KT v South West Sydney Area Health Service

[2010] NSWADT 227

CITATION:	KT v South West Sydney Area Health Service [2010] NSWADT 227 This decision has been amended. Please see the end of the decision for a list of the amendments.
DIVISION:	General Division
PARTIES:	APPLICANT KT RESPONDENT South West Sydney Area Health Service
FILE NUMBER:	093255
HEARING DATES:	On the papers
SUBMISSIONS CLOSED:	6 April 2010
DATE OF DECISION:	14 September 2010
BEFORE:	Molony P - Judicial Member
LEGISLATION CITED:	Privacy and Personal Information Protection Act 1998 Health Records and Information Privacy Act 2002
CASES CITED:	Department of Education and Training v ZR (No 2) (GD) [2006] NSWCA 270 KO & KP v Commissioner of Police, New South Wales Police [2005] NSWADT 18 KT v South West Sydney Area Health Service [2010] NSWADT 131 LN v Sydney South West Area Health Service [2009] NSWADT 278 LN v Sydney South West Area Health Service (No 2) [2010] NSWADT 38 LN v Sydney South West Area Health Service (GD) [2010] NSWADTAP 16
REPRESENTATION:	APPLICANT In person RESPONDENT A Brit, barrister
ORDERS:	The Tribunal determines not to take any action with respect to the matter

REASONS FOR DECISION

The Application

1 KT made an application to review the conduct of the South West Sydney Area Health Service (the SSWAHS) under the Privacy and Personal Information Protection Act 1998 (the PPIP Act) and/or the Health Records and Information Privacy Act 2002 (the HRIP Act) on 25 September 2010. He had originally sought two internal reviews of the conduct in issue by the SSWAHS on 14 July 2010.

2 The application was originally listed before Judicial Member Higgins who subsequently recused herself from hearing the matter. It was then listed before me for a planning meeting 1 December 2010, when I made directions for the filing of evidence and submissions, and otherwise adjourned the matter for a further planning meeting on 23 February 2010. At that further planning meeting I decided that the issues for determination could be adequately determined, in the absence of the parties, on the papers in accordance with s 76 of the Administrative Decisions Tribunal Act 1997. I also made directions allowing KT to file any submissions in response to those filed by the SSWAHS.

3 KT subsequently made an application that I disqualify myself from hearing this and other matters on the ground of apprehended bias. I refused that application. On 1 June 2010 I provided written reasons for that decision: see KT v South West Sydney Area Health Service [2010] NSWADT 131.

4 KT asserts that the conduct complained of in each of his internal reviews was in contravention of the information protection principles (IPPs) under the PPIP Act and/or of the health privacy principles (HPPs) under the HRIP Act.

5 In his first internal review KT complained of the following conduct, verbatim:

(a) [The Hospital] disclosed my personal information to the lawyer of Mr. Mr [Z], in unlawful purpose, this happened on 3/4/2009. This happened while [the Hospital] refused to give me the same all details and documents of all investigations of the assault occurred on me inside the hospital.
(b) [The Hospital] collected my health information (sensitive information) from Mutual Employers Limited Co. Without consent from me or collect it directly from the individual (This occurred on April 2009). I sent fax to Dr Nossar and Ms. McAllister on 19 June 09, and they ignored the reply.
(c) The minute of an investigation done by HR or [the Hospital], was disclosed to the third party, by sending it by fax to (Environmental Service Department) and was exposed to public to see, although the investigator had cautioned all parties of the investigation not to talk about this matter and should be confidential (This minute of meeting has personal information opinion and about me ..ETC. (isn't victimisation as per the directive policies)
(d) Under freedom of information act, I got information that Chris Leahy contacted Newtown Police informed and disclosed my personal information in unlawful purpose, and asked police to take Even No. against me just not for taking action, but to take it and put it on my file to assist him dismiss me, and expressed his opinion about me. (I got on May 2009).
(e) Ms Jackie Mills, received a closed stamped envelop has application of an AVO by Ms Travers (which later is dismissed) and my address was C/ [the Hospital] as printed on the envelop, she disclosed my address to police who came to my address to hand it over to me. She has send to me by mail, while in other occasion: she ignored to send me a notice of attending court to me (I got it on May 2009).

6 Hereafter, these complaints shall be referred to as complaints 1(a), 1(b), 1(c), 1(d) and 1(e).

7 In his second internal review request KT sought to review the following conduct, verbatim:

Ms Charlotte Roberts has disclosed my personal and health information; name, email, health information, opinion etc, and sent my completed document to [LN], which I received on 13 July 2009.

8 KT says he received the internal review decisions on 24 and 25 September 2009 respectively, and alleges that they were out of time.

Jurisdiction

9 The Tribunal’s jurisdiction to hear and determine this application for review of conduct arises under section 55(1) of the PPIP Act, section 21 of the HRIP Act and section 38 of the Administrative Decisions Tribunal Act 1997 (‘the ADT Act’).

10 The conduct that is the subject of review is that identified by KT in his internal review applications quoted at above. In KO & KP v Commissioner of Police, New South Wales Police [2005] NSWADT 18, the Tribunal said:

‘13 In the present case, the internal review application plainly related to a particular disclosure by a particular, named, officer of the respondent on a particular occasion. Indeed, it is the only relevant conduct referred to in the relevant sense. Notwithstanding that a wide spectrum of contraventions of the IPPs is later alleged in the application (by a naming of the provisions only) the scope of the application is about the disclosure of certain personal information. I accept the submission of the respondent that these applications do not concern, for example, collection or storage of the alleged personal information.’

11 This passage was cited with approval by the Appeal Panel in Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44 at [18]. The Appeal Panel found that the scope of the internal review, reasonably construed, confined the boundaries of the external review. This is so as s 54 of the PPIP Act allows an applicant to seek review of ‘the conduct that was the subject of the application [for internal review] under section 53,’ not other conduct.

12 The SWSAHS submits and that in his application to the Tribunal regarding his second set of complaints KT has included two matters which were not the subject of his internal review application. These are:

Ms. Roberts used my personnel information in secondary purpose without lawful reasons.
Ms. Charlotte Roberts forced me to make consent to Ms [A].

13 Having perused all the material and evidence associated with this application I agree with the SSWAHS that these two complaints cannot be fairly characterised as falling within the scope of the conduct alleged in KT’s second internal review request. As a result the Tribunal does not have jurisdiction to review them.

14 I also agree with the SSWAHS that the delay in providing KT with the internal review decisions does not amount to conduct which can be the subject of a review by this Tribunal. Section 53(6) of the PPIP Act gives a person who has applied for internal review a right “make an application under section 55 to the Tribunal for a review of the conduct concerned,” when the review is not completed within 60 days. Such a review is, in any case, a review of the conduct concerned; i.e. in the internal review request.

Factual Context to Complaint 1

15 In order to understand the issues raised in this matter it is necessary to briefly outline the factual background against which the issues for consideration arise as disclosed (in part at least) by the evidence. It is clear that there are starkly different views as to those events held by the various persons involved. It is not necessary for me to resolve those differences and I have not attempted to so. It is, however, necessary to have some understanding of background conflict in order to understand and follow the evidence.

16 KT worked at the Hospital as a cleaner. As such he a member of the Environmental Services Department. Ms [Y] also worked in that Department. Her partner Mr [Z] also worked for the Hospital.

17 In the course of his employment KT has made a number of Worker’s Compensation claims against the SSWAHS for injuries sustained in the course of his employment. In 2008 there were a number of such claims active.

18 On 27 March 2008 there was an incident between KT and Ms [Y] while driving their vehicles on public roads. Each made allegations of improper conduct against the other with respect to that incident. On 28 March 2008 there was a further incident between them in the hospital premises for which each, again, blamed the other. Each made complaints to management about the other. KT said he was being bullied and harassed. Ms [Y] claimed she was fearful of KT. The SWSAHS commenced an investigation.

19 KT was off work after these incidents. It is not clear precisely why.

20 KT lodged a claim in the Industrial Relations Commission relating to victimization and the non-payment of wages for two days in January. It is not clear precisely when this occurred. He says it concerned the ongoing bullying and harassment. In those proceedings Ms [Y] filed an affidavit sworn on 10 June 2008 (TA10) in which she admitted an incident in February 2008, when she had glared at KT and pulled a face at him. These proceeding were ultimately discontinued with the SSWAHS writing to KT on 15 July 2008 saying that it apologised if he felt aggrieved by not working on the two days concerned, and that his future employment would not be prejudiced as a result (Exhibit 13 to KT’s affidavit).

21 When he was due to return to work in late July 2008 both KT and Ms [Y] were directed not to have contact with each other, and to treat the investigation as confidential. The internal investigation was still in progress.

22 Following his return to work an incident took place at the Hospital between Mr [Z] and KT on 30 July 2008. They became involved in an argument which escalated to a physical altercation during which Mr [Z] punched KT to his face and stomach. Mr [Z] then left and subsequently presented himself at the Police Station. He was charged with assault occasioning actual bodily harm. An internal investigation was commenced by the SSWAHS and staff members interviewed.

23 On 26 August 2008 Ms [Y] obtained an interim apprehended violence order against KT (TA7). KT then sought an apprehended violence order against Ms [Y]. Ms [Y]’s application was ultimately dismissed on 11 March 2009.

24 On 20 March 2009 the solicitors for Mr [Z] in the criminal proceeding relating to the assault charge served a subpoena to produce documents on the SSWAHS. That subpoena required the production of:

“The following documents and things in the possession the Human Resources Department of the Royal Prince Alfred Hospital relating to the investigation into the altercation between [Ms [Y]] and [KT] on 31 July 2008 at the [the Hospital]
1.All statements, including witness statements.
2.All department notes.
3.All records of interviews.
4.All findings.
5.All decisions and outcomes.”

25 Ms Mills; the Director of Human resources of the Hospital, complied with the subpoena on or about 26 March 2009.

26 The charges were heard before Magistrate Ellis. A copy of her Honour’s reasons for decision given on 3 April 2009, are part of exhibit JW5 to the Affidavit of Janelle Whalan filed by the SSWAHS. Her Honour dismissed the charges against Mr [Z], being satisfied that he acted in reasonable self-defence. With Mr [Z]’s consent, she also made a six months apprehended violence order restraining Mr [Z]’s interactions with KT.

27 On 12 January 2009 KT’s employment with the SSWAHS was terminated on the ground that he had breached the NSW Department of Health Code of Conduct, by reasons of three breaches of that code relating to the fight with Mr [Z].

The Evidence

28 There was a significant volume of evidence filed by both parties which I considered in the course of making this determination.

29 From the Applicant this consisted of:

- KT’s outline of evidence – filed 7-1-10 – with annexures TA1 to TA29
- Affidavit of KT with 34 exhibits.
- KT's outline of submissions with comments on the Respondent’s submissions and evidence (comments)

30 For the SSWAHS this consisted of affidavits from:

- Ms Mills, with 3 exhibits
- Ms [Y], with 2 exhibits
- Mr Leahy, with 2 exhibits
- Ms McAllister, with 2 exhibits
- Dr Nossar,
- Ms Whalan, with 5 exhibits
- Ms Roberts, with 11 exhibits.

31 Personal information is defined in both s 4 of the PPIP Act and s 5 of the HRIP Act as follows:

In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

32 Section 5 of the HRIP Act defines health information:

In this Act, health information means:
(a) personal information that is information or an opinion about:
(i) the physical or mental health or a disability (at any time) of an individual, or
(ii) an individual’s express wishes about the future provision of health services to him or her, or
(iii) a health service provided, or to be provided, to an individual, or
(b) other personal information collected to provide, or in providing, a health service, or
(c) other personal information about an individual collected in connection with the donation, or intended donation, of an individual’s body parts, organs or body substances, or
(d) other personal information that is genetic information about an individual arising from a health service provided to the individual in a form that is or could be predictive of the health (at any time) of the individual or of any sibling, relative or descendant of the individual,
but does not include health information, or a class of health information or health information contained in a class of documents, that is prescribed as exempt health information for the purposes of this Act generally or for the purposes of specified provisions of this Act.

33 Health information, so defined, is excluded from the meaning of personal information in the PIPPA by s 4A.

34 The SSWAHS conceded it is both an organisation and a health service provider within the meaning of the HRIP Act and that that Act applies to it.

35 KT’s application concerns both personal information to which the PPIP Act applies, and health information to which the HRIP Act applies.

36 The relevant IPPs under the PPIP Act are found in sections 10 to 19 of that PPIP Act. The relevant HPPs are found Schedule 1 of the HRIP Act.

Consideration of Complaint 1(a)

37 This complaint has two parts to it. First that the SSWAHS disclosed personal information to Mr [Z]’s lawyer, and secondly, that it refused him the same details and documents relating to the investigations of the assault.

38 Sections 17 and 18 of the PIPPA provide:

17. Limits on use of personal information
A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless:
(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or
(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or
(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.

18 Limits on disclosure of personal information
(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:
(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or
(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or
(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.
(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.

39 Section 25 of the PIPPA, however, provides that:

25 Exemptions where non-compliance is lawfully authorised or required
A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if:
(a) the agency is lawfully authorised or required not to comply with the principle concerned, or
(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998 ).

40 Similarly, HPP 11 (1) prohibits the disclosure of health information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless that purpose is one nominated in sub-paragraphs (a) to (l) of that principle. Clause (2) of the HPP, however, provides:

An organisation is not required to comply with a provision of this clause if:
(a) the organisation is lawfully authorised or required not to comply with the provision concerned, or
(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998 ),

41 KT’s complaint that the SSWAHS disclosed his personal information and health information to Mr [Z]’s lawyers gives rise to a consideration of all these provisions.

42 As I understand KT’s contentions he argues that the SSWAHS unlawfully disclosed information in two ways. First, by faxing a series of documents to Mr [Z]’s lawyers prior to the issue of the subpoena. Secondly, when Ms Mills complied with the subpoena, by producing to the Court documents outside its scope.

43 Annexed to KT outline of evidence are the following documents which he asserts were unlawfully disclosed by the SSWAHS to Mr [Z]’s lawyers before the subpoena was issued:

- TA2 - This is a faxed copy email from Ms [Y] to her manager dated 27 March 2008 complaining about KT’s behaviour on the roads the day before. This bears a fax imprint which shows it was sent from Environmental Services on 11 September 2008. It does not show to whom it was faxed.
- TA3 – This is a letter from Ms [Y] to her manager dated 28 March 2010 about an incident between KT and herself on that morning. This bears a fax imprint which shows it was sent from Environmental Services on 11 September 2008. It does not show to whom it was faxed.
- TA4 – This is a copy email to Ms [Y] to Mr Driver dated 11 July 2008. KT says t is bears a fax imprint which shows it was sent from Environmental Services on 11 September 2008. I cannot read the fax imprint. It does not show to whom it was faxed.

- TA5 - This is an internal memorandum to Ms [Y] dated 29 July 2008 directing her not have contact with KT and to keep the investigation confidential. This bears a fax imprint which shows it was sent from Environmental Services on 11 September 2008. It does not show to whom it was faxed.
- TA6 - This is a copy email to Ms [Y] to Mr Driver dated 5 August 2008. KT says it bears a fax imprint which shows it was sent from Environmental Services on 11 September 2008. I cannot read the fax imprint. It does not show to whom it was faxed.
- TA7 – This is a copy of the Interim AVO obtained by Ms [Y] against KT on 26 August 2010. KT says t is bears a fax imprint which shows it was sent from Environmental Services on 11 September 2008. I cannot read the fax imprint. It does not show to whom it was faxed.
- TA8 - This is a hand written document from a person elsewhere identified as Mr [Z] regarding a violent altercation. This bears a fax imprint which shows it was sent from Environmental Services on 11 September 2008. It does not show to whom it was faxed.
- TA9 – This is KT application for an AVO against Ms [Y]. This bears a fax imprint which shows it was sent from Environmental Services on 11 September 2008. It does not show to whom it was faxed.
- TA10 – This is a copy of Ms [Y]’s affidavit dated 29 June 2010 and filed in the Industrial Relations Commission proceedings commenced by KT. KT relies an index of documents (TA1) apparently prepared by Mr [Z]’s Barrister (in response to an ethics complaint made against him by KT). It shows that he was in possession of the Affidavit.
- TA11 – This is a copy letter from Ms [Y] to her manager dated 29 January 2008. KT says it was annexed to her IRC affidavit. It is not included in the Barrister’s index of documents.
- TA12 – This is a copy of TA2. KT says it was annexed to her IRC affidavit. It is included in the Barrister’s index of documents.
- TA13 - This is a copy of TA3. KT says it was annexed to her IRC affidavit. It is included in the Barrister’s index of documents.
- TA14 –This is a Police fact sheet regarding the charges against Mr [Z] and dated 31 July 2008. This bears a fax imprint which shows it was sent from Environmental Services on 11 September 2008. It does not show to whom it was faxed.
- TA15 – This is copy of an internal record of interview (KT calls it a minute of interview) conducted with Mr [Z] on 6 August 2008. It includes a copy of TA8 and identifies it as being written by Mr [Z]. This bears a fax imprint which shows it was sent from Environmental Services on 11 September 2008. It does not show to whom it was faxed.
- TA16 – This is a letter dated 2 October 2010 from a Hospital Assistant regarding the incident on 30 July 2008. KT says t is bears a fax imprint which shows it was sent from the SSWAHS. I cannot read the fax imprint. It does not show to whom it was faxed. It is in the barrister’s index of documents.
- TA17 – Copy email dated 4 November 2008 from Mr [Z]’s solicitor to his Barrister, attaching additional witness statements. By reference to the Barrister’s index of documents KT deduces that there were statements from Ms [Y]’s manager and another employee (W), neither of which is before me. KT says that this proves a disclosure of his personal information.
- TA18 – This is a one paragraph, apparently extracted from an unidentified document, who KT asserts was Mr [Z]’s barrister. It refers to the writer being aware of the “course of the internal investigation.” KT relies on this as proof of disclosure of personal information.

44 In her affidavit Ms [Y] said that on 11 September 2008 she sent (and then re-sent) by facsimile from work to the solicitors a fax (GT2) containing the following documents: TA2 (and TA12), TA3 (and TA13), TA7, TA8, TA14, and TA15. She said did so:

… on behalf of my partner and with his consent. I sent the facsimile in my personal capacity, I did not send it for work purposes.

45 On 16 September 2008 she also faxed to the solicitors a copy of KT application for an AVO against her: TA9. She did so for own and not for work purposes. The fax was accompanied by a request for advice about the AVO application.

46 In his affidavit KT said that there were many documents faxed from the Hospital to Mr [Z]’s lawyers. He noted that Ms [Y] had been told to keep the information regarding the investigation confidential. He argued that she had breached those confidentiality requirements by faxing documents relating to the investigation to the solicitors.

47 There is a disparity between the copy fax (GT2) sent by Ms [Y] and the documents produced by KT which were faxed from environmental services. Not included in GT2 are documents TA4, TA5, TA6, TA9, TA15 and TA16. Apart from TA16, each of these was faxed from environmental on 11 September 2008. An examination of the faxing time and page numbers on these documents reveals that they were sent as part of the same facsimile transmission. This leads me to conclude that Ms [Y]’s exhibit GT2 is incomplete.

48 In my view Ms [Y]’s evidence regarding sending these faxes is probable, consistent and likely. She has been involved in an ongoing workplace conflict with KT. This had escalated when her partner Mr [Z] had sought to intervene, resulting in him being charged with assault. All of the documents she said she faxed to the solicitors, together with those that I have found were also included in the fax, were sent by her on behalf of herself or Ms [Y], and were relevant background material available to her personally, or to Mr [Z].

49 I accept that she faxed the documents in her personal capacity and did not do so on behalf of or with approval of the SSWAHS.

50 I find that Ms [Y] faxed to the solicitors in her personal capacity the documents at TA2, TA3, TA4, TA5, TA6, TA7, TA8, TA9, TA12, TA13, TA14, TA15 and TA16. Insofar as she thereby disclosed KT’s personal information or health information that disclosure was not, on the material before me, authorised by, made on behalf of, or with the consent of the SSWAHS. The material she faxed was all material which, in the circumstances, she would be expected to have access to personally. They were documents to which both Ms [Y] and Mr [Z] had legitimate access to and control of personally. With respect to most of those documents (the AVO applications apart) they were also documents containing information which the SSWAHS had collected and used. In some cases that collection was from Ms [Y] and Mr [Z].

51 In Director General, Department of Education and Training v MT [2006] NSWCA 270 the Court of Appeal held that the disclosure of personal information help by an agency by an employee of that agency for the employees own purposes did not result in a breach of s 18 by the agency. Spigelman CJ , with whom IPP JA and Hunt AJA agreed said at [45]:

Where, as here, the "use" or "disclosure" of information was for a purpose extraneous to any purpose of the Department, it should not be characterised as "use" or "disclosure" by the Department or conduct of the Department. It is not appropriate to adopt a rule of attribution that extends so far.

52 Unlike the situation in Director General, Department of Education and Training v MT in which the unauthorised disclosure was made as a result of an access to department controlled records by a teacher, here Ms [Y] disclosed information that was available to and within the control of Mr [Z] and herself personally. The information related to matters in which they were personally concerned, albeit connected with their employment with the SSWAHS. The disclosure by Ms [Y] was not authorised by the SSWAHS. The disclosure was to Mr Z’s lawyers. It was made for the purposes of preparing his defence to criminal proceedings against him, which related to the information in the disclosed documents. This was extraneous to the purposes of the SSWAHS. The information disclosed was available to and in the control of Ms [Y] and Mr [Z] personally and they were free to disclose it to Mr [Z]’s lawyers. The fact Ms [Y] did so from a work fax, does not affect the personal nature of their access to and control of the information or of the disclosure.

53 Had Ms [Y] has accessed the SSWAHS’ records in order to obtained the documents in question, rather than having them personally, the disclosure by Ms [Y] was made in her personal capacity. There is no evidence that it was a disclosure made by the SSWAHS.

54 With respect to the apprehended violence application (TA9) KT pointed out that the document Ms [Y] faxed to the solicitors (GT2) included photographs of his injuries after the fight with Mr [Z]. He said that this should not have been disclosed. I have looked at Exhibit GT2 closely. It is a six page fax, including a hand written coversheet signed by Ms [Y]. The AVO application is out of order in the fax. The fax included, at page 4, photographs of KT’s injuries and, at page 6, an Attorney-General’s internal fax memorandum requesting the Registrar of the Local Court at Newtown to serve Ms [Y] with the APVO. That memorandum said that the total number of pages faxed to the Local Court was five, including the cover sheet. The application itself was three pages long, leaving one other page to be accounted for. The obvious explanation is that the application included a copy of the photographs. In the absence of any evidence to the contrary I accept that was the case.

55 With respect to documents TA10 and TA11 (Ms [Y]’s IRC affidavit and an annexure) there is no explanation in the evidence as to how this came into the possession of Mr [Z]’s lawyers. The documents do not bear a fax imprint. Two possible explanations suggest themselves. First, as KT maintains that it was disclosed by the SSWAHS to Mr [Z]’s lawyers. Secondly, that Ms [Y] provided Mr [Z]’s lawyers with a copy. Of these, the second impresses me as the more likely and probable.

56 Document TA17 is the email form Mr [Z]’s solicitors to his Barrister, attaching two statements. Those statements are not in evidence. KT suggests that they are from Ms [Y]’s manager and another employee (W). Accepting, for the present purposes that this was the case, there is no evidence that they were internal documents of the SSWAHS, that they contained personal information or health information relating to KT, or that they were disclosed by the SSWAHS. Who prepared the statements and for what purpose is entirely unclear.

57 Document TA18 is the one paragraph extract (KT says it was written by Mr [Z]’s barrister) stating that the lawyer was aware of the course of the internal investigation. KT relies on this as proof of the disclosure of his personal information. I reject this for a number of reasons. First the origins of the paragraph and who wrote it are entirely unclear. Secondly, accepting that it is what KT says it is, one would expect a barrister in the circumstances to take instructions from his client (Mr [Z]) and those associated with him (Ms [Y]) as to the course of the internal investigations into the incidents giving rise to, and the circumstances surrounding, the assault charge. To do his job properly counsel would have to ensure that he was aware of the course of that investigation. Being so aware does not demonstrate a disclosure of personal information or health information by the SSWAHS.

58 As a result of all the above I am not persuaded that the fact that all these documents were in the possession of Mr [Z]’s lawyers demonstrates a breach of the IPP 17 or 18, or of HPP 11 by the SSWAHS.

59 The second of aspect of complaint 1(a) involves a consideration of whether Ms Mills, when answering the subpoena on the SSWAHS behalf, disclosed documents outside of the scope of the subpoena.

60 Ms Mills evidence is that the documents she sent the Court were:

… the records and notes of interview of witnesses in relation to the investigation, a statement made by a staff member in relation to the incident, a report of the investigation and four letters evidence the outcomes of the investigation.

61 There is no evidence of precisely what those documents were. Given the way in which the subpoena was drawn, seeking “documents and things in the possession the Human Resources Department of the Royal Prince Alfred Hospital relating to the investigation into the altercation between [Ms [Y]] and [KT] on 31 July 2008,” the documents relating to the earlier the conflicts between KT and Ms [Y], and the investigation into them, should have been produced in response to the summons.

62 From his outline of evidence it is apparent that KT holds a different view. He alleges that KT failed to provide the Court with a copy of his statement to the internal investigation, and, “helped the accused and [Ms [Y]] to access to the details of the investigation before finishing it.”

63 Without evidence as to what precisely the documents produced by the SSWAHS to the Court were it is impossible to assess whether they were properly responsive to the subpoena: that is, in any case, a matter for the Court. Ms Mills' description of the documents produced appears to be properly responsive. The exceptions in s 25 of the PPIP Act regarding the disclosure of personal information, and in HPP 11(2) of the HRIP Act, apply.

Consideration of Complaint 1(b)

64 KT says that in April 2009 the SSWAHS collected health information from Employers Mutual Limited (EML), its workers compensation insurer or scheme agent.

65 KT provided two workers compensation certificates to the Tribunal at two different planning meetings. On 4 November 2009 he produced a WorkCover medical certificate dated 7 January 2009 which contains a hand written note "ATTN: Ms Kimberley please provide copy to employer thanks". At another planning meeting on 1 December 2009 KT produced another WorkCover medical certificate dated 16 January 2008. This certificate was sent with a cover letter from the Applicant to Ms McAllister, and received on 17 January 2008.

66 The second certificate contained a consent signed by KT to:

…my Nominated Treating Doctor, my employer, the insurer, other treating practitioners, rehabilitation providers, WorkCover approved Injury Management Consultants and WorkCover NSW exchanging information for the purposes of managing my injury and workers compensation claims. I understand this information will be used by WorkCover and insurers to fulfil their function under the workers compensation legislation.

67 It is not possible to tell whether KT signed the same consent on the first certificate as it has been cut off in the copying process. However in his comments KT wrote of this:

I made my consent to my treatment (sic) doctor…, my employer (not ex-employer), the insurer, other treatment practitioner, rehabilitation provider (not ex- rehabilitation provider) for exchange of information for the purposes of injury only.

68 From that, I am satisfied that KT did sign the consent.

69 In her affidavit Ms McAllister produced a copy of the second certificate as part of Exhibit MM1. That exhibit also included a letter dated 16 January 2008 from KT sending her that certificate. She placed both on KT’s rehabilitation file.

70 KT provided a letter (TA21) he had written to EML dated 8 June 2009 in which, put shortly, he had asked why they were providing his health information to his ex-employer. EML replied on 10 June 2009 (TA22). The letter confirmed that the medical certificate had been released to the SSWAHS. It explained that the SSWAHS “needs to be informed about your fitness to work as this directly impacts on their premium” and that he had consented to the release.

71 KT submitted that:

It is cleared (sic) that the respondent collected my health information because they wanted it from the insurer about my fitness for work, (while my employment was terminated), not as I asked the insurer to convey the certificate to the employer.

72 In his affidavit KT made the point that Ms McAllister was not his rehabilitation provider at the times she received these certificates, and that he was no longer an employee of the SSWAHS. He significantly expanded on this in his comments and argued that the evidence demonstrated that she had collected and retained his health information. He alleged breaches of IPP1 (s 8- collection of personal information), IPP2 (s 9 – information not be collected about a person from others without consent), IPP3 (s 10- obligations of an agency which has collected personal information), HPP1 (collection of health information for a lawful purpose) and HPP4 (obligations of an agency which collects health information).

73 Exhibit TA3 to KT’s affidavit is a letter he faxed to Dr Nossar and Ms McAllister on 9 June 2009 stating that he was aware that they were collecting his personal information and health information from the insurer and instructing them not to do so. In his affidavit KT Dr Nossar acknowledged receiving this, and exhibited his reply (GN2). KT made detailed submissions as to that letter, which do not assist in determining this complaint.

74 The information in the WorkCover medical certificates is plainly health information.

75 I agree with the Respondent that this complaint raises the issue of whether there had been a breach of HPP3 or HPP4. They relevantly provide:

3 Collection to be from individual concerned
(1) An organisation must collect health information about an individual only from that individual, unless it is unreasonable or impracticable to do so.
(2) Health information is to be collected in accordance with any guidelines issued by the Privacy Commissioner for the purposes of this clause.
4 Individual to be made aware of certain matters
(1) An organisation that collects health information about an individual from the individual must, at or before the time that it collects the information (or if that is not practicable, as soon as practicable after that time), take steps that are reasonable in the circumstances to ensure that the individual is aware of the following:
(a) the identity of the organisation and how to contact it,
(b) the fact that the individual is able to request access to the information,
(c) the purposes for which the information is collected,
(d) the persons to whom (or the types of persons to whom) the organisation usually discloses information of that kind,
(e) any law that requires the particular information to be collected,
(f) the main consequences (if any) for the individual if all or part of the information is not provided.
(2) If an organisation collects health information about an individual from someone else, it must take any steps that are reasonable in the circumstances to ensure that the individual is generally aware of the matters listed in subclause (1) except to the extent that:
(a) making the individual aware of the matters would pose a serious threat to the life or health of any individual, or
(b) the collection is made in accordance with guidelines issued under subclause (3).
(3) The Privacy Commissioner may issue guidelines setting out circumstances in which an organisation is not required to comply with subclause (2).
(4) An organisation is not required to comply with a requirement of this clause if:
(a) the individual to whom the information relates has expressly consented to the organisation not complying with it, or
(b) the organisation is lawfully authorised or required not to comply with it, or
(c) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998 ), or
(d) …

76 The evidence demonstrates the certificate dated 16 January 2008 included a consent signed by KT to information being exchanged with his employer for the purposes of managing his injury and workers compensation claims. KT sent that certificate. He clearly consented to and assisted in the collection. There is no merit in his complaint.

77 With respect to the certificate dated of 7 January 2009 this was sent to the SSWAHS by EML. The evidence demonstrates the certificate included a consent signed by KT to information being exchanged with his employer for the purposes of managing my injury and workers compensation claims. KT says that this consent did not extend to his ex-employer. I do not accept this. KT’s argument. The employer against whom KT was making his workers compensation claim was the SSWAHS. KT had made a series of such claims. Its liability for claims relating to KT’s employment did not cease on his employment being terminated, but continued while KT had a lawful claim to compensation or benefits. The SSWAHS was obviously the employer referred to in the consent which KT signed. Their involvement in his workers compensation claims did not cease on his employment being terminated. He clearly consented to the collection. This occurred after his employment was terminated.

78 The consent was not as KT submitted consent to the exchange of information for the purposes of injury only. It was for the purposes “of managing my injury and workers compensation claims.” Integral to that, from the SSWAHS’ perspective, is keeping track of ongoing claims against it, whether or not the worker concerned remained in employment.

79 There is no merit in his complaint.

Consideration of Complaint 1(c)

80 KT alleges that a minute of the internal investigation was faxed to the Environmental Services Department and was thereby exposed for the public to see. The minute in question is not in evidence, but, KT says, was required to be kept confidential.

81 This allegation is denied by the Respondent, who argues that such a minute would not contain personal information. Rather it would be information or an opinion about an individual's suitability for appointment or employment as a public sector official, and therefore not personal information within the meaning of the PPIP Act: s 4(3)(j).

82 In my view there is insufficient evidence to determine that this complaint is made out. The evidence does not persuade me that information was faxed to the Environmental Services Department or, if it was, that the information so conveyed was personal information or health information.

83 Further the transmission of such information within an agency does not provide evidence of disclosure.

Consideration of Complaint 1(d)

84 KT alleges that Mr Leahy, then the Acting Director of Corporate Services at the Hospital, contacted the Police and disclosed KT’s personal information to them with respect to the complaints Ms [Y] made against him following the incidents at the end of March 2008. KT said that this was done by Mr Leahy for an unlawful purpose (KT’s dismissal).

85 KT relied on a COPS Event ref No E139214784 created on 1 April 2010 by Police. It records that Ms [Y] attended the Police Station on that day to report workplace harassment issues on the advice of Mr Leahy. Ms [Y] provided the Police with details of the incidents which occurred on 27 and 28 March 2008. It continued:

The victim has spoken to her manager about workplace harassment and an investigation is currently taking place. The POI has been removed from work and is to attend a health check with a doctor before he is cleared to return to work. Mr Leahy has stated that POI may be dismissed pending the investigation.
Both the victim and manager Mr Leahy have informed police they wanted to make a record of the happenings but did not want action taken with the POI.

86 When the internal review was conducted by Ms Roberts she reported that when asked about contact with the Police, Mr Leahy stated, “that he did not contact … Police regarding [KT].”

87 In his affidavit Mr Leahy said that Ms [Y] had advised him of the incidents with KT. Following a discussion with the Manager of Internal Audit of the SSWAHS he emailed the manager of Environmental Services recommending that Ms [Y] contact the Police. On 1 April 2008 he was phoned by Police regarding the incidents reported by Ms [Y].

8. … I said words to the following effect, "I am aware of these incidents and the one that occurred within the workplace is being investigated".
During the conversation Officer Hall expressed his concern about the level of aggression demonstrated in these reported incidents and enquired what the workplace was doing to ensure the safety of [Ms [Y]]. I said words to the following effect "[KT] had been removed from the workplace and would require formal clearance before returning to the workplace". Officer Hall then asked me a question, he used words to the following effect "Has been dismissed or would he be dismissed as a result of this incident". I responded in general terms and said words to the effect that "dismissal may be a possibility but that no investigation had been completed at that time".
I advised Officer Hall that I did not require him to take any further action at this stage because I believed the separation of the two parties from the workplace was sufficient to prevent further escalation of the incidents but as one of the incidents happened outside the workplace, and given its seriousness it should be reported to police.
9 I disclosed information to Officer Hall about this matter because he was investigating two serious allegations against [KT] made by [Ms [Y]] alleging that [KT] had threatened her physically and verbally and I was trying to assist him with his duty as a police officer.
10 At the time of the phone call I had reasonable grounds to suspect that offences may have been committed whereby i) [KT] had driven erratically and cut [Ms [Y]] off whilst driving home and ii) where [KT] shouted at her "I'm going to get you" whilst preventing her from closing her office door.
11 I believe that disclosure of the information to the police was necessary to prevent or lessen what I believed to be a serious threat to [Ms [Y]].
12 I also disclosed the information to the Police in order to manage the risk for Sydney South West Area Health Service (SSWAHS) associated with the incident..

88 Mr Leahy said he was that when interviewed by Ms Roberts for the purpose of the internal review she had asked whether he had “contacted the Police regarding [KT].” He said he had not. He said that this was true, as the Police had contacted him.

89 In his affidavit KT made a number of allegations with respect to Mr Leahy’s subsequent actions, and his alleged failure to investigate KT’s complaints against Ms [Y]. He referred to the NSW Health Privacy Manual – Version 2 Paragraph 15.2.4.4. provides:

Where police wish to interview staff in relation to a matter that is unrelated to their work (eg, they may have witnessed a car accident or a crime), the health service will have no involvement in any interview, as it is purely a matter between staff member and police.
Where police seek to conduct an interview about an incident related to the health service (eg, in relation to a coronial matter or an assault on hospital premises) the staff member should be advised to contact their representative organisation, or a support person should be offered.

90 As I understood it KT was of the view that in compliance with the Privacy Manual Mr Leahy should not have agreed to speak with Police. This was because Ms [Y] had two complaints against KT, one of which occurred at work (and therefore should be handled under the grievance or discipline policies) and one that occurred away from work. That later complaint KT submitted, in his comments, was unrelated to work. As a result, KT argued that Mr Leahy should not have spoken with Police.

91 I do not accept this. Ms [Y] had made a series of complaints against KT which, if true, demonstrated a very concerning pattern of intimidation and harassment, with the potential to put Ms [Y] as significant risk. In my view both the incidents about which Ms [Y] complained were related to the health service. They concerned an alleged pattern of harassment and intimidation between employees of the SSWAHS, which had started in and was associated with the workplace, but had spread from there to the public roads. It involved conduct which had the potential to put the physical safety of those involved at significant risk.

92 Further, in his comments, KT sought to argue that rather than the Police contacting Mr Leahy by phone, they had left a message for him, and Mr Leahy had the contacted them. There is no evidence to support this.

93 Mr Leahy’s literal interpretation of the question that Ms Roberts asked concerning whether he was contacted by Police has had the unfortunate consequence of leading KT to believe that Mr Leahy was not truthful in his response to that question. KT has made a vigorous attack on his reliability as a result. My view of the issue is that Mr Leahy’s explanation of those events is consistent with the Police Event entry. There is no evidence which demonstrates that Mr Leahy himself contacted the Police. I accept they contacted him.

94 This complaint by KT is clearly focussed on the disclosure of what he says is his personal information by Mr Leahy to the Police. It raises for consideration whether there has been a breach of the disclosure requirements in s 18 of the PPIP Act.

95 The SSWAHS argued that the information Mr Leahy gave the Police was information opinion about KT’s suitability for appointment or employment, and therefore excluded from the meaning of personal information. I do not accept this. In the context in which Mr Leahy provided the information it was information and opinion with respect to KT’s conduct in his interactions with Ms [Y].

96 Section 23(5) (d)(ii) of the PPIP Act provides that:

(5) A public sector agency (whether or not a law enforcement agency) is not required to comply with section 18 if the disclosure of the information concerned:
(d) is reasonably necessary:
(i)…
(ii) in order to investigate an offence where there are reasonable grounds to believe that an offence may have been committed.

97 In my opinion Ms [Y]’s complaint to the Police provided reasonable grounds for the belief that KT may have committed one or more offences: offences relating to road rage immediately come to mind. Ms [Y] had made a complaint to the Police that they were investigating. In those circumstances the SSWAHS was not required to comply with s 18. I also accept that the disclosure of the personal information was authorised by the NSW Health Privacy Manual – Version 2 Paragraph 15.2.4.4.

Consideration of Complaint 1(e)

98 KT alleges that Ms Mills, the HR Director, gave Police his address thereby enabling them to serve him at home with Ms [Y]’s application for an APVO. He produced a copy of that application which shows his address as care of the Environmental Services Department at the Hospital, and a copy of the envelope in which it was contained from the Local Court addressed to him at the Hospital. He complains that Ms Mill’s did not simply forward the envelope to him, but rather gave Police his address.

99 In her affidavit Ms Mills expressly denied disclosing KT’s address to the Police.

100 In his affidavit KT made a series of allegations against Ms Mills not related to the issues now under consideration. With respect to this issue he argued that the Police must have obtained his address for the Human Resources department. He regarded this as a logically compelling conclusion.

101 I do not share that view. The Police have significant resources available to them to locate the addresses of individuals. The fact that they served him at home does not lead to the conclusion that the SSWAHS, and Ms Mills in particular, disclosed his address to them.

102 There is no breach of section 18 of the PPIP Act demonstrated by the evidence.

Factual Background to Complaint 2

103 It is necessary to cover the background leading up to KT’s second complaint in some detail, in order to properly understand the issues it raises.

104 On 3 September 2008 the SSWAHS received an application for internal review from KT and LN. It was referred to Ms Roberts to conduct the review. A copy of the internal review application is exhibit CR1 to Ms Roberts’ affidavit. It was made and signed by KT and indicated that KT was complaining on behalf of his wife LN, who was capable of making the complaint herself. It alleged, among other things, that the SSWAHS had disclosed health information relating to his wife, his daughter and himself, and had obtained LN’s medical reports without consent.

105 On 30 September 2008 Ms Roberts wrote to KT requesting further information to enable the internal review to investigate his allegations. She wrote that:

…before I can commence the investigation I will need a letter from your wife which states that she gives SSWAHS authorization to proceed with the investigation about the alleged disclosure of her health information …

106 No such consent was received. As a result Ms Roberts conducted the internal review without accessing LN’s medical records.

107 On 12 October 2008 KT sent an email to Ms Roberts in which he provided further information as requested (Exhibit CR3). This included information relating to the alleged disclosure of KT’s health information by the Manager of Environmental Services, Ms Mills and Mr Leahy.

108 The internal review was completed on 21 November 2008. A copy was sent to KT on 4 December 2008. It included the following paragraph:

[KT] has also made application on behalf of his wife, in my letter (dated 30 September 2008), to [KT] acknowledging receipt of his application, I advised that I required a letter from his wife giving SSWAHS authorisation to proceed with the investigation about the alleged disclosure of her personal health information. The authorisation was not provided to me. Without her authority I have not undertaken investigation into the direct handling of her personal health information. I have not accessed her records nor undertaken any audit procedure on them.

109 The review (Exhibit CR4) nonetheless considered the allegations that the SSWAHS had disclosed LN’s health information, and found that no conduct in breach of a IPP or HPP had been demonstrated.

110 On 20 April 2009 Ms Roberts received am internal review application from LN. She alleged the collection and disclosure of her health information by the Manager of Environmental Services, Mr Leahy, Ms Whalan, Dr Nossar and one other person. Ms Roberts wrote to KT on 29 May 2009 requesting that she provide specific information with respect to those allegations. By fax dated 3 June 2009 LN replied (the fax imprint bears KT’s first name) giving some details of her allegations against Ms Whalan only, but not with respect to the other individuals she had named. An attachment to LN’s fax was a response from Dr Nossar relating to KT. This provided Ms Roberts with a link back to the earlier internal review sought by LN on behalf of himself, his wife and child.

111 Ms Roberts found (Exhibit CR8) that LN’s complaint was out of time and that she had not provided any additional information as requested. She proceeded with the review with respect to Ms Whalan and found no breach of a HPP. She attached a copy of the earlier internal review decision (Exhibit CR4) “to confirm and remind [LN] that the complaint had been dealt with by the previous internal review report prepared for her and her husband.”

112 LN unsuccessfully appealed that decision to this Tribunal: see LN v Sydney South West Area Health Service [2009] NSWADT 278. It is to be noted that KT acted as agent for LN in the proceedings before the Tribunal: the reasons record that KT appeared as her agent. I also note that the Appeal Panel refused KT leave to act as agent for LN in appeal proceedings relating to that application: LN v Sydney South West Area Health Service (GD) [2010] NSWADTAP 16, heard on 27 January 2010.

113 On 14 July 2009 made the internal review application now under discussion. He complained that by providing LN with a copy of the earlier internal review decision, the SSWAHS had disclosed his personal information to LN.

114 The internal review was conducted by Ms Whalan. She did so on the basis that KT’s compliant raised three issues which required consideration. There were that he alleged that Ms Roberts had:

-Disclosed his personal information and health information to LN.
-Done so without his consent.
-Failed to secure and misused KT’s personal information and health information.

115 Ms Whalan found no breach of s 18 the PPIP Act (IPP 11) or of HPP 11.

116 The present review requires the Tribunal to again consider that conduct.

Consideration of Complaint 2

117 There is no dispute that Ms Roberts used KT’s personal information and health information from the earlier internal review when considering LN’s later request for internal review. Similarly, there is no dispute that she disclosed that limited information to LN by providing her with a copy of that earlier internal review decision.

118 The personal information disclosed in doing so consisted of LN’s email address. That email address was written on application for internal review KT made on behalf of LN and him. While there is a reference to health information in the internal review report there is no associated medical or diagnostic details provided.

119 Sections 17 and 18 of the PPIP Act provide:

17 Limits on use of personal information
A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless:
(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or
(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or
(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.
18 Limits on disclosure of personal information
(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:
(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or
(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or
(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

120 Insofar as the document contained health information HPP 10 relevantly provides:

(1) An organisation that holds health information must not use the information for a purpose (a secondary purpose ) other than the purpose (the primary purpose ) for which it was collected unless:
(a) Consent
the individual to whom the information relates has consented to the use of the information for that secondary purpose, or
(b) Direct relation
the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose, or
…
(j) Investigative agencies
the use of the information for the secondary purpose is reasonably necessary; or
…
(5) The exemption provided by subclause (1) (j) extends to any public sector agency, or public sector official, who is investigating or otherwise handling a complaint or other matter that could be referred or made to an investigative agency, or that has been referred from or made by an investigative agency.

121 HPP 11 relevantly provides:

An organisation that holds health information must not disclose the information for a purpose (a secondary purpose ) other than the purpose (the primary purpose ) for which it was collected unless:
(a) Consent
the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or
(b) Direct relation
the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or
Note. For example, if information is collected in order to provide a health service to the individual, the disclosure of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose
…
(k) Investigative agencies
the disclosure of the information for the secondary purpose is reasonably necessary for the exercise of complaint handling functions or investigative functions by investigative agencies, or

…
(6) The exemptions provided by subclauses (1) (k) and (2) extend to any public sector agency, or public sector official, who is investigating or otherwise handling a complaint or other matter that could be referred or made to an investigative agency, or that has been referred from or made by an investigative agency.

122 The SSWAHS argues that when KT made the earlier internal review on behalf of his wife and himself he impliedly consented to the use of his personal and health information both in determining the complaint and in reporting on the complaint to both LN and himself. This, it submits, extends to the situation where LN made a further complaint about some of the same matters.

123 In LN v Sydney South West Area Health Service (No 2) [2010] NSWADT 38 Montgomery JM at [74] considered the implicit consent that a person seeking an internal review gives to a reviewer considering relevant health information:

… I agree that it can be implied that a complainant making an application for an internal review has implicitly consented to the reviewer having use of and being given access to relevant health information in respect of that application. It would be impossible for a reviewer to conduct an investigation and not have access to relevant health information. In my view, LN has implicitly consented to the Respondent using her relevant health information for that purpose. It is also my view that the health information that Ms Whalan used was relevant for the purposes for which it was used.

124 I agree with that analysis. The making of such an implication, in the absence of express statements with-holding such consent, is necessary to achieve the object set out in s 3(1)(c) of the HRIP Act of providing an accessible framework for the resolution of complaints regarding the handling of health information, and that of the PPIP Act with respect to personal information. I am satisfied that by making the application for internal review KT impliedly consented to his health information being used for the purpose of that internal review.

125 Here the SSWAHS’ argument goes a step further. It says that where a complaint is made by a person on behalf of her or himself and another, the person making the application impliedly consents not only to the use of his or her health information in the course of the deliberative process, but to the release of that information to the other in reporting on the outcome of the review. That consent, it is argued, extends to include to the later use and release of the information to the other person where they make a later internal review request relating to the same matter.

126 In my opinion the consent implied when KT made the internal review application on behalf of LN and himself was to his health information being accessed and used for the purposes of that review, and being released to LN for the purposes of that review. I do not see any justification for implying consent to the use of his health information in a subsequent review made by LN. Such an implication is not reasonably necessary for the purposes of the internal review to which the implied consent relates.

127 Next the SSWAHS submits that Ms Roberts use of KT’s health information was reasonably necessary for the secondary purpose of Ms Roberts undertaking an internal review in respect of LN application: HPP10(1)(b). The SSWAHS argues that the internal review process necessarily involves an investigation “to obtain information in respect to the alleged conduct from persons other than the applicant and such information would invariably include ‘health information’”. Thus any non-compliance with HPP 10(1) is reasonably necessary for the conduct of the review.

128 In my opinion, this submission is too wide. Where the health information being accessed is not that of the individual who has made the application for internal review, then the fundamental question is whether it was reasonably necessary to use the health information in question for the purposes of the review. In this case, the first review covered some of the same ground as that which fell within the scope of LN’s later internal review request. KT had made the earlier internal review application on behalf of himself and LN. The similar matters in issue in both had been investigated and considered in the first internal review decision. The use of the earlier internal review was therefore reasonably necessary for the conduct of the second in accordance with HPP (10(1)(b).

129 Further, the SSWAHS submitted that the use of the health information was reasonably necessary for the secondary purpose of exercising the complaint handling functions or investigative functions by investigative agency: HPP 10(1)(j). Because the SSWAHS is not an investigative agency within the meaning of s 4 of the HRIP Act, the SSWAHS relies on sub-clause (5) on the basis that the complaint could be referred to the Health Care Complaints Commission.

130 Section 65 of the HRIP Act provides:

(1) The Privacy Commissioner may refer a complaint made under this Act to the Health Care Complaints Commission if the complaint concerns:
(a) the professional conduct of a health service provider, or
(b) a health service that affects the clinical management or care of a person who uses or receives a health service (including a patient).
(2) The Privacy Commissioner may communicate to the Health Care Complaints Commission any information that the Privacy Commissioner has obtained in relation to the complaint.
(3) The Privacy Commissioner and the Health Care Complaints Commission are to consult regularly to ensure the appropriate referral of complaints between them.
Note. Section 26 of the Health Care Complaints Act 1993 provides that the Health Care Complaints Commission may refer a complaint to another person or body. The Commission may therefore refer a complaint that raises a possible contravention of a Health Privacy Principle, a provision of Part 4 or a health privacy code of practice to the Privacy Commissioner.
(4) This section does not affect the operation of section 47 (Referring privacy related complaints to other authorities) of the PPIP Act.

131 In this case KT’s there is no suggestion that LN’s complaint related to the professional conduct of a health service provider, or affected the clinical management or care of a person. As a result, I do not accept the SSWAHS’ submission with respect to clause 10(1)(j).

132 With respect to the disclosure KT’s health information to LN, the SSWAHS makes similar submissions with respect to HPP 11 as it did to HPP 10. It argues that by including LN in his initial complaint, KT had impliedly authorised the disclosure to LN of his health information reasonably used for the purposes of that internal review. I think that this necessarily flows from his seeking a privacy internal review on his own and LN’s behalf. The joint nature of that complaint indicated his consent to health information relevant to the review being disclosed to LN as part of that deliberative process. The SSWAHS had no reason to believe that KT would object its disclosure to LN.

133 Having consented to that release, I have great difficulty in seeing how KT can reasonably argue that the consent was limited so as to prevent the subsequent release of a copy of the internal review decision to LN, albeit in another context.

134 With respect to KT’s personal information he had, when making his initial internal review application, consented to the use of his personal information for the purpose of considering the complaint he made on LN’s behalf. Ms Roberts used that information in considering the same complaints, but when LN was making the subsequent complaint. The purpose for which Ms Roberts used the personal information was the investigation of those complaints. KT had impliedly consented to such a use.

135 Ms Roberts released a copy of the first internal review decision to LN in the belief that it related to a complaint made by LN and KT, and had been previously provided to them, via KT. It was disclosed to LN for the purposes for which it had been collected (the investigation of a privacy complaint by LN and KT) and the SSWAHS had no reason to believe, in the circumstances, that KT would object to the disclosure to LN.

136 KT says that he made the application for internal review on behalf of himself and LN “without her consent.” He submits that in subsequently disclosing the whole of that decision to LN, Ms Roberts disclosed matters concerning him alone, as well as those concerning LN. In this he is correct. KT argues that any consent he gave was time limited, although he does not say how. He argues that for consent to be valid it must be in writing and describe the purposes for which it was given. He says that there is no general provision which requires that he disclose his personal and health information to “my wife or ex-wife even my daughters”.

137 I agree with KT that he is not bound to disclose his health information to his wife, his ex-wife or his children.

138 I am, however, satisfied that when he made the original internal review application on his own and LN’s behalf, he impliedly consented to the reviewer accessing his health information and personal information that was relevant to and necessary for the proper conduct of the internal review. The document evidencing that implied consent is the application for internal review, signed by him. He also impliedly consented to the release of that internal review and any personal information or health information it contained to LN.

139 Ms Roberts was therefore entitled to regard him as having consented to the release of the first internal review to LN.

140 One further point needs to be made about this. KT says he made the application on LN’s behalf without her consent. This is an issue which was raised by LN in her own proceedings. The Tribunal found that she had agreed to KT’s application. Whether or not LN was willingly a party to KT’s initial internal review application is not germane to the issue to be decided before me. I simply observe that if KT did make the first application without LN’s authority, as he now claims, it would be unconscionable to allow him now to resile from the consent to his information being disclosed to LN implicit in that application.

Conclusion

141 As a result of all of the above I conclude that there has been no conduct which breaches a HPP or IPP by the SSWAHS. As a result the Tribunal determines not to take any action with respect to the matter.

21/01/2011 - typographical error amended, Ipp JA - Paragraph(s) 51