LN v Sydney South West Area Health Service (No 2)

[2010] NSWADT 38

CITATION:	LN v Sydney South West Area Health Service (No 2) [2010] NSWADT 38
DIVISION:	General Division
PARTIES:	APPLICANT LN RESPONDENT Sydney South West Area Health Service
FILE NUMBER:	093170
HEARING DATES:	On the papers
SUBMISSIONS CLOSED:	11 December 2009
DATE OF DECISION:	8 February 2010
BEFORE:	Montgomery S - Judicial Member
CATCHWORDS:	Privacy – information protection principle – personal information –Health information – Health Privacy Principle - use of health information
LEGISLATION CITED:	Administrative Decisions Tribunal Act 1997 Health Records and Information Privacy Act 2002Privacy and Personal Information Protection Act 1998
CASES CITED:	Department of Education and Training v MT [2005] NSWADTAP 77 FM v Macquarie University [2003] NSWADT 78 GL v Department of Education and Training [2003] NSWADT 166 JD v Department of Health (No 2) [2004] NSWADT 227 JD v NSW Department of Health [2007] NSWADT 219 LN v Sydney South West Area Health Service [2009] NSWADT 278
REPRESENTATION:	APPLICANT In person RESPONDENT A Britt, barrister
ORDERS:	The application is dismissed.

REASONS FOR DECISION

1 In these reasons the names of several private individuals have been anonymised so as to preserve the privacy of their personal affairs. The Applicant is referred to as LN. I have also limited my discussion of the evidence in order to avoid the possibility that the identities of individuals might be revealed.

2 LN was a patient at a hospital (“the hospital”) operated by the Respondent. In April 2009 she sought a review of conduct of the agency under the Privacy and Personal Information Protection Act 1998 (‘PPIP Act’) and the Health Records and Information Privacy Act 2002 (“the HRIP Act”) and she asserted a number of breaches of the Information Privacy Principles (‘IPPs’) contained in the PPIP Act and the Health Privacy Principles (‘HPPs’) contained in the HRIP Act by the agency.

3 The background of the matter is set out in more detail in my decision in LN v Sydney South West Area Health Service [2009] NSWADT 278. On 29 September 2009 I dismissed most of LN’s application. I found that the Tribunal has jurisdiction to hear that part of LN’s Application that is made in respect of the correspondence sent by Ms Jan Whalan to LN on 30 January 2009. This decision relates to that part of the application.

4 LN’s application for an internal review complained of the following conduct:

“Ms. Jan Whalan sent a letter to me on 30 January [2009] admitted that she was aware that I will come on (due date) to [the hospital], so that she accessed to my health information to know when and where will I get to [the hospital] for PET Scan.”

5 The Applicant appears to allege a disclosure and misuse of health information. I agree with the Respondent’s interpretation of LN’s complaint as being in the following two parts:

(a) that Ms Whalan sent a letter to LN in which Ms Whalan discloses to LN that she is aware that LN will attend the hospital at the end of January 2009 for a follow up appointment; and
(b) Ms Whalan accessed LN’s health information in order to know that LN would attend the hospital for a follow up appointment.

6 The Respondent admits the first of those complaints i.e. that Ms Whalan wrote to LN and disclosed her knowledge of the follow up appointment. It also concedes that the information about LN attending the hospital is "personal information" for the purposes of section 5 of the HRIP Act.

7 It is conceded that the Respondent is an organisation as defined in section 4 of HRIP Act and that the Respondent is a health service provider as defined in section 4 of the HRIP Act. It is conceded that the information that LN would be attending the hospital for a follow up appointment is health information within section 6(a)(iii) of the HRIP Act.

8 Section 4A of the PPIP Act excludes all health information from the definition of personal information from 1 September 2004. That section provides:

4A Exclusion of health information from definition of “personal information”
Except as provided by this Act or the Health Records and Information Privacy Act 2002, the definition of personal information in section 4 does not include health information within the meaning of the Health Records and Information Privacy Act 2002.

9 The term " health service provider" is defined in section 4 of the HRIP Act as follows:

health service provider means an organisation that provides a health service but does not include:
(a) a health service provider, or a class of health service providers, that is prescribed by the regulations as an exempt health service provider:
(i) for the purposes of this Act generally, or
(ii) for the purposes of specified provisions of this Act, or
(iii) for the purposes of specified Health Privacy Principles or health privacy codes of practice, or
(iv) to the extent to which it is prescribed by the regulations as an exempt health service provider, or
(b) an organisation that merely arranges for a health service to be provided to an individual by another organisation.

10 The term "personal information" is defined in section 5 of the HRIP Act as follows:

5 Definition of “personal information”
(1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

11 Section 11 of the HRIP Act provides:

11 How this Act applies to organisations
(1) This Act applies to every organisation that is a health service provider or that collects, holds or uses health information.
Note. The term organisation means a public sector agency or a private sector person.
(2) An organisation to whom or to which this Act applies is required to comply with the Health Privacy Principles and with any health privacy code of practice or provision of Part 4 that is applicable to the organisation.
(3) An organisation must not do any thing, or engage in any practice, that contravenes a Health Privacy Principle or a health privacy code of practice or a provision of Part 4 in respect of which the organisation is required to comply.

12 Health information is defined in section 6 of HRIP as follows:

6 Definition of “health information”
In this Act, health information means:
(a) personal information that is information or an opinion about:
(i) the physical or mental health or a disability (at any time) of an individual, or
(ii) an individual’s express wishes about the future provision of health services to him or her, or
(iii) a health service provided, or to be provided, to an individual, or
(b) other personal information collected to provide, or in providing, a health service, or
(c) other personal information about an individual collected in connection with the donation, or intended donation, of an individual’s body parts, organs or body substances, or
(d) other personal information that is genetic information about an individual arising from a health service provided to the individual in a form that is or could be predictive of the health (at any time) of the individual or of any sibling, relative or descendant of the individual,
but does not include health information, or a class of health information or health information contained in a class of documents, that is prescribed as exempt health information for the purposes of this Act generally or for the purposes of specified provisions of this Act.

13 Health Privacy Principle 10(1) provides:

10 Limits on use of health information
(1) An organisation that holds health information must not use the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless:
(a) Consent
the individual to whom the information relates has consented to the use of the information for that secondary purpose, or
(b) Direct relation
the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose, or
Note. For example, if information is collected in order to provide a health service to the individual, the use of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose.
…
(j) Investigative agencies
the use of the information for the secondary purpose is reasonably necessary for the exercise of complaint handling functions or investigative functions by investigative agencies, or
…
(2) An organisation is not required to comply with a provision of this clause if:
(a) the organisation is lawfully authorised or required not to comply with the provision concerned, or
(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).
(5) The exemption provided by subclause (1) (j) extends to any public sector agency, or public sector official, who is investigating or otherwise handling a complaint or other matter that could be referred or made to an investigative agency, or that has been referred from or made by an investigative agency.

14 Health Privacy Principle 11(1) provides:

11 Limits on disclosure of health information

(1) An organisation that holds health information must not disclose the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless:
...

15 The Respondent relies on written submissions by Mr Britt and:

(a) an affidavit dated 20 November 2009 of Janelle Whalan, the Respondent’s Director Corporate Services; and
(b) an affidavit dated 13 November 2009 of Charlotte Roberts, the Respondent’s Principal Investigations and Compliance Officer.

16 Ms Whalan’s evidence is that she requested details about any further appointments LN may have at the hospital to assist her with internal review as Privacy Officer; and for her general investigation into LN’s complaint/allegation/claim. She said that she was trying to determine whether LN had organised a follow up appointment with her referring doctor, to inform her decision about whether the Report could be safely released to her in accordance with the departmental procedure. In addition, she needed to know if LN would be returning to the hospital so she could effectively manage any risks associated with future interactions between LN and Hospital staff and requests for her information.

17 She agreed that she sent correspondence to LN but says that she never accessed or viewed LN's medical record.

Ms Roberts’ evidence

18 Ms Roberts’ evidence is that her responsibilities include coordinating, managing and assisting with grievance management, complaints management and other corporate services functions and compliance responsibilities for those hospitals and services with reporting accountability to the Respondent and the NSW Department of Health. She also conducts and reports internal reviews for Privacy, FOI and Human Resources.

19 In April 2009 she received an application for Internal Review from LN. She conducted an investigation into the complaint and prepared an internal review report in relation to the alleged privacy breach. In June 2009 she sent a letter to LN attaching a copy of the report into her internal review. He affidavit annexed copies of a number of documents the evidence dealings between the parties.

The Respondent’s submissions

20 The Respondent submits that the relevant Health Privacy Principle that appears to be applicable to LN’s application is principle 10 - the use of health information. It says that principle 11 is not relevant as it concerns the external as distinct from internal use of information (see Department of Education and Training v MT [2005] NSWADTAP 77 at [39] where a similar distinction was made in respect of sections l7 and 18 of PPIP Act).

21 The Respondent concedes that the term "use" has been given broad meaning (see JD v Department of Health (No 2) [2004] NSWADT 227; JD v NSW Department of Health [2007] NSWADT 219; GL v Department of Education and Training [2003] NSWADT 166 and FM v Macquarie University [2003] NSWADT 78).

22 The Respondent concedes that Ms Whalan did "use" the information in reviewing and responding to LN's internal review application and LN's complaint more generally. It says that Ms Whalan's use was both in her capacity as a reviewer but also more generally in her role as a Director of Corporate Services in responding to a complaint from a client.

23 The Respondent relies on a number of exemptions to principle 10.

Consent
24 Principle 10(1)(a) excludes the circumstances where there is consent. The Respondent submits that the consent of the person concerned maybe express or implied. It says that by making an application for an internal review LN has implicitly consented to the Reviewer (Ms Whalan) having use of and being given access to health information in respect of LN's application.

25 It says that the Reviewer is required to carryout an investigation of the alleged conduct (section 53(1) & (2) of the PPIP Act). The Reviewer must review the conduct the subject of the application (section 53(5) of the PPIP Act). It will be necessary in such an investigation to obtain information in respect to the alleged conduct from persons other than the applicant and such information would invariably include "health information".

26 It would be impossible for a reviewer to conduct an investigation and not have access to health information if only to check the accuracy or veracity of any complaint. The Respondent submits that this approach is consistent with the purpose of the HRIP Act in section 3(l)(c).

27 Further, it submits that the material in the internal review application went beyond an application for a review and was a complaint of a general nature. In such circumstances LN gave the Respondent an implied consent to respond to that complaint and address the issues that were of a concern to LN and in particular obtaining a copy of the scan report.

Complaint handling function
28 Principle 10(1)(j) allows the use of information for a secondary purpose of complaint handling functions. The Respondent submits that the phrase "by investigative agencies" in Principle 10(1)(j) does not qualify the phrase "for the exercise of complaint handling functions". Accordingly, it says that Principle 10(l)(j) allows the Respondent to use health information for its complaint handling functions.

29 In the alternative, the Respondent relies upon Principle 10(5). It is submitted that the Respondent is a public sector agency and Ms Whalan is a public sector official who was investigating or otherwise handling a complaint that could have been referred or made to an investigative agency (i.e. Health Care Complaints Commission (“HCCC”)) by LN.

30 The Respondent says that Ms Whalan was undertaking a complaint handling function when considering LN's application for internal review. The use of this information by Ms Whalan was reasonably necessary to assist her with her investigation and internal review as Privacy Officer as well as her general investigation into the complaint/claim in her role as the Director of Corporate Services. Ms Whalan was trying to determine whether LN had organised a follow up appointment with her referring doctor to inform her about her decision about whether the Report could be safely released to LN.

31 In addition, Ms Whalan needed to know if LN would be returning to the Department of PET and Nuclear Medicine so she could effectively manage the risk associated with future interactions between LN and Hospital staff and future requests for LN’s information.

32 The Respondent relies on the exemption contained in Principle 10(2) (b). It says that the reviewer is required to carry out an investigation of the alleged conduct (section 53(1) & (2) of the PPIP Act). The Reviewer must review the conduct the subject of the application (section 53(5) of the PPIP Act). It will be necessary in such an investigation to obtain information in respect to the alleged conduct from persons other than the applicant and such information would invariably include "health information". The Respondent says that in this sense any non-compliance is necessarily implied or reasonably contemplated in order to conduct a review.

Legitimate secondary purpose
33 The Respondent submits that Principle 10(1)(b) allows it to use information for a secondary purpose directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose. The primary purpose of the information was LN attending the hospital on 3 November 2008 for treatment concerning the same matters that were the subject of the initial complaint that was the subject of the review by Ms Whalan.

34 The Respondent says that providing a report with respect to a previous scan on a day that LN was at the hospital is a legitimate secondary purpose and an individual would reasonably expect the organisation to use the information for the secondary purpose i.e. the date they were attending the hospital.

35 Further, the Respondent says that the information was used for the secondary purpose of handling a legal claim, an alleged breach of the privacy legislation, made by LN. LN would reasonably expect this use (as required by section 10(l)(b)) because the Patients/Clients Privacy and Information Brochure states that patient information may be used for the management of legal claims. Further, the information was used for the secondary purpose of investigating a complaint made by LN about the health service and LN would reasonably expect such a use.

36 The Respondent submits that the application should be dismissed. In the alternative, if the Tribunal finds that there has been a breach by the Respondent it is of the most trivial nature and it is open to the Tribunal to decide not to take any action on the matter.

LN’s case

37 LN relies on written submissions in reply to the Respondent’s evidence and submissions. LN also relies on an affidavit by TA.

TA’s evidence

38 TA accompanied LN when LN visited the hospital in November 2008 and January 2009. He is a former employee of the hospital and is aware of the Respondent’s internal policies and guideline.

39 TA’s evidence primarily concerns LN’s visit to the hospital on 24 November 2008 and on 29 January 2009 and his previous dealings with the Respondent. Other than to assert that he assumed that Ms Whalan contravened LN’s health privacy and accessed her health record as a reprisal, his evidence does not concern the matter that remains for determination.

LN’s submissions

40 LN provided a response to the affidavits by Ms Whalan and Ms Roberts. She objects to Ms Whalan’s evidence and says that parts of her affidavit are not correct and that it is misleading. She contends that Ms Whalan she did not receive any complaint and request for internal review on 5 January 2009. She says that she received correspondence from the executive director of the hospital indicating that he received her application on Monday 29 December 2008. A copy of the document is fax stamped by the Respondent on 30 December 2008. She says that in separate affidavits of Ms Whalan she has indicated that she received it on 30 December 2008 and 5 January 2009. However, she asserts that neither is correct and that her application was initially sent on 13 December 2008 and followed up on 20 December 2008.

41 LN says that because of her prior dealings with LN, Ms Whalan is disqualified from reviewing the case, and that her decision must struck out.

42 LN says that it is clear from the material available to her that Ms Whalan requested that she be given the PET report and other information and that it is clear that Ms Whalan intended to know LN’s health information, not as the reviewer. She also asserted that her health information has been disclosed to other parties. She submits that Ms Whalan has admitted that she accessed LN’s medical record by requesting her referral letter.

43 She says that she has not requested Ms Whalan to provide her with a copy of the PET scan or access her health record at all. She says that if Ms Whalan was required to carry out an investigation of LN’s complaint, she must investigate all events that lead to the complaint and the investigation must be done through the guidelines of NSW Privacy Commissioner.

44 LN also referred to another matter before the Tribunal. She says that in regard to that matter she was pressured into signing a consent form before documents would be released to her. She says that Ms Whalan had provided a report to her notwithstanding that she has not signed a release form in this matter.

45 LN asserts that Ms Whalan’s motivation in obtaining details of her appointment was not to assist her in her investigation but in reprisal for LN’s previous complaint against the hospital and also in reprisal against TA. She says that Ms Whalan was requesting further information in order to abuse LN and TA when they went to the hospital.

46 She says that she did not request that Ms Whalan provide her with the report, and it is not within her capacity to obtain and access LN’s medical report. She says that Ms Whalan’s affidavit is completely inadmissible.

47 LN asserts that of Ms Roberts’ evidence is not credible as Ms Whalan is Ms Roberts’ direct manager. She objects to Ms Roberts’ affidavit and says that it must be struck out for many reasons - incredibility, inconsistency with other material, and the fact that Ms Roberts is working under the influence and management of Ms Whalan.

48 LN also provided other written submissions that comprised 74 pages. Notwithstanding the length of the submissions, much of the content of the submissions is of little relevance to the issue to be determined. I have had great difficulty in understanding much of LN’s material and do not understand its relevance to these proceedings.

49 LN asserts that the evidence establishes that:
- Ms Whalan confirmed that she sent the letter of 27 January attached with PET report to assist LN in understanding the policies. LN says that she did not requested Ms Whalan to provide her with the PET report or to explain any policies to her.
- Ms Whalan confirmed that she became aware of the follow-up appointment at the end of January.
- Ms Whalan confirmed that she wanted to obtain a copy of the PET report.
- Ms Whalan confirmed that she was involved in LN’s complaint, as she wanted to explain in details the purpose of the procedure in the PET department.
- Ms Whalan confirmed that a patient must sign an authorization form. LN has not signed such a form.
- Although Ms Whalan had admitted to the above, she stated that access to clinical information was not necessary to conduct the investigation and review. LN says that this admission shows that there was no reason to access, obtain and use her PET report.
- It is clear from the Reviewable Decision that Ms Whalan accessed and reviewed LN’s health information, although she admitted that it was not necessary to access it while she undertook the investigation.

50 LN asserts that the PET scan report was attached to Ms Whalan’s letter of 27 January 2009. She says that it would have been impossible to send it without viewing the details.

51 As best as I can understand it I understand that LN submits that the allegations concerning Ms Whalan amount to conduct in breach of the following HPPs and IPPs:
HPPs:
1) Collect, (HPP 3)
2) misuse, (HPP 10)
3) The applicant was not made aware of this conduct. (HPP 4).
4) Disclose. (HPP 11).
5) Anonymity. (HPP 13).
6) Linkage of Health Record (Hpp 15).

IPPs:
1) Collect unlawfully (IPP 1).
2) Collect not direct (IPP 2)
3) Collect irrelevant (I PP3)
4) Not secured (IPP5)
5) Misused (IPP 10)
6) Disclosure (IPP 11)

52 LN submits that the exemptions that the Respondent seeks to rely on are not applicable. She submits that no exemptions are to be applied for this conduct.

53 LN submits that it is clear that Ms Whalan had not collected the health information from LN. The collection of this information from LN was not unreasonable or impracticable, as communication occurred between her and Ms Whalan.

54 LN says that it is clear that Ms Whalan did not collect the PET scan report and the referral letter concerning LN directly from LN. Ms Whalan collected it from other staff members. It is clear that there was no reasonable reason for Ms Whalan to not contact LN directly for any details she desired.

55 LN says that it is clear that Ms Whalan failed to notify LN of the collection of her information according to Act and Statutory guidelines.

56 LN says that it is clear that Ms Whalan breached HPP10. LN says that she has the capacity to give consent and that she has not ever given any consent to Ms Whalan.

57 LN says that it is clear that the Respondent is not an investigation agency nor was their investigation referring to an investigative agency. Accordingly, the exception provided for in HPP (10)(1)(j) has no application.

58 LN says that it is clear that the Respondent has breached HPP 19 and no exemptions are to be relied on.

59 LN says that it is clear that Ms Whalan disclosed and exchanged the PET report after obtaining it and no exemptions are to be relied on. She says that it is clear that Ms Whalan or other staff members had exchanged her health information through email not for ongoing care, because they are not LN’s treatment doctors or at least nurse. Also, the admission of Ms Whalan that she used it for other purposes was not for ongoing care. It is very clear, that Ms Whalan breached the NSW Health Privacy policy.

60 LN says that it is clear, by her direction to the PET scan Department, her transaction of investigation and her letter of 27 January 2009 that Ms Whalan failed to identify the applicant. She asserts that this is in breach of HPP 13.

61 LN says that the emails exchanged between Ms Whalan and PET staff, through electronic linkage, is in breach of HPP 15.

62 LN says that it is clear that the Respondent has breached HPP 3,4,10,11, 13, 15.

63 LN also contends that the same conduct is in breach of the IPPs 1, 2, 3, 5, 10, 11.

64 She seeks orders that the Tribunal “not only takes a decision based on the sought order in my application, but to top up the compensation to $100,000 and refer the conduct of Ms Whalan to the very attention of the responsible Minister for the agency to act according to sec. 69 of HRIP Act”.

Discussion

65 On the evidence before me it is my view that LN’s application is totally without merit.

66 I am satisfied that the information in issue is health information for the purposes of the HRIP Act. Pursuant to section 4A of the PPIP Act, health information is excluded from the definition of “personal information” in that Act. Accordingly, none of alleged breaches of the IPPs to which LN has referred have any application in this matter.

67 For the reasons argued by the Respondent it is my view that the only relevant Health Privacy Principle that is applicable to LN's application is principle 10.

68 There is no doubt that the Respondent held LN’s health information prior to this incident. Nor is there any doubt that the Respondent collected the health information in accordance with the HRIP Act. Ms Whalan is not the Respondent. Any action on her part to request LN’s health information cannot amount to collection for the purposes of the HRIP Act. It follows, in my view, that the Health Privacy Principles that relate to collection have no application in this matter.

69 There is no evidence to support a suggestion that the Respondent has breached Principle 13 by not giving LN the opportunity to not identify herself when entering into transactions with or receiving health services. In any event, this is not an issue for determination in this matter.

70 There is no evidence to support a suggestion that the Respondent has breached Principle 13 by including LN's health information in a health records linkage system or by disclosing an identifier of LN in breach of that Principle. In any event, this is not an issue for determination in this matter.

71 I agree with the Respondent that Principle 11, which places limits on the disclosure of health information, concerns the external as distinct from internal use of information. There is no evidence to support a suggestion that the Respondent has breached Principle 11 by disclosing LN’s health information.

72 I agree that the Respondent used LN's health information. Ms Whalan used the information in reviewing and responding to LN's internal review application/complaint.

73 In my view, none of the other Health Privacy Principles have any application.

74 I agree with the Respondent’s argument that Principle 10(1)(a) excludes the circumstances where there is consent and that the consent of the person concerned may be implied by the circumstances of the matter. I agree that it can be implied that a complainant making an application for an internal review has implicitly consented to the reviewer having use of and being given access to relevant health information in respect of that application. It would be impossible for a reviewer to conduct an investigation and not have access to relevant health information. In my view, LN has implicitly consented to the Respondent using her relevant health information for that purpose. It is also my view that the health information that Ms Whalan used was relevant for the purposes for which it was used.

75 I also agree with the Respondent’s argument that the exception provided for in Principle 10(1)(b) is applicable to the circumstances of this matter. The Respondent was entitled to use the information for the secondary purpose of handling LN’s complaint of an alleged breach of the privacy legislation. Objectively, an individual who has lodged such a complaint would reasonably expect the organisation to use the relevant health information for the secondary purpose.

76 I also agree with the Respondent’s argument that the exception provided for in Principles 10(1)(j) and 10(5) is applicable to the circumstances of this matter. Given the history of the matter, it is conceivable that LN would have lodged a complaint with the HCCC. Ms Whalan is a public sector official who was investigating or otherwise handling a complaint that could have been referred or made to an investigative agency for the purposes of Principles 10(5). The use of this information by Ms Whalan was reasonably necessary to assist her with her investigation.

77 If I am wrong in this determination, it is my view that if there was any breach on the part of the Respondent, it is of the most trivial nature and I would determine to take no action on the matter.

Order

The application is dismissed.