client/patient. However as a matter of principle, sensitive categories of health records such … mental health …should not be accessed by health care providers who are treating the client/patient for other reasons, unless consent is obtained”.

24 KJ submitted that the Agency appears not to be compliant with this policy in sharing psychological information with other team members without patient consent.

25 The Psychologist appeared and gave evidence before the Tribunal. There is a serious dispute between the Psychologist and KJ in relation to what KJ was told about the use that would be made of her general medical file and any notes that were placed upon it. Whilst the Psychologist has no specific recollection of what she told KJ, she says that she would have given her usual “spiel”. What she would have told KJ would have been consistent with her usual practice in relation to patients. She said that she would not have told KJ that what was written on her general medical file would be confidential but that she would have told KJ that what was written on the file would be available to be read by other clinicians employed by NCCC.

26 The Agency conceded that it did not tell KJ who the recipients of the information might be, but states that, with one exception, it was confined to the Agency itself and was for the purposes of KJ's care and treatment. The Agency argues that section 10 is not concerned with the provision of information to employees of the relevant Agency. It is concerned with the dissemination of information to others beyond the relevant agency.

27 The Agency further argues that the obligations placed on an agency by section 10 of the Privacy Act are premised upon the prospect that recipients of the information might be broader than the particular public sector agency itself.

28 The Agency submits that the scope of section 10 of the Privacy Act is confined to the fact of informing, or failing to inform a person about to whom their information will be given. The Agency conceded that this should have happened in the circumstances relevant to this matter and that it did not.

29 The Privacy Commissioner submits that the requirements of section 10 are intended to give individuals a certain measure of control over their personal information. By specifying the purposes for which the personal information is being collected, who will receive the information, and whether supplying providing information is mandatory or voluntary, an individual is able to make an informed choice about whether to provide their information to an agency. The requirements are also intended to enable individuals to exercise other rights under the Privacy Act. IPP 3 is based upon the broad principles of purpose specification and openness by government agencies and other organisations.

30 The Privacy Commissioner disputes the Agency’s submission that IPP 3 is concerned with the dissemination of the information beyond the relevant agency to others. It is submitted that there is no such limit to the meaning of "recipient" in section 10(c) of the Privacy Act. Therefore, in the absence of an express limitation, the provision should not be read down in the manner submitted by the Agency. The Privacy Commissioner submitted that a broader interpretation of section 10(c) is consistent with the principle of openness.

Finding in relation to IPP 3

31 KJ seeks a ruling as to whether the Agency contravened IPP 3 of the Privacy Act by the Psychiatrist’s and the Psychologist’s action in placing their clinical notes on KJ’s general medical record file and the Psychiatrist’s action in sending a letter about KJ to two outside doctors.

32 The Psychologist and KJ disagree as to what KJ was told about the use that would be made of her medical record and any notes that were placed upon it. Each of these individuals was an impressive witness. The Psychologist has no specific recollection of what was said and has no written record of having followed her usual course of conduct. Of itself, this is not surprising. On the other hand KJ is adamant that she was not given the information that the Psychologist asserts would have been given and would not have given her consent if requested to do so. In my view it is possible that the Psychologist had overlooked giving KJ her “usual spiel”. It is also possible that KJ was in a state of distress at the time, was given information about the purposes for which the information was being collected and simply does not recall it. In the circumstances I am unable to make a ruling on this issue.

33 The Agency conceded that it did not tell KJ who the recipients of the information might be. However the Agency argues that IPP 3 is not concerned with the provision of information to employees of the Agency itself. I do not agree that IPP 3 should be given such a narrow interpretation. In the absence of an express limitation, the provision of information to employees of the relevant Agency should not be considered as falling outside the scope of IPP 3. Such an artificial distinction is not consistent with the Privacy Act’ purpose of establishing principles for dealing with personal information in an open and accountable manner. It may also be inconsistent with an individual's reasonable expectations of how their personal information, will be handled by an agency. In this regard I agree with the view expressed by the Privacy Commissioner.

34 If a patient is notified that personal information disclosed during a consultation with a practitioner employed by an agency will be shared with her treating team, the patient may be able to choose whether to disclose any information, or only certain information, to the practitioner. The ability to exercise such choice is clearly contemplated by section 10(d) of the Privacy Act, which requires an agency to notify an individual whether the provision of information is mandatory or voluntary. In order to make an informed choice about whether to provide or withhold personal information it maybe appropriate, particularly in the health setting, for an agency to advise an individual about its opinion regarding the potential beneficial or adverse effects of a decision to provide or withhold particular information. However an individual's choice to provide or withhold personal information is not dependent on the agency's opinion.

35 Sufficient information must be provided to an individual when their personal information is collected, to allow the individual to give informed consent. What information would be sufficient will vary from case to case. However, in my view, the information provided would not be sufficient unless it included information regarding the intended recipients of the individual's information. Whether an agency would need to seek further consent for necessary uses and disclosures will depend on the circumstances of the case and the needs and wishes of the individual.

36 The Privacy Commissioner has submitted, and I agree, that the type of personal information at issue is relevant in determining whether an agency has taken such steps as are reasonable in the circumstances to make an individual aware of the matters in section 10. In this case, a particularly sensitive class of health information is at issue. KJ has posed a number of circumstances in which it would be unnecessary for employees of the Agency to have access to that sensitive personal information. In my view, had the Agency specified who would receive the information that KJ provided, KJ would have had information on which to base a decision about whether or not to provide her information to the Agency. In the circumstances of this matter, I am not satisfied that the Agency took steps as were reasonable necessary to make KJ aware of the intended recipients of the information. In contravention of IPP 3 of the Privacy Act, the Agency denied KJ the opportunity to make an informed decision on the issue.

Alleged Contravention of Information Protection Principle 12 (section 19)

37 KJ asserts that the Agency has contravened IPP 12 by the Psychiatrist’s action in sending a letter containing KJ’s psychological information and the Psychiatrist’s opinions of KJ to two outside doctors.

38 KJ says that she expected that her psychological information would be handled in a confidential manner. She asserts that the neither the Agency nor the staff at the NCCC did or said anything to disabuse her of that expectation. On the contrary, she says that the Psychologist confirmed her expectations by assuring her that everything said in their consultations would remain confidential. KJ asserts that this assurance of confidentiality was not qualified in any way.

39 IPP 12, contained in section 19 of the Privacy Act provides:

“19 Special restrictions on disclosure of personal information

(1) A public sector agency must not disclose personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, health or sexual activities unless the disclosure is necessary to prevent a serious or imminent threat to the life or health of the individual concerned or another person.

(2) A public sector agency that holds personal information must not disclose the information to any person or body who is in a jurisdiction outside New South Wales unless:

(a) a relevant privacy law that applies to the personal information concerned is in force in that jurisdiction, or

(b) the disclosure is permitted under a privacy code of practice.

(3) For the purposes of subsection (2), a relevant privacy law means a law that is determined by the Privacy Commissioner, by notice published in the Gazette, to be a privacy law for the jurisdiction concerned.

(4) The Privacy Commissioner is, within the year following the commencement of this section, to prepare a code relating to the disclosure of personal information by public sector agencies to persons or bodies outside New South Wales.

(5) Subsection (2) does not apply:

(a) until after the first anniversary of the commencement of this section, or

(b) until a code referred to in subsection (4) is made,

whichever is the later.”

40 Some exemptions to the application of section 19 are found in sections 26 and 28 of the Privacy Act. Section 26(2) provides:

“26 Other exemptions where non-compliance would benefit the individual concerned

...

(2) A public sector agency is not required to comply with section 10, 18 or 19 if the individual to whom the information relates has expressly consented to the agency not complying with the principle concerned.”

41 Section 28(2) of the Privacy Act provides:

“28 Other exemptions

...

(2) A public sector agency is not required to comply with section 19 if, in the case of health related information and in circumstances where the consent of the individual to whom the information relates cannot reasonably be obtained, the disclosure is made by an authorised person to another authorised person involved in the care or treatment of the individual. An authorised person is a medical practitioner, health worker, or other official or employee providing health or community services, who is employed or engaged by a public sector agency.”

42 Clause 3 of the Code expands the exemption in section 28(2) of the Privacy Act to allow agencies to disclose health related information to private health service providers as well as public health service providers. However, clause 3 retains the requirement that such disclosure may only occur where the consent of the individual cannot reasonably be obtained.

43 KJ submitted that IPP 12 contains no exceptions concerning related purposes or assumed awareness of the individual. In support of this submission she referred to the Agency's publication Privacy Information Policy & Privacy Internal Review Procedures, October 2000 that expresses this view.

44 KJ asserts that there is no merit to the Psychiatrist’s claim that KJ’s surgeon referred KJ to her. KJ says that she saw the Psychiatrist twice and was referred by her NCCC medical oncologist. KJ says that she did not know that the Psychiatrist and the surgeon were in communication about her, and did not consent to that communication.

45 KJ denies the Psychiatrist’s claim that she wrote to KJ’s surgeon and the doctor thought to be KJ’s GP after receiving a copy of a letter written by KJ’s surgeon to this GP. The Psychiatrist claimed that in the letter the surgeon expressed concern about KJ's mental state and said he had referred KJ to the Psychiatrist. However, KJ stated that the only mention of the Psychiatrist in the surgeon’s letter to the GP is a statement that he had suggested that KJ contact the Psychiatrist and her team should she have ongoing problems.

46 KJ submits that this was not a referral and that the Psychiatrist, completely unsolicited and unauthorised, took it upon herself to send these two doctors a psychiatric assessment of KJ. She further submits that, in not obtaining KJ’s consent, the Agency has contravened IPP 12.

47 The Agency accepts that it should have obtained KJ's express consent to the disclosure of KJ's personal information as required by section 19 of the Privacy Act. However, the Agency argues that the action taken in relation to the complaint was measured and appropriate. The proposals advanced by The Privacy Contact Officer as well as the implementation of changes to policies, procedures and training recommended by the Client Liaison Officer form a sound, rational and reasoned approach to the issues that KJ's complaint has raised. The Agency submits that there is therefore no need for the Tribunal to grant relief of the kind sought by KJ.

48 The Privacy Commissioner has submitted that there may be instances where a dissemination of information within an agency amounts to disclosure, either because the agency concerned consists of a number of discrete units, or the information is of such a confidential nature that it is reasonable to describe the manner in which it is disseminated as disclosure, or because of a combination of such factors. It is further submitted that an artificial distinction between use within an agency and disclosure outside may not be consistent with an individual's reasonable expectations of how their personal information, particularly sensitive personal information as defined in section 19, will be handled by an agency.

Finding in relation to IPP 12

49 Again I am in general agreement with the views expressed by the Privacy Commissioner. The Privacy Act does not clearly define what is meant by a public sector agency. In my view, the expression should be given a broad interpretation, consistent with the principle that personal information should be dealt with in an open and accountable manner. For example a statutory body that is administratively part of a larger public sector agency can constitute an agency in its own right. What constitutes a public sector agency will be a question of fact to be determined on a case by case basis.

50 While generally speaking the expression “disclosure” refers to making personal information available to people outside an agency, in the case of large public sector agencies consisting of specialised units, the exchange of personal information between units may constitute disclosure.

51 In the circumstances of this matter, I am satisfied that the Agency disclosed KJ's personal information in contravention of the requirements of section 19 of the Privacy Act as KJ has alleged. The exceptions provided by sections 26 and 28 of the Privacy Act are not applicable. I have no evidence on which I can determine whether this contravention of section 19 was wider than the Psychiatrist’s sending letters to two outside doctors. Nevertheless, it is my view that by placing the sensitive information on KJ’s general medical file, the Agency was at risk of disclosing that information. The exchange of the information between units within the Agency could, in my view, constitute disclosure. The Agency has acted prudently in separating the information from KJ’s general file. The Agency should ensure that there is not further disclosure of the psychological information in contravention of IPP 12.

52 Given the findings relating to the contraventions of IPP 3 and IPP 12, it is appropriate in the circumstances to order that the Agency refrain from contravening these IPPs. However, the orders that KJ has sought extend further than the collection and disclosure of the information that she has provided. KJ has asserted that the matters she has complained about are indicative of a systemic problem. This view seems to be supported by the Agency’s submission that IPP 3 does not relate to Agency employees and that it has a global approach to retaining patient information of the kind under consideration with unrestricted access to the information. While it may be inferred that the Agency has acted in breach of these IPPs on a wider scale, on the evidence before me I am unable to conclude that there is a systemic problem within the Agency that could ground the orders sought.

53 In any event, I agree with the Agency’s submission that there is no need for the proposed orders having regard to the fact that the Agency has determined that it should implement procedures so as to ensure that there is compliance with the Privacy Act in so far as there was any departure from them.

54 In relation to the fourth proposed order, the Agency proposes to allow KJ to place a note about her privacy complaint on her general medical file. I agree with the Privacy Commissioner’s submission that the Tribunal's jurisdiction to make orders under section 55(2) is not limited by action taken by an agency in relation to the substantive complaint prior to a hearing or determination by the Tribunal. Nevertheless, I agree with the Agency’s submission that there is no need for the making of the order as sought. Accordingly, I make no order in relation to this issue on the expectation that the Agency will comply with its undertaking to KJ.

Proposal to use the patient registration form as a consent form for the disclosure of a patient's psychosocial information

55 KJ made detailed submissions in relation to the Agency’s proposal to modify the patient registration form to obtain the patient’s consent to the collection and sharing of medical information and medical investigations with other clinical practitioners. KJ argues that this form, signed by patients when they first consult the Agency, is not an appropriate vehicle to obtain a patient's consent. The consent relates to the disclosure of the entire clinical record of their consultations for the entirety of the patient's life.

56 The need for consent to disclosure should be considered on a case-by-case basis and only recommended to the patient if it is seen as beneficial for specific reasons. Obtaining consent for disclosure should happen only after the patient has met their counsellor and the other members of the "team". It should be a matter for discussion when the counsellor is explaining and negotiating the terms of the counselling relationship.

57 KJ asserts that there is no need for disclosure of the entire record of psychosocial consultations to the whole "team" to be standard procedure. All that most of the team need to know is that the patient is receiving support from the psycho-oncological team; they do not need access to the details.

58 She also asserts that the proposed form is in breach of the Authorised Disclosure provisions of the NSW Department of Health's privacy policy which says at clause 6.1:

“6.1 Informed consent

Informed consent of the client/patient is acknowledged as one of the cornerstones of information privacy. Personal health information should not be disclosed without the consent of the person to whom it relates, except in the specific circumstances set out in this Code.

For consent to be valid:

· the client/patient must be legally competent, that is, be able to understand the nature and consequences of the proposed use of the information

· it must be freely given

· it must be informed, that is, sufficient information provided to allow a reasoned decision

· it must be specific.

The health care provider or organisation to whom information will be released should be specified and the information provided should be limited to that relating to the current episode of care. Access to information about an unrelated episode or to the full clinical history requires separate express consent.

Obtaining consent in advance where the condition requiring care has not manifested is not acceptable, as the client/patient will not be aware of who will be accessing the record or for what purpose.”

59 KJ asserts that before seeking a patient’s consent a practitioner should consider why they want to recommend to the patient that they consent to this disclosure. They should then discuss with the patient the extent of disclosure that will occur if consent is given, as well as the benefits and potential risks of disclosure.

60 KJ disputes the Agency’s claim that the actions of the Psychiatrist and the Psychologist in making KJ’s psychological information available to others were "appropriate" and indeed "best practice" according to clinical standards. While she concedes that the Code and the applicable professional codes of ethics of the Royal Australian and New Zealand College of Psychiatrists and the Australian Psychological Society contemplate that information will be shared in appropriate circumstances, between health professionals, KJ asserts that all three of these documents clearly state that patient consent should be obtained for any such information sharing. She provided detailed references in support of this submission.

Finding in relation to proposed consent form

61 In my view, there is much merit in KJ’s argument regarding the Agency’s proposal to modify the patient registration form to obtain the patient’s consent to the collection and sharing of medical information and medical investigations with other clinical practitioners. It is by no means clear that the Agency’s intention is as KJ has asserted. However, I have grave concerns that such an approach would not provide that Agency with the informed consent needed to comply with the Privacy Act.

62 It is not for the Tribunal to dictate to the Agency the procedures it should adopt so as to ensure that there is compliance with the Privacy Act. These procedures should be developed after careful consideration by the Agency’s administrators in consultation with an appropriate ethics committee and client representative. This process is beyond the practical scope of the Tribunal’s functions, if not beyond its jurisdiction. In the circumstances, it is my view that the matter should be given further consideration by the Agency so as to ensure that any procedures it adopts will ensure that it can comply with the requirements of the Privacy Act and that any consent provided by its clients is informed consent.

Referral of general issue of privacy protection of patient information within multidisciplinary treating teams for consideration by the Minister of Health and the Privacy Commissioner.

63 KJ asserts that the matters she has complained about are not confined to two clinicians in one health agency but rather that it is a systemic problem. She argues that there is a lack of alignment between the expectations of patients about how their privacy will be respected and a culture of disclosure that exists in the medical community. She submits that the issue of privacy protection in multidisciplinary health environments needs high-level discussion, the design of appropriate recordkeeping systems and the production of published guidelines for both clinicians and patients.

64 KJ ask that the Tribunal consider bringing the general issue of the confidentiality of patient information in a multidisciplinary setting to the attention of the Minister for Health and the Privacy Commissioner as one that needs consideration and the development of a consistent approach of which all public health agencies, their staff and patients should be aware.

65 The Agency’s submission in relation to this issue is that the Tribunal should note that there is specific legislation to be implemented in 2004 that will deal with questions of privacy in the health related public sector. In the circumstances it is not appropriate to refer anything to the Minister and the Privacy Commissioner.

Finding in relation to proposed referral

66 In Vice Chancellor, Macquarie University v FM [2003] NSWADTAP 43, the Appeal Panel held that orders should be inter partes unless there are good reasons for a wider-operating order. The Appeal Panel stated at paragraph 125:

“In our view, unless there are good reasons to make a wider systemic order, orders should be confined to the parties to the proceedings. In our view no case was advanced by FM that went beyond what happened to him and its lawfulness. Orders should, as we see it, be inter partes unless there has been considered attention given in the proceedings to the possibility of a wider-operating order. Obviously in well-administered organisations the order will be adopted as a precedent and a basis for policy that will govern all practice of a like kind.”

67 Given the Appeal Panel’s statement and the view I have expressed above as to the lack of evidence with respect to any systemic problem, I do not agree that it is appropriate to make the referral to the Minister and the Privacy Commissioner as KJ has sought.

Order

1. I declare that the Wentworth Area Health Service has contravened the Information Protection Principles provided for by sections 10 and 19 of the Privacy & Personal Information Protection Act 1998.

2. The Wentworth Area Health Service is ordered to refrain from collecting personal information from the Applicant without informing her of the purposes for which the information is being collected and the intended recipients of the information.

3. The Wentworth Area Health Service is ordered to refrain from disclosing the Applicant’s health information without her informed consent.

4. The Application is otherwise dismissed.