CITATION: NK v Northern Sydney Central Coast Area Health Service [2010] NSWADT 258 DIVISION: General Division APPLICANT NK PARTIES: RESPONDENT Northern Sydney Central Coast Area Health Service FILE NUMBER: 093130 HEARING DATES: 25 November 2009, 1 December 2009, 15 February 2010 SUBMISSIONS CLOSED: 28 April 2010 DATE OF DECISION: 1 November 2010 BEFORE: Montgomery S - Judicial Member CATCHWORDS: Privacy – information protection principle – personal information –Health information – health privacy principle – collection – security – access – accuracy – disclosure LEGISLATION CITED : Health Records and Information Privacy Act 2002 Privacy and Personal Information Protection Act 1998 EG v NSW Police [2003] NSWADT 150 FM v Vice Chancellor, Macquarie University [2003] NSWADT 78 Gray v Motor Accident Commission [1998] HCA 70; 196 CLR 1 JD v Department of Health [2005] NSWADTAP 44 Mahenthirarasa v SRA (No 2) (2008) 72 NSWLR 273; [2008] NSWCA 201 MT v NSW Department of Education and Training [2004] NSWADT 194 CASES CITED: NZ v Director General, Department of Housing [2006] NSWADT 173 at [47] OS v Mudgee Shire Council [2009] NSWADT 315 Uren v John Fairfax & Sons Pty Ltd [1966] HCA 40; (1966) 117 CLR 118 Whitfeld v De Lauret and Co Ltd (1920) 29 CLR 71 WL v Randwick City Council [2007] NSWADTAP 58 XL Petroleum (NSW) Pty Ltd v Caltex Oil (Aust) Pty Ltd (1985) 155 CLR 448 at 469-470 ZR v NSW Department of Education and Training [2008] NSWADT 199 APPLICANT NK REPRESENTATION: RESPONDENT Northern Sydney Central Coast Area Health Service ORDERS: 1 Any further submissions upon which the applicant proposes to rely are to be filed and served within 14 days of the date of this decision 2 Any further submissions upon which the Respondent proposes to rely are to be filed and served within 28 days of the date of this decision. REASONS FOR DECISION 1 In these reasons the names of several private individuals have been anonymised so as to preserve the privacy of their personal affairs. The Applicant is referred to as NK. I have also limited my discussion of the evidence in order to avoid the possibility that the identities of individuals might be revealed. 2 NK is an employee of a hospital ("the Hospital") operated by the Respondent. He has applied to the Tribunal for review of conduct by the Northern Sydney & Central Coast Area Health Service ("the Respondent"). The relevant events took place at the Hospital between 26 August 2008 and 19 January 2009. They are centred on actions taken by a registered nurse of the Hospital ("Nurse W") and the Human Resources Manager of the Hospital ("the Human Resources Manager") after the Applicant presented to the Emergency Department of the Hospital on 26 August 2008. 3 NK seeks orders, including an order for damages, for an alleged breach of his privacy by the Respondent, pursuant to the Health Records and Information Privacy Act 2002 ("Health Privacy Act") and the Privacy and Personal Information Protection Act 1998 ("Privacy Act"). Specifically, NK seeks the correction of alleged inaccuracy in his personal records, that it delete certain notes in his medical file and that it pay compensatory damages to him for psychological harm suffered as a result of alleged breaches of privacy by the Respondent. Factual Background 4 On 25 August 2008, a colleague at the Hospital ("Nurse M") directed NK to take a day off out of his annual leave. NK also alleges that he was subject to bullying and harassment by [Nurse M] in the workplace. 5 On 26 August 2008 NK presented at the Emergency Department of the Hospital, seeking help in relation to anxiety and stress. NK was distressed by thoughts and feelings he was undergoing at that time, in relation to his experiences in the workplace. NK's presenting problem is listed in the Inpatient Admission Form as "forced mania", "patient states due to work situation took self off medications to have deliberate mania at work.. O/E clear thinking man wanting help HX bi polar disorder". 6 Nurse W, an Acting Clinical Nurse Consultant in the Integrated Psychiatric Emergency Service at the Hospital, conducted an hour-long assessment of NK. The reason for NK's presentation is listed in a 12 page diagnostic form completed by Nurse W appears as follows: Realised today that he needed help – today is the first time that he has ever felt that he could harm others. Gives long story of problems at work – claims he has been harassed; that his formal complaints have not been properly addressed. Other staff are aware that [NK] has "bipolar disorder". Last week when minister was due to visit [NK] was told to take a day off. He says he has never been unprofessional at work. Has become increasingly angry over this incident.' 7 Nurse W ticked the alert boxes for self harm and harm to others. The forms indicate that NK, "Intended to create "situation" in [NK's workplace] by self harming. Some paranoia but has insight into this. PFTD. No grandiosity but very confident manner." Nurse W was required to indicate her risk assessment in relation to both suicide and risk of harm to others. In relation to each of these risk factors, Nurse W ticked "Low risk". Her contemporaneous notes state: "Has never thought of hurting others until this episode or when drinking. Denies frequent suicidal thoughts but has had them in the past; makes frequent reference to it today." 8 NK states that he indicated he had experienced "thoughts and feelings" of harm to others. Nurse W's statement confirms that NK "continued to indicate thoughts and feelings that he had been having of causing harm …. He clarified that he did not have thoughts of harming anyone at his work other than [Nurse M]. He indicated that he could harm [Nurse M]. His perception was that he had been bullied and harassed by this person and that all his efforts to gain redress via complaints had been ineffective. He indicated that he was capable of hurting her and had thought of killing either her or himself." Nurse W states that the clinical records are not intended to include everything verbatim that was or is said by a patient. 9 Dr Lim, a psychiatry trainee at the Hospital, assessed NK and ultimately agreed that there was a need to admit NK for treatment and further assessment. NK was scheduled under section 15 of the Mental Health Act 2007, which provides: 15 Mentally disordered persons A person (whether or not the person is suffering from mental illness) is a mentally disordered person if the person's behaviour for the time being is so irrational as to justify a conclusion on reasonable grounds that temporary care, treatment or control of the person is necessary: (a) for the person's own protection from serious physical harm, or (b) for the protection of others from serious physical harm. 10 NK was subsequently transferred to another hospital ("the second Hospital") where he was assessed by Dr Jovanova. On 27 August 2008 NK was declared fit to be discharged. 11 Dr Lim states that "he described ideas of harm to 'others' in plural and that these thoughts had caused him significant distress. I assessed him as having a moderate level of risk to himself by way of internalizing his anger which may lead to suicidality, as well as a moderate level of risk to others whom he felt had unjustly treated him." 12 To maintain NK's confidentiality as an employee of the Hospital, he was transferred to the second Hospital under schedule that evening. No warning was given to the second Hospital, by any person at the Hospital, that NK was considered to be a threat to his or anybody else's safety. 13 Upon admission at the second Hospital, NK again provided information regarding thoughts and feelings, "suicidal" and "homicidal ideation"; "homicidal thoughts against supervisor… suicidal thoughts." The second Hospital's records indicate NK's reason for referral "self-presents to [the Hospital's] ED with thoughts of wanting to harm others and thoughts of committing suicide." NK was then released from the second Hospital the following day and the second Hospital's records indicate NK was no longer having the negative "thoughts and feelings". NK's resignation 14 NK submitted his resignation to the Hospital by letter dated 26 August 2008. The letter also included various grievances relating to alleged bullying and harassment experienced by NK during the course of his work at the hospital. NK told Nurse W of his resignation when she was assessing him for treatment. 15 NK's resignation letter was provided to NK's supervisor, Ms A. Ms A provided a copy to the Human Resources Manager. She also gave NK's resignation letter to three other staff members: Nurse M, Ms W and Ms L and asked them to read it. Ms A considered that it was necessary for those staff to be informed that NK had resigned and that his upcoming shifts would need to be covered, and she sought their comments in relation to the bullying claim. Ms A stated that each of these people denied the allegations by NK. 16 Ms A claims that because NK indicated in his resignation letter that he would be sending the letter to the "minister's office as well as my local state and federal member of government as well as the four TV stations as well as two talk back radio stations" she did not consider any obligation to NK to keep the letter confidential. 17 NK's wife and mother attended the Hospital's Human Resources Department to request that it retrieve NK's resignation letter in view of the fact that NK had been admitted to the Emergency Department. NK formally retracted his resignation on 27 August 2008. Events on 2 September 18 Nurse W recounted that because she had continuing concerns about NK after his transfer from the Hospital, she contacted the second Hospital to find out if he was still a patient there. She discovered that he had been discharged the next day. She requested a discharge summary form and spoke with a nurse who faxed the notes to her. Nurse W then decided to inform her manager of these events because of concerns she had that NK "was having thoughts and feelings of a homicidal nature and because of threats of self-harm and of harm to at least one other person ([Nurse M]) who, like [NK], were (sic) employees of the hospital." 19 Nurse W states that she "only intended using and disclosing this information to management given that, in my view, I was preventing a serious and imminent threat to the life, health or safety of both [NK] and/or his work colleague ([Nurse M])." The consensus of opinion of those she consulted was that she should speak to the Human Resources Manager. 20 On 2 September 2008, Nurse W advised the Human Resources Manager that she had been reviewing NK's file in light of concerns she had arising from his presentation on 26 August 2008. She informed the Human Resources Manager that she considered that she had a duty of care to advise him of certain threats made by NK. She informed him that under the NSW Mental Health Act, she had an obligation to report threats that represented a clear and present danger and that such obligation overrode confidentiality provisions. As a result of this conversation, the Human Resources Manager contacted the Area Director (Clinical Business Unit), the Rehabilitation Co-ordinator, and Senior HR Staff. The Human Resources Manager says in his statement at [12]-[14]: Such were the seriousness of the concerns, that I arranged to have NK's electronic ID card blocked so that he could not access the department and I also advised that [NK] should only be on site for medical reasons or to attend matters relating to any investigations. In my capacity as the Hospital's Human Resources Manager I became aware of certain difficulties that the staff who worked directly with [NK] had advised staff in the department (amongst other things) that he had Bi-Polar Disorder and was intending to go off his medication. In relation to [NK], I have had cause to indicate to him that he would be unable to return to work until assessed by specialist psychiatric assessment and until receiving appropriate clearance. Such matters are not taken lightly. Whilst I am no longer employed by the Hospital (having retired) my view remains that such requirements were necessary in terms of the Hospital's duty of care to [NK], staff and patients of the Hospital and the public. To the extent that I have provided any information to any persons (including persons connected with the investigation of any of the above issues or related issues) I have always done so within the context of my role and the duty of care owed as described above. Later events 21 On 8 September 2008, a meeting between NK and staff of the Hospital Human Resources Department took place at the Hospital. NK stated that the purpose of this meeting was to discuss his return to work plan. Present at this meeting were NK, NK's wife, the Human Resources Manager and the Return to Work Coordinator. It is alleged that during the course of this meeting, the Human Resources Manager advised NK that on 2 September 2008, Nurse W had advised him that NK had made some serious threats against staff. 22 On 23 September 2008, in a formal grievance lodged by NK relating to claims of bullying and harassment (separate from his privacy complaint), NK stated that "… In particular I was deeply concerned that it would appear that my actual medical records or a summary of them had been forwarded to Human Resources. Given patient doctor confidentiality, I find this extremely alarming." 23 NK alleges that on 5 October 2008 "...Early that morning, I realised I needed some professional intervention but due to previous confidentiality breaches I was scared about taking myself to [the Hospital], which is in walking distance from my home…" NK further states that as a result of not being able to locate other suitable support, due to it being a public holiday, he subsequently attempted suicide. NK was admitted to hospital and found that his concerns pertaining to the alleged previous confidentiality breach, were understood by the treating Psychiatric Registrar. A significant stressor leading to this event was NK's concern that he could no longer access treatment from the Hospital, in cases of emergency when his bipolar disorder becomes unstable. NK was concerned that his medical file may be shown to and discussed with his employer (the HR Department of the hospital). 24 On 10 October 2008, as part of the investigation into NK's grievance, an email from the officer conducting the Fact Finding noted that NK "... in the presence of the [Nurse W], did make serious threats against a fellow staff member [Nurse M] ..." 25 On 31 October 2008, NK's treating psychiatrist, Dr Jenneke provided a report in which he indicated that he considered NK fit to return to work. Dr Jenneke was previously the Clinical Director of the Mental Health Service for the Hospital's area and Director of the Inpatient Unit at the Hospital. 26 On 18 December 2008, NK received a letter from the officers conducting the Fact Finding that provided that Nurse W had raised concerns about the serious nature of threats made against Nurse M, and that NK was suicidal and homicidal, and that the threats were serious enough to warrant breaking patient confidentiality. 27 On 6 January 2009, NK attended an appointment with his treating Psychiatrist. During this consultation, NK reviewed (allegedly for the first time) documentation provided to the Doctor by the Respondent's indemnity scheme - the Treasury Managed Fund (TMF). NK complains that there was inaccurate information in this material and the notes had been discussed between the TMF Case Manager and the Human Resources Manager. The applicant complains that when he had an opportunity to review the notes from TMF, he found that they contained statements from staff. NK was particularly concerned about one such statement and queries whether other staff have had access to, or reviewed his clinical notes. 28 NK claims that on 12 January 2009 he was provided a copy of a Risk Assessment dated 3 September 2008 which states that he had had both suicidal and homicidal thoughts and that he had made specific threats towards Nurse M. On 19 January 2009, NK was required to sign a consent for documentation to be forwarded to an independent psychiatrist for review. This consultation related to the applicant's return to work plan. Again, it was noted in the material provided to the independent psychiatrist that a serious threat made by NK on 26 August 2008 had been reported under a perceived duty of care. NK complains that the information provided and documented in the Human Resources Manager's notes is not supported in the medical notes. 29 A return to work assessment dated 13 February 2009 showed that NK was fit to return to work. However, the arrangements for NK's return to work were not finalized throughout the course of this matter. NK was on leave from his employment at the Hospital from 26 August 2008. Complaints 30 NK complains about the use and disclosure of his personal information in relation to his medical condition pursuant to both the Health Privacy Act and the Privacy Act. He complains that his medical record was disclosed and used by the Respondent without authority, that his personnel record is inaccurate and that the inaccurate information has been used and disclosed inappropriately to third parties (Treasury Managed Fund, external medical practitioners and other staff within the Hospital) concerned with a grievance lodged by him and his return to work assessment. 31 In his application for review, NK seeks the following orders: - an order requiring the Respondent to pay damages by way of compensation for the psychological harm suffered, the subsequent and ongoing medical and other related expenses incurred, loss of liberty and loss of incremental pay increases due to the numerous breaches of the several Health Privacy Principles and Information Protection Principles; - an order requiring the Respondent to correct all inaccuracies in Personal Records/Information held relating to NK; - an order requiring inaccurate information held on NK's medical file be deleted/amended, or in the alternative, that notes made on 2 September 2008 be clearly labelled as inaccurate and unnecessary; - an order requiring all inaccurate personal/health information that has been used and disclosed be corrected and all third parties informed in writing of the inaccuracies; - an order requiring the Respondent to refrain from continuing to question NK in relation to his treatment on 26 August 2008; - an order requiring the Respondent to apologise, in writing for each of the numerous breaches and the subsequent refusals to rectify the situation; - an order requiring the Respondent to remove the restrictions placed on NK's attendance at his workplace due to the inaccurate information being used; - an order requiring that NK's [the second Hospital] notes be removed from his Hospital medical file. 32 NK alleges that the Respondent has breached the following Health Privacy Principles (HPPs) and Information Protection Principles (IPPs): - HPP 3 (collection to be from individual concerned); - HPP 4 (individual to be made aware of certain matters); - HPP 5 (retention and security); - HPP 7 (access to health information); - HPP 9 (accuracy); - HPP 11 (disclosure of health information); - HPP 10 (use of health information); - IPP 9 (Agency must check accuracy of personal information before use); - IPP 10 (limits of use of personal information). 33 Section 21 of the Health Privacy Act provides: 21 Complaints against public sector agencies (1) The following conduct by a public sector agency is conduct to which Part 5 (Review of certain conduct) of the PPIP Act applies: (a) the contravention of a Health Privacy Principle that applies to the agency, (b) the contravention of a health privacy code of practice that applies to the agency. (2) For that purpose, a reference in that Part: (a) to personal information is taken to include health information, and (b) to an information protection principle is taken to include a Health Privacy Principle, and (c) to a privacy code of practice is taken to include a health privacy code of practice. (3) This section applies only to conduct engaged in after the commencement of this section. 34 Section 5 defines "personal information" as follows: (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. 35 Section 6 defines "health information": In this Act, health information means: (a) personal information that is information or an opinion about: (i) the physical or mental health or a disability (at any time) of an individual, or (ii) an individual's express wishes about the future provision of health services to him or her, or (iii) a health service provided, or to be provided, to an individual, or (b) other personal information collected to provide, or in providing, a health service, or (c) other personal information about an individual collected in connection with the donation, or intended donation, of an individual's body parts, organs or body substances, or (d) other personal information that is genetic information about an individual arising from a health service provided to the individual in a form that is or could be predictive of the health (at any time) of the individual or of any sibling, relative or descendant of the individual, but does not include health information, or a class of health information or health information contained in a class of documents, that is prescribed as exempt Complaint 1 – retention and security 36 NK contends that the security of his medical information has been breached by the Respondent. NK complains that Nurse W breached HPP 5 on 2 September 2008, by accessing NK's medical record. On that date she added the following notation: "File reviewed due to risks issues identified in assessment." 37 HPP 5 provides: 5 Retention and security (1) An organisation that holds health information must ensure that: (a) the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) the information is disposed of securely and in accordance with any requirements for the retention and disposal of health information, and (c) the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) if it is necessary for the information to be given to a person in connection with the provision of a service to the organisation, everything reasonably within the power of the organisation is done to prevent unauthorised use or disclosure of the information. 38 NK also contends that the access of his medical record by Nurse W constituted a breach of PD 2005_593 Privacy Manual Version 2 NSW Health, the mandatory policy directive in place within NSW Health at 15.1.4 – Conclusion of Care: When an episode of care concludes for whatever reason (including the death of a client/patient), the right of access by a health care provider to the record is normally terminated at the same time. 39 Dr Jenneke gave evidence that (15 February 2010, transcript p 27): …In other words your medical record is only available to the treating staff at the time and once that episode of care is over, unless you have continued treatment from the [the Hospital's] Mental Health Service, your records should not be available to anyone unless there's a request and your consent has been given. 40 Dr Jenneke also gave evidence that is very unusual to review a patient's file seven or eight days after discharge unless there was another episode of care and then the medical practitioners would have access to the patient's file again. 41 NK argues that the Respondent did not protect his medical records from the unauthorised access of its employee, Nurse W. NK also refers to the Respondent's internal review which provided that: To comply with this HPP the agency is required to ensure that health information is securely housed and protected against loss. Staff can use and disclose health information for purposes directly related to treatment, and in ways that would be reasonably expected for current and future care and for purposes required for the management of the health service (billing, quality improvement initiatives etc). Any requests for access to a health record for outside treatment purposes or for a legitimate secondary purpose, requires the consent of the patient (and appropriate identification checks are completed). It is the Area Health Services Policy that all requests for patient records should be made via the Medical Records Department so that all medical record releases can be recorded and documented. The Medical Records Department adhere to the Guidelines within the NSW Health Privacy Manual, Version 2, ("the Privacy Manual", see link http://www.health.nsw.gov.au/policies/pd/2005/PD2005_593.html ) and manage requests for medical records in accordance with these guidelines. In this case, it has been found, following inquiries with the Medical Records Department that there is no record of any third party access to the notes. It appears that the notes have only been released for the delivery of care of patient care. 42 NK suggested that his medical records were inappropriately accessed by Nurse W on 2 September without the access being recorded by medical records. 43 At the same time Nurse W also added the following notation to NK's medical record: I contacted [the second Hospital] and found that [NK] was only kept for 2 hours. Notes requested and received." 44 This statement is inaccurate in view of an internal review conducted by South West Area Health Service, which states: "[NK] was admitted to [the second Hospital] on the 26 August 2008 and discharged on 27 August 2008." 45 NK also refers to the fact that the fax that Nurse W received from the second Hospital contained the following discharge summary at p2: "Admission date 26/08/08 Discharge date 27/08/08". 46 Pages 9 (final entry) and 10 (initial entry) of the fax provided: "Date 27.08.08 Time 11.30" "Date 26/08/08 Time 23.45" 47 NK submits that Nurse W's notation was wrong by approximately 10 hours. 48 NK also argues that Nurse W's conduct on 2 September 2008 breached HPP 9, Accuracy: An organisation that holds health information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 49 The Respondent conceded that the medical records incorrectly record the amount of time spent by NK at the second Hospital. The Respondent proposes to make an addendum to the notes along with advising all parties who were privy to that information of the inaccuracy as to time spent at the second Hospital. The Respondent submits that there is insufficient evidence for the purposes of a damages award for psychological harm suffered as a result of that inaccuracy that can be attributed to the Respondent's conduct. 50 On the evidence before me, for the reasons argued by NK, I find that both aspects of this complaint are proven. Complaint 2 - Collection 51 On 2 September 2008, Nurse W contacted the second Hospital and discussed NK with a person whose identity is not known and requested that NK's medical record be sent to her. Nurse W states that she received the second Hospital's record on the same day. 52 NK contends that this action constitutes a breach of HHP3, which provides: 3 Collection to be from individual concerned (1) An organisation must collect health information about an individual only from that individual, unless it is unreasonable or impracticable to do so. (2) Health information is to be collected in accordance with any guidelines issued by the Privacy Commissioner for the purposes of this clause. 53 NK also asserts that this action also constituted a breach of HHP 4, which provides: 4 Individual to be made aware of certain matters (1) An organisation that collects health information about an individual from the individual must, at or before the time that it collects the information (or if that is not practicable, as soon as practicable after that time), take steps that are reasonable in the circumstances to ensure that the individual is aware of the following: (a) the identity of the organisation and how to contact it, (b) the fact that the individual is able to request access to the information, (c) the purposes for which the information is collected, (d) the persons to whom (or the types of persons to whom) the organisation usually discloses information of that kind, (e) any law that requires the particular information to be collected, (f) the main consequences (if any) for the individual if all or part of the information is not provided. (2) If an organisation collects health information about an individual from someone else, it must take any steps that are reasonable in the circumstances to ensure that the individual is generally aware of the matters listed in subclause (1) except to the extent that: (a) making the individual aware of the matters would pose a serious threat to the life or health of any individual, or (b) the collection is made in accordance with guidelines issued under subclause (3). (3) The Privacy Commissioner may issue guidelines setting out circumstances in which an organisation is not required to comply with subclause (2). (4) An organisation is not required to comply with a requirement of this clause if: (a) the individual to whom the information relates has expressly consented to the organisation not complying with it, or (b) the organisation is lawfully authorised or required not to comply with it, or (c) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998 ), or (d) compliance by the organisation would, in the circumstances, prejudice the interests of the individual to whom the information relates, or (e) the information concerned is collected for law enforcement purposes, or (f) the organisation is an investigative agency and compliance might detrimentally affect (or prevent the proper exercise of) its complaint handling functions or any of its investigative functions. 54 NK submits that the purpose of Nurse W's collection of his information from the second Hospital is unclear. This is because NK ceased to be a patient of Nurse W on 26 August 2008. 55 In her evidence before the Tribunal, Nurse W claimed that while NK ceased to be her patient upon his transferral to the second Hospital, he was released back into her catchment area when he was released from the second Hospital. This was her justification for accessing NK's file. NK submits that this holds little merit and is not supported by the Act or the policy. In any event NK was discharged from the second Hospital with follow up care to be provided by his general practitioner and his psychiatrist as noted in the second Hospital's discharge summary. 56 NK also submits that he was transferred to the second Hospital in accordance with Departmental policy, in order to help protect his confidentiality and privacy as an employee because he worked at the Hospital. He submits that that protection was removed due to the actions of Nurse W. 57 The Respondent submitted that Nurse W should be accepted as a witness of truth and fault should not be found with her actions by virtue of the words she recorded on the initial assessment forms. Her evidence was said to demonstrate a reasoned and logical thought process borne out of genuine concern. 58 I agree with NK's submission that there was no justification for Nurse W's collection of his information from the second Hospital. In my view, Nurse W's explanation for doing so is without any merit. 59 For the reasons argued by NK, it is my view that Nurse W's collection of NK's information from the second Hospital constitutes a breach of both HHP3 and HHP 4. Complaint 3 - Use 60 NK submits that the Respondent has breached HPP 10. HPP 10 provides: 10 Limits on use of health information (1) An organisation that holds health information must not use the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless: (a) Consent the individual to whom the information relates has consented to the use of the information for that secondary purpose, or (b) Direct relation the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose, or Note. For example, if information is collected in order to provide a health service to the individual, the use of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. (c) Serious threat to health or welfare the use of the information for the secondary purpose is reasonably believed by the organisation to be necessary to lessen or prevent: (i) a serious and imminent threat to the life, health or safety of the individual or another person, or (ii) a serious threat to public health or public safety, or 61 On 2 September 2008 Nurse W approached the Human Resources Manager and discussed NK's presentation to the Emergency Department on 26 August 2008. At the time when she went to see the Human Resources Manager she had the second Hospital's medical file which showed that NK was discharged on 27 August 2008. The opinion of NK's treating doctor from the second Hospital prior to discharge on 27 August was the most recent medical opinion Nurse W had in regard to NK when she went to see the Human Resources Manager on 2 September 2008. The second Hospital's file records: "Co-operative, hopeful about the future." 62 NK submits that Nurse W appears to indicate that she did not feel that NK was adequately treated at the second Hospital and she appeared to question the Psychiatric Registrar and Psychiatric Consultant at a specialist Psychiatric Hospital. 63 The Respondent relies upon HPP 10(c)(i) and submits that Nurse W was acting upon a serious and imminent threat to the life of Nurse M. 64 Nurse W was asked by NK to explain what specific threats had been made. She responded: "No because they were fairly open-ended threats … you did um… my recollection is that …um … that your were …really distressed by [Nurse M's] attitude … um and that you. I seem to recall you saying that you would get even with her that she couldn't treat you like that." 65 She gave evidence that "there was an implication of threat towards this individual [Nurse M], made towards me" [page 45, transcript 25 November 2009]. 66 The Respondent submitted that in considering whether the words used by NK constituted a threat, the actual carrying out of the threat is not required. It submits that in the present circumstances, NK was not required to have threatened Nurse M for Nurse W to have understood at the time of the assessment that a threat was being made. 67 The Respondent also relied upon a report by Dr Lisa Brown. Dr Brown states that the body of legal and psychiatric literature concerning consideration of whether to breach confidentiality and report a potential risk suggests that the threshold is low if a specific potential victim is nominated. Attached to Dr Brown's report is the article "Twenty Years after Tarasoff: Reviewing the Duty to Protect" Harvard Rev Psychology July/August 1996 by Stuart A Anfang, MD and Paul S Applebaum, MD) ("the Tarasoff article"). In support of the position that a health practitioner has a duty to report such a threat, the Tarasoff article states: "When a therapist determines, or pursuant to the standard of his profession should determine, that his patient presents a serious danger of violence to another, he incurs an obligation to use reasonable care to protect the intended victim against such danger. The discharge of this duty may require the therapist to take one or more of various steps, depending upon the nature of the case. Thus it may call for him to warn the intended victim or others likely to apprise the intended victim of danger, to notify the police, or take whatever steps are reasonably necessary under the circumstances." 68 However, the Tarasoff article also notes: It is worth mentioning that in other English-speaking countries such as England, Canada and Australia, the notion of a duty to protect has been discussed but not accepted in case law or statute. 69 However, the Respondent relies on Dr Brown's report as support for the submission that Nurse W had reasonably discharged her duty to warn, or, pursuant to the Health Privacy Act, she had reasonable grounds to believe that there was a serious and imminent threat to Nurse M. It is further submitted that pursuant to the NSW Health Privacy Manual (Second Edition: Policy Directive: PD2005_593) Nurse W is expected to share information about a client/patient and to focus on client/patient "behaviours that may pose a threat or risk…" 70 In response, Dr Jenneke stated that he thought it was questionable that Nurse W should have disclosed NK's health information in the present case. His evidence was that (transcript 15 February 2010, p25): …When you had presented at hospital of your own accord, there was no pressure from anyone for you to attend. You actually self presented, which for most psychiatrists would be a good sign that the patient has got some insight and his judgment is not impaired. There was, while you expressed some thoughts, there was no evidence that the threat was made according to the notes that I've seen and certainly there is no documentation of a specific threat. If the clinician was concerned that you clearly had made a threat to an identified person, and that perhaps there is a risk of you acting on that, then of course the clinician will have to consider whether there is a duty towards or even, what we call, protect the threatened person or the victim. If that's the particular case, it's a very serious situation and it would have to be recorded very extensively, both by the initial clinician, by the registrar and with a discussion with the psychiatrist or the consultant psychiatrist on duty. Normally when there's any situation like that, certainly in my experience, working in the public hospital system for so long, what needs to happen is consultation needs to occur with the relevant psychiatrist and often the psychiatrist may consult his colleagues as well. If the threat, if the clinician at the time thought that it were imminent, the word is imminent risk, then of course it is their duty or responsibility to take appropriate action, which includes informing you, the patient, that you are going take this, it's necessary for you to take this action by informing – the victim has to be informed, number two, the police would often be informed. If you were in hospital we would normally put you under the Mental Health Act to protect you and the patient from possible harm. But the clear responsibility has to be that a threat was made and that you had the capability of doing that. The other factor that needs to be considered is, is there any history of past violence – have you done this to others? And I'm not sure whether that was ever explored. So there's a lot of factors that need to be considered before you make the very important decision to inform the victim, the police and to commit someone to hospital involuntarily. So that would be the normal procedure. Whether you're going to inform the employer is another matter I think. I'm not sure that the employer should be informed in a situation like that because the employer themselves are not the victim, so the employer should not have been, to me that's just simply private. I would be concerned about breaching privacy under the circumstances, which is a very important issue for clinicians, breaching of privacy, otherwise patients will lose their trust in seeking appropriate treatment which in fact leads to serious complications by them avoiding treatment because they believe that their privacy is not protected. 71 In FM v Vice Chancellor, Macquarie University [2003] NSWADT 78, Hennessy DP said: Serious and imminent threat to life or health 55 Under s 18(1)(c) disclosure of personal information is permitted if "the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person." B gave evidence that he received a written complaint that FM assaulted a student. He said that he was concerned that similar incidents could happen again at the UNSW. Both B and C gave evidenced that they witnessed FM engaging in verbal abuse and physical intimidation of a student. C said that he was concerned that FM would repeat his behaviour at UNSW and was apprehensive that FM might injure someone. 56 While I accept that evidence, I am not satisfied that it founds reasonable grounds for a belief that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of any person. Even if the allegations of FM's previous conduct could be characterised as a threat to the life or health of any person, (and I am not satisfied that it could) any threat must be both serious and imminent. In this case it was neither. In particular, The Macquarie Dictionary, 3rd edition, The Macquarie Library, relevantly defines "imminent" as "likely to occur at any moment; impending." There is simply no basis on which a person could believe that it was necessary to disclose personal information about FM to prevent or lessen an "imminent" threat to the life or health of any person. 72 In the present case, Nurse W disclosed the applicant's heath information seven days after she had seen NK and six days after the most recent medical opinion available to her was recorded. In her evidence before the Tribunal she was unable to recall or suggest any specific threats made by NK. The medical records of NK do not contain any indication that Nurse W was concerned that NK may pose a "threat to the life, health or safety of the individual or another person". No effort was made to inform the second Hospital that NK made threats. The health records indicate that NK indicated he was having thoughts and feelings. He was in a highly distressed state. The second Hospital had discharged NK on 27 August, apparently satisfied that he was not a risk to the safety of himself or others. 73 Even accepting, for the purposes of argument, the Respondent's submission that NK made threats on 26 August 2008, this would not a found reasonable belief that disclosure would be required to prevent a "serious and imminent threat to the life, health or safety of the individual or another person", on 2 September 2008. 74 There is no evidence that it was at all reasonable for Nurse W to consider NK a serious and imminent threat. 75 The Respondent's argument that it was acting on the basis of a "serious and imminent threat" cannot be sustained in the circumstances of this case. On the day that Nurse W had actual contact with NK she made no effort to take any special precautions or measures in relation to an alleged fear of an "imminent threat" by NK. She did not raise any particular fears with Dr Lim nor upon NK's transfer to the second Hospital. If NK did not constitute a "serious and imminent threat" on 26 September, any belief Nurse W held that NK was a risk on 2 September 2008, was not reasonable. 76 On the view of the evidence most favourable to Nurse W it may be said that she acted in some misguided belief that she had a legal obligation or clinical responsibility to bring her concerns to the attention of others. If she did feel a responsibility to take some action, the correct approach would have been to follow the steps outlined by Dr Jenneke. The steps that she did take were all inappropriate for this situation. The most obvious approach would have been to document her concerns in the report that she prepared on 26 August 2008 and to raise he concerns with Dr Lim. Her reasons for not taking that approach are not clear. However, I note that NK has proffered an explanation for Nurse W's conduct. It is not for this Tribunal to examine those issues any further. 77 I agree with NK and find that the Respondent has breached HPP 10. 78 It appears that NK's second Hospital's record was subsequently provided to the Hospital's Human Resources Department without NK's knowledge or consent and the information pertaining to NK's admission by Nurse W on 26 August 2008 was shared with other staff within the hospital. This conduct also constitutes breaches of HPP 10. Complaint 4 - Accuracy 79 NK complained that the alleged threats that Nurse W reported to the Human Resources Manager were not supported by the notes in NK's medical records. NK complains that inaccuracies in his personnel file are inconsistent with his health record. He refers, in particular, to the Risk Assessment, altered on 2 September 2008, when Nurse W inserted the following: "[Nurse W] advised that on 26 th August, [NK] expressed both homicidal and suicidal thoughts and made specific threats towards [Nurse M]." 80 NK complains that information that was recorded in an email of 2 September 2008 from the Human Resources Manager, relying upon Nurse W allegations, which stated "[NK] had specifically made threats against an Enrolled Nurse." That email also said "We may also have to advise security depending on how we move forward as [NK] lives very close to the hospital and has also visited [Nurse M's] home." "[NK] had been scheduled and transferred to [the second Hospital] however released home after 3 hours – the Registrar had advised [NK] that there may be a duty of care to advise management." 81 NK states that he has not visited Nurse M's home, although she has visited his home. He submits that he was not informed by any hospital staff member that they considered they were under a duty of care to inform management about his medical care and neither Dr Lim nor Nurse W have made any notation to that effect in the medical record. 82 NK also complains that inaccurate information was provided to Dr Samuels, an independent psychiatrist retained in respect of NK's 'return to work' plan. In particular NK complains that information was provided via a background brief pertaining to the threats alleged to have been made upon admission on 26 August 2008 as well as disclosure of this information to the Hospital's Human Resources department by Nurse W. 83 NK also alleges that this conduct by Nurse W on 2 September 2008 breached HPP 9, which provides: 9 Accuracy An organisation that holds health information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 84 On 2 September when Nurse W went to see the Human Resources Manager she had the second Hospital's medical file in her possession. That file showed that NK was discharged on 27 August 2008. NK points out that the most recent medical opinion Nurse W had on 2 September 2008, was the opinion of NK's treating doctor from the second Hospital prior to his discharge on 27 August 2008. as previously note, the second Hospital's file records: "Co-operative, hopeful about the future." 85 Nurse W told the Tribunal that she had already read NK's medical record from the second Hospital when she placed this information on NK's medical record. 86 Nurse W's evidence before the Tribunal is somewhat unclear on where this information came from. She states that she was told this over the phone and that she concluded that NK was left in the waiting room at the second Hospital for a long period of time and his treatment could only have taken two hours. This is inconsistent with her suggestion to the Human Resources Manager that NK received three hours of treatment at the second Hospital. 87 The second Hospital's file indicates that NK was in the second Hospital for approximately 12 hours. The second Hospital provided a letter, dated 16 October 2009, to the Hospital Medical Records Department clarifying the duration of NK's stay at the second Hospital. When the Hospital's Medical Records Department provided NK with a full set of medical records to NK on 18 December 2009, this letter had not been placed upon his file. 88 The Respondent's internal review concluded that: "Information … that the applicant had made a specific threat against [Nurse M], was inaccurate." 89 In these circumstances, in reporting her concerns with respect to NK's alleged threats to the Human Resources Manager, Nurse W did not take such steps as were reasonable in the present circumstances to ensure that having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. The information reported was not accurate, it was not up to date and it was misleading. In addition, the disclosure was made to the Human Resources Manager, NK's employer. 90 Although Nurse W claimed that she spoke with her manager and that the manager took her to see the Human Resources Manager, the Human Resources Manager indicated that his office was attended by Nurse W alone. 91 For the reasons argued by NK, I find that the Respondent has breached HPP 9. Complaint 5 - Use 92 NK's letter of resignation was hand delivered to the office of the General Manager of the Hospital on 26 August 2008. On the same day the letter was forwarded to the Human Resources Manager and Ms A. Again on 26 August 2008, Ms A gave the letter to the three members of staff referred to above so that they could read and comment on it. Nurse M was one of the three staff members shown the letter. As previously noted, NK had alleged that Nurse M had bullied and harassed him. 93 NK asserts that these actions constitute a contravention of section 17 of the Privacy Act. Section 17 provides: A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. 94 In order to determine that issue, it is first necessary to determine whether the letter of resignation constitutes "personal information". Section 4 of the Privacy Act defines "personal information" as follows: (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. 95 The definition of "personal information" is very broad, and not limited to information of a private nature: WL v Randwick City Council [2007] NSWADTAP 58 at [20]; OS v Mudgee Shire Council [2009] NSWADT 315 at [19]. The supply of a name would almost always be "personal information", even in a document which does not contain further information about the person: WL v Randwick City Council at [21]–[22]. 96 The Respondent refers to Ms A's evidence that she believed that the resignation letter would shortly be part of the public domain, because NK stated that it would be: "… sent to the minister office as well as my local state and federal member of government as well as the four TV station as well and two talk back radio stations after I have handed it to you." 97 Section 4(3)(b) provides that personal information does not include information about an individual that is contained in a publicly available publication. 98 The classic example of a publicly available publication is information that is published in a newspaper: EG v NSW Police [2003] NSWADT 150. In relation to information held by an agency, the term refers to "a state of affairs where a person can come to the agency, and have provided to them a document with no questions asked": WL v Randwick City Council at [26]. 99 Moreover, the Appeal Panel in WL v Randwick City Council at [27] expressed the view that: 27 We emphasise also that the exception refers to a publicly available 'publication'. The term 'publication' connotes, we think, more than a mere document that can be uplifted from an administrative file and inspected or copied. It has a connotation of greater formality than that. We are inclined to the view that what was in the mind of the Parliament was material in a published form consistent with general, unfettered availability such as a brochure, pamphlet or report. The reference to 'freely available' does not mean it has to be free of charge. 'Freely', in our view, connotes unrestricted access in this statutory context. 100 At the time Ms A read NK's resignation letter, and at all other times after reading the letter, it was not "material in a published form consistent with general, unfettered availability". While NK indicated an intention to provide copies to ministers and some media organisations, even if NK did provide the letter to these individuals and organisations, the letter would not become a "publicly available publication" for the purposes of section 4(3)(b) of the Privacy Act by that mere fact alone. In any event, NK did not in fact provide the letter to any third party. 101 In my view, NK's resignation letter does not fall within the exception for "publicly available information" in section 4(3)(b) of the Privacy Act. The letter was undoubtedly "personal information" within the meaning of section 4(1) of the Privacy Act. 102 I do not accept the Respondent's suggestion that Ms A cannot be criticised for disclosing the contents of the letter because NK had indicated that the letter would soon be in the public domain. 103 The fact that the letter was unsolicited does not exclude the application of section 17. In MT v NSW Department of Education and Training [2004] NSWADT 194, I held that section 17 applied to both solicited and unsolicited information, despite the use of the word "collected" in the section. I stated at paragraph [171]: When the provisions of sections 17 and 18 of the Privacy Act are looked at in conjunction with beneficial objects of this legislation, it leads me to the conclusion that the word "collected" in those sections should be ascribed a different meaning to that given in sections 8 to 11. The word "collected" in sections 17 and 18 should be taken as meaning "obtained". 104 See also ZR v NSW Department of Education and Training [2008] NSWADT 199 at [130]–[132]. 105 The primary purposes for which the resignation letter was collected, were to record NK's resignation and to record NK's grievances in relation to his workplace environment. The use of the letter by Ms A was a secondary purpose, relating to the investigation of the allegations. It cannot be said that NK consented to the use of the information for the secondary purpose as he was not informed that the letter would be shown to the other staff members. 106 The Respondent appears to argue that there was something in the nature of implied consent, by reason of NK's writing that he would also send the letter to other third parties. However, this is insufficient for the purposes of section 17(a) because NK was not proposing to inform the nurses himself. There was no consent to the use of the information for the secondary purpose of investigation. 107 The question arises as to whether the secondary purpose, that is, the investigation into the allegations by Ms A was "directly related" to the purpose for which the information was collected for the purposes of section 17(b). While the primary purpose of the letter was to record NK's resignation, Ms A's use of the letter was for a related purpose - investigation of the allegations contained in the letter. 108 In this regard, NK also claims that the Respondent has breached its own policy, NSW Health Policy PD 2005-584 Grievance Resolution (Workplace) for the Department of Health and Public Health Organisations ("the Grievance policy"). Clause 4.4 provides: 4.4 Confidentiality Information relating to a grievance should only be provided on a "need to know" basis, and should not be provided to third parties. Those involved in a grievance have both the right to confidentiality, and the responsibility for maintaining confidentiality. This includes confidentiality of those involved as well as the subject matter. While the respondent is entitled to, and must be provided with, enough information to allow and adequate response to the complaint, there would need to be a valid reason for others in the workplace not involved in the grievance to have access to any information on who is involved, or on the matters raised. 109 Clause 6.1 of the Grievance policy provides: 6.1 Rights and responsibilities in grievance management To be given protection against any victimisation or harassment because they have raised a grievance. Supervisor/Manager rights and responsibilities include: To ensure all workplace grievances seriously, fairly and impartially To ensure that all documentation in their possession remains confidential and it is kept in a secure place. To protect staff members from victimisation, harassment and discrimination 110 The Human Resources Manager, in response to a question from the Tribunal at the hearing on 25 November 2009, as to whether he would normally leave it up to the people who are the subject of the complaints to deal with those complaints, agreed that he would not. "It wouldn't normally happen that way – so it was an unusual occurrence." 111 NK argues that the reason it would not normally happen that way is that it is contrary to the Grievance policy, because it could potentially lead to a complainant being victimised. 112 The Grievance policy sets out a process for dealing with complaints of the kind contained within NK's letter of resignation. In my view, Ms A has responded to the allegations appropriately by raising them with the Human Resources Manager. However, both the Human Resources Manager and Ms A had the responsibility to ensure that NK's letter of resignation remains appropriately confidential because of the allegations contained within it, and both had the responsibility to ensure that it was kept in a secure place. NK was entitled to have the issues that he raised treated in a fair, impartial and appropriately confidential manner. 113 In my view it was appropriate for Ms A to inform staff that NK had resigned and that his upcoming shifts would need to be covered. However, this could have been done without providing them with a copy of his resignation letter. 114 The steps that Ms A took in giving NK's resignation letter to Nurse M, Ms W and Ms L and asked them to read and comment on it were inappropriate for this situation. The Human Resources Manager had the responsibility to ensure that the matter was dealt with in accordance with the Grievance policy. 115 The Respondent did not keep NK's personal information confidential. Ms A has directly breached NK's entitlement to confidentiality and exposed NK to the possibility of recrimination. This is clearly contrary to the Grievance policy. By adopting the approach that he did, the Human Resources Manager permitted Ms A to do this. There were other less intrusive means available to the Respondent in its investigation of the allegations in NK's letter. 116 In my view, the use of the personal information in this manner can not be said to be for a purpose permitted by section 17 of the Privacy Act. 117 I find that in giving NK's resignation letter to Nurse M, Ms W and Ms L, the Respondent has used NK's personal information for a purpose other than that for which it was collected in breach of section 17 of the Privacy Act. Complaint 6 - Use 118 NK complains about a memo from the Human Resources Manager to the Director of Business Units for the Respondent, Ms S. The purpose of this memo was to advise Ms S of a significant incident or threat. NK complains about three statements in the memo. Firstly, that he had made a threat against an enrolled nurse; secondly, that he was discharged from the second Hospital after only three hours; and thirdly, that the medical records will have full documentation. 119 NK contends that the Human Resources Manager did not take reasonable steps to confirm the accuracy, relevancy or the completeness of the information. Nor did he take steps to confirm that it was up to date and not misleading. The Human Resources Manager was questioned before the Tribunal about whether Nurse W gave him details about the threats she said that NK had made. the Human Resources Manager replied: "No, only to the extent that he specifically threatened an enrolled nurse with whom he had interactions" (p 62, transcript 25 November 2009). 120 The Human Resources Manager indicated that he had not seen NK's medical records and that he had presumed that everything Nurse W told him would have been placed on the medical record. The Human Resources Manager accepted that he must have taken Nurse W comment at face value, that NK was released from [the second Hospital] after only three hours. 121 The following exchange took place (p 63, transcript 25 November 2009): Montgomery: Okay. Given the action that you've taken against him, wouldn't it be reasonable to think that you might check that? [The Human Resources Manager]: We haven't taken any action against him specifically, other than to indicate that there had been a threat and concern, and to limit his access to [his workplace]. Montgomery: A fairly significant record – action if he's been out of work ever since. [The Human Resources Manager]: Well NK has been on special paid leave would be my understanding and remains on such. So there's … Montgomery: But to say no action has been taken is not really correct. [The Human Resources Manager]: Well again – well without wishing to be arguing, but there's been a workers complaint going on during that period and other instances as well. So he was off – I don't know that he was actually suspended or on Workers Comp, I can't remember. But anyway, he was off on Workers Comp, but remained on full pay during that period whilst the – there was an attempt to negotiate a return to work while his claim was… Montgomery: But wasn't action taken to cancel his right of access to the premises? [The Human Resources Manager]: No, only to [his workplace]. 122 On 2 September when Nurse W approached the Human Resources Manager about NK's presentation on 26 August, the Human Resources Manager had already received written medical information from a doctor who had treated NK on 1 September, stating that NK would be fit to return to work on 2 September. The Human Resources Manager therefore had in his possession a later medical opinion that contradicted Nurse W's assessment that there were ongoing risks in relation to NK. The Human Resources Manager nevertheless ignored the later certificate from NK's general practitioner. 123 On the evidence before me I am satisfied that the memo from the Human Resources Manager to Ms S contains the inaccuracies that NK has alleged. Clearly, the Human Resources Manager did not take steps to ensure that the information was relevant, accurate, up to date, complete and not misleading accurate before including it in the memo to Ms S. In doing so, it is my view, that the Human Resources Manager has contravened HPP 9. By using the information for a purpose other than the purpose for which it was collected the Human Resources Manager has also contravened HPP 10. Complaint 7 – Use 124 NK also claims that on 2 September 2008, the Human Resources Manager sent an email to Ms S, with copies to four other people in which he reported information that he had received from either Nurse M or Ms A, to the effect that NK had visited Nurse M's home. NK submits that this information is untrue and the Respondent has never provided any corroboration of the statement that NK had visited the home of Nurse M. He submits that the Human Resources Manager's email constitutes a contravention of section 16 of the Privacy Act. Section 16 provides: 16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 125 NK alleges that the Human Resources Manager has also breached HPP 9, which provides: 9 Accuracy An organisation that holds health information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 126 The Human Resources Manager gave evidence on 25 November 2009, as to the source of the information as follows: "I believe it was [Nurse M], or it could have been to [Ms A] to me via [Nurse M], I can't recollect exactly." 127 NK referred to JD v Department of Health [2005] NSWADTAP 44, where the Appeal Panel said: 44 We agree with the submissions of the Privacy Commissioner (submissions to Tribunal filed 22 April 2004) that the mischief that s 16 is intended to address involves an agency taking action on the basis of information it holds about an individual and in a way which is adverse to the interests of that individual without taking reasonable steps to ensure the information is accurate and not incomplete, irrelevant, out of date or misleading. The Privacy Commissioner submitted, and we agree, that it is only possible to give effect to s 16 if use is interpreted as the process of considering, assessing or weighing up personal information so as to make a decision or adopt a further course of action. 128 In my view, the information to the effect that NK had visited Nurse M's home is personal information for the purposes of the Privacy Act. By including this information in the memo, the Human Resources Manager was clearly taking action in a way which was adverse to NK's interests and he did so without taking reasonable steps to ensure the information is accurate. 129 I agree with NK that the Human Resources Manager's conduct constitutes a contravention of section 16 of the Privacy Act. Complaint 8 - Use 130 NK also complains that the information conveyed by Nurse W to the Human Resources Manager and by Nurse M or Ms A to the Human Resources Manager and other information of unknown origin and unknown detail was used in the following: - On 3 September 2008 a Confidential Report (Document P) was created using the information provided. - On 3 September 2008 a Risk Assessment (Document Q) was created using the information provided. - On approximately 18 September 2008, the Human Resources Manager used the information provided to him by Nurse W by relaying it to a Fact-Finding Committee investigating NK's allegations of workplace bullying and harassment. This information is contained in the Fact-Finding Report of 15 October 2008 (Document R). -In a referral brief to Dr Samuels created by the Human Resources Manager (Document S). - On 7 January 2009, the information was used in a letter from Ms S (Document T). 131 NK submits that the information in the Human Resources Manager's email was used in all of the above documents, and that the allegations were presented as facts, without checking the accuracy of the information. NK submits that this action constitutes a breach of HPP 9 and section 16 of the Privacy Act. 132 NK contends that the information "used" in each of these documents had serious and adverse consequences. The confidential report contains "allegations" by Nurse M and Nurse W that were not investigated by the Respondent and in the case of Nurse M's allegations, they were never even put to NK for comment. The confidential report indicates NK: "has a mental health condition which may give rise to the allegations and that independent psychiatric assessment is required." 133 NK says that the authors of this report actively denied him the ability to respond because he had a mental health condition. NK submits that he was denied an opportunity to respond to the allegations on the basis that he has an acknowledged mental health condition and that this amounts to discrimination. 134 The Risk Assessment prepared by the Human Resources Manager and Ms S contains allegations made by Nurse M and Nurse W. NK states that a reference to his "prior threatening behaviour" in that report was a surprise to him, as no such behaviour had been put to him to answer. These allegations in the Risk Assessment resulted in the suspension of NK from all duties. The suspension continued until 30 November 2009. 135 The Risk Assessment also contained reference to "a number of reports of odd behaviours". NK does not understand what is meant by "odd behaviours". NK contends that the information in the Risk Assessment was used without consulting the him; he was not given an opportunity to comment on the information. 136 NK submits that the information conveyed to the Fact-Finding Committee resulted in NK being denied procedural fairness in the investigation - colleagues who NK had asked to be interviewed were not interviewed and false information from Nurse M was accepted. In support of this submission NK refers to correspondence with the Respondent of 2 October 2009, accepting that there were untruths made by Nurse M. 137 In the letter of 7 January 2009, Ms S stated that NK would remain on special leave and suspended from the workplace "pending consideration of the independent psychiatric report". An independent psychiatric report dated 4 February 2009, requested by the Respondent declared that NK was fit to return to work immediately. The Respondent took no action in relation to that report until 30 November 2009 when NK received a formal notice to return to work. NK has never been the subject of formal disciplinary action but the Respondent has put him under restrictions relating to his bi-polar condition. 138 NK submits that the allegations made by Nurse W and Nurse W were never properly investigated, and he was subjected to a mental health psychiatric assessment with defamatory information given to the investigating psychiatrist. 139 The evidence before me supports NK's assertions in regard to this complaint. He has clearly been denied procedural fairness in regard to many aspects of this matter and the Respondent appears to have acted in total disregard to his entitlements. For the reasons argued by NK, I find that the Respondent has breached HPP 9 and section 16 of the Privacy Act. Complaint 9 - Disclosure 140 As noted above, NK complains that there was inaccurate information in the material provided to the TMF and the notes had been discussed between the TMF Case Manager and the Human Resources Manager. NK contends that his medical records were provided to the TMF without his consent. NK also suggests other third parties may have accessed his medical record. 141 HPP 11 (1) prohibits the disclosure of health information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless that purpose is one nominated in sub-paragraphs (a) to (l) of that principle. 142 According to the Respondent's internal review at [4.1.3.2]: Information relating to the release of the applicant's medical record to TMF came to light at a late stage in the review as initial enquiries with the Medical Records Department has suggested that there had been no third party requests for the applicant's records. This Complaint has now been thoroughly investigated. It has been found, as noted above in 4.1.1.2 that TMF acted with the applicant's consent in seeking access to clinical notes from the applicant's admission to [the second Hospital] and [the Hospital]. Furthermore, consent was obtained from the applicant via the form 'FM RC Consent to Release/Obtain Information' at the commencement of the Worker's Compensation claim on 26 August 2008. 143 The consent form states: "I [NK] hereby give consent for the rehabilitation coordinators and associated workers compensation officers of NSCCH to obtain/release information from: nominated treating doctors, Employer, Insurer, Other treating Practitioners, Rehabilitation Providers, WorkCover NSW for the purposes of managing my work related injury and workers compensation claim." 144 The WorkCover certificates dated 1 and 10 September are signed by NK and include "consent to my nominated treating doctor, my employer, the insurer, other treating practitioners, rehabilitation providers and WorkCover NSW exchanging information for the purposes of managing my injury and workers compensation claim." 145 NK's presentation at the Hospital (and the second Hospital) was directly related to the workers compensation claim, so NK should have had a reasonable expectation that relevant clinical notes could be requested for the purposes of managing his injury and workers compensation claim. 146 I find that the Respondent has not acted in contravention of HPP 11 in regard to the provision of NK's medical records to the TMF. Complaint 10 147 NK says that Ms A informed TMF of a conversation between herself and another member of staff, to the following affect: "Last week I was approached by [Nurse J], who stated that she thought she had to speak to me regarding an incident about [NK]. She said that last week [Nurse M] came and asked about [NK's] welfare, and [Nurse M] asked what she knew. [Nurse J] was aware that a few weeks before hand he was stating many strange things including that he would go off his medication so that he could have an episode to make it difficult for the Department. … She explained that she felt that coming to me with this information was the right thing to do." 148 NK further alleges that Nurse M, the staff member who he complained was bullying and harassing him, disclosed details contained within his letter of resignation after being informally advised of and shown the letter. NK states that the conversation referred to above occurred after Nurse M had seen his letter of resignation. 149 In my view, this information falls within the same category as that referred to above under Complaint 10. Information concerning NK's behaviour in the workplace was directly related to the workers compensation claim, so NK should have had a reasonable expectation that relevant information could be provided for the purposes of managing his injury and workers compensation claim. 150 I find that the Respondent has not acted in contravention of HPP 11 in regard to the provision of this information to the TMF. Complaint 12 - Accuracy 151 NK complains that when Dr Jenneke requested NK's medical records from the Hospital, the file received did not contain the additional notation by Nurse W entered on 2 September or a copy of the second Hospital medical file which had been faxed directly to Nurse W. Dr Jenneke requested NK's medical records on 11 September 2008 and received them on 9 October 2008. 152 NK contends that this constitutes a contravention of HPP 5 in that the information forming NK's medical record was not in his medical records on the date of the Dr Jenneke's request. Alternatively, NK contends that access to the medical records was intentionally refused in contravention of HPP 7. 153 I have no basis for finding that the Respondent intentionally refused Dr Jenneke's request for access to the medical records. In my view it is probable that the information referred to above was not included in NK's medical records on 11 September 2008. 154 I find that the Respondent has acted in contravention of HPP 5 in regard to the security of this information. If the information was not retained on NK's medical records it cannot be said that the Respondent had taken reasonable security safeguards to ensure that the information was protected against loss. Complaint 13 - disclosure 155 NK complains that the Human Resources Manager provided certain documentation to Occupational Solutions which was then conveyed to Dr McLure. TMF contacted Occupational Solutions and Dr McLure to investigate NK's WorkCover complaint. This information included reference to inaccurate personal/health information and was substantially relied upon by TMF to deny NK's WorkCover claim. 156 NK contends this is a breach of HPP 11 and HPP 9 and sections 16 and 18 of the Privacy Act. 157 In my view, this information falls within the same category as that referred to above under Complaint 10. NK should have had a reasonable expectation that relevant information could be provided for the purposes of managing his injury and workers compensation claim. 158 Nothwithstanding that the information provided was inaccurate, I find that the Respondent has not acted in contravention of HPP 11, HPP 9 or sections 16 or 18 of the Privacy Act in regard to the provision of this information to Occupational Solutions. Damages 159 NK has submitted that the Respondent has committed numerous contraventions of the Privacy Act and Health Privacy Act. He submits that the Tribunal should consider each individual contravention by the Respondent separately and individually in regards to "determination of damages" and contends that each contravention should be considered for "damages not exceeding $40,000" separately and individually. In support of this submission NK refers to section 21 of the Privacy Act, which provides: 21 Agencies to comply with principles (1) A public sector agency must not do any thing, or engage in any practice, that contravenes an information protection principle applying to the agency. (2) The contravention by a public sector agency of an information protection principle that applies to the agency is conduct to which Part 5 applies. 160 NK also refers to section 21 of the Health Privacy Act, which provides: 21 Complaints against public sector agencies (1) The following conduct by a public sector agency is conduct to which Part 5 (Review of certain conduct) of the PPIP Act applies: (a) the contravention of a Health Privacy Principle that applies to the agency, (b) the contravention of a health privacy code of practice that applies to the agency. (2) For that purpose, a reference in that Part: (a) to personal information is taken to include health information, and (b) to an information protection principle is taken to include a Health Privacy Principle, and (c) to a privacy code of practice is taken to include a health privacy code of practice. (3) This section applies only to conduct engaged in after the commencement of this section. 161 NK submits that both the Privacy Act and the Health Privacy Act define conduct as being a singular contravention of a singular principle. He submits that each of the alleged contraventions of Privacy Principles would constitute individual pieces of conduct. 162 Section 55(2) of the Privacy Act provides that: (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, 163 NK has submitted that sections 21 and 55 of the Privacy Act should be read together so that section 55 should be interpreted as "…damages not exceeding $40,000 by compensation for any loss or damage suffered because of a contravention of an information protection principle". NK also points out that had he decided to request individual internal reviews, and subsequently applied for merits review in the Tribunal in respect of each individual contravention. He submits that he should not be penalised for asking for all the alleged contraventions to be heard together. 164 NK claims he suffered psychological damage and relies on the oral evidence given by his treating psychiatrist, Dr William Jenneke, NK's statement and NK's oral evidence before the Tribunal. NK acknowledges that he suffered bi-polar which is a pre-existing condition. This condition has been declared stable or in remission by Dr Jenneke, Dr Samuels (an independent psychiatrist who produced a report at request of NK and the Area Health Service) and Dr McClure (psychiatrist reporting to GIO in relation the NK's Worker's Compensation claim). 165 In NZ v Director General, Department of Housing [2006] NSWADT 173, the President said: 31 In the present case there is clear evidence of the fragile mental health of the applicant. In Rummery , the AAT said at [46] of its reasons: '46. The final principle which emerges from the Hall decision, and which we consider is applicable in this matter, is that it is an applicant's account of his or her reaction to a breach of the legislation (be it the discrimination legislation or the privacy legislation) which should guide the assessment of damages, and not the perceived reaction of the majority of the community or of a reasonable person in similar circumstances. As Wilcox J put it [in Hall v Sheiban ], at 256: "...I do not think that it is helpful to test the evidence in the light of such matters as 'reasonable community standards and expectation'; whatever they may be ...The damage is not to be ignored or discounted simply because the effect of the conduct on the complainant is unusually severe. Expressed in presently relevant pronouns, the rule is the same as in other areas of tort law: a sexual harasser takes his victim as he finds her."' 166 Later in NZ the President stated: 46 In my view, at most only an aspect of the applicant's current state of health can be attributed to the particular event that is the subject of these proceedings. I accept, in general, the view expressed in Rummery that the errant agency must take the individual harmed as he or she presents, and it is the impact on the victim that is to be assessed (similar to the 'egg shell skull' theory of tort law: see Bourhill v Young [1942] UKHL 5 ; [1943] AC 92 at 109-110 per Lord Wright; Beavis v Apthorpe (1962) 80 WN (NSW) 852 at 857 per Herron CJ; Havenaar v Havenaar [1982] 1 NSWLR 626 at 631 per Glass JA). Some people will have a more severe reaction to an event than others. 167 NK asserts that the fact of a pre-existing condition is somewhat irrelevant in the Tribunal's determinations. NK acknowledges that his bi-polar condition preceded the contraventions and will continue to require ongoing management for the rest of his life. NK states that he should not be penalised for having continued to seek treatment from his general practitioner and his psychiatrist to assist him to cope with the contraventions that are the subject of the proceedings and the consequences of them. NK should not be penalised by the Tribunal for actively seeking treatment to ensure his condition remained stable and that he did not develop another psychiatric condition. 168 The Respondent discussed at some length a letter in which Dr Jenneke states that NK was "coping better". However, NK states that this letter was in response to a request from the Human Resources Manager that NK receive clearance from his psychiatrist, after his attempted suicide on 6 October 2008 so that the applicant could participate in investigations instigated by the Respondent. In this respect NK argues that Dr Jenneke's reference to "coping better" was in relation to the fact that NK was no longer attempting to commit suicide. It is also pertinent to note that Dr Jenneke expressed the following view: It is in the interest of [NK's] mental health that the investigations are expedited because it is causing [NK] a great deal of anxiety which is understandable and could destabilise his psychiatric condition. 169 The investigation referred to was in regards to the allegations against NK by Nurse M and Nurse W. There is no evidence that such investigation has ever been conducted. 170 Dr Jenneke stated that "a significant stressor for [NK] was his discovery that his privacy had been breached and that his confidential information such as his medical records and letter of resignation had become available to staff which should not have occurred" (Dr Jenneke's report of 9 November 2009). Dr Jenneke also recorded that "Other factors have contributed to [NK's] distress which includes the uncertainty of his employment and disciplinary proceedings which have been commenced by his employer." 171 Dr Jenneke gave evidence before the Tribunal on 15 February 2010. Dr Jenneke saw NK on 11 September 2008 and there was no evidence that NK had any symptoms indicating that he had had a relapse of his bipolar. The diagnosis by the second Hospital was an adjustment disorder rather than a relapse of his bipolar disorder. No symptoms of the bipolar disorder arise from the medical notes of either hospital. NK asked Dr Jenneke whether his bipolar had been unstable over the last 18 months. Dr Jenneke responded: No, not in my clinical judgment no. In fact the bipolar disorder has been in remission throughout the time that I've seen you up to the present time. There is no evidence that you had a manic or depressive relapse. 172 Dr Jenneke saw NK shortly after he tried to commit suicide by hanging himself. Asked how much of that attempt was to do with NK's bipolar and how much it was to do with the stress and anxiety caused by the alleged breach of privacy, Dr Jenneke responded (15 February 2010, transcript p 28): Again my opinion is that you did not have, you did not show any evidence during the period I have treated you up to date, of any relapse of your bipolar disorder. What was happening was really you were very distressed by what had occurred and as a result of that, you had to present to hospital because you were so agitated and concerned about what had occurred. So it was the ongoing stress rather than bipolar disorder. 173 Dr Jenneke was asked by counsel for the Respondent about NK's other life stressors. Dr Jenneke referred to a precarious financial situation and his accommodation being a source of stress as well has having to support two children from a previous marriage. However he clarified that none of these factors were present during the relevant period of time. These were past stressors from NK's consultations with Dr Jenneke in 2006, rather than after 26 August 2008. 174 In cross-examination by counsel for the Respondent Dr Jenneke was asked whether NK is or was coping better since 26 August 2008. Dr Jenneke said that it was his close supervision of NK that prevented him having a relapse and because of the tremendous support that he has been receiving from his family and friends. Dr Jenneke's evidence was that (15 February 2010, transcript, p 39): My view would be that if he did not have psychotherapy and treatment, psychotherapy is part of the treatment as well as the drug treatment, the risk would have been he would have had a relapse or developed a psychiatric disorder which he did not. So in my opinion, due to the intensive treatment as I've indicated earlier that has led to him being able to go back to work and that in fact he did not develop another psychiatric disorder. 175 Dr Jenneke said that NK has been medically fit to return to work since soon after he was discharged from [the second Hospital]. This opinion is shared by his general practitioner and two independent psychiatrists. NK's claim for exemplary damages 176 NK seeks an award of exemplary damages. He argues that the Tribunal has power to make such an order pursuant to section 55(2)(g) of the Privacy Act which provides that the Tribunal may make "such ancillary orders as the Tribunal thinks appropriate and as evidenced in case law. 177 In NZ v Director General, Department of Housing at [47], the President accepted that the reaction of NZ to the disclosure was "a heightened or severe one". Having had regard to the various considerations canvassed in Rummery, he awarded NZ compensation of $4,000. He declined to award aggravated damages. The President said, at par 52: "The applicant also seeks an award for 'aggravated damages' that involves a form of reproof or chastisement of the Department going beyond that which is effected by the making of an award of damages of the usual kind. This type of award is more usually referred to in tort law as an award of 'exemplary' or 'punitive' damages. Rummery is a good illustration of a case where the conduct of the agency in defence of the claim was so egregious that such an award might well have been made. But the award ultimately made was global, and there was no express reference by the AAT to the inclusion within it of a 'punitive' or 'exemplary' element. I should add that I do not see any difficulty in awarding aggravated or exemplary damages if the case justifies it." 178 In Uren v John Fairfax & Sons Pty Ltd [1966] HCA 40; (1966) 117 CLR 118, Windeyer J said: "that aggravated damages are given to compensate the plaintiff when the harm done to him by a wrongful act was aggravated by the manner in which the act was done: exemplary damages, on the other hand, are intended to punish the defendant, and presumably to serve one or more of the objects of punishment - moral retribution or deterrence": at 149. 179 In Gray v Motor Accident Commission [1998] HCA 70; 196 CLR 1, Gleeson CJ, McHugh, Gummow and Hayne JJ said at [12] (excluding citations): Exemplary damages are awarded rarely. They recognise and punish fault, but not every finding of fault warrants their award. Something more must be found. Although they are awarded rarely, they have been awarded in very different kinds of case: ranging from abuse of governmental power exemplified by Wilkes v Wood and its associated cases, through defamation cases of the kind considered in Uren , to assault cases such as Fontin v Katapodis . And the examples could be multiplied. 180 To attract an award of exemplary damages, the defendant's conduct in committing the wrong must amount to 'conscious wrongdoing in contumelious disregard of the plaintiff's rights': Whitfeld v De Lauret and Co Ltd (1920) 29 CLR 71 at 77; Uren v John Fairfax & Sons Pty Ltd (1966) 117 CLR 118 at 129 per Taylor J, at 147 per Menzies J, at 154 per Windeyer J; XL Petroleum (NSW) Pty Ltd v Caltex Oil (Aust) Pty Ltd (1985) 155 CLR 448 at 471 per Brennan J; Gray v Motor Accident Commission (1998) 196 CLR 1 at [15] per Gleeson CJ, McHugh, Gummow and Hayne JJ. Where the defendant is not a conscious actor, as where the defendant acts while out of control, there can be no award of exemplary damages: Costi (formerly Constantinou) v Minister of Education (1973) 5 SASR 328 at 332. Nor will such damages be awarded where the defendant's conduct, though objectionable, is not in some way reprehensible, high-handed, outrageous or insulting: Uren v John Fairfax & Sons Pty Ltd (1966) 117 CLR 118 at 122 per McTiernan J, at 129 per Taylor J, at 143 per Menzies J. Exemplary damages are normally parasitic on compensatory damages and are, therefore, aimed at punishing and deterring conduct which is also the subject of compensatory damages, from which the exemplary award ought to be separated: XL Petroleum (NSW) Pty Ltd v Caltex Oil (Aust) Pty Ltd (1985) 155 CLR 448 at 469-470. Agency's position on damages 181 The Respondent submitted that: - There is insufficient investigation of NK's psychiatric condition to attribute any of his present symptoms to the present application. - There are a number of unrelated factors and stressors that could be causing NK's alleged symptoms rather than the actions or conduct of the Respondent in relation to the application. - There is insufficient expert evidence from NK to support a finding of compensatory damages payable by the Respondent. 182 The Respondent submits that there is insufficient material before the Tribunal for it to determine the full extent of NK's bi-polar condition either before August 2008 or post 2008. The Respondent refers to Dr Brown's report in which she states that none of the records reviewed by her outlined sufficient detail about the clinical symptoms experienced by NK as part of his being diagnosed with bipolar affective disorder. In particular Dr Brown referred to possible complications by past substance abuse and gambling issues. Dr Brown noted that Dr Jenneke referred to a number of stressors which he considered relevant to NK's distress. She noted that Dr Jenneke referred to two investigations against NK and said that these investigations were presumably referring to him "having been put off work and having a ban against visiting the Hospital placed on him" (Dr Brown's report, 19 November 2009). Dr Brown recorded that both the Hospital's and the second Hospital's staff considered that NK was experiencing an acute adjustment reaction or disorder in relation to his perceptions of being bullied and his acute thoughts of self harm and aggression. Dr Brown considered that on 26 August 2008, NK was experiencing acute emotional distress and that it was possible that at that time that he had also developed an Adjustment Disorder, secondary to his being distressed by alleged bullying. 183 The Respondent argued that it followed that if this diagnosis was correct, NK was already suffering from a recognised disorder unconnected with his Privacy claim. The Respondent claims that the actions or conduct of the Respondent cannot be found to have caused these symptoms. Consideration 184 I do not agree with NK's submission that each individual contravention by the Respondent should be considered separately in regards to the determination of damages. In my view, the term 'conduct' for the purposes of section 55 encompasses the totality of the proven occurrences that are the subject of the application. 185 NK's application concerns acts by officers of the Respondent that have occurred with a common purpose as part of a single transaction. This remains the case notwithstanding that some of the acts occurred on separate occasions. Separate acts on different occasions, and by different officers, may be related by reason of the relationship between the parties. The purpose for which the acts were done may be sufficient to warrant that they be treated as related acts. Whether or not that is the case will be a question of fact to be determined on the evidence in each case. 186 The facts of this matter show that while there were several separate acts by officers of the Respondent, each of those is related to the actions of Nurse W. The actions of the other officers were the Respondent's response to advice provided by Nurse W. They should be treated as related acts for the purposes of section 55. 187 In my view, the totality of the proven occurrences constitutes a single episode of 'conduct'. It follows, in my view, that section 55(2) of the Privacy Act authorises the Tribunal to order an agency to pay NK a maximum of $40,000 by way of compensation for any loss or damage he may have suffered because of the conduct. Is an award of damages warranted? 188 As will be apparent from the discussion above, it is my view that the Respondent has acted in contravention of a number of HPPs and IPPs. On the evidence before me I am satisfied that NK has suffered significant loss or damage because of the Respondent's conduct. 189 I do not accept that NK's psychiatric condition cannot be attributed to the Respondent's conduct. In this regard I accept Dr Jenneke's evidence in regard to the state of NK's health prior to becoming aware of the conduct and in my view there is no question that the consequences of the conduct have been significant. That is the case nothwithstanding NK's existing condition and the other stressors affecting him. 190 The consequences have been exacerbated by the manner in which the Respondent has responded to his complaint both at the internal review stage and at the external review stage. At no stage of the process does the Respondent's response do it any credit. In my view it has fallen far short of its obligations to act as a model litigant. In regard to the standards of a 'model litigant' see the discussion in the Court of Appeal's judgment in Mahenthirarasa v SRA (No 2) (2008) 72 NSWLR 273; [2008] NSWCA 201. 191 In my view, an order that the Respondent is to pay NK damages is warranted. I also agree that other orders should be made in regard to NK's personal records. 192 In light of the time that has passed since the hearing of evidence I propose to give the parties the opportunity to provide further submissions in regard to the appropriate orders to be made. I also encourage the parties to take the opportunity to attempt to resolve these issues between themselves. Orders 1. Any further submissions upon which the applicant proposes to rely are to be filed and served within 14 days of the date of this decision. 2. Any further submissions upon which the Respondent proposes to rely are to be filed and served within 28 days of the date of this decision. DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.