DKV v Southern NSW Local Health District [2019] NSWCATAD 12

Read the decision here: DKV v Southern NSW Local Health District [2019] NSWCATAD 12 

Summary

The Tribunal found that the disclosure of health information in a medical report by a specialist to a treating GP was for the primary purpose for which it was collected: for assessment, diagnosis and ongoing treatment of the Applicant. Therefore it was not necessary that the Applicant specifically consented to the disclosure. The Tribunal considered that the Respondent took reasonable steps to ensure accuracy of the information in the circumstances, however, the Respondent did not ‘use’ the information itself, it was only ‘disclosed’ under the Health Privacy Principles (HPPs). The Tribunal confirmed that it had jurisdiction to review only matters raised in the course of internal review by an agency, and commented positively on the way in which the Respondent had promptly and appropriately responded to the Applicant’s privacy complaint.

What you need to know

The Applicant complained that her health information had been disclosed by a medical specialist to two GPs. The Applicant also alleged that the underlying collection of the information by the specialist was excessive and intrusive.

This matter considers HPP 11, the disclosure principle, which provides that an agency or organisation can only disclose your health information for the purpose for which it was collected or a directly related purpose that you would expect (unless one of the exemptions in HPP 11 applies). Otherwise separate consent is required. The Tribunal also considered HPP 9, which requires an agency to take reasonable steps to ensure that that health information is relevant and accurate before being used.

The Tribunal made a number of findings set out below which led it to affirm the decision of the respondent agency.

The decision is also a reminder that, in undertaking administrative review of an alleged contravention of an HPP in the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act), under section 55(1) of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act), the Tribunal cannot review matters that were not first raised in the course of the internal review by the agency.

Legislative background

Health Privacy Principles (HPPs)

The decision considers the following HPPs contained in Schedule 1 to the HRIP Act:

Clause 2: Information must be relevant, not excessive, accurate and not intrusive (HPP 2)

Clause 4: Individual to be made aware of certain matters (HPP 4)

Clause 9: Accuracy (HPP 9)

Clause 11: Limits on disclosure of health information (HPP 11)

Factual background

The Applicant consulted with a specialist in a health facility conducted by the Respondent. The specialist took notes and sent a report on the consultation in a referral letter to two General Practitioners: the Applicant’s treating doctor (GP 2) and another doctor (GP 1). The Respondent’s computer system had malfunctioned and auto-populated the letter with both doctors’ names. The letter was then faxed to both GP 1 and GP 2.

The Applicant alleged breaches of the HPPs arising from the information collected by the specialist and the disclosure to each of the GPs, contending that the report contained details that she did not wish to be disclosed even to her treating doctor.

The Respondent accepted breaches of privacy in relation to the disclosure to GP 1, a visiting doctor at the health facility. GP 1 had seen the Applicant for an ankle injury that was unrelated to the reason treatment was sought from the specialist.

On the other hand, the Applicant had been a patient of GP 2 for nearly 20 years. GP 2 had also treated the Applicant for the same conditions for which she saw the specialist. It was usual for the specialist to provide referral letters to the treating GP, particularly where the specialist’s advice was for the patient to receive follow up treatment with them.

A nurse, who provided evidence, was also present at the consultation with the specialist. She recalled a discussion about the Applicant seeing GP 2, which included that a referral letter would be sent to GP 2.

Tribunal findings

The Respondent agreed there had been a breach of HPP 11 in respect of the letter sent to the wrong doctor, GP 1, through the automated population of the letter. The Respondent also accepted a breach of HPP 4 in that the Applicant was not fully informed about the purpose for which information was being collected and to whom it might be disclosed.

The Tribunal therefore made findings as to the remaining live issues: the alleged breaches of HPPs 9 and 11 in respect of GP 2, and whether it had jurisdiction to consider HPP 2.

HPP 2

The Tribunal found that it did not have jurisdiction to consider HPP 2 because it was not raised in the internal review application and was not considered in the internal review conducted under section 53 of the PPIP Act.

Even if the Tribunal had jurisdiction to consider HPP 2, the Tribunal considered the Respondent had not breached that principle because the information collected by the specialist was relevant to advising a clinician involved in follow up treatment, was not excessive in relation to the subject matter of the consultation and did not intrude to an unreasonable extent on the personal affairs of the Applicant.

In relation to the obligation to ensure information collected is accurate, up to date and complete, the Tribunal found that the Respondent had taken reasonable steps in the circumstances, having regard to the purposes for which the information was collected, because the claims of inaccuracies appeared minor and were ‘unlikely to be material to ongoing treatment’. Further, the claimed inaccuracies ‘could easily have arisen from a misunderstanding of the information being conveyed over the period of the consultation’ (at [26]).

HPP 9

In relation to HPP 9, the Applicant had submitted that there was an ‘intrusive and excessive collection of information’ (at [32]). The Tribunal found that HPP 9 does not cover collection or disclosure of health information, but relates to ‘use’ of information. It requires the agency to take reasonable steps to ensure, having regard to the purpose for which the information is proposed to be used, that the information is relevant, accurate, up to date, complete and not misleading.

The Tribunal found that HPP 9 did not arise because the Respondent had not ‘used the information itself’ but, by providing a referral to GP 2, had disclosed the information for the purposes of HPP 11 (at [34]). Nevertheless, the information collected to assess the Applicant’s condition appeared to be accurate on its face and the collection of social information, together with personal and family history, was required by State health policy directives and guidelines.

HPP 11

In relation to disclosure of the information to the GP 2, the Tribunal found there had been no breach of HPP 11 because the information was disclosed for the primary purpose for which it was collected, namely, ‘to assess the applicant’s health, provide an up to date diagnosis and set out a plan and recommendations for ongoing treatment by way of referral to the treating GP’ (at [29]).

Alternatively, the disclosure was ‘directly connected to the purpose for which the information was gathered, to diagnose and recommend a further health service be provided’ (at [30]). Further, the Applicant could reasonably expect that the report would be sent to the treating doctor, because, the Tribunal accepted, it was discussed at the consultation (clause 11(1)(b) of Schedule 1 to the HRIP Act).

Given these findings, specific consent to the disclosure was not required by HPP 11 (at [30]).

Comment on the conduct of the internal review

The Tribunal found the Respondent’s response to the Applicant’s complaints was ‘correct, prompt, and indicating compassion and insight’ (at [37]), that the Respondent appeared to have ‘taken the complaint very seriously’ and ‘acted responsibly to try to limit the impact on the applicant and to prevent further damage’ (at [10]). The Tribunal set out the action taken by the Respondent in this case at [10] and [36]. This included:

• rapidly providing a written apology to the applicant, acknowledging the distress caused
• providing progress reports on addressing the complaint
• offering to add notations required by the applicant to the facility’s files and to write to GP 1 and GP 2 to request removal of the report from the files
• providing a revised report/referral letter
• implementing a series of actions to improve its performance relative to the HPPs and being willing to pass feedback on to NSW Health so that the experience may provide lessons system wide.

Tribunal outcome

Finding no further breach, the Tribunal decided to take no action in respect of conduct other than that which the respondent conceded involves a breach of the HPPs. Having determined the issue of liability, the Tribunal would separately consider the question of damages and costs in relation to the breaches of HPPs 9 and 11 that were conceded by the Respondent.

The Tribunal concluded at [37]:

Except as conceded by the respondent, I find that there has been no breach of HPP 9 and HPP 11.