Civil and Administrative Tribunal New South Wales Medium Neutral Citation: ERJ v South Eastern Sydney Local Health District [2022] NSWCATAD 260 Hearing dates: 3 May 2022 Date of orders: 5 August 2022 Decision date: 05 August 2022 Jurisdiction: Administrative and Equal Opportunity Division Before: S Dunn, Senior Member Decision: 1. Pursuant to s 64 of the Civil and Administrative Tribunal Act the publication or broadcast of the name of the Applicant in these proceedings is prohibited. Note: A reference to the name of the Applicant includes a reference to any information, picture or other material that identifies the Applicant or is likely to lead to the identification of the Applicant. 2. Within 14 days of the date of these Reasons for Decision the Respondent is to provide an unreserved formal written apology to the Applicant addressing and apologising for the Respondent's breaches of HPP 11 in respect of the Applicant's health information as identified in these Reasons for Decision and for all distress caused to the Applicant as a result of those breaches. Catchwords: PRIVACY – Health Privacy Principle 11 – was the Applicant's health information disclosed for the primary purpose - would the Applicant reasonably expect his information to be disclosed for a secondary purpose Legislation Cited: Administrative Decisions Review Act 1997 (NSW) Civil and Administrative Tribunal Act 2013 (NSW) Health Records and Information Privacy Act 2022 (NSW) Privacy and Personal Information Act 1998 (NSW) Cases Cited: AEC v Commissioner of Police (NSW) [2013] NSWADTAP 30 AF v Minister for Health [2012] NSWADTAP 61 DTN v Commissioner of Police [2020] NSWCATAP 73 EJE v Department of Communities and Justice [2021] NSWCATAD 96 EON v Mid North Coast Local Health District [2022] NSWCATAD 113 Category: Principal judgment Parties: ERJ (Applicant) South Eastern Sydney Local Health District (Respondent) Representation: Applicant (self-represented) A Bulbulia (Principal Privacy Officer, Legal Services Unit, South Eastern Sydney LHD) (Respondent) File Number(s): 2021/00157996 Publication restriction: Pursuant to s 64 of the Civil and Administrative Tribunal Act 2013 the publication or broadcast of the name of the Applicant in these proceedings is prohibited. Note: A reference to the name of the Applicant includes a reference to any information, picture or other material that identifies the Applicant or is likely to lead to the identification of the Applicant. REASONS FOR DECISION Background 1. In these reasons for decision the name of the Applicant has been anonymised so as to preserve the privacy of their personal affairs. The Applicant is referred to as the Applicant or ERJ. 2. During 2019 and 2020, the Applicant was being provided with case management support services by the AIDS Dementia and HIV Psychiatry Service (ADAHPS) which is one of the Respondent's facilities. In these reasons I refer to ADAHPS as either ADAHPS or the Respondent. During this period the Applicant was also being provided with services by a separate NSW Health entity, a sexual health clinic. While the Applicant was not aware of the name of this entity, the Respondent explains that these services were being provided by the Public Health Service (Sexual Health) Clinic based in Queanbeyan under the governance of the NSW Health HIV/AIDS and Related Programs Unit (the HARP Clinic). The Applicant was also receiving treatment from the South Eastern Regional Hospital Bega (SERH) which comes under the governance of the Southern New South Wales Local Health District. The Respondent explains that SERH provided consulting rooms for HARP Clinic staff who were treating the Applicant and that HARP Clinic nurses who arranged blood tests and monitored the Applicant's medication needs would see him at SERH. 3. The Applicant complains that an employee of ADAHPS disclosed his health information without his knowledge or consent to certain persons outside of ADAHPS who he understood to be SERH employees. The Respondent accepts that the Applicant's health information was disclosed to the persons identified by the Applicant but says that these persons were staff members of the HARP Clinic. I note that there are some references in the material before the Tribunal to at least one of those persons as being of "Bega Sexual Health Clinic SERH". However as both SERH and the Harp Clinic are separate entities to ADAHPS nothing ultimately turns on whether these persons were SERH staff or HARP Clinic staff. In these reasons they are referred to as being HARP Clinic staff members. 4. In March 2021 the Applicant made an application for an internal review by the Respondent under Part 5 of the Privacy and Personal Information Act 1998 (NSW) (PPIP Act) complaining that the Respondent had breached the Health Privacy Principles (HPPs) under the Health Records and Information Privacy Act 2022 (NSW) (HRIP Act) by, amongst other things, disclosing his health information to persons outside of ADAHPS without his consent. 5. That internal review was concluded in April 2021. The Respondent determined that there had been no breach of the HPPs. 6. The Applicant now applies to this Tribunal for a review of the conduct which was the subject of the internal review application. There are a number of aspects of the internal review decision which the Applicant takes issue with. However, it is the conduct that was the subject of that review, not the review decision itself, which the Tribunal is tasked with reviewing: s 55 PPIP Act, AEC v Commissioner of Police (NSW) [2013] NSWADTAP 30 at [34]. 7. Section 63 of the Administrative Decisions Review Act 1997 (ADR Act) provides that, in determining an application for review, the Tribunal is to make the correct and preferable decision having regard to the material before it and any applicable written or unwritten law. 8. The internal review application and the submissions filed in these proceedings canvassed a number of issues to which various HPPs under the HRIP Act might have potential application including issues as to the accuracy or correction of the Respondent's records concerning the Applicant and the Applicant's access to information, however, at the hearing of the application the Applicant confirmed that the issue in these proceedings was limited to the disclosure of his health information without his knowledge or consent and that he did not press for access to or correction of any records. 9. At a Case Conference in the course of preparing the proceedings for hearing it was agreed by the parties that the only conduct of the Respondent which is in issue in these proceedings is the conduct of the Applicant's Case Manager at ADAHPS. That person is no longer employed by the Respondent and was not represented before the Tribunal. I shall refer to her in these reasons as the Applicant's Case Manager. Relevant Legislative Provisions 1. The HRIP Act sets out certain Health Privacy Principles (HPPs) which public and private sector agencies must comply with when handling "health information". 2. Section 6 of the HRIP Act defines "health information", relevantly, as follows: In this Act, health information means: (a) personal information that is information or an opinion about: (i) the physical or mental health or a disability (at any time) of an individual, or (ii) an individual's express wishes about the future provision of health services to him or her, or (iii) a health service provided, or to be provided, to an individual, or (b) other personal information collected to provide, or in providing, a health service… 1. It is not in dispute that the Respondent is a public sector agency which holds health information about the Applicant. 2. The HPPs are set out in Schedule 1 to the HRIP Act. HPP 10 relates to the use an agency may make of health information and HPP 11 relates to the disclosure which may be made of health information. The distinction between "disclosure" and "use", as those terms are used in HPP 10 and HPP 11, was considered by the Appeal Panel of the Administrative Decisions Tribunal in AF v Minister for Health [2012] NSWADTAP 61 which stated [at 102]: 'Use' and 'disclosure' have usually been presented as discrete concepts in data protection law, and that distinction is drawn in this law. 'Use' is generally seen as referring to the internal use made of personal information by the collecting agency, whereas 'disclosure' is used to describe the act of supplying the information to a third party external to the agency. 1. In this case it is HPP 11 which is relevant for consideration. HPP 11 provides, relevantly, as follows: 11 Limits on disclosure of health information (1) An organisation that holds health information must not disclose the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless: (a) Consent the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or (b) Direct relation the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or 1. Section 21 of the HRIP Act provides that a contravention of a HPP that applies to a public sector agency is conduct to which Part 5 of the PPIP Act applies. 2. Part 5 of the PPIP Act (ss 52–55) relates to internal and external review of conduct of a public sector agency that is alleged to be in breach of a HPP. 3. Section 53 provides that a person aggrieved by the conduct of a public sector agency may apply for an internal review of the conduct. Section 53(7) provides that, following completion of the review the public sector agency may do any one or more of the following: (a) take no further action on the matter, (b) make a formal apology to the applicant, (c) take such remedial action as it thinks appropriate (eg the payment of monetary compensation to the applicant), (d) provide undertakings that the conduct will not occur again, (e) implement administrative measures to ensure that the conduct will not occur again. 1. Section 55 of the PPIP Act provides that a person who has made an internal review application and is not satisfied with the findings of the review or the action taken by the public sector agency in relation to the application may apply to the Tribunal for an administrative review of the conduct that was the subject of the internal review application. 2. Section 55(2) of the PPIP Act provides that on reviewing the conduct of a public sector agency the Tribunal may decide not to take any action on the matter, or it may make one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. Material before the Tribunal 1. The Applicant relied upon: 1. His application (undated) received by the Tribunal on 2 June 2021 which attached documents including his internal review application, and copies of some emails and screenshots of text messages; 2. Submissions received by the Tribunal on 18 October 2021 and documents attached to those submissions which were marked D1, D7, D10, D15–D26, D28-D35, D37, D38, D39, D41- D49; 3. Submissions received by the Tribunal on 11 February 2022 and documents attached to those submissions; 4. Further submissions made orally at the hearing of the proceedings. 1. Some of the Applicant's written and oral submissions were really in the nature of evidence. The Respondent did not cross-examine the Applicant. 2. The Respondent relied upon: 1. Documents lodged with the Tribunal under s 58 of ADR Act (s 58 documents); 2. Submissions dated 17 November 2021; 3. Submissions in reply dated 25 February 2022; 4. A Chronology of Conduct dated 1 March 2022; and 5. Further submissions made orally at the hearing. 1. During the course of the hearing the Respondent undertook to provide the Tribunal and the Applicant with copies of extracts from the Respondent's website outlining the services provided by ADAHPS as there was no evidence before the Tribunal as to the nature of the services ADAHPS provided. This was filed on 3 May 2022. On 10 May 2022 the Applicant provided a short submission in response complaining that a number of the services that are indicated in that material as services ADAHPS was able to provide were not offered or provided to him. That complaint is beyond the scope of these proceedings. 2. There was no evidence from the Applicant's Case Manager who is no longer employed by the Respondent or any other officer of the Respondent. Relevant Facts 1. The following facts emerge from the material before the Tribunal. 2. The Applicant was being provided with healthcare services by a Senior Medical Officer and a Sexual Health Registered Nurse at the HARP Clinic. It is not clear on the evidence before the Tribunal when these services commenced but it was at some point prior to 13 March 2019. These individuals were not represented in the proceedings and I shall refer to them, and to all other relevant health and allied service providers by their positions rather than by their individual names. 3. On 13 March 2019, the HARP Clinic referred the Applicant to ADAHPS for case management support namely provision of "specialist advice, accessing care/service engagement and linking with [other] services". The reason for the referral was that the Applicant was HIV positive and had co-morbidities. The Applicant's Case Manager became the Applicant's Case Manager on about 19 March 2019. 4. According to the NSW Health website, "ADAHPS… provides a range of services to assist people who have HIV related cognitive impairment and complex health needs. It's a confidential service for NSW residents and it's free." It states that ADAHPS case managers can provide a range of support based on an individual's needs. Under the heading "How can case manager help?", it is stated: Case managers can: Advocate Help organise medications and reminders arrange tests to monitor memory loss or poor concentration assist with housing issues co-ordinate case conferences to identify support needs and monitor their effectiveness link to social and support agencies help manage medical appointments arrange in-home and community support 1. On 4 April 2019, the Applicant met with the Applicant's Case Manager at Bega Hospital and the Applicant's Case Manager completed an assessment form. The Applicant signed a form headed "Consent for ADHAPS (sic) to obtain and share personal information" which stated: ADAHPS needs your permission to obtain and share your personal details with other services that provide support to you, eg community workers, housing providers and private contracted workers… I, [ERJ], give permission for ADAHPS to obtain details about my health/situation and for ADAHPS to share this with other services when it's needed for my care, or to ensure the safety of those working with me. This consent will last for two years unless I withdraw it. ADAHPS will not ask for or share information about me that is not relevant to the services they are providing to me…. 1. That form also stated "I have been given and understand the NSW Health Information Privacy Leaflet" – that leaflet is not in evidence. 2. The Applicant's Case Manager's notes of that meeting state: "[ERJ] says he doesn't require support at this stage." 3. The Applicant describes the services that the Applicant's Case Manager provided as being limited to an emotional support role. The Applicant's recollection is that he spoke to the Applicant's Case Manager infrequently in the first year and in that time she really didn't do anything for him at all. It appears from the Applicant's Case Manager's Progress/Clinical Notes in the s 58 documents that from April 2019 to late May 2020 she telephoned the Applicant approximately 12 times to check on his health. She collected his health information in these discussions. Her notes also disclose that during this time she also reported back to or was contacted by the Sexual Health Nurse at the Harp Clinic, and occasionally the Senior Medical Officer, to discuss the client's position and checked up on whether appointments to see various specialists had been arranged. The Applicant's Case Manager also made contact on the Applicant's behalf with an organisation known as Positive Living regarding possible assistance they may be able to provide the Applicant with social housing. 4. By late May/early June 2020 the Applicant had become unhappy with the services that HARP was providing to him and at some point in the period 25 May 2020 to 1 June 2020, the Applicant notified HARP Clinic that he no longer wished to engage with services provided by them. 5. In a telephone call with the Applicant on 27 May 2020, the Applicant's Case Manager's notes indicate that, the Applicant told her that he did not want to speak to the Sexual Health Nurse because he was upset with her. Her notes record: "client didn't elaborate". 6. On 1 June 2020, the Applicant notified the Applicant's Case Manager by telephone that he no longer wanted to engage with the HARP Clinic. At the hearing the Applicant said that in late May/early June he told the Applicant's Case Manager in a telephone call (presumably in this conversation) that he did not want her to speak to HARP. 7. The Applicant's Case Manager's note of that conversation state: Phone client…Client said he doesn't want to deal with the Community team and will continue seeing his GP for his Health and HIV care. Client said he doesn't have faith in the Community Team. 1. On 1 June 2020 the Applicant's Case Manager had a conversation with the Sexual Health Nurse of the HARP Clinic. In a file note which appears to have been authored by that nurse she states: Spoke to [Applicant's Case Manager] from ADAHPS … Client saying does not want to continue his HIV care with this sexual health service. [Applicant's Case Manager] thought Client sounded rational and did not express any emotional issues. 1. The Applicant's Case Manager's note of that conversation states: P/C from [Sexual Health Nurse] who informed me that she had a meeting about a complaint received from client…said GP is not able to write scripts for his HIV medication and will need to get scripts written by Dr and Infectious Diseases or Canberra. [She] will try and contact him this week to find out if he wants to transfer his care from the community team and inform him of scripts. 1. Sometime prior to 9 June 2020 it appears from a file note made by a Clinical Nurse Consultant (CNC) with HARP, that the Applicant had texted the Sexual Health Nurse saying "No I don't want to talk or hear from either of you or [the Senior Medical Officer]… You should have been notified of this by HR at the hospital". 2. On 9 June 2020 the CNC sent an email to the Applicant which stated: While we are saddened you no longer want to be engaged with our service, we wholeheartedly respect your wishes. So you can continue to receive optimal care, where would you like to be referred to? With your consent, we can arrange for a handover of necessary information to save you from having to repeat your history to a new care provider. We wish you the best of luck…for the future. If you could please advise where to forward your information, that would be most appreciated. 1. On or about 9 June 2020, the Applicant notified the Sexual Health Nurse by text message that he wanted all of his health care to be managed by his GP and, on or about 10 June 2020, he lodged a formal complaint in relation to the care he had received from the HARP Clinic. 2. On 10 June 2020, the CNC emailed the Applicant's Case Manager at 12.15pm stating: I am conscious that there is a great deal happening for the above client at the moment. So we can coordinate his care as a team, and all be on the same page, I was wondering whether we may be able to schedule a case meeting for early next week? It would be really beneficial for the client to have a plan documented, in particular around handing over his HIV care to his chosen care provider. 1. On the same day at approximately 2.40pm according to the Applicant's Case Manager's notes she telephoned the Applicant. Her notes state: I asked client if he still gave me consent to talk to the Community Team client said yes, client said he is going to absolve [the Sexual Health Nurse] from complaint, he said he doesn't want to speak to her and is upset with her… 1. On 11 June 2020 the Applicant's Case Manager emailed the CNC attaching an updated ADAHPS Care Plan for the Applicant and stating: My role with the client has been regular phone contact to check on clients wellbeing as discussed/requested by [the Sexual Heath Nurse and Senior Medical Officer]. The client has been tricky to engage with at times but during covid he has engaged quite well and I have managed to maintain fortnightly contact with the client to check on his wellbeing and as the client puts it 'have a chat'. Since finding out about the complaint last week from [the Senior Medical Officer], I have said to the client that I can't give advice or comment on the complaint, my support will continue to be monitoring health and wellbeing, referral to Services (such as ACON for counselling and as needed) and liasing with [Positive Living] regarding the clients Housing application. ADAHPS is focused on having a cohesive working relationship with Murrumbidgee and Southern LHDs to ensure ongoing client care, Today the client has requested I give him a bit of space while he 'deals with the hospital issues' but will ring me as needed. If I haven't heard from the client in 3-4 weeks I will reach out to see how he is doing. 1. On or about the same date the Applicant's Case Manager had a telephone conversation with the CNC in which the CNC suggested that "given there is a great deal happening for this client, it may be worth holding a client review next week." In a file note of that conversation the CNC notes that the Applicant's Case Manager agreed and was happy to attend whenever scheduled. The note continues: [Applicant's Case Manager] has been in contact with the client this morning – she reports [ERJ] is very confused about where the request to have a mental health assessment has come from. He is also very angry about it. He is seeing his GP in the coming days – hopefully this will clarify a few things for him. [Applicant's Case Manager] reports that [ERJ] plans on transferring his care to Sydney – she will encourage him to contact Sexual Health Team to forward his notes to a nominated service. 1. In his October 2021 submissions the Applicant says that on 14 July 2020 there was a call between the Applicant's Case Manager and himself. He states: At which time [the Applicant's Case Manager] told me she would be speaking to [the CNC]. My reply was I did not want her speaking to [the CNC]. [Applicant's Case Manager] mentioned I was not her only client (my understanding was that [the Applicant's Case Manager] would have to have contact with [the CNC] and was referring to ADAHPS and the sexual health clinic SERH other clients) At that time, I agreed for [the Applicant's Case Manager] to "update" [the CNC] and told [the Applicant's Case Manager] to inform [her] "I was fine and had found another s100 antiviral prescriber and that was waiting for my initial consultation with them as a new patient." 1. At the hearing the Applicant said that in this conversation he made it clear to the Applicant's Case Manager that he only gave approval for her to speak to the CNC about him once, to let her know that he had found another doctor and that he was fine, but that he did not give approval for any further discussions. 2. At the end of the Applicant's Case Manager's note of that conversation she states: Client is aware I will be providing update to [CNC]. 1. On 15 July 2020 the Applicant's Case Manager sent the CNC an email headed "Client update" advising her about the telephone call she had had with the Applicant and providing detailed information as to his current state of health, his medication status, that he had an upcoming health review scheduled and had seen his GP, information which went beyond the information that the Applicant "was fine and had found another s100 antiviral prescriber and that was waiting for my initial consultation with them as a new patient". 2. That email states: I told the client that I had contact with you and will update you on his health and the phone call which the client was ok with. I was hoping he would agree to have you as a contact person in terms of his Health as well as me but he didn't want to talk to you. I will work on that because besides me, I don't think he is talking to anyone (maybe the GP) about his health and I would feel comfortable if there was another staff member he was in contact with too. I will contact him after the surgery (he prefers that) and I will let you know how that goes. 1. In a text message on 16 July 2020 to the Applicant's Case Manager, the Applicant stated: "Hi [Applicant's Case Manager] could you please close my file and notify [Positive Living] that I will no longer be needing his services as we or I mainly have found the solution to my situation". 2. In his internal review application, the Applicant states: "I had formally asked for my case to be closed with ADAHPS on the 16th July 2020 and yet [the Applicant's Case Manager] refused and persisted in having me agree to phone calls for "support"". 3. The Applicant's Case Manager's notes disclose that, having received the Applicant's text on 16 July 2020 she attempted to call him twice and that the Applicant returned her call on 17 July 2020. Her note of that conversation states: I told client about my concerns about not having contact and asked if I could continue contact, client agreed for me to have contact. 1. On or about 17 July 2020, the CNC made a note in relation to "Email from [the Applicant's Case Manager] ADAHPS" (which appears to be a reference to the Applicant's Case Manager's 15 July email) headed "Retrospective" which stated: Client has agreed to remain in contact with [Applicant's Case Manager], he reported to [Applicant's Case Manager] that he has engaged with GP for medical care. [Applicant's Case Manager] is unsure whether this includes HIV management – he did disclose he was continuing to take ART. [Applicant's Case Manager] would feel more comfortable if there were x2 people involved with [ERJ]'s care in case she is on leave etc. So far [ERJ] has not consented to being contacted by CNC, however [Applicant's Case Manager] will continue to encourage. 1. By text message sent on 30 July 2020 from the Applicant to the Applicant's Case Manager, the Applicant stated: This message sent today.. to [Applicant's Case Manager]/ADAHPS on behalf of myself is to revoke permission and all authority previously given to ADAHPS, their associated staff and [Applicant's Case Manager] by myself [ERJ] in regards to my personal information sharing with any 3rd party medical or otherwise. As of this moment you no longer have permission to share or comment via any form of electronic communication including in person via telephone with any 3rd party, specifically Bega Southern regional Hospital or any department therein! I will forward this same revocation to ADAHPS head office directly via email today however any and all 3rd party communication stops as of this moment, today 30/07/2020 5.29am. Signed [ERJ] 1. The Applicant says in his internal review application that on approximately 30 July 2020 the Applicant's Case Manager told him that she will "have to email [CNC] to let her know she would not be able to contact her anymore regarding my healthcare". 2. The Applicant's Case Manager's note of that conversation states: I phoned client, he said that he does not want me to have contact with [CNC] or Community Team. I told client that I will need to contact [CNC] to inform her of that. 1. On 31 July 2021, the Applicant's Case Manager spoke to the CNC via telephone. In her Progress / Clinical Note of that conversation the Applicant's Case Manager states: Phoned [CNC] informed her that [the Applicant] has told me not to contact her or the local team. [CNC] has concerns about client's HIV scripts and care. Informed [her] that client said he has a few months worth of scripts and that I shared the same concern with the client. 1. The CNC's note of that conversation states: [Applicant's Case Manager] phoned [ERJ] today – Conversation went for > 60 minutes, covered: He wanted to close his file with ADAHPS … [ERJ] reports he is not sleeping [Applicant's Case Manager] reports that [ERJ] started to say some unusual things – i.e went from saying he had 2 month to 7 months worth of ART left… [ERJ] does not want [Applicant's Case Manager] to discuss case with anyone from "community health" Summary of Concern: [Applicant's Case Manager] is concerned that [ERJ] has no other supports in place. She is in Sydney and if takes leave etc who will be supporting [ERJ] CNC concerned that [Applicant's Case Manager] is isolated in her care for [ERJ] CNC concerned [ERJ] may not in fact be taking his ART Plan CNC to email [SERH staff] who have taken over case management of [ERJ] and express concerns [Applicant's Case Manager] to discuss case with Manager CNC to discuss case with HARP Manager 1. On 4 August 2020 a case conference was held concerning the Applicant attended by a Doctor (Director of Medical Services (DMS)) at SERH, who had taken over the Applicant's care, the Applicant's Case Manager, the CNC and the manager of HARP at which there was a discussion concerning the Applicant's ongoing HIV management, local supports and coordination of care. 2. The Progress / Clinical Note prepared by the Applicant's Case Manager dated 4 August 2020 states: Skype meeting organised by [Director Medical Services], [HARP Manager] CNC and myself attended. Discussed client wishes to withdraw consent for Adahps to communicate with the community team and who would be managing client's HIV health. [DMS] said she would contact Dr [ ] regarding handover of HIV care and to [the Applicant's GP.] I clarified with [DMS] if [those two persons] are the people I need to communicate with in order to be updated on the client's care, [DMS] said yes, I also mentioned that client gave consent for this last week. I said I will update Care Plan and send to client. [DMS] asked why I would send to client unless he requested it. I said to [DMS] I could send care plane and update [with] her. Spoke to [ADAHPS service coordinator] and care plan and updates, [she] said client consent would be required and she will look into the process. Plan to speak to client about care plan and if he would like me to send updates to [DMS] or just [the other Doctors identified]." 1. By email dated 17 August 2020 the Applicant advised the Applicant's Case Manager that he had chosen to discontinue with ADAHPS services entirely and requested that she close his file. 2. On or about 26 August 2020 the Applicant's Case Manager telephoned the CNC and advised that she was no longer working with ERJ. 3. In March 2021 the Applicant made his application for internal review complaining about the Applicant's Case Manager sharing information about him without his knowledge or approval for several months after she was aware an agreement was in place to remove [HARP Clinic staff] from his health care from 12 June 2020. Submissions 1. In summary, the Applicant submits that on each occasion from 11 June 2020 onwards that the Applicant's Case Manager disclosed his health information to staff of HARP Clinic that communication was in breach of his privacy. There are a number of communications referred to by the Applicant in his submissions but I understand many of these are referred to by way of context and, because it was agreed that the only conduct of the Respondent in issue in the proceedings was the conduct of the Applicant's Case Manager, I understand the specific communications the Applicant complains about are: 1. The Applicant's Case Manager's email to the CNC on 11 June 2020 and the provision of the updated care plan attached to that email and the telephone conversation between them on that date (11 June communication); 2. The Applicant's Case Manager's email to the CNC on 15 July 2020 headed "Client update" (15 July communication); 3. The Applicant's Case Manager's conversation with the CNC on 31 July 2020 (31 July communication); and 4. The Applicant's Case Manager's participation in the Case Conference held on 4 August 2020 (4 August Case Conference). 1. The Applicant's submissions also include a complaint about the conversation between the Applicant's Case Manager and the CNC on 26 August 2020 but I understand the Applicant's complaint in relation to that conversation relates to the accuracy of certain information provided by the Applicant's Case Manager to the CNC in that conversation, not to the disclosure of the Applicant's health information, and while the Applicant maintains the information was inaccurate, he does not press for any orders to be made in that regard. 2. The Respondent submits, first, that the period identified by the Applicant in his internal review application and applicable to the Respondent's decision is 16 July 2020 to 26 August 2020 and submits that the Tribunal is limited to reviewing the Respondent's conduct during that period which is the subject of the original application for the internal review: EJE v Department of Communities and Justice [2021] NSWCATAD 96 at [22]. 3. The Respondent's written submissions address HPP 10 relating to the "use" of the Applicant's information, rather than its disclosure. At the hearing the Respondent accepted that, as the relevant conduct was the provision of the Applicant's health information to a third party, that conduct is correctly categorised as "disclosure" rather than "use" of the Applicant's information, so that HPP 11 is the relevant HPP for consideration in these proceedings, not HPP 10: EON v Mid North Coast Local Health District [2022] NSWCATAD 113 at [36]. 4. The Respondent submits that, in all relevant instances, it lawfully disclosed the Applicant's health information to HARP Clinic for ADAHPS' primary purpose, pursuant to HPP 11(1). 5. The Respondent submits that the primary purpose of collecting the Applicant's health information was to provide "healthcare and follow-up services to the Applicant". 6. Alternatively, should the Tribunal find that any of the disclosures were not for ADAHPS' primary purpose, the Respondent submits that the disclosures were made for a secondary purpose, pursuant to HPP 11 (1)(b). This secondary purpose can be categorised, the Respondent submits, as a "further service" provided by ADAHPS directed at monitoring and protecting the Applicant's healthcare needs and welfare in circumstances where the Applicant had disengaged with ADAHPS and other health-service providers. The Respondent submits that this secondary purpose is directly related to ADAHPS' primary purpose. Further, the Respondent submits that the Applicant would have reasonably expected ADAHPS to disclose his information for the secondary purpose because it was solely done for the protection of his health welfare, even after the Applicant had expressly withdrawn his consent for ADAHPS to share his information with third parties. The Respondent submits that an individual must reasonably expect a health-service provider to use or disclose information when the secondary purpose goes solely to the protection of that individual's health-welfare. Consideration Date of conduct 1. While I accept that the Tribunal is limited to reviewing the scope of the Respondent's conduct which is the subject of the original application for the internal review, I do not accept that the internal review application was limited in scope to the period after 16 July 2020 as the Respondent suggests. In the internal review application the Applicant stated under the heading "when did the conduct occur (date)?": "Between 1/1/2019 – Present" and under the heading "What is the specific conduct you are complaining about": The agency, being [the Applicant's Case Manager]…shared that information without my knowledge or approval with [CNC] and SERH Community health dept for several months after she was aware a firm agreement was in place removing …SERHs Community health staff from my care from 12/06/2020… Purpose of disclosure of information 1. I do not accept that the disclosure of the Applicant's health information was made, in each case, for the purpose for which the Applicant collected the information. Nor do I agree with the Applicant's definition of the Respondent's "primary purpose" in collecting the information which the Respondent describes as "to provide healthcare and follow-up services". ADAHPS is not a healthcare services provider. It is not the case, as the Respondent submitted, that it was providing "treatment and follow up care", nor, therefore as the Respondent submitted, that it was doing so conjointly with the HARP Clinic. ADAHPS provides a range of support services to people with HIV related cognitive impairment and complex health needs and in this case was engaged to provide case management services to the Applicant. The Respondent's primary purpose in collecting the Applicant's health information was to enable it to provide those services. At the time of each disclosure HARP was no longer engaged to provide services to the Applicant. While ADAHPS may wish to speak to HARP to seek to identify the Applicant's ongoing needs and to obtain information from HARP for that purpose, it does not appear to me to be necessary for ADAHPS to disclose to HARP, who were no longer engaged in the Applicant's care, his information for that purpose. Accordingly, I do not accept that disclosure of the Applicant's health information to HARP was made for the primary purpose. 2. I agree that the disclosure was made in each case for a secondary purpose, namely in order to seek to monitor and protect the Applicant's welfare by seeking to ensure that he continued to have appropriate care and support after having disengaged HARP. I accept that the secondary purpose was directly related to the primary purpose. Would the individual reasonably expect disclosure of his health information 1. The question which then remains is whether, in each case, the disclosure was made with the Applicant's consent or, if not, the Applicant would reasonably expect the Respondent to disclose the information for the secondary purpose. 11 June communication 1. While the Tribunal faces some difficulty in the absence of evidence from the Applicant's Case Manager, it appears from the chronology of events that, by 11 June 2020 the Applicant's Case Manager was aware that the Applicant had requested that HARP no longer provide him with any services. It is also clear that the Applicant had told the Sexual Health Nurse that he did not wish to speak with or hear from either herself or the Senior Medical Officer. It appears that this is the reason why the CNC sent the email of the 9th of June responding to his request to terminate HARP's services. However, while at the hearing the Applicant said that in early June he had told the Applicant's Case Manager he did not wish her to share his information with HARP, this is not consistent with his written submissions or with his internal review application which states under the heading "What is the specific conduct you are complaining about": The agency, being [the Applicant's Case Manager]…shared that information without my knowledge or approval with [CNC] and SERH Community health dept for several months after she was aware a firm agreement was in place removing …SERHs Community health staff from my care from 12/06/2020… 1. Nor is it consistent with the Applicant's Case Manager's file note of that conversation where she notes that the Applicant did give his consent for her to talk to the "community team". On the evidence before the Tribunal it does not appear that the Applicant had in fact yet told the Applicant's Case Manager that he did not want her to share his information with anyone at HARP. 2. Accordingly, in light of the consent form that he had originally signed which stated that he gave permission for ADAHPS to share his information "when it's needed for my care", I consider that the disclosure was made with the Applicant's consent. 15 July communication 1. The Applicant's own evidence was that in their telephone call on 14 July 2020 he gave the Applicant's Case Manager permission to speak to the CNC once (but once only) and the Applicant's Case Manager's file note of her conversation with the Applicant on that date and subsequent email make it clear that she had advised the Applicant in that conversation that she would be providing an "update" to the CNC. The information provided in the 15 July email goes beyond what the Applicant said he authorised the Applicant's Case manager to share. However, in light of the evidence that the Applicant was told that she would provide the CNC with an "update", I consider that the 15 July communication was also made with the Applicant's consent. 31 July communication 1. The Applicant's text message of 30 July 2020, however, was abundantly clear that he did not consent to the Applicant's Case Manager sharing his personal information with any third party from that moment forward. While the Applicant accepts that the Applicant's Case Manager told him that she would "have to email [CNC] to let her know she would not be able to contact her anymore regarding my healthcare" it is clear from the CNC's file note of their conversation on 31 July that, in that conversation, the Applicant's Case Manager did more than simply advise the CNC that she could no longer contact her and did disclose health information relating to the Applicant. There is no suggestion on the material before the Tribunal that the Applicant's consent was sought or that he was told that it would still be necessary to share his information for the purpose of seeking to ensure the Applicant continued to have appropriate care and support (or for any other purpose for that matter) and in the circumstances I do not accept the Respondent's submission that the Applicant would have reasonably expected the Applicant's Case Manager to do so. To the contrary, especially given that the Applicant's Case Manager had previously been careful to obtain his consent, it would have been reasonable for the Applicant to expect that she would not. As such, I find that the 31 July communication was in breach of HPP 11. 4 August Case Conference 1. Although it is not clear from the material before the Tribunal what information relating to the Applicant was disclosed by the Applicant's Case Manager at the Case Conference and it is clear from her Progress/Clinical notes that she was concerned to ensure that she had the appropriate consent to share the Applicant's care plan with the new team treating the Applicant (which on the materials before the Tribunal does not appear later to have been shared), the Respondent accepts that Applicant's Case Manager did disclose his health information at that conference. 2. There is no evidence of any further communication with the Applicant in the period after 31 July and before the Case Conference advising him that a Case Conference was to be held, or why, and seeking his consent to disclose his information or advising him that it was proposed to disclose his information at such a conference. 3. For the same reasons as apply in respect of the 31 July communication, while the Applicant might reasonably expect a case conference to be held and for ADAHPS to obtain information at such a conference so as to identify his support needs and monitor whether they are being addressed, I again do not accept that the Applicant would reasonably have expected his information to be disclosed in such a context and I find, to the extent that there was such a disclosure, a further breach of HPP 11 in respect of the 4 August Case Conference. I note that, in light of the clear message in the Applicant's 30 July text withdrawing consent to disclose his information to any third party, the Respondent was in breach of HPP 11 in this respect in disclosing the Applicant's information both to the HARP attendees at the conference as well as to the DMS. 4. While there is an obvious tension between the Respondent's (and the Applicant's other service providers') duty of care and the HPPs and it is understandable that the Respondent would have been concerned to seek to protect the Applicant's welfare and to ensure that he continued to have access to appropriate care and support, in the circumstances, after the Applicant had so clearly withdrawn his consent for his information to be shared, if the Respondent considered that it was necessary for his health information to be disclosed in order to seek to protect his interests, then it, at least, should have advised the Applicant that, notwithstanding he had expressly withdrawn his consent, it proposed to make these disclosures and to explain why. Conclusion 1. The Applicant, on learning of these disclosures felt that the Applicant's Case Manager was acting "in collusion" with those with whom she shared his information, that he had been deceived into sharing his information with her and that his trust had been betrayed. While, on the basis of the material before the Tribunal, it appears to the Tribunal that the Applicant's Case Manager was seeking to act to protect the Applicant's interests, it is understandable that the discovery that his information had been shared against his wishes caused the Applicant significant stress, at a time when he was already in a highly stressed state because of the significant medical issues he was managing. 2. The orders that the Tribunal may make under s 55(2) are set out at [19] above. As the Tribunal stands in the shoes of the agency, the actions and remedies available to the agency under s 53(7) are also available to the Tribunal: DTN v Commissioner of Police [2020] NSWCATAP 73 at [94]. 3. In terms of the orders sought, at the hearing the Applicant indicated that if the Tribunal were to find a breach by the Respondent of any HPP, he sought an acknowledgement from the Respondent admitting that it had breached his privacy and an apology. 4. I consider that in the circumstances of this case it is appropriate that a letter should be issued from the Respondent to the Applicant acknowledging the breaches of HPP 11 in respect of the health information of the Applicant as are identified in these reasons and providing an unreserved apology for the distress caused to the Applicant as a result of those breaches. Orders 1. Pursuant to s 64 of the Civil and Administrative Tribunal Act the publication or broadcast of the name of the Applicant in these proceedings is prohibited. Note: A reference to the name of the Applicant includes a reference to any information, picture or other material that identifies the Applicant or is likely to lead to the identification of the Applicant. 2. Within 14 days of the date of these Reasons for Decision the Respondent is to provide an unreserved formal written apology to the Applicant addressing and apologising for the Respondent's breaches of HPP 11 in respect of the Applicant's health information as identified in these Reasons for Decision and for all distress caused to the Applicant as a result of those breaches. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 05 August 2022