Privacy Case Note: FCZ v Illawarra Shoalhaven Local Health District [2022] NSWCATAD 79
Read the decision here: FCZ v Illawarra Shoalhaven Local Health District [2022] NSWCATAD 79
Summary
The Tribunal reviewed the conduct of Illawarra Shoalhaven Local Health District (the respondent) in refusing to give FCZ (the applicant) access to health information relating to her daughter (a child) which FCZ requested under the Health Records and Information Privacy Act 2002 (HRIP Act). The respondent withheld access to information referred to as “Confidential Documents” under Health Privacy Principle 7 (access) (HPP7), having decided that the applicant was not an authorised representative with parental responsibility under section 8(1)(c) of the HRIP Act. The conduct under the HRIP Act was reviewed by the respondent by way of internal review under section 53 of the Privacy and Personal Information Protection Act 1998 (PPIP Act). The respondent found that release of the information would contravene HPP 7 as well as section 14 of the Government Information (Public Access) Act 2009 (GIPA Act) because there was an overriding public interest against disclosure of the information.
The Tribunal determined that the applicant was not entitled to request access to the Confidential Documents and rejected the applicant’s contentions that she had parental responsibility and that she was the “individual” to whom the health information relates within the meaning of HPP 7. The Tribunal also determined that even if FCZ was the authorised representative under s. 8(1)(c) of the HRIP Act, the public interest considerations against disclosure under clauses 3(a), 3(b) and 3(g) of the GIPA Act outweighed the public interest in favour of disclosure of the information.
What you need to know
The decision identifies the importance of agencies confirming, by way of evidence, the parental responsibility of a person making a request for access to personal and health information about a child under the HRIP Act.
The decision highlights the operative effect of section 22 of the HRIP Act, which confirms that any limitations on access that are imposed by the GIPA Act equally apply to an agency’s obligation to comply with the HPPs. Where an overriding public interest against disclosure under the GIPA Act applies to the information, an agency is not required to provide access to the information under the HRIP Act.
Legislative background
HRIP Act
Section 6 definition of health information
Section 8 authorised representative
Section 22 GIPA Act not affected
Clause 7 of Schedule 1 (HPP 7) access to information
Clause 11 of Schedule 1 (HPP 11) disclosure of information
PPIP Act
Section 53 internal review of conduct by agency
Section 55 administrative review of conduct
GIPA Act
Sections 12, 13 and 14 (public interest test)
Section 55 personal factors
Factual background
In January 2021, the applicant lodged a request for medical records of 3-4 April 2015 held by Port Kembla and Wollongong hospitals, as well as documentation relating to the attendance of the applicant’s daughter on 10 May 2015. The applicant provided a Medicare card which listed her daughter’s name as proof of identity and proof of parental responsibility for release of the medical records. The Wollongong Hospital released some documents but withheld documents within the “Confidential Documents”. In February 2021, the applicant made a further request for the Confidential Documents, however, the respondent refused to provide access and advised the applicant that a subpoena would be required due to family court proceedings involving the applicant and orders made by the Family Court of Australia. In April 2021, the respondent requested the applicant to provide a copy of the final parenting orders issued by the Family Court with respect to her daughter, before any requested information could be released. The applicant did not provide this information and in May 2021, the respondent refused the request for access to information. In June 2021, the applicant made an application for internal review of the respondent’s conduct under the HRIP Act in relation to the request for medical records made in January 2021. In August 2021, the respondent issued the internal review report under section 53 of the PPIP Act which determined that it did not breach HPP7 and HPP11 of the HRIP Act, noting the steps taken to confirm the applicant’s authorised representative status; and also found there was an overriding public interest consideration against disclosure under clauses 3(a), 3(b), 3(g) of the Table to section 14 of the GIPA Act.
Tribunal findings
The Tribunal confirmed that its administrative review related only to the alleged contravention of HPP 7 (access) arising from the respondent’s refusal to provide the applicant with access to the Confidential Documents: at [35].
The Tribunal identified the provisions of the HRIP Act concerning “authorised representatives” with parental responsibility:
Under s 8(1) of the HRIP Act, an “authorised representative” in relation to an individual means:
(c) a person having parental responsibility for the individual, if the individual is a child.
Further, “parental responsibility” is defined in s 8(3) as follows:
parental responsibility, in relation to a child, means all the duties, powers, responsibility and authority which, by law, parents have in relation to their children.
The Tribunal confirmed that the legislative regime under the GIPA Act applied to the conduct of the respondent:
Under s 22(1) HRIP Act, nothing in the HRIP affects the operation of the GIPA Act. Further under s 22(3) HRIP Act, conditions or limitations imposed under the GIPA Act with respect to access to health information effectively apply as if they were provisions of the HRIP Act. Consequently, if there is an overriding public interest against disclosure under the GIPA Act [section 13, GIPA Act], an agency is not required to provide access to a document under the HRIP Act: at [39].
The Tribunal was not satisfied that the applicant was an “authorised representative” within the meaning of section 8 of the HRIP Act as the applicant did not have parental responsibility for her daughter under the Family Court orders, either at the time she made the request for the Confidential Documents, or at the time of the Tribunal proceedings: at [63]-[65].
The Tribunal rejected the applicant’s contention that she is the individual to whom the health information relates within the meaning of HPP 7. The Tribunal stated:
The “individual” referred to in the definition of “health information” in s 6 of the HRIP Act is the person to whom a health service was provided or whose physical health is the subject of the information. It is clear on the evidence that the health services provided at Wollongong and Port Kembla Hospitals … (recorded in the Confidential Documents) were provided to FCZ’s daughter, not to FCZ. The health information is information about FCZ’s daughter and not FCZ. That same individual, being FCZ’s daughter, is the person to whom the health information relates.
Consequently, FCZ was not entitled to request access to the Confidential Documents and the respondent did not breach HPP 7 by refusing her access. To the contrary, the respondent repeatedly requested proof that FCZ had parental responsibility for her daughter and took steps to ensure the Confidential Documents were not disclosed to FCZ without that proof. This was to ensure the respondent did not breach HPP 11. The respondent’s caution was entirely warranted: at [67]-[68].
The Tribunal considered that even if the applicant was the authorised representative with parental responsibility to request access to the information, the public interest considerations against disclosure (clauses 3(a), 3(b) and 3(g)) outweighed those in favour of disclosure (sections 3 and 12): [69]-[70].
In the circumstances of this case, the disclosure of the Confidential Documents could reasonably be expected to contravene HPP 11 (disclosure) because:
- the “primary purpose” for collecting the personal health information of the applicant’s daughter was for the respondent to provide health services to the daughter, not to provide the applicant, at her request, with information about her daughter’s medical condition
- the applicant’s daughter cannot consent to disclosure for a secondary purpose, and the applicant’s husband, who has parental responsibility, expressly stated that he does not consent to the disclosure
- disclosure is not in the best interests of the applicant’s daughter (clause 3(g)), given the “unrelenting pursuit for evidence of an alleged sexual assault”.
The Tribunal also considered the personal factors and motives for the application captured by section 55 of the GIPA Act in determining if there was an overriding public interest consideration against disclosure: at [72]. In the circumstances of this case, the Tribunal identified the applicant’s relationship as mother to her daughter (section 55(1)(a); motive for the application to reagitate allegations about sexual assault (section 55(1)(b)); and the applicant’s non-compliance with Family Court orders (section 55(1)(c)).
Tribunal outcome
The Tribunal found that, on balance, the public interest considerations against disclosure outweighed the public interest considerations in favour of disclosure. The respondent’s refusal to provide the applicant with access to the Confidential Documents was not in breach of HPP 7. The Tribunal made orders to take no action in the matter pursuant to s. 55(2) of the PPIP Act.
