Civil and Administrative Tribunal New South Wales Medium Neutral Citation: EON v Mid North Coast Local Health District [2022] NSWCATAD 113 Hearing dates: 10 August 2021 Date of orders: 06 April 2022 Decision date: 06 April 2022 Jurisdiction: Administrative and Equal Opportunity Division Before: D Dinnen, Senior Member Decision: (1) Pursuant to s 55(2) of the Privacy and Personal Information Protection Act 1998 (NSW) no further action is taken on the matter. Catchwords: ADMINISTRATIVE REVIEW - Health information - Review of conduct of agency - Health Privacy Principles – disclosure – HPP 11 – exceptions Legislation Cited: Health Records and Information Privacy Act 2002 Mental Health Act 2007 Privacy and Personal Information Protection Act 1998 Cases Cited: AF v Minister for Health [2012] NSWADTAP 16 Bevege v Commissioner of Police (NSW) [2014] NSWCATAD 22 BN v Hornsby Shire Council [2008] NSWADT 249 BVS v Sydney Local Health District [2015] NSWCATAD 171 CBL v Southern Cross University [2018] NSWCATAP 236 CEU v University of Technology Sydney [2017] NSWCATAD 79 CNC v NSW Police Force [2017] NSWCATAD 94 CYL v YZA [2017] NSWCATAP 105 Department of Education and Communities v VK [2011] NSWADTAP 61 Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44 Director General, Department of Education and Training v MT [2005] NSWADTAP 77 DKV v Southern NSW Local Health District [2019] NSWCATAD 12 DMW and DMX v NSW Local Land Services [2019] NSWCATAD 128 DXJ v Health Administration Corporation [2019] NSWCATAD 230 EJE v Nepean Blue Mountains Local Area Health District [2021] NSWCATAD 289 JD v Department of Health (NSW) [2005] NSWADTAP 44 KJ v Wentworth Area Health Service [2004] NSWADT 84 KO v Commissioner of Police (NSW) [2005] NSWADTAP 56 NZ v Department of Housing (NSW) [2005] NSWADT 58 OD v Department of Education and Training (GD) [2005] NSWADTAP 74 PN v Department of Education and Training (GD) [2010] NSWADTAP 59 Category: Principal judgment Parties: EON (Applicant) Mid North Coast Local Health District (Respondent) Representation: Counsel: A Zheng (Respondent) Solicitors: Applicant (self-represented) Crown Solicitor (Respondent) File Number(s): 2021/26453 Publication restriction: Pursuant to s 64(1)(a) the Applicant's name and the names of his family members are restricted from publication and disclosure. Pursuant to s 64(1)(b) and (d) the disclosure of confidential paragraph 30 to the Applicant and its publication or broadcast is prohibited. REASONS FOR DECISION 1. The Applicant has been provided with the pseudonym 'EON' to ensure his privacy is maintained in these proceedings. His family members, where necessary that they are referred to, will also be provided with pseudonyms. 2. EON is a former patient of the Port Macquarie Base Hospital, which forms part of the Mid North Coast Local Health District (MNCLHD/the Respondent). He received treatment and care from the Respondent on various occasions in 2020 as a person with a 'mental illness' under the Mental Health Act 2007 (the MH Act). 3. The Applicant seeks an administrative review of conduct by the Respondent. His complaint is that the Respondent disclosed certain information to one or more of his family members in the lead up to a hearing before the Mental Health Review Tribunal (MHRT) on 24 September 2020 (the September Hearing). He alleges that the disclosures were not authorised under the MH Act and were therefore not permitted under Health Privacy Principle (HPP) 11(2), and the conduct therefore contravened s 72(2) of the MH Act, the Health Records and Information Privacy Act 2002 (HRIP Act) and the Privacy and Personal Information Protection Act 1998 (PPIP Act). His request for internal review made 22 September 2020 stated: [EON] instructs that he has routinely advised [MNCLHD] and its employees and officers that he would like the following people excluded from being provided with information and/or consulted about his treatment: [EON's Mother] [EON's sister] [EON's sister, referred to as the pseudonym 'EOS'] [EON] instructs that Dr Tranter has disclosed [EON]'s personal information and health information to one or more of the above individuals in the lead up to [EON]'s CTO Review Hearing on 24 September 2020 and specifically invited them to attend the hearing before the MHRT. Such conduct likely contravenes s 72(2) of the Mental [H]ealth Act, the [HRIP Act] and s 12, s 17 and s 18 of the [PPIP Act]. [EON] instructs that he does not maintain a close personal relationship, nor does he have frequent personal contact with any of the above-mentioned individuals to warrant any of them being a designated carer as per s 71(2) of the Mental Health Act. I also note that s 72A(3) provides that 'an authorised medical officer… must not determine that a person is a principal care provider of another person if the person is excluded from being given notice or information about the other person under the Act.' [EON] again requests that the above-mentioned individuals are not provided with information or consulted about his medical treatment and all unauthorised disclosure of his personal and health information cease. As per s 52 of the [PPIP Act], [EON] requests an internal review of the above complaint. 1. On 24 December 2020, the Respondent provided the outcome of the internal review to Legal Aid on behalf of EON (the Reviewable Decision). The Reviewable Decision found that there was no unauthorised disclosure of EON's health information in breach of HPP 11, as any such disclosure fell within the exception in HPP 11(2) as being authorised by another law, or necessarily implied or reasonably contemplated by another law. 2. The Respondent accepted that its staff disclosed information about EON to one of his sisters, referred to in these reasons for decision as 'EOS', in the lead up the September Hearing. It identified five separate disclosures to EOS on 21 August 2020, 28 August 2020, 1 September 2020, 3 September 2020 and 24 September 2020. The Respondent contended that its conduct in making the disclosures did not breach HPP 11 for the following reasons: 1. that the exception in HPP 11(1)(b) applies as the disclosure was made for a purpose directly related to the Primary Purpose, and EON would reasonably expect the Respondent to disclose the information for the Secondary Purpose; or 2. the disclosures were each made for the same Secondary Purpose as the Primary Purpose, and therefore were not prohibited by HPP 11; or 3. the exception in HPP 11(2)(b) applies as any non-compliance with HPP 11 was permitted, necessarily implied or otherwise reasonably contemplated under the Mental Health Act. 1. The Applicant contended that he notified the Respondent on multiple occasions pursuant to s 72(2) of the MH Act that he wanted to exclude his family members from being given notice or information about him and that pursuant to s 72A(3) his sister or other family members whom he had excluded could not be his 'designated carer' or 'principal care provider'. The Respondent's conduct therefore constituted a breach of his privacy with respect to the disclosure of his health information to EOS. Legal Principles Jurisdiction and scope of review 1. The Tribunal's jurisdiction in these proceedings derives from Part 5 of the PPIP Act. Under s 53(1) of the PPIP Act, 'a person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct.' Conduct, for the purposes of Part 5 of the PPIP Act, is deemed by s 21(1) of the HRIP Act to include, relevantly, the contravention of a HPP by a public sector agency. Under s 11 of the HRIP Act, an 'organisation' that is a health service provider must also comply with the HPPs. The Respondent has accepted that it is an 'organisation' and a 'public sector agency', as defined by s 4 of the HRIP Act, and that it is a health service provider for the purposes of s 11 of the HRIP Act, as defined by s 4 of the HRIP Act. 2. Under s 55 of the PPIP Act, if a person has made an application for an internal review under s 53 of the PPIP Act and is not satisfied with the findings of the review, or the action taken by the public sector agency in relation to the application, they may apply to the Tribunal for administrative review of the relevant 'conduct' under the ADR Act. The reviewable conduct is the action or circumstances involving the agency that might amount to a possible contravention of an information protection principle: CYL v YZA [2017] NSWCATAP 105 at [58]. 3. A person cannot apply to the Tribunal under s 55 of the PPIP Act unless that person has first applied for an internal review under s 53 of the PPIP Act: Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 at [7]. The scope of the proceeding in the Tribunal is then determined by the scope of the application for internal review: KO v Commissioner of Police (NSW) [2005] NSWADTAP 56 at [13]; Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44 at [16]; CYL v YZA [2017] NSWCATAP 105 at [58]. In respect of applications under s 55 of the PPIP Act, the Appeal Panel of the former Administrative Decisions Tribunal observed in OD v Department of Education and Training (GD) [2005] NSWADTAP 74 at [13]-[14] that: The applicant can not, after the application has been dealt with by the agency, widen the scope of the process. It is a fundamental premise of the Act that the agency first be given an opportunity to review the conduct of concern to the applicant. Therefore, it would be wrong to allow proceedings in the Tribunal to be changed in scope so as to allow the applicant to put in issue new items of conduct or new bodies of information if they were not abl[e] to be identified (by the agency considering the complaint reasonably) at the initial stage. It is therefore critical that the agency and subsequently the Tribunal delineate with care and precision the actual information that is the subject of the internal review application and any subsequent application to this Tribunal. Privacy complaint 1. 'Personal information' under the PPIP Act is defined under s 4A to exclude 'health information' within the meaning of the HRIP Act, except as provided by either the PPIP Act or the HRIP Act. Section 6 of the HRIP Act then defines 'health information' as follows: (a) personal information that is information or an opinion about – (i) the physical or mental health or a disability (at any time) of an individual, or (ii) an individual's express wishes about the future provision of health services to him or her, or (iii) a heath service provided, or to be provided, to an individual, or (b) other personal information collected to provide, or in providing, a health service, or […] 1. A 'health service' is defined by s 4 of the HRIP Act to include 'medical', 'hospital', 'mental health', and 'community health' services. It also includes 'welfare services,' which are 'necessary to implement' any of the foregoing. 2. HPP 11 contained in Schedule 1 to the HRIP Act relevantly provides: 11 LIMITS ON DISCLOSURE OF HEALTH INFORMATION (1) An organisation that holds health information must not disclose the information for a purpose (a 'secondary purpose') other than the purpose (the 'primary purpose') for which it was collected unless-- (a) the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or (b) the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or Note: For example, if information is collected in order to provide a health service to the individual, the disclosure of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. … (2) An organisation is not required to comply with a provision of this clause if-- (a) the organisation is lawfully authorised or required not to comply with the provision concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998 ), or (c) the organisation is an investigative agency disclosing information to another investigative agency. … Mental Health Act 1. Section 71 of the MH Act defines what is meant by a 'designated carer' and s 72 of the MH Act provides for the nomination of designated carers. It provides that up to 2 persons can be so nominated (s 72(1)) and also that a person can nominate persons who are excluded from being given notice or information about the person under this Act (s 72(2)). Section 72(7) allows authorised medical officers to not give effect to a nomination in certain circumstances: (7) An authorised medical officer or a director of community treatment is not required to give effect to a nomination, or a variation or revocation of a nomination, if the officer or director reasonably believes-- (a) that to do so may put the patient or nominated person or any other person at risk of serious harm, or (b) that the person who made the nomination, variation or revocation was incapable of making the nomination, variation or revocation. 1. A 'principal care provider' is defined under s 72A of the MH Act as the individual 'who is primarily responsible for providing support or care to the patient (other than wholly or substantially on a commercial basis)'. There is no provision for the nomination of a principal care provider, unlike a designated carer, although the principal care provider can also be a designated carer (s 72A(5)). Instead, s 72A(2) provides that an authorised medical officer may, for the purposes of complying with a provision of the MH Act, determine who is the principal care provider of a person. In doing so, s 72A (3) and (4) provide that: (3) The authorised medical officer or the director of community treatment must not determine that a person is the principal care provider of another person if the person is excluded from being given notice or information about the other person under this Act. (4) An authorised medical officer or a director of community treatment is not required to give effect to a requirement relating to a principal care provider of a person under this Act or the regulations if the officer or director reasonably believes that to do so may put the person or the principal care provider at risk of serious harm. 1. There are a number of provisions in the MH Act requiring information to be provided to or from a patient's 'designated carer' and/or 'principal care provider'. Section 72B(a) requires consideration of information provided by 'any designated carer, principal care provider, relative or friend of the patient or person' for the purpose of determining whether the person is a mentally ill person or a mentally disordered person or whether to discharge the patient or person. 2. Section 75 requires notification where a person is detained in a mental health facility: 75 NOTIFICATION TO CARERS OF INITIAL DETENTION (1) An authorised medical officer must, not later than 24 hours after a person is detained in a mental health facility, take all reasonably practicable steps to notify any designated carer and the principal care provider (if the principal care provider is not a designated carer) of the person that the person is detained in the facility. (2) Notice need not be given if the person is discharged or classified as a voluntary patient within that period. 1. Section 76(3) requires notification of a mental health inquiry: 76 NOTIFICATION OF MENTAL HEALTH INQUIRIES … (3) The authorised medical officer must, in accordance with the regulations, take all reasonably practicable steps to give notice to any designated carer and the principal care provider (if the principal care provider is not a designated carer) of an assessable person of a proposed mental health inquiry. 1. Section 78 requires notification of a variety of events: 78 NOTIFICATIONS TO DESIGNATED CARERS AND PRINCIPAL CARE PROVIDERS OF EVENTS AFFECTING PATIENTS OR DETAINED PERSONS (1) An authorised medical officer of a mental health facility must take all reasonably practicable steps to notify any designated carer and the principal care provider (if the principal care provider is not a designated carer) of a patient or person detained in the facility if any of the following events occurs-- (a) the patient or person is absent from the facility without permission or fails to return at the end of a period of leave, (b) it is proposed to transfer the patient or person, or the patient or person is transferred, to another mental health facility or other facility, (c) the patient or person is discharged from the mental health facility, (d) the patient or person is re-classified as a voluntary patient, … (h) the patient or person has any matter before the Tribunal. (2) The authorised medical officer must give the notice as soon as practicable after becoming aware that the event has occurred. (3) In the case of a proposed transfer, the notice must be given before the relevant order or arrangement is made, except in an emergency. 1. Section 79 requires consultation with the designated carer or principal care provider in discharges and other care planning: 79 DISCHARGE AND OTHER PLANNING (1) An authorised medical officer of a mental health facility must take all reasonably practicable steps to ensure that a patient or person detained in the facility, and any designated carer and the principal care provider (if the principal care provider is not a designated carer) of the patient or person, are consulted in relation to planning the patient's or person's discharge and any subsequent treatment or other action considered in relation to the patient or person. (2) In planning the discharge of any such patient or person, and any subsequent treatment or other action considered in relation to the patient or person, the authorised medical officer must take all reasonably practicable steps to consult with agencies involved in providing relevant services to the patient or person, any designated carer and the principal care provider (if the principal care provider is not a designated carer) of the patient or person and any dependent children or other dependants of the patient or person. (3) An authorised medical officer of a mental health facility must take all reasonably practicable steps to provide any such patient or person who is discharged from the facility, and any designated carer and the principal care provider (if the principal care provider is not a designated carer) of the patient or person, with appropriate information as to follow-up care. 1. Section 189(1)(c) of the MH Act specifically provides that disclosure of information to a designated carer or the principal care provider in connection with the provision of care or treatment to the person under the MH Act is an exception to the general prohibition against disclosure of information obtained in connection with the administration or execution of the MH Act: 189 DISCLOSURE OF INFORMATION (1) A person must not disclose any information obtained in connection with the administration or execution of this Act or the Mental Health and Cognitive Impairment Forensic Provisions Act 2020 or the regulations unless the disclosure is made-- (a) with the consent of the person from whom the information was obtained, or (b) in connection with the administration or execution of this Act or the Mental Health and Cognitive Impairment Forensic Provisions Act 2020 , or (c) without limiting paragraph (b), to a designated carer or principal care provider of a person in connection with the provision of care or treatment to the person under this Act or the Mental Health and Cognitive Impairment Forensic Provisions Act 2020 , or (d) for the purposes of any legal proceedings arising out of this Act or the Mental Health and Cognitive Impairment Forensic Provisions Act 2020 or the regulations or of any report of any such proceedings, or (d1) for a purpose referred to in health privacy principle 10 (1) (f) (research) under the Health Records and Information Privacy Act 2002, or (e) with other lawful excuse. Maximum penalty--50 penalty units. (2) A person is not required to comply with subsection (1) if non-compliance is necessarily implied or reasonably contemplated under an Act or law. Evidence and submissions Dr Tranter 1. The Respondent relied on the evidence of Dr Richard Tranter, who provided an affidavit affirmed on 21 May 2021 and was cross-examined at length by the Applicant at hearing. Dr Tranter has been a Staff Specialist in Psychiatry and the District Medical Director for Mental Health and Alcohol and Other Drugs Services at the MNCLHD since late January 2019. He began working as a psychiatrist in New South Wales in 2019, after more than 25 years' experience elsewhere in Australia, the United Kingdom and New Zealand. He became responsible for EON's community-based treatment within the MNCLHD from 7 April 2020 and had his first face to face contact with EON on 15 May 2020. Prior to that, he was involved in clinical review discussions regarding EON on 5 February 2020 and was consulted about his admission to the inpatient unit at Port Macquarie on 11 March 2019. 2. Dr Tranter explained that EON has a diagnosis of schizophrenia and experiences intense persecutory delusions particularly focussed on his family. His opinion is that 'EON's persecutory beliefs towards his family are indicative of ongoing mental illness'. 3. Dr Tranter provided his understanding of the MH Act and its application to EON's treatment with reference to the NSW Mental Health Act Guide Book ('the Guide Book'), the MH Act, applicable policy documents including 'Collaborative Care Planning in Mental Health Services: MNC-PRO-0066-109' and 'Community Mental Health – Rapid Response: MNC-PRO-0074-17' and NSW Health Policy Directive 'Discharge Planning and Transfer of Care for Consumers of NSW Health Mental Health Services NSW: PD2019-045'. He explained that: In my opinion, in most clinical situations there is agreement between the treating team and the patient regarding the identification of a 'designated carer'. In rare situations, it may become apparent to the treating team that a client may be excluding an appropriate designated carer on the basis of delusional beliefs secondary to their mental illness. Where the patient fails to identify an appropriate designated carer according to the definition provided by the Guide Book, then the treating team will attempt to identify an appropriate designated carer or principal care provider, guided by the hierarchy set out in Section 4.1.d of the Guide Book. 1. According to Dr Tranter's knowledge and review of the Respondent's records, EON's first contact with Port Macquarie Base Hospital Mental Health Unit (the Hospital) was in March 2019. He was admitted as an involuntary patient under the MH Act and discharged on 21 March 2019. EON was discharged from the community mental health team on 25 June 2019. He was then admitted to Concord Mental Health Unit in September 2019 on a voluntary basis but was made an involuntary patient following increasing paranoia and his threats to discharge himself against medical advice. On 20 January 2020 he was 'detained for less than 24 hours by the Port Macquarie Base Hospital Mental Health service'. On 27 February 2020 he was again admitted as an involuntary patient at the Hospital. On 6 March 2020 the Mental Health Review Tribunal (MHRT) made an order for the in-patient treatment of EON for 4 weeks. EON did not nominate a designated carer during this latest admission, but nominated certain family members as persons excluded from being given information regarding his care. 2. On 20 March 2020, EON was discharged subject to a community treatment order (CTO) made by the MHRT. The CTO had a term of 6 months (to expire on 19 September 2020) and included a requirement that EON comply with ongoing treatment in the form of depot medication, as well as attending reviews with EON's case manager and his treating psychiatrist, Dr Tranter. There was no family or designated carer representation for EON at the MHRT hearings on 6 March 2020 and 20 March 2020. 3. On 22 April 2020, the treatment team at the Hospital responsible for overseeing EON's care, including Dr Tranter, held a clinical case review and the issue of whether a designated carer or a principal care provider could be identified for EON was raised for discussion. EOS was identified by the treatment team as the 'principal carer' for EON. This decision was recorded on EON's electronic medical record (eMR). A 'principal carer' is a term used by staff at the Hospital to refer interchangeably to 'designated carer' or 'principal care provider' under the Mental Health Act. 4. Dr Tranter gave evidence regarding the determination to make EOS the principal carer for EON, despite EON's nomination on 6 March 2020 that EOS and certain other family members be excluded from being given information regarding his care. He was also cross examined on this issue by the Applicant and gave consistence evidence. Essentially the determination relied on Dr Tranter's medical assessment of EON as lacking capacity to make the decision to exclude certain family members from being given information and being otherwise involved in his care. Dr Tranter took into account that EOS was EON's next of kin as recorded in his eMR; that although EON was effectively estranged from his family during the period of time that he was unwell, he also had not maintained any meaningful relationships outside of the family; and that involving EON's family, such as EOS, in critical care planning and decisions under the MH Act was, in Dr Tranter's clinical assessment, in EON's best interests. This determination was conveyed by Dr Tranter to EON on 15 May 2020 at a consultation in the outpatient clinic. 5. It is in this context that members of the Respondent's staff communicated with EOS about EON in the lead up to the September Hearing before the MHRT, which took place on 24 September 2020. Confidential evidence 1. Pursuant to confidentiality orders made by the Tribunal on 6 July 2021 the Respondent provided the Tribunal with evidence in a confidential session which was prohibited from disclosure to the Applicant and prohibited from broadcast or publication. That evidence included information provided by and to EON's family members, including the content of the communications which are the subject of EON's privacy complaint. 2. [Not for Publication] EON 1. Whilst not providing a formal statement, EON provided the Tribunal with a letter dated 23 October containing his history of abuse by his family, his treatment by Ward 1A (of the Hospital) and the difficulties he had faced and continued to face in dealing with the Respondent. At hearing he gave oral evidence to support his complaint and his treatment by the Respondent. He had admitted himself to a psychiatric ward eight times in the past three years. Each time he claims to have excluded his family from being provided with information about him and his treatment, and this has been disregarded. His mother and sister were not supportive of him, financially or otherwise. His sister had abused him physically and had introduced him to marijuana. There was a history of abuse by his family members. The only criteria they ever satisfied to be considered a 'designated carer' or 'principal care provider' was being related to him, they did not satisfy any of the other criteria under the MH Act. 2. EON said that he didn't do drugs anymore and understood his diagnosis of paranoid schizophrenia. He was medicated and attended regular GP visits. He claimed that the acts of aggression and failure to comply with the CTO and other treatment plans alleged by the Respondent were, essentially, the result of misunderstandings or miscommunications. He was studying and trying to put his past behind him without his family's interference. He was a cogent, rational adult who should be able to make a decision about whether or not his family members should have access to his medical records or information about his condition and treatment. Consideration IPPs or HPPs? 1. Although the Applicant's Internal Review Application referred to ss 12, 17, and 18 of the PPIP Act in addition to the HRIP Act, the Tribunal agrees with the Respondent's submission that the applicable privacy provision to the conduct complained of by EON is HPP 11. Section 12, 17, and 18 of the PPIP Act contain the IPPs relevant to 'personal information', but the 'information' the subject of the relevant conduct was 'health information'. The HPPs as contained in Schedule 1 to the HRIP Act that are equivalent to ss 12, 17, and 18 of the PPIP Act are HPP 5 (retention and security), HPP 10 (limits on use of health information) and HPP 11 (limits on disclosure of health information). 2. HPP 5 provides certain requirements as to how long information is kept and provides that it must be disposed of securely so as to protect against loss, unauthorised access, use, modification or disclosure and against other misuse. Generally, conduct that would be captured by HPP 5 would be inadvertent disclosure due to failure to securely maintain and dispose of health information. In circumstances where the conduct complained of involves deliberate and authorised disclosures made by Hospital staff to EOS, HPP 5 seems inapplicable. 3. HPP 10 concerns the 'use' of health information. A 'use' of information generally refers to 'internal use made of personal information by the collecting agency', while the term 'disclosure' implies the provision of information to a third party, external to the agency: see Department of Education and Communities v VK [2011] NSWADTAP 61 at [20]-[21]; JD v Department of Health (NSW) [2005] NSWADTAP 44; Director General, Department of Education and Training v MT [2005] NSWADTAP 77 at [25], [39]-[40]; NZ v Department of Housing (NSW) [2005] NSWADT 58 at [69]; AF v Minister for Health [2012] NSWADTAP 16 at [102]; Bevege v Commissioner of Police (NSW) [2014] NSWCATAD 22 at [25]; BVS v Sydney Local Health District [2015] NSWCATAD 171 at [44]; CNC v NSW Police Force [2017] NSWCATAD 94 at [20]; CEU v University of Technology Sydney [2017] NSWCATAD 79 at [126]; CBL v Southern Cross University [2018] NSWCATAP 236; DXJ v Health Administration Corporation [2019] NSWCATAD 230 at [29]-[32]; cf. KJ v Wentworth Area Health Service [2004] NSWADT 84 at [48]-[51]). 4. I agree with the Respondent's submission that in this case, the information was provided to a third party, EOS, and the conduct is more correctly characterised as 'disclosure' than 'use'. HPP 11 concerns the disclosure of health information, subject to various exceptions, and is therefore the relevant HPP for consideration in these proceedings. 5. As discussed above at [5], the Respondent relied on each of the 'exceptions' to HPP 11 to the effect that there had been no breach of the Applicant's privacy by the Respondent's conduct in making the disclosures to EOS on 21 August 2020, 28 August 2020, 1 September 2020, 3 September 2020 and 24 September 2020. I will deal with each of these exceptions below. Review of determination of EOS as principal carer 1. The Tribunal's jurisdiction in these proceedings is to review whether conduct by the Respondent has breached various provisions of the PPIP or HRIP Act, as referred to in the Applicant's application for internal review which is set out above at [3] above. This Tribunal cannot review the decisions made by EON's treating team, including Dr Tranter, under the MH Act, even if those decisions are incorrect or unfounded. In PN v Department of Education and Training (GD) [2010] NSWADTAP 59 at [57]-[59] the Appeal Panel noted in the context of a review concerning s 25(b) of the PPIP Act that: In our view, it is enough for s 25(b) to apply that the transactions in issue (here, one instance of indirect collection and otherwise disclosures) are of a type that is contemplated by the [workers compensation] regime; and that they are genuinely undertaken for the purpose of the scheme. ... […] The Tribunal's task is simply to make a broad judgement as to whether s 25 applies. The protection given to an agency by s 25 is not lost simply because the agency has failed to comply, in some aspect of the detail, with a requirement of the other law. 1. Section 25(b) of the PPIP Act is in similar terms and application to cl 11(2)(b) of Schedule 1 to the HRIP Act, in that it provides an exemption for compliance with the HPPs if 'non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law…'. The Tribunal's task is simply to make a broad judgment as to whether cl 11(2)(b) of Schedule 1 to the HRIP Act applies to the relevant circumstances. That protection is not lost because the Respondent may have (or has) failed to comply with a requirement of the MH Act in making its determination under s 72A(2) of the MH Act. 2. The effect of this is that, unfortunately for the Applicant, the Tribunal has no power in these proceedings to consider or determine whether any of the decisions made by Dr Tranter or others under the MH Act in relation to EON's care or treatment are correct or valid. The Tribunal has to assume that they are. On that basis I agree with the Respondent's submission that the decision to identify EOS as EON's designated carer and/or principal care provider is not the subject of the present review. Primary purpose and Secondary Purpose 1. The first basis upon which the Respondent submitted the disclosures were not breaches of HPP 11 was that the 'Primary Purpose' for which the information was collected was the same as the 'Secondary Purpose' for which it was disclosed. The Respondent submitted that objectively considering the nature of the information, the Primary Purpose for collecting the information which was later disclosed to EOS was : 1. in respect of the 21 August, 1 September and 24 September Disclosures, to enable the Respondent to provide community and mental health services to EON under the MH Act. 2. in respect of the 28 August Disclosure, to enable the Respondent to provide community health services to EON. 3. in respect of the two pieces of information disclosed by the 3 September Disclosure, the Primary Purpose in respect of the first was to enable the Respondent to provide welfare services to support EON's ongoing care and treatment while in the community, and in respect of the second piece of information to provide EON with the necessary mental health services. 1. In EJE v Nepean Blue Mountains Local Area Health District [2021] NSWCATAD 289 (EJE), the Tribunal found at [125] that the Primary Purpose for the collection of EJE's health information from EJE's mother was 'intertwined' with the Secondary Purpose for disclosing health information back to EJE's mother. HPP 11 had therefore not been breached in those circumstances, nor in circumstances where the Respondent had collected health information from EJE's GP, who had referred her for medical treatment, where a discharge summary about EJE was later provided to her GP (at [163]). The Tribunal held that the disclosures were 'for the primary purpose for which (the information) was collected' (at [163]), which the Tribunal characterised as 'for the purpose of determining what, if any, further medical treatment was appropriate and to ensure 'continuity of care'' (at [162]). 2. I accept that the disclosures of EON's health information to EOS were made to her in compliance with the Respondent's obligations under the MH Act, in relation to EON's treatment. Each communication was made to EOS, who EON's treatment team had determined was his 'designated carer' and/or 'principal care provider' under the MH Act in the lead-up to the September Hearing. In my view, however, the disclosures in this matter are not analogous with the situations considered by the Tribunal in EJE regarding disclosures to EJE's mother and GP, where the information had been collected from EJE's mother and her GP for the purpose of providing EJE with continued medical treatment. There is no evidence that EOS was, in fact, involved in enabling or assisting EON to access continued medical treatment through the Respondent in the lead up to the September Hearing at the MHRT, even if she was nominated by the Respondent as EON's principal carer. 3. However I do agree with the Respondent's submission that if the Primary Purpose is not considered to be the same as the Secondary Purpose, they are 'directly related' within the meaning of HPP 11(1)(b). The two requirements for HPP 11(1)(b) to apply as an exception to HPP 11 are that the Secondary Purpose must be 'directly related' to the Primary Purpose, and EON must have reasonably expected the disclosure to be made for the Secondary Purpose. For the Primary and Secondary Purposes to be 'directly related', 'a direct relationship is all that is required': BN v Hornsby Shire Council [2008] NSWADT 249. 4. In my view the health information disclosures provided to EOS in the lead up to the September Hearing were directly related to the Primary Purpose for which the Respondent collected EON's health information, to inform EOS as the Respondent's determined 'principal carer' for the purpose of involving EOS in the care and mental health services being provided to EON, pursuant to the MH Act. 5. The second requirement for the exception at HPP 11(1)(b) to apply is that EON 'would reasonably expect the organisation to disclose the information for the secondary purpose'. In DKV v Southern NSW Local Health District [2019] NSWCATAD 12, it was held that a patient consulting with a specialist should reasonably expect the disclosure to be made to her treating GP if the consultant discussed doing so at the consultation. Similarly, in DMW and DMX v NSW Local Land Services [2019] NSWCATAD 128, a disclosure made to the local council was considered to have been reasonably expected by the complainant where the person offered to make enquiries on the complainant's behalf with the council, and that was not refused. 6. I agree with the Respondent's submissions that EON would have reasonably expected that the disclosures would be made to EOS for the Secondary Purpose of informing her and involving her in his care by his treatment team because upon EON's admission to the Hospital, he was provided with a Statement of Rights, and a member of the inpatient team went through the information with him. The Statement of Rights explains that: A designated carer or any other person who is your principal care provider may ask for information on your behalf and will be informed if you are kept in a mental health facility, subject to a mental health inquiry, transferred or discharged and of proposed special mental health treatments or surgical operations. You and a designated carer or any other person who is your principal care provider also have the right to be given information about follow-up care if you are discharged. 1. EON was also aware that EOS had been identified as his designated carer because Dr Tranter informed him of this on 15 May 2020, and explained to EON both the basis for that decision, and also that consultations would take place with EOS, as required by the MH Act, and that EON's family including EOS would continue to be able to provide the treating team with information about EON's collateral history and to raise concerns. EON expressed his intent to challenge the identification of EOS as his designated carer, which indicated his understanding of those circumstances. It is clear from EON's evidence and his cross examination of Dr Tranter that he did not like this decision, but in the absence of him successfully challenging it he would reasonably expect that the Respondent would make the disclosures of his health information to EOS as his designated carer under the MH Act. 2. Accordingly, I find that each of the five disclosures falls within the exception in HPP 11(1)(b). Permitted or reasonably contemplated under an Act 1. The Respondent relied on the exception at HPP 11(2)(b) in the alternative to HPP 11(1)(b), to the effect that the disclosures to EOS were permitted or otherwise reasonably contemplated under the MH Act. 2. As discussed above, once EON's treating team, including Dr Tranter as his treating psychiatrist, had identified that EOS was the designated carer and/or principal care provider for EON, the MH Act required that certain information concerning EON's care and treatment had to be notified to her. The communications with EOS took place in August and September 2020, following EON's discharge from Hospital in March 2020 in the lead up to his MHRT hearing and fell within the Respondent's obligations under the MH Act with respect to notifying or consulting with an individual's designated carer or principal care provider. Each of the five disclosures by the Respondent to EOS was therefore reasonably contemplated by the MH Act pursuant to ss 75, 76, 78, and 79, which required the Respondent to inform and consult with a patient's designated carer and/or principal care provider. 3. Further, s 189 of the MH Act provides that it is an exception to the general prohibition on disclosing any information obtained under the MH Act if that disclosure is made to a designated carer or principal care provider in connection with the provision of care or treatment to the person under the MH Act. I find that each of the five disclosures to EOS were permitted under s 189 of the MH Act because they were disclosures made for the purpose of, and in connection with, the provision of care and treatment to EON by the Respondent. 4. Accordingly, I find that the exception at HPP 11(2)(b) also applies to the disclosures made to EOS of EON's health information which were the subject of the Applicant's internal review application. Conclusion 1. Having found that the Respondent has not breached HPP 11 because either or both of the exceptions at HPP 11(1)(b) and HPP 11(2)(b) apply, the appropriate course is for the Tribunal to take no further action pursuant to s 55(2) of the PPIP Act. Orders 1. Pursuant to s 55(2) of the Privacy and Personal Information Protection Act 1998 (NSW) no further action is taken on the matter. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 06 April 2022