NZ v Health Care Complaints Commission

[2006] NSWADT 111

Set aside by Appeal: Set Aside by Appeal on 2 November 2006: NZ v Health Care Complaints Commission (GD) [2006] NSWADTAP 56

CITATION:	NZ v Health Care Complaints Commission [2006] NSWADT 111
DIVISION:	General Division
PARTIES:	APPLICANT NZ RESPONDENT Health Care Complaints Commission
FILE NUMBER:	053195
HEARING DATES:	26/10/05
SUBMISSIONS CLOSED:	10/25/2005
DATE OF DECISION:	04/13/2006
BEFORE:	O'Connor K - DCJ (President)
CATCHWORDS:	Privacy - information protection principle - disclosure to third party
MATTER FOR DECISION:	Principal matter
LEGISLATION CITED:	Health Care Complaints Act 1993 Privacy and Personal Information Protection Act 1998
REPRESENTATION:	APPLICANT In person RESPONDENT K Eastman, barrister
ORDERS:	Application dismissed.

1 The respondent, the Health Care Complaints Commission (the HCCC), is the statutory body responsible for investigating complaints relating to the work of health care professionals. The applicant has applied to the Tribunal under the Privacy and Personal Information Protection Act 1998 (the Privacy Act) for review of certain conduct of the HCCC. Section 21 of the Privacy Act provides:

‘(1) A public sector agency must not do any thing, or engage in any practice, that contravenes an information protection principle applying to the agency.

(2) The contravention by a public sector agency of an information protection principle that applies to the agency is conduct to which Part 5 applies.’

2 The HCCC is a public sector agency (see s 3) bound by the Act. The claim is that the HCCC contravened s 18, an information protection principle. Section 18 prohibits the disclosure of personal information subject to various exceptions. The key terms are:

‘(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency …’.

3 As a result of directions made at a planning meeting, the application for review is confined to actions taken by the HCCC in response to correspondence that it received from the applicant in the period 24-29 September 2004. The applicant’s position is that this correspondence was strictly confidential. In her opinion, the HCCC breached its obligation under s 18 when it disclosed part of that correspondence to a third party, Ms M, and in so doing identified the applicant as the source of the disclosed material. The HCCC’s reply is that it was obliged by its enabling legislation, the Health Care Complaints Act 1993 (HCC Act), to disclose the information.

4 There is no dispute that, in the circumstances, there was a disclosure of ‘personal information’ of a kind that is protected by the Act (see definition, s 4).

5 The HCCC refers first to the exception to s 18 found at s 25 of the Privacy Act. Section 25 provides:

‘A public sector agency is not required to comply with section … 18 … if:

(a) the agency is lawfully authorised or required not to comply with the principle concerned, …’.

6 The HCCC’s submission is that the communication, so far as it made allegations against the third party in respect of the third party’s capacity as a nurse, constituted a ‘complaint’ within the meaning of the HCC Act, and it was obliged to deal with the communication in the manner provided by that Act.

7 Section 4 of the HCC Act defines ‘complaint’ as follows:

‘ complaint means a complaint made under this Act or a complaint made under another Act that is able to be dealt with by the Commission under this Act.’

8 Ms Eastman for the HCCC submitted that this definition, which is plainly uninstructive, should be read in conjunction with s 7, which provides:

‘ 7 What can a complaint be made about?

(1) A complaint may be made under this Act concerning:

(a) the professional conduct of a health practitioner, or

(b) a health service which affects the clinical management or care of an individual client.

(2) A complaint may be made against a health service provider.

(3) A complaint may be made against a health service provider even though, at the time the complaint is made, the health service provider is not qualified or entitled to provide the health service concerned.’

9 The submission is that in this case the complaint related to a health practitioner within the meaning of the Act – a person who provides nursing services (see definition of ‘health practitioner’ and the related definition of ‘health services’, s 4).

10 The HCCC is obliged, it is submitted, to notify such a complaint to the affected person. Section 16 provides:

‘ 16 Person against whom complaint made to be notified of complaint

(1) The Commission must give written notice of the making of a complaint, the nature of the complaint and the identity of the complainant to the person against whom the complaint is made. The notice must be given not later than 14 days after the Commission’s assessment of the complaint under Division 4.’

11 Section 28(1) of the HCC Act provides relevantly:

‘ 28 Notice of action taken or decision made following assessment

The Commission must give the parties to the complaint notice in writing of the action taken or decision made by the Commission following its assessment of the complaint. The notice is to be given within 14 days after the Commission takes that action or makes that decision.’

12 The applicant’s position is that she did not make a ‘complaint’, therefore these provisions are not triggered. She also refers to the express statements at the beginning and end of her correspondence that the contents were confidential and for Judge Taylor – the Acting Commissioner - only.

13 The documentary material relevant to the present matter is contained in a folder filed by the HCCC on 1 September 2005 (the folder).

Circumstances

14 The applicant is a Housing Department tenant; and she believes that she has been the subject of reports to the Housing Department from various family members including her sister suggesting that she has undisclosed assets which affect her eligibility for rent concessions (said to be interests in various parcels of land derived by way of inheritance from her mother).

15 At Waverley Court in August 2003 the applicant’s sister, Ms M, brought apprehended violence order proceedings against the applicant. Among the material produced to the court in support of that application were letters from the applicant which contained allegations relating to the conduct of Ms M, in her capacity as a registered nurse while dealing with patients.

16 Some time later, on 24 September 2004, the applicant sent two bundles of documents (Tabs 1 and 2 in the folder) to the HCCC addressed to the then Acting Commissioner, Judge Taylor.

17 Tab 1 is a mixed group of documents. It starts with some pages of a court transcript – the proceedings at Waverley Court on 5 August 2003 (selected pages, not in order, containing parts of the oral evidence of – her sister, Ms M, her sister’s daughter and the applicant).

18 There is then a separate typewritten text, written by the applicant, which include allegations against her sister (patient thefts). The bulk of the text deals with other concerns the applicant has about her sister’s conduct towards her, the matters raised being ones that do not bear on Ms M’s responsibilities as a nurse. The material then includes such items as a hand-written letter of reference from a local parish priest (dated 28 February 1997) giving her support in resisting steps being taken by the Housing Department to remove her from her property; and an earlier letter of reference in connection with applications for employment. The material also includes a copy of the degree certificate issued by the University of Sydney on the occasion of her obtaining a Master of Arts (Philosophy) in 1998. The material also refers to the fact that the applicant now suffers from a psychological condition known as agoraphobia. The material also includes various documents such as records of summonses issued by the applicant against her sister, references to disputes with her sister and legal correspondence relating to the sale of property.

19 This is an incomplete picture, but is intended to illustrate the variety of material sent to the HCCC.

20 There is correspondence dated 29 September 2004 (Tab 3) from the applicant in the course of which the allegations again appear that her sister steals from patients.

21 The Tribunal’s attention was drawn by the HCCC to the following passages that appear in the correspondence of 29 September 2004:

At p 4:

‘I am asking you to please assist me to stop [Ms M] removing the patients valuable jewellery and implicating me a innocent citizen in such despicable behaviour that I have witnessed myself against those patients by her.’

At p 7:

‘[I]t is very bad for me because now I am worse and can’t possible [sic] even imagine how on earth can you keep her in a position which involves caring for patients. When this in fact, is not true she does not give them proper standard of care, please see the complaint from the police made by the patient. It is on the NSW police record in fact.’

At p 7:

‘I am exasperated by this improper behaviour she has conducted against those patients and myself and my late mother. It is highly inhumane and is definitely not the HCCC proper requirements which could be seen as the standard of care for patients.

My sister had physically assaulted this patient if you obtain that copy of the complaint. I believe you should investigate it on my behalf because I have suffered from this and intend to put my complaint to the Privacy Commissioner against the HCCC for breach of the Mental Health Act.’

At p 11:

‘Also, Judge Taylor, if the HCCC had taken proper investigations to the actual theft conducted by [Ms M] between those periods this would not have happened to me. Such as, [Ms M] making all these false fabricated spelling family behaviour of hers [sic] she had used to cover up her thefts and has been incriminating me with this behaviour.’

‘So, given this complaint does not bear my name it shows that [Ms M] is coving this up [sic] and so it should be investigated before it gets worse for me. As she has used the actual HCCC complaints against me at court and made all these lies to police to cover up the thefts against the patients.’

At p 12, the letter concludes as follows:

‘Could you please stop this behaviour against me it made me worse and I have not had a chance to my life but [Ms M] has for years and I am very ill.

Please protect my privacy do not release this to [Ms M] or any of her family noted in this letter as they cover for her and inflict this on me in their group.’

More documents were sent on 29 September 2004 (Tab 3).

22 On 13 October 2004 Ruth Robinson, Acting Manager, Complaint Assessment Team, sent the applicant a letter, as follows:

‘The Health Care Complaints Commission received three batches of printed matter relating to your complaint against your sister, [Ms M].

The Commission has notified your sister that you have lodged a complaint about her as required under the Health Care Complaints Act 1993 (the Act). She has also been informed of the nature of the complaint.

The Health Care Complaints Commission has been established to assist the people of New South Wales to resolve their health care concerns and to investigate matters that raise significant issues of public health and safety or questions as to the appropriate treatment or care of a person by a health service provider. The Commission also investigates matters relating to the professional conduct of health practitioners that provide grounds for disciplinary action against a health practitioner or involves gross negligence on the part of a health practitioner. I have enclosed a brochure explaining the role of the Commission and the complaint handling process.

Your complaint has been assessed and the Commission is declining to continue with your complaint for several reasons:

1. No health/patient care issues are apparent;

2. Your allegation against your sister has been previously investigated and found to have no substance.

If you do not agree with the way the Commission has assessed your complaint, you are entitled to a review of the assessment decision. Please write to us asking for a review of the Commission’s assessment decision and state the reasons you disagree with the decision.’

23 On the same day a letter was sent to Ms M notifying her of the complaint, and of the HCCC’s decision not to investigate.

24 On 22 October 2004 the HCCC received a handwritten fax from the applicant, the opening words of which are: ‘Your agency made error I asked my files to go to Judge Taylor only’. It continues later – ‘I did not make any complaint against [Ms M]; and so to advise her you made an error. To protect my privacy … do not release it to [Ms M] or this is breach my privacy [sic]’.

25 On 25 November 2004 the applicant lodged with the HCCC the application for review of conduct the subject of these proceedings. Under the heading ‘What is your complaint?’ she wrote –

‘To stop accessing, invading my privacy to your client [Ms M] and on the files system’.

26 Under the heading ‘When did the conduct you are complaining about occur?’ she wrote ‘2000, 2001, 2002, 03, 04 across times’.

27 Under the heading ‘What effect did the conduct have on you or another person?’ she wrote –

‘A false AVO with false HCCC complaints’.
HCCC’s Decisions

28 In light of this complaint and further examination of the material, the HCCC’s solicitor, Mr Swain, formed the view that the complaint not only concerned the alleged improper disclosure of the material relating to her sister found in the documents lodged by the applicant in September and October 2004, but also related to the HCCC’s dealings with a statutory declaration given to the HCCC by the applicant on 24 March 2003 (five months before the sister’s AVO proceedings against the applicant). That statutory declaration included a paragraph in which the applicant stated that she had seen her sister stealing jewellery from a patient, and giving details.

29 The contents of the statutory declaration had been investigated, and the HCCC found them not to have substance. This material had been used by the sister as part of her evidence against the applicant at the AVO proceedings.

30 It is helpful to set out the following sections of Mr Swain’s first report to the HCCC dated 19 May 2005:

‘ BACKGROUND:

The Commission received two letters and material from [the applicant] on 24 and 29 September 2004 that raised a number of issues including concerns over the settlement of her late mother’s estate, applications for apprehended violence orders in relation to family members, and her sister, [Ms M], allegedly stealing from a patient at a nursing home and assaulting a patient. No issues were raised by [the applicant] concerning any health care services provided to her.

[The applicant] also provided a statutory declaration dated 24 March 2003 where she states:

“My statement is attached as per my sister [identifying particulars deleted by Tribunal] that she created a theft against an ill patient in the [deleted by Tribunal] home who was in her care in 1996, she stole her valuable antique diamond ring from the patient by force, which I witnessed when I went to pick up my mother’s bandages for her infectious feet – diabetes condition (see my statement) [Ms M] abuses, harasses, threatens me over her created theft.”

In her letter of 13 September 2004 (received 29 September 2004) [the applicant] said that her sister physically assaulted the patient and the Commission should investigate on her behalf. In the same letter [the applicant] said there had been a breach of her privacy by the Commission because her sister had taken a Commission complaint and made a false allegation against her in AVO proceedings and made defamatory, false and humiliating claims against her good name.

The letters were considered to be a complaint against [Ms M] concerning theft of jewellery from a patient. The complaint was assessed and declined on 4 October 2004 because no health/patient care issues where [sic] apparent and the allegation was previously investigated and apparently had no substance.

The Commission wrote to [Ms M] on 13 October 2004 advising of the complaint and the assessment outcome as required by s.16 and s.28 of the Health Care Complaints Act, 1993. [The applicant] was advised by letter on the same day that her sister had been notified of the complaint and the assessment outcome.

On 18 October 2004 [the applicant] telephoned the Commission and advised that the correspondence was about herself and not [Ms M]. On the same day [Ms M] contacted the Commission upset at having received a letter from the Commission informing her of a complaint against her. [Ms M] was advised that it was not a complaint according to her sister. The Commission subsequently received a letter from [the applicant] on 22 October 2004 in which she stated the Commission made an error, her file and the letters were sent for Judge Taylor only, and no complaint had been made against [Ms M]. [The applicant] also stated that her file was not to be released to [Ms M] as this would be a breach of her privacy. A similar letter was received from [the applicant] on 1 November 2004.

The complaint was re-assessed on 1 November 2004 noting that the complaint was withdrawn. The assessment level was changed from 2 to 0. The Commission wrote to [Ms M] on 5 November 2004 advising that [the applicant] had not intended to make a complaint and apologised for any undue stress the error may have caused. The Commission wrote to [the applicant] on the same day advising of the action taken and apologising to her.

[The applicant] wrote to the Commission on 17 November 2004 requesting a copy of the letter sent to [Ms M] and stating that there was no reason to advise [Ms M] about any of the correspondence sent to the Commission. [The applicant] requested the Commission not to release her personal files or any correspondence to [Ms M].

…

COMMISSION CODE OF CONDUCT:

The Commission has a Code of Conduct and Ethics, which deals with privacy and confidentiality including the disclosure of information.

The Code states that all officers of the Commission have a duty to maintain confidentiality of information and must take precautions to ensure that information is not disclosed without clear authority. The Commission recognises to do so may cause harm to individuals, affect their information privacy and breach duties of confidentiality owed to them. The Code also recognises that disclosure of information by the Commission of complaint information is necessary for the purpose of dealing with the complaint.

The issue of privacy and confidentiality is also addressed in the Commission’s Investigations Practice Manual at point 4.3.2. Relevantly the Manual states that an offence is committed if information is disclosed without authority or lawful excuse (s.37 of the Health Care Complaints Act, 1993). The Commission privacy policy is followed to ensure privacy protection of information held in the Commission. Section 37 was repealed on 1 March 2005 and replaced by s.99A, which is in similar terms.

REVIEW:

[The applicant] alleges that the Commission breached her privacy by:

1. treating her letters in September 2004 as a complaint and notifying [Ms M];

2. [Ms M] using Commission documents against her in AVO proceedings before the Local Court at Waverley in August 2003.

The Commission is very conscious of the need to maintain confidentiality of complaint and other information it receives and the privacy and confidentiality of people. It is appreciated that to disclose such information can cause harm, affect their information privacy and breach duties of confidentiality owed to them. This is the reason the Commission has developed policies and guidelines to deal with the confidentiality of information that it receives or obtains as part of its business. The policies and guidelines are contained in the Commission’s Code of Conduct and Ethics and the Practice Manual.

The Commission is not a public sector agency that keeps a Public Register as defined in s.3 of the Privacy and Personal Information Protection Act. It also does not have the privacy code of practice pursuant to Part 3 of the Act. The review therefore does not apply to these matters.

[Ms M] is not a client of the Commission or employed by the Commission.

In relation to the Information Protection Principles outlined in Division 1 Part 2 of the Act there has been no breach by the Commission for the following reasons:

1. in all the circumstances it was reasonable for staff of the Commission to consider the correspondence from [the applicant] as a complaint against [Ms M] [file 04/01859]. The correspondence made allegations that [Ms M] stole from a patient in 1996 and requested that the matter be investigated. There was nothing contained in the letters or material to suggest that it was not a complaint.

2. the Commission was required by s.16 and s.28 of the Health Care Complaints Act to notify [Ms M] of the complaint and the outcome of assessment. In notifying [Ms M] the Commission was complying with its statutory obligations.

3. the Commission was required by s.16 and 28 of the Act to notify [Ms M] of the complaint made in 2000 [file 00/02162] and the assessment outcome. A copy of the letter of complaint was provided pursuant to s.16(2). In notifying [Ms M] the Commission was complying with its statutory obligations. The notification letter of 19 December 2000 was tendered by [Ms M] in the AVO proceedings instituted by [the applicant] and made exhibit 32. The Commission was not a party to the proceedings and did not provide the letter to the Court.

This is a case where it is appropriate to take no further action pursuant to s.53(7) of the Privacy and Personal Information Act for the following reasons:

1. there has not been any breach of the Information Protection Principles for the reasons outlined above

2. as there has been no breach of Information Protection Principles no monetary compensation should be paid pursuant to s.53(7)(c) of the Act

3. the Commission took appropriate action by apologising to [the applicant] and [Ms M] once [the applicant] advised that she did not intend to make a complaint. The Commission appropriately apologised for any undue stress that the error may have caused.

4. the Commission has reviewed and implemented a new assessment process following amendments to the Health Care Complaints Act that came into force on 1 March 2005 and in particular the requirements of s.20(2). These changes have been made to ensure that in future all complainants are contacted to confirm whether a complaint has been made and the specific allegations made in the complaint. Section 20(2) states:

“Unless the Commission decides to decline to entertain a complaint, the Commission is, as part of its assessment of the complaint and as soon as practicable after commencing its assessment:

(a) to identify specific allegations comprising the complaint and the person or persons whose conduct appears to be the subject of the complaint, and

(b) to use its best endeavours to confirm with the complainant and with any other person who provided relevant information in relation to the complaint that the matters so identified accord with the information provided by them.”

5. the Commission has altered its records to show that no complaint was made in relation to file 04/01859.

CONCLUSION:

There has been no breach of the Privacy and Personal Information Protection Act or the Information Protection Principles as alleged by [the applicant]. An apology has previously been given to [the applicant] and [Ms M], assessment processes have been reviewed and changed, and records have been altered to show [the applicant] did not make a complaint. Accordingly, no further action should be taken.

[The applicant] should be advised of the outcome of the review pursuant to s.53(8) of the Act and be advised of her right of review by the Administrative Decisions Tribunal pursuant to s.55 of the Act.’

Hearing

31 The applicant appeared by telephone, as necessitated by her condition.

32 Ms Eastman referred to the history of the matter, the internal review decision and the various statutory provisions already mentioned. Her ultimate submission was that the application was misconceived and should be dismissed.

33 In my view, in light of the circumstances recorded above, the submission is correct. There were passages in the material submitted by the applicant which contained serious allegations of misconduct within the nurse-patient relationship involving a registered nurse. The HCCC was entitled to form the view that its statutory responsibilities were engaged, i.e. that it had before it a complaint within the meaning of the HCC Act. It formed that view, and then acted as contemplated by its legislation. It was lawfully authorised by s 16 to provide the subject of the complaint with information that included the identity of the maker of the complaint.

34 The applicant drew attention to s 16(4) of the HCC Act which provides:

‘(4) This section does not require the Commission to give notice under this section if it appears to the Commission, on reasonable grounds, that the giving of the notice will or is likely to:

(a) prejudice the investigation of the complaint, or

(b) place the health or safety of a client at risk, or

(c) place the complainant or another person at risk of intimidation or harassment.’

35 This provision provides the Commissioner with a power not to proceed in the usual way. Whether the Commissioner should, or should not, have exercised this power in the circumstances is, in my view, not a matter that the Tribunal need inquire into. Section 25(a) deals with circumstances where an agency is ‘authorised’ or ‘required’ to disclose personal information. At the least, this was a situation where the agency had the relevant authorisation. That is all the Tribunal needs to address in order to reach a conclusion as to compliance with the Privacy Act.

36 The Tribunal accepts that the applicant did include statements in her correspondence, in prominent positions at the beginning and end of the letter sent on 24 September 2004, asking that her communication be treated as confidential. But at the same time there were other contents in the letter which brought into play the obligations placed on the HCCC by Parliament. It was open to it, as the Tribunal has observed, to make the judgement that it did.

37 The case does, however, highlight the possibility that communications may sometimes be made to complaints-investigation agencies by members of the public who are less than familiar with the possibility that some part of their communication may be treated as a formal complaint and, with their identity revealed, may be made known to the subject of the complaint. They may have thought, for example, they were engaged in the provision of intelligence information not to be passed on.

38 As noted in the internal review report, the HCCC has adopted since March 2005 protocols which make clearer to complainants the practice of the HCCC in relation to communication of the identity of complainants; and there has been an amendment to legislation designed to clarify practice (see now HCC Act, s 20(2)).

39 It is also apparent from the internal review decision that the HCCC has taken a number of other steps to give a measure of redress to the applicant. It apologised to the applicant once it was informed that she did not intend to make a formal complaint. It has also altered its records to show that no complaint was made.

40 Section 55(2) of the Privacy Act provides relevantly:

‘(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders:

(a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c) an order requiring the performance of an information protection principle or a privacy code of practice,

(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f) an order requiring the public sector agency not to disclose personal information contained in a public register,

(g) such ancillary orders as the Tribunal thinks appropriate.’

41 No contravention is found. The Tribunal’s decision is that no further action is required. Had the Tribunal made a finding of contravention, the measures already taken would have been considered sufficient in the circumstances.

42 The HCCC also indicated that it does not seek any order for costs.

Order

Application dismissed.