KD v Registrar, NSW Medical Board [2004] NSWADT 5

CITATION: KD v Registrar, NSW Medical Board [2004] NSWADT 5 DIVISION: General Division APPLICANT PARTIES: KD RESPONDENT Registrar, NSW Medical Board FILE NUMBER: 023185 HEARING DATES: 1/09/2003 SUBMISSIONS CLOSED: 09/17/2003 DATE OF DECISION: 01/13/2004

BEFORE: Britton A - Judicial Member APPLICATION: Privacy - information protection principle - disclosure to third party - Privacy - information protection principle - personal information - use MATTER FOR DECISION: Principal matter Health Care Complaints Act 1993 Medical Practice Act 1992 LEGISLATION CITED : Privacy & Personal Information Protection Act 1998 Privacy and Personal Information Protection Regulation 2000 Public Finance and Audit Act 1983 CASES CITED: Kioa v West (1985) 159 CLR 550 Re Minister for Immigration and Multicultural Affairs; Ex parte Miah (2001) 206 CLR 57 APPLICANT Mr KD, agent REPRESENTATION: RESPONDENT G Furness, barrister PRIVACY COMMISSIONER Dr J Gaudin ORDERS: The Tribunal determines not to take any action on the matter

1 This is an application pursuant to s 55 of the Privacy and Personal Information Protection Act 1998 ("the Privacy Act"). The applicant, KD, seeks review of conduct by the NSW Medical Board ("the Board"), which she contends constituted a contravention of the information protection principles set out in Part 2 of the Privacy Act. She alleges that the Board contravened Privacy Principles 11 and 12 (ss. 18 and 19 of the Act). She seeks orders for compensation and rectification of damage allegedly caused to her by way of the disclosure of personal information concerning her by the Board to a doctor against whom she had made a complaint. Background 2 The facts in this matter are, in virtually all respects, uncontentious. Having been referred to the North Shore Urodynamics Centre by her treating physician, in November 1999, KD underwent a procedure conducted by Dr A, a specialist gynaecologist and urogynaecologist. It is unnecessary here to relate the nature of the procedure but the applicant regarded her treatment during the procedure by the doctor the subject of her complaint, and the consequences of the procedure as highly unsatisfactory. She complained about both to the NSW Minister for Health, Mr Craig Knowles, in a letter dated 29 September 2000. 3 The Minister referred that letter to the Health Care Complaints Commission and, pursuant to s 26 of the Health Care Complaints Act 1993, in November 2000 the Commission in turn referred it to the Board for investigation. By letter dated 6 January 2001, the applicant provided further material to the Board and attached a copy of her Medicare claims history obtained from the Health Insurance Commission for the period November 1999 to November 2000 ("Medicare history"). 4 The Board wrote to the applicant on 24 January 2001 acknowledging her letters of September 2000 and January 2001. The letter stated that "The Medical Board is in the process of obtaining information from [Dr A] in relation to your complaint. On receipt of this information, the matter will be reviewed by the Medical Board to determine what action, if any, is to be taken against [Dr A]. The Medical Board will advise you of the outcome of its inquiries in due course." 5 It is not clear when KD's letter of 6 January 2001 and the accompanying Medicare history were sent to Dr A, but on 2 February 2001, Ms Rebecca Forbes, the Board's Complaint Co-ordinator wrote to Dr A asking for his comments on the complaint and seeking answers to four specific questions or allegations raised in that complaint. Ms Forbes also asked for a copy of Dr A's relevant medical records. She advised him that "at the conclusion of this process, the Board will advise you, [KD], and the Health Care Complaints Commission of the outcome." 6 Dr A responded in detail to the Board's letter of inquiry with a letter answering the allegations made by KD together with a copy of a letter (undated) sent to the Health Care Complaints Commission (which had raised KD's complaints with him directly some time earlier although exactly when the evidence before the tribunal does not reveal), and the relevant medical records. 7 On 29 March 2001, the Board wrote back to KD enclosing a copy of Dr A's response to her complaint. It stated among other things that the Board had decided that there were no grounds on which to take any action against the doctor. 8 On 12 April 2001, KD wrote back to the Board complaining that she had been informed [on 3 April] by Ms Forbes that copies of her correspondence raising the allegations against Dr A had been provided to the doctor. She wrote, "As this information was provided to [Dr A] without my knowledge and more importantly without my consent, I request that you provide me with a prompt explanation." The essence of the Board's answer to KD, conveyed to her in a letter from the Deputy Registrar, Ms Anne Scahill on 26 April 2001, was that when investigating complaints the Board was required to observe principles of natural justice by allowing the practitioner the subject of the investigation to respond to the allegations made against him or her. 9 Unsatisfied with this response, in May 2001 KD took her complaint concerning breach of privacy to the Minister for Health, who requested a response from the Board. She also complained to the Privacy Commissioner who, in August 2001, wrote to the Board seeking its response to the complaint. Between August 2001 and March 2002 correspondence ensued between the Privacy Commission and the Board. In May 2002, KD sought an internal review by the Board pursuant to the Privacy Act. In July 2002, the Board's Privacy Review Officer, Mr Andrew Dix (the Registrar of the Board), having completed his review of the complaint, wrote to KD outlining the course and results of his investigation, his decision and the reasons for it. [It is to be noted that the Privacy Commissioner in his letter to the Board dated 8 March 2002 took the view that six documents had been disclosed to Dr A. The best evidence indicates that only three were disclosed, namely the Medicare Claims history, the accompanying letter from the applicant to the Board dated 6 January 2001, and the applicant's letter to the Minister dated 29 September 2000.] 10 In summary, Mr Dix found that the Board had been obliged to apply the principles of natural justice during its investigation, that there had been no indication of any particular desire for or expectation of confidentiality expressed by KD in her original complaint concerning Dr A's treatment of her and that some material which KD believed had been forwarded by the Board from her without her consent had not, in fact, been sent to the doctor. He found that there had been no contravention of the Privacy Act but that certain improvements could be made to the Board's procedures to alert complainants to the fact that their letters of complaint were likely to be forwarded to the medical practitioners against whom complaints were made and giving them an opportunity of declining to consent to such a process before any further steps were taken in an investigation. He also decided that the Health Care Complaints Commission should be requested to adopt a similar procedure with complainants and, finally, that a formal apology be offered to KD for the distress she suffered as a result of her letters being forwarded to Dr A. The respondent has since made the amendments to its procedures foreshadowed in Mr Dix's letter to the applicant. In November 2002, the Health Care Complaints Commission also made the amendments recommended by Mr Dix. 11 KD filed her application for a review by this tribunal of the Board's conduct on 16 August 2002. Evidence 12 KD gave evidence that the discovery that her correspondence had been passed on to Dr A by the Board surprised and shocked her and entailed increased anxiety and stress, exacerbating her condition of chronic pain. Medical evidence supporting this evidence was also tendered from her treating physician, Dr Peter Jones. 13 Mr KD attested that Ms Forbes in a phone conversation in December 2000 suggested that the Medicare claims history be forwarded to the Board. Mr KD said he agreed to send it so it could "go on the file". In cross-examination Mr KD agreed that in the course of that conversation Ms Forbes advised that she was about to write to Dr A about the complaint. Issues for determination 14 There are only two legal issues for determination in this matter: first, did the Board breach the Privacy Act by sending personal information relating to the complainant to Dr A? Second, if so, what are the appropriate remedies? Relevant law 15 "Personal information" is defined by s 4 of the Privacy Act as "information or an opinion… about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion." It is a very broad definition. 16 Section 4(4)(a) of the Privacy Act provides that personal information is held by a public sector agency if among other things the agency is in possession or control of the information. Section 4(5) provides that for the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited. The Privacy Act does not further define "collect" or "collection" of personal information. 17 "Investigative agency" for the purposes of the Privacy Act is defined as "the Ombudsman's Office, the Independent Commission Against Corruption, the Police Integrity Commission, the Inspector of the Police Integrity Commission and any staff of the Inspector, the Health Care Complaints Commission, the office of Legal Services Commissioner, and a person or body prescribed by the regulations for the purposes of this definition". The Board has not been prescribed under the Privacy and Personal Information Protection Regulation 2000 as an investigative agency. It does, however, fall within the Privacy Act definition of "public sector agency", being a statutory body whose accounts are required to be audited by the Auditor-General (see s 41C and Schedule 2 of the Public Finance and Audit Act 1983). 18 While the Medical Board is not defined in the Privacy Act as an investigative agency, the Health Care Complaints Commission may, pursuant to s 26 of the Health Care Complaints Act 1993, refer matters to it for investigation if it deems such a course appropriate. Under the Medical Practice Act 1992, the Board and Health Care Complaints Commission are obliged to notify each other of complaints concerning medical practitioners. Under the Medical Practice Act, the Board has certain investigative powers and functions concerning allegations of criminality, incompetence, unprofessional conduct and professional misconduct by medical practitioners. 19 Section 47 of the Medical Practice Act requires that when the Board receives a complaint it must "as soon as practicable after the complaint is made" notify the person against whom the complaint is made in writing of the fact of the complaint, the nature of the complaint and the identity of the complainant unless such notice is likely to, or will, prejudice the investigation, place the health or safety of the complainant at risk or place the complainant at risk of intimidation or harassment. Similar provisions apply in respect of the Health Care Complaints Commission under s 16 of the Health Care Complaints Act. 20 The Privacy Act prescribes certain principles for the protection of personal information collected by public sector and investigative agencies. These are subject to certain exemptions in specific cases. Sections 17-19 provide for limits on the use and disclosure of personal information held by public sector agencies. The effect of s 17 is that an agency must not use personal information for a purpose other than that for which it was collected unless with consent, or for a purpose related to the purpose for which the information was collected or to prevent or reduce a serious threat to the individual concerned. 21 Section 18 prohibits the disclosure of the personal information by public sector agencies to another person or body unless the disclosure is directly related to the purpose for which the information was collected and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure or that the individual would be reasonably likely to understand that such information is usually disclosed to that other person or body, or the agency reasonably believes it is necessary to make disclosure to meet a serious threat to the individual. 22 Section 19 places special restrictions on certain types of personal information, including "personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, health or sexual activities." Such information is not to be disclosed unless it is necessary "to prevent a serious or imminent threat to the life or health of the individual concerned or another person." (Emphasis added.) 23 For convenience ss. 17, 18 and 19 are set out below. 17. A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. 18. (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 19. (1) A public sector agency must not disclose personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, health or sexual activities unless the disclosure is necessary to prevent a serious or imminent threat to the life or health of the individual concerned or another person. 24 Public sector agencies are generally obliged to comply with these principles. (See ss. 20-22 of the Privacy Act.) There are, however, a number of exemptions from the general principles. Most relevantly, ss. 24 and 25 in certain circumstances release investigative and public sector agencies from what would otherwise be their obligations. Of greatest relevance here is s. 25 which provides: A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if: (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998 ). Findings and Conclusions 25 I accept KD's evidence that she was surprised and shocked to learn that material had been passed on to Dr A for comment by the Board. She was, at the time of the procedure undertaken by Dr A, in considerable distress and it appears that her chronic pain and associated psychological conditions increased after the procedure. I hasten to add that I am not investigating an allegation of medical negligence or misconduct and seek to draw or imply no conclusions concerning the treatment the applicant received at the hands of Dr A. The primary question here is whether the Board breached it obligations under the Privacy Act. 26 The respondent contends that the information provided by the applicant is not "personal information" for the purposes of the Act because it was not confidential information, being her medical history at least parts of which were known or likely to have been made known to Dr A. This argument holds little water. Whether or not others have the same information, a public sector agency is bound to treat the personal information – information or opinion about individuals whose identities are apparent or ascertainable from the information -- it obtains, in accordance with the principles and provisions of the Privacy Act. The exemption or exception contended for simply does not exist within the legislation. The material referred for comment by the Board to Dr A was self-evidently "personal information". 27 The respondent also argues that the information sent by the applicant was unsolicited and therefore pursuant to s 4(5) of the Privacy Act not "collected" by the Board. As a consequence it is asserted that ss. 8, 9, 10, 11, 17 and 18 of the Privacy Act do not apply to the information the subject of this application. This submission raises a question of fact: was the disclosed information unsolicited? It is to be observed that virtually all complaints received by investigative agencies will be unsolicited. It does not follow however that all information provided by a complainant to an investigative agency will be. The evidence is that the applicant's husband, told Ms Forbes about the Medicare history and she in turn invited him to send it, and any other relevant information, to the Board. While there is often a fine line between soliciting and extending an invitation to forward information, in the circumstances of this case it appears to me that the 6 January letter and Medicare history were unsolicited. It is self evident from the history of this matter that the applicant's letter to the Minister (forwarded to it by the Health Care Complaints Commission) was also unsolicited. Accordingly each of the three documents referred for comment by the Board to Dr A were not in my view information "collected" by the Board for the purposes of the Privacy Act. 28 As a consequence ss. 8, 9 10 and 11 have no application. The Privacy Commissioner submits that while ss. 8-11 only apply to personal information collected by agencies, ss. 12-19 apply to personal information held by agencies, irrespective of whether that information was collected, within the meaning of the Privacy Act. Put simply once an agency "holds" personal information, ss. 12-19 come into play. 29 The respondent agrees that s 19 catches all personal information held by an agency, however obtained, but asserts that ss 17 and 18 do not. It argues that it is implicit from the construction of these provisions that each apply only to information that has been collected. In my view, the respondent's argument is correct. Section 5(4) applies here as elsewhere: unsolicited information is not "collected" for the purposes of the Act. Section 17 refers to information held for a purpose "other than that for which it was collected." This seems to me to confine the relevant information to information that had been collected by the agency for one purpose and prevents it being used for another. Critically, it relates to collected information. 30 The interpretation of s 18 is more difficult but I think that the same implication obtains. Section 18(1)(a) again refers to the purpose for which information has been collected. Sub-section (1)(b) refers to personal information "of that kind" held by an agency. I think that there is a reasonable inference that this refers to "collected information" also, although it is not as clear in this instance as in (1)(a). It may well also refer to the wider category of unsolicited information. Given that this is beneficial legislation, s 18(1)(b) ought be given the wider interpretation. That view is strengthened by the fact that s 18(2) refers to "the purpose for which the information was given to it" rather than, as in s 18(1)(a), "for which the information was collected". Has there been a contravention of ss 18 or 19? 31 Section 19 provides that an agency (including an investigative agency) is not permitted to disclose "personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, health or sexual activities" except "to prevent a serious or imminent threat to the life or health of the individual concerned or another person." The information disclosed to Dr A was information relating to the health of the applicant. As the information was not disclosed to " prevent a serious or imminent threat…" this constitutes a contravention of s 19, unless, as the Board contends, it is it is exempt from that provision. 32 Section 25 provides that an agency is not required to comply with s 19 if it is "lawfully authorised or required not to comply with the principle concerned" or " non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law". 33 The respondent contends that it is entitled to rely on s 47 of the Medical Practice Act, which obliged it to disclose the substance and nature of KD's complaint to Dr A. Further it contends that as an administrative decision maker, as a matter of procedural fairness it was obliged to notify Dr A of any significant and adverse allegation made against him and give him an opportunity to meet those claims. (Re Minister for Immigration and Multicultural Affairs; Ex parte Miah (2001) 206 CLR 57) 34 While the Board has statutory and common law obligations requiring it to provide information to a practitioner the subject of investigation, it does not follow that it is required to disclose all information obtained in the course of that investigation. The rules of procedural fairness and s 47 of the Medical Practice Act do not require the Board in effect to act as a mailing house and pass on indiscriminately all information obtained in the course of its inquiry to the subject practitioner. The Board may and, in my view, must, examine the material to determine whether it is "credible, relevant and significant or provided on a confidential basis". (See Brennan J in Kioa v West (1985) 159 CLR 550 at 629.) 35 It is uncontroversial that the respondent was obliged to put the substance of KD's claim to Dr A. The critical issue is whether it was necessary for it to disclose all of the information it did in order to comply with its statutory and common law obligations. 36 The substance of the complaint is set out in the four-page letter to the Minister dated 29 September 2000. It is difficult to see how the investigation could proceed without the disclosure of that document. In my view as a matter of procedural fairness the Board had no option but to disclose it to Dr A. 37 Less straightforward is the letter of 6 January 2001 and the accompanying Medicare history. The applicant stated she was forwarding the Medicare information to "reinforce her allegations against Dr A". She asserted that the history substantiated her claim that following the surgical treatment carried out by Dr A it was necessary for her to obtain remedial treatment. In her letter to the Minister, the applicant also alleged that Dr A had billed Medicare for services not rendered. In a letter dated 15 February 2001, Dr A acknowledged the overcharging, contended it was an administrative error and claimed it had been rectified. 38 While some of the Medicare history may have been relevant to the matters under investigation it is apparent that parts of the report have no direct relevance to the applicant's claim. At the very least consideration should have been given to whether the whole report was relevant to the applicant's allegations concerning Dr A. I am not persuaded that it was necessary for the Board to forward the report in full to Dr A to comply with its statutory and common law obligations. Nor am I so persuaded in respect to the letter of 6 November 2001. It merely repeats in broad terms the allegation made in the applicant's letter to the Minister and goes on to detail the emotional and financial costs said to have been suffered by her as a result. 39 The respondent contends that, in any event, neither document was provided on a confidential basis. It points to the absence of any indication on the face of the documents that they were provided on that basis. The respondent argues that it should have been clear to the applicant's husband, from his conversation with Ms Forbes, that the volunteered documents would be forwarded to Dr A. Mr KD on the other hand claims that he had understood that the documents would be put on his wife's file for the reference of the Board alone. 40 While it was reasonable of the Board to assume that KD had implied her consent to disclose her complaint to Dr A, particularly as she had already published her complaint to the Minister for Health and the Health Care Complaints Commission, I do not accept that it was reasonable for the Board to assume that she had consented to it passing on to Dr A, each and every document provided the Board. This is especially the case given the absence of any detailed advice given to the applicant about the Board's procedures in relation to investigations and what it proposed to do with the personal information it collected. 41 Accordingly I am not satisfied that the Board was entitled to rely on the s 25 exemption in respect of the Medicare history and the applicant's letter of 6 January. 42 In my opinion, it was reasonable for the Board to believe that KD was "reasonably likely to have been aware" that information of the type contained in her complaint is usually disclosed to the subject of the complaint. On the other hand, and I will deal with this issue in more detail below, I do not consider that she would have been reasonably likely to have been aware that her Medicare records and her letter of 6 January would be disclosed to Dr A. There was, therefore, a prima facie breach of s 18(1)(b) in that regard. 43 Section 24 (3) operates to exempt an agency investigating a complaint referred to it by an investigative agency from compliance with s 18 if the information is disclosed to another investigative agency. Here the offending disclosure was not to an investigative agency and accordingly the s 24 exemption is not available. Direction on Processing of Personal Information by Public Sector Agencies 44 In submissions received after the conclusion of the hearing Dr Gaudin, for the Privacy Commissioner, drew to the Tribunal's attention the Direction issued under s 41 of the Privacy Act on "Processing of Personal Information by Public Sector Agencies". This Direction, issued by the Commissioner on 29 December 2001, exempts the Board and other agencies from compliance with certain information protection principles, including s 18 and s 19(1), if compliance might detrimentally affect (or prevent the proper exercise of) any of the agency's investigative functions or its conduct of any lawful investigations. 45 It was submitted for the Board that the effect of this Direction (of which it had not previously been aware) was to release it from any obligation to comply with ss 18 and 19 as disclosure to Dr A was necessary to meet its obligations under the Medical Practice Act and the common law. 46 For much the same reason as set out above, I am not persuaded that there is any basis to conclude that the non-disclosure of the Medicare history and the applicant's letter of 6 January might detrimentally affect (or prevent the proper exercise of) any of the Board's investigative functions or the conduct of its investigation into Dr A. The respondent in my view is, however, entitled to rely on the Direction in respect of the letter to the Minister dated 29 September 2000. Summary 47 I find there was a breach of 19(1) and s 18(1)(b) of the Privacy Act in relation to the conduct of the Board in disclosing to Dr A, the Medicare history and the applicant's letter of 6 January 2001. Findings 48 The applicant seeks a formal apology and monetary compensation. 49 At the hearing the respondent contended that it had offered a verbal apology to the applicant; this was disputed by the applicant. In written submissions the respondent advised that following the hearing a written apology had been issued to the applicant. Given this, there would now be no utility in making the order sought and I decline to do so. 50 In respect of the claim for damages I am without power to make an order under s 55(2)(a) as the conduct occurred in 2001 and an order for damages may only be made in respect of conduct that post dates 1 July 2002: 55(4). 51 I have also considered whether or it would be appropriate to make any other order under s 55(2) of the Privacy Act. I note the Board has initiated a number of reforms outlined in [10] of these reasons, which among other things give complainants a fuller understanding of its procedures in relation to investigations and a formal opportunity to comment on whether they consent to information provided being forwarded to the subject practitioner. In light of these reforms I am not satisfied that I should take any further action in this particular matter. Determination The Tribunal determines not to take any action on the matter.