Administrative Decisions Tribunal New South Wales Medium Neutral Citation: QB v Greater Southern Area Health Service [2011] NSWADT 90 Hearing dates: On the papers Decision date: 04 May 2011 Before: P H Molony, Judicial Member Decision: On file number 093307 - 1. Application dismissed. On file number 093229 - 1. Order that the agency to refrain from any conduct or action in contravention of, and to perform, HPPs 3, 4, 9 and 11. 2. Order that the agency apologise in writing to QB for each of the breaches found within 30 days of the publication of these reasons. 3. Order that the agency within 60 days of the publication of these reasons the agency shall: a. write to Dr Y and Dr Z seeking to recover QB's health information disclosed to them in breach of HPP 11; and, b. if that health information is recovered, ensure that it is safely secured; and, c. whether or not the health information is recovered, advise QB in writing of the outcome of the request for recovery, and, if the health information is recovered, provide QB with details of what has been recovered and how it is secured. 4. The agency shall file and serve any submissions it wishes to make with respect to the form and content of the additional draft orders set out in paragraph 162 of these reasons within 30 days of publication. 5. OB shall file and serve any submissions in reply within a further 21 days. 6. The Tribunal shall then determine on the papers whether to make order in accordance with the draft, or in any other and what form. 7. Any application by QB for costs should be filed and served within 30 days, specifying the costs sought, and providing proof of expenses claimed. 8. Any submissions in reply from the agency should be filed and served within a further 21 days. 9. The Tribunal shall then determine the issue of costs on the papers. Catchwords: Health Records and Information Privacy Act 2002 - health privacy principles - collection - unlawful - notification - use - accuracy - disclosure Legislation Cited: Privacy and Personal Information Protection Act 1998 Health Records and Information Privacy Act 2002 Administrative Decisions Tribunal Act 1997 Freedom of Information Act 1989 Health Records and Information Privacy Code 2005 Mental Health Act 2007 Cases Cited: EN v UTS (No 2) [2009] NSWADT 193 KP v Narrandera Shire Council [2011] NSWADTAP 15 OA v NSW Department of Housing (No 2) [2006] NSWADT 94 ZR v Department of Education & Training [2010] NSWADTAP 75 Texts Cited: Mental Health Review Tribunal Hearing Kit Category: Principal judgment Parties: QB (Applicant) Greater Southern Area Health Service (Respondent) Representation: Applicant - in person Respondent - GILD Insurance Litigation Pty Ltd File Number(s): 093229 and 093307 Publication restriction: See paragraph 1 REASONS FOR DECISION 1In these reasons the names of certain individuals and other information, which may enable the identity of the Applicant to be ascertained, have been suppressed in order to protect the Applicant's privacy. Background 2On 18 August 2008 QB made a request to the Greater Southern Area Health Service (the agency) under the Freedom of Information Act 1999 (the FOI Act) for a copy of her file from November 2007 to date. She paid the requisite fee for the FOI application on 1 September 2008. 3On 29 October 2008 the agency made a determination to grant QB partial access to the documents in her file. Full access was refused on the basis that the redacted information was confidential information supplied by third parties who objected to its release. Confidential information was redacted. 4QB then sought assistance from the office of the NSW Ombudsman. 5In a letter of complaint addressed to the agency's Mental Health Team (MHT) on 7 December 2008 QB complained about a series of issues, She had become aware of them as a result of being given partial access under the FOI Act. Her complaints included that - * Her patient registration from which was completed on the basis of information provided by a third person contained false information. It misstated her age, her source of income, her next of kin and the name of her local doctor. * The registration form was never shown to her. * Mental health workers never verified the information in that form. * The agency requested a copy of her discharge summary from an interstate hospital without reason. * Agency staff discussed her health history with Dr Z without her knowledge or consent. * The agency faxed Dr Z information about her - including the discharge summary - without her knowledge or consent. * Agency staff arranged for her to be observed at Dr Z's surgery without her knowledge or consent. * Agency staff contacted an interstate doctor who had treated her in the past (Dr M) - again without her knowledge or consent. * Her meeting with a MHT worker on 21 January 2008 was inaccurately recorded in MHT notes. * Her rights were not explained to her at any time. 6On 8 December 2008 QB made a complaint to the agency concerning contraventions of Health Privacy Principles (HPPs) under the Health Records and Information Privacy Act 2002 (HRIP Act). Relevantly, she completed this as follows - ... Q6 Please cross which of the following describes you complaint (you can cross more than one) X - collection of personal/ health information - storage or security of my personal/ health information X - refusal to let me access or find out about my own personal/ health information X - accuracy of my personal/ health information X - use of my personal/ health information X - disclosure of my personal/ health information - other - I'm not sure Q7 When did this conduct occur? 03.01.08 to 01.02.08 Q8 when did you first become aware of this conduct? 11.11.08.1 only received 'partial access' via FOI, so I have still not seen the whole file. Q9. You need to lodge this application within 6 months of the date you have written at Q8. If more than 6 months has passed you need to ask the agency for special permission N/A Q10 What effect did the conduct have on you? I had absolutely no idea what was going on at the time. All information and activities were kept from me. It was disempowering and confusing. Q 11 What effect might the conduct have on you in the future? The misconduct of [worker A] and [Worker B], the GP's and my relatives makes me question the ethical conduct of health and mental health service providers and their ability to have a positive impact. Q12 What would you like the agency to do about the conduct? (for example an apology, a change in policies or practices, your expenses paid, damages paid to you, training for staff etc.) Yes to all of the examples above. An apology, a change in policies or practices, your expenses paid, damages paid to you, training for staff . And I would like to know how [Dr Y] is storing my discharge summary that was faxed. I'm not a patient of that doctor. Is it filed in someone else's Me? eg my Aunt's ([J]) or was the discharge summary given to a 3 th party by Dr later without my consent (such as my Aunt), or was it destroyed? If so, what date was it destroyed and who saw it before it was. I would like to know what was faxed to Dr Z on 16.01.08, and if it is found that the information should not have been faxed (as it was done without my knowledge or consent) then I would like the info destroyed. (Presumably the faxed info is currently held in my patient file at [Dr Z's] Medical Clinic. I didn't actually fill in a form and register as a patient at the PSMC until 17.01.08, so I'd also like to know how that confidential information about me was stored before that ) 7On 12 December 2008 OB applied for internal review of the FOI decision. 8On 16 December 2008 Mr Jacobs completed an internal review of the decision made under the FOI Act. He determined that an entry in the record of a conversation with Dr M on 23 January 2008 should be released, but otherwise confirmed the decision. 9QB received the FOI internal review on 25 January 2009 and immediately sought assistance from the NSW Ombudsman. She also lodged a complaint with the Health Care Complaints Commission. 10On 7 April 2009 the Privacy Commissioner wrote to the agency advising that it was legally obliged to carry out an internal review of conduct QB had complained of under the PIPP Act and the HRIP Act. 11QB was advised on 11 May 2009 that a review of conduct would be undertaken. 12In June 2009 the NSW Ombudsman wrote to the agency suggesting that the FOI internal review decision be redetermined, and that the agency release some further information, which had previously been redacted, to QB. On 18 June 2009 the agency wrote to QB advising that it was releasing those records, having accepted the Ombudsman recommendations. 13On 19 June 2010 the agency completed an internal review of conduct under the PPIP Act, Mr Jacobs conducted the internal review. He set out the following factual background relating to the conduct under review - On 1 st January 2008 an AccessLine Handover report relating to [QB] was received by the ... Mental Health Team. The report was made following receipt by AccessLine staff of a phone call from a third party who was concerned for [QB's] mental well being. AccessLine is the common name of the Greater Southern Mental Health Intake service which is a 24 hr, seven day a week, telephone service with a focus on Mental Health, Sexual Assault, Depression/Suicide and Drug & Alcohol Issues. It is a confidential, freecall service for people residing within the Greater Southern Area Health Service. The Mental Health intake service is a contact point for existing clients, carers, the public, health professionals and community and welfare service providers. This Intake service is directly linked to existing mental health resources in the Greater Southern Area Health Service and is staffed by an experienced, multidisciplinary health team. GSAHS policy requires that all persons who are the subject of an AccessLine notification and report, including where the notification is made by a third party, are to be regarded as clients of the Health Service and are to receive appropriate services. AccessLine triages all calls using the 'Urgency of Response' scale. [QB] was assessed as Category D - Low Urgency which requires an appropriate response be commenced within 48 hours. A second third party notification was made by telephone on 2 nd January 2008 directly to the ... Mental Health team. Arrangements were subsequently made for the party who made the contact with AccessLine to meet with [a worker], from the ... Mental Health team, on Monday 7 1h January 2008. The patient record documents the actions that were subsequently taken to provide an appropriate response to this referral, ensuring that [QB] received an appropriate level of care from the Health Service . 14Mr Jacobs made some preliminary comments relating to the complexity of the situation that faced agency staff following receipt of the third party referrals. ... it is important to acknowledge and understand the complexity of the situation confronting the Temora Mental Health staff In this matter. -Two separate third party notifications had been received in which the notifying parties had expressed concern for [QB's]'s health, one through AccessLine and the second direct; 5 - The AccessLine Line handover report had triaged the matter as Category D - requiring a response within 24 to 48 hours; [the interstate hospital], confirmed that [QB] had been an inpatient at that hospital from 23 rd July 2007 to 2 nd August 2007 - diagnosis first episode psychosis and probable schizophrenia - Mental health staff did not know whether [QB] was still taking the medications prescribed at [the interstate hospital] . - The third party referrals stated that [QB] was intending to travel overseas to India in the near future and was making arrangements to get the recommended vaccinations - GSAHS policy required an appropriate response to this matter, the normal initial steps of which would be to make contact with [QB] and to make a comprehensive assessment of her current health, however - The third party referrals indicated it would not be appropriate for GSAHS mental health staff to approach [interstate] . They stated that [QB] was particularly disturbed by the manner of her referral to [the interstate hospital] . The discharge summary states the Reason/Mode for Referral as "Brought by ... CAT when moved out to live with sister in [X], as she felt unsafe in her house in [Y]". In summary, based on all the information available to them, the mental health staff concluded, in line with their duty of care and Health Service policy, that they needed to make contact with [QB] In order to make an assessment of her current health, and that this needed to be done in a manner which would neither cause her distress nor aggravate her current state of health. 15In that context, the internal review of conduct identified and considered a series of alleged breaches of HPPs complained of by QB. 16First, were the alleged breaches of the collection principle in HPP3 (cl 3 of Schedule 1of the HRIP Act). The breaches identified were the collection of health information relating to OB from third party sources, on a confidential basis, and the seeking (and receipt) of information about QB's previous diagnosis and condition from the interstate hospital. 17With respect to the former, the internal review considered that there was no breach of the collection principle because - This principle does not preclude the Health Service from receiving, seeking and acting on information received from third parties. Health Services frequently receive information, particularly relating to people with an apparent mental health illness, from third parties. It is important for the Health Service to act on this information in an appropriate manner, both in the interest of the health and welfare of the person to whom the information relates and in the interest of public welfare and safety. In many cases this third party information is given with the understanding that it is being given in confidence and that the identity of the person providing the information will be protected. The maintenance of confidentiality in these cases is essential both to the provision of the original information and to the continuing provision of information where this may be necessary and appropriate. The loss of these information sources could have a detrimental effect on the safety and welfare both of the person to whom the information relates and to other associates of the person, and potentially to the general public. [QB] is aware that the Health Service has received information from third parties, both through AccessLine and directly. The identity of these parties has been withheld. The withholding of the identity of these third parties was fully addressed in the response to [QB's] FOI application and appeal. Similar principles apply under the HRIP Act. (...) It is considered that Health Privacy Principle 3 has not been contravened in this matter, namely in the receiving and acting upon third party information and the withholding of the identity of those parties. 18With respect to the form the interstate hospital information the review determined that - In relation to the seeking of information regarding [QB] from [the interstate hospital], it is felt that this was an appropriate course of action, given all the circumstances of this matter, and therefore not in contravention of Health Privacy Principle 3. Whether [the interstate hospital], should have released a copy of the discharge summary to GSAHS is a matter for [the interstate hospital], not GSAHS. 19Secondly, the internal review identified conduct alleged to be in breach of HPP 7 which relates to access to health information. The refusal of the agency to give QB full access to her file under the FOI Act was identified as relating to this. The agency found no breach of HPP7, relying on the exemption for confidential information in clause 13(b) of the FOI Act. As a result the agency considered it was lawfully authorised to refuse QB access to the information it had redacted. 20Thirdly, the internal review identified conduct alleged to be in breach of HPP 9, which is concerned with the accuracy of health information. The internal review identified a series of matters that QB said were recorded inaccurately in her health information obtained from the agency under FOI. These were - * The registration form completed on 7 December 2008 incorrectly recorded her next of kin and her age. The internal review determined that these should be amended. * Inaccuracies QB claimed existed in the notes of her meeting with Worker B on 21 January 2008. This included the fact that Y had been invited to attend the meeting without her consent. The internal review noted that Worker B denied this, * QB's disagreement with clinical assessments made by staff of the agency and other clinicians, The internal review found no breach but noted that perceived inaccuracies and requested amendments can be attached to the records in issue. It determined that QB's letter of 7 December 2008 should be included in her record. 21Fourthly, the internal review noted that OS had alleged breaches of HPP 10 with respect to the use of her health information. The internal review noted that the only persons who had used QB's health information were the two workers directly involved in her case, and that they used it for the purposes for which it was collected. The internal review noted that QB had not made any other allegations of inappropriate use. 22Fifthly, the internal review identified conduct alleged to be in breach of HPP 11, which provides limits on the disclosure of health information. The internal review identified three complaints made by OB relating to this: disclosures to Dr Y, Dr Z and Dr M. 23With respect to Dr Y the internal review found - Mental health team member, [Worker A], was the staff member managing the Health Service's response to this matter at the time. [Worker A] is no longer a member of staff and her present whereabouts are unknown. It was not possible to interview her in regard to the actions she took in this matter. In her entry dated 7 th January 2008, 10:30am [Worker A] indicates that she has received further information from a concerned third party. In the entry [Worker A] states that "I am led to believe this young woman ([QB]) will flee to India if she perceives she is being pursued by mental Health services". The entry then indicates that [A] had devised a plan for [QB] possibly to meet with [Dr Y], a local ... doctor. If this occurred and [Dr Y] requested it, a copy of the [the interstate hospital] discharge summary would be sent to him. The entry concludes "we await contact from [Dr Y]". However the record also contains a copy of a fax cover sheet also dated 7 th January 2008 indicating that [Worker A] had faxed a copy of the discharge summary to [Dr Y]. There is no indication in the record whether [QB] had been in contact with [Dr Y], whether [Dr Y] had requested the discharge summary nor any explanation of why [Worker A] was apparently diverging from her plan of the same date referred to above. It is recognised that [Worker A] was attempting to respond to a very complex matter, as described earlier in this report in ..., in her entry of 7 " ' January 2008 [Worker A] notes that [QB] is currently unmedicated and had been unmedicated since shortly after her discharge from [the interstate hospital]. However there is nothing in the record at this time that would lead to a conclusion that there existed a serious and imminent threat to [QB's] health or safety. Conclusion: It is considered therefore that in providing a copy of the [the interstate hospital's] discharge summary to [Dr Y] In the manner in which it occurred on the 7 th January 2008, GSAHS has breached Health Privacy Principle 11. 24With respect to disclosure to Dr Z on 16 January 2008 the internal review said - Mental health team member [Worker B] is now managing the Health Service's response to this matter. I interviewed [Worker B] on 13" May 2009. The client record indicates that the Health Service had received further information from the concerned third parties regarding [QB] specifically that - - [QB] had indicated she was running away to India as she believed India was a safe place to hide because she felt people were still following her. - [QB] had made an appointment with [Dr Z] in [V] to receive vaccinations prior to go going to India, and - She is still unmedicated. During my interview with her [Worker B] said she had considered that at the time there was a serious and imminent threat to the health and welfare of [QB] and that she had a duty of care in relation to her, She considered that it was imperative that a clinical assessment be made of [QB] as soon as possible. She was also conscious of [QB]'s possible negative reaction to a direct approach by GSAHS mental health staff. She decided to seek the assistance of [Dr Z], with whom she knew that [QB] had an appointment. [Worker B] discussed [QB] 's reported current condition with [Dr Z] and faxed him a copy of the [the interstate hospital]'s discharge summary to give him a more comprehensive understanding of [QB] 's state of health. [Dr Z] undertook to contact the mental health team if he observed any unusual behaviour by [QB]. An entry in the record 2008 by [Worker B], dated 17 th January 2008, indicates that [Dr Z] had reported that [QB]'s behaviour while at the surgery was appropriate and that he had not observed any unusual or odd behaviour. It is considered that [Worker B]'s assessment that there was a serious and imminent threat to the health and welfare of [QB] was an appropriate assessment given the circumstances of this matter, its complexity and based upon the information that was available to her. Conclusion: it is considered therefore that in providing a copy of the St Vincent's discharge summary to [Dr Z] in the circumstances in which it occurred on the 16 th January 2008, GSAHS and its staff have not breached Health Privacy Principle 11. 25With respect to disclosure to Dr M on 18 January 2008 the internal review found - At the time [Dr M] was a psychiatrist with the ... [interstate] Mental Health Service ..., where [QB] had been a client in 2007. [Worker B] contacted [Dr M] to seek advice and assistance on the management of this matter, particularly given that it appeared that [QB] would react negatively to a direct approach by staff of the ...mental health team. The record indicates that [Dr M] stated that [QB] was quite unwell when [interstate] and that she ([Dr M]) agreed with the need for a current mental health assessment. [Dr M] agreed to contact [QB] to encourage a follow up post discharge from hospital. The record shows that on 21 st January 2008 [Dr M] contacted [Worker B] informing her that [QB] was agreeable to an assessment. [Worker B] subsequently contacted [QB] by phone and [QB] presented later that same day for an assessment. As noted previously [Worker B] had formed the opinion that there was a serious and imminent threat to the health and welfare of [QB] and that she had a duty of care in relation to her. The advice and assistance given by [Dr M] supports the assessment made by [Worker B]. I have also previously stated that I considered [Worker B's] assessment that there was a serious and imminent threat to the health and welfare of [QB] was an appropriate assessment given the circumstances of this matter, its complexity and based upon the information that was available to her. Conclusion: It is considered therefore that in discussing [QB]'s referral to the Temora Mental Health team with [Dr M] in the circumstances in which it occurred on the 18 24 January 2008, GSAHS and its staff have not breached Health Privacy Principle 26The internal review recommended that - Given the findings of this internal review, however, it would he appropriate for the Health Service to apologise to [QB] for those occurrences where it has been considered that the health privacy principles have been contravened. Where it has been concluded that no contravention of the principles has occurred, no further action need be taken. The Internal review has determined that there are a number of inaccurate entries in the medical record relating to [QB]s next of kin, doctor, date of birth and age. [QB] should be informed that these entries will be corrected. [QB] further indicated in her letter of 7 th December 2008 many entries in the medical record with which she disagreed. She should be advised that the medical record cannot be altered or deleted but measures can be taken to correct or append any inaccuracies. Additional medical records or requested amendments can be attached to the record. With [QB's]s consent, a copy of her letter of 7 th December 2008 should be placed in the record. It is recommended that the applicant be notified of the outcome of this internal review, a copy of the report provided to her and a formal apology be issued by the Area Health Service in respect of those occurrences where it has been considered that the health privacy principles have been contravened. It is further recommended that [QB] be informed her record will be corrected in relation to incorrect entries regarding her next of kin, doctor, date of birth and age and that a copy of her letter of 7 December 2008 will be included in the record, if she so consents. 27QB sought external review of the agency's conduct on 27 August 2009. 28At a planning meeting held on 18 November 2009 the parties agreed that issues associated with the determination of QB's FOI request were intermingled and connected with her application under the privacy legislation. The parties agreed that QB would file an application to review the agency's FOI decisions, and the agency indicated it would not oppose the late filing of that application. On 24 November 2009 QB filed that application. 29On 9 December 2009 I granted leave for QB to make her late application for review under the FOI Act out of time. I also made direction that both QB's applications proceed through the Tribunal together and directions as to filing documents. 30Despite a referral to mediation the parties have been unable to resolve their difference. 31On 3 August 2009 I made directions for the filing of final material and submissions, and determined that the proceedings could be determined on the papers under s 76 of the Administrative Decisions Tribunal Act 1997. I was and remain of the view that the issues for determination can be adequately determined in the absence of the parties. 32In the period since then and submissions finally closing on 22 February 2010 (after a number of extensions) the Tribunal has received correspondence from the parties which indicates that QB was mistakenly sent, and now has in her possession, complete and unedited copies all of the documents which were the subject of her FOI request. 33When I reviewed the file in preparation for writing this decision I asked the Registrar to write to the parties, on 1 March 2010, as follows - I refer to the above matters which have progressed through the Tribunal and are to be decided together on the papers, with evidence in one being evidence in the other. Following the passing of the extended date for the filing of submissions by the agency on 22 February 2010, the files have been referred to Judicial Member Molony for decision. Mr Molony has now looked at the files. He notes that all the information which is the subject of [QB's] Freedom of Information (FOI) application (ADT file number 093307) "including the copies of which exemption has been sought" was mistakenly sent to [QB] by the respondent, and is now in her possession. [QB] has written to the Tribunal advising that she will withdraw her FOI application, if assured by the agency that she now has all the documents that are in its possession. In the circumstances, Mr Molony is concerned that there is no point in him proceeding to determine the application under the Freedom of Information Act . Any decision he may make has been made redundant by the inadvertent disclosure of all the documents in issue to QB. Mr Molony notes that: - Both [QB] and the agency say in correspondence that QB has been provided with the "entire file." He assumes this corresponds with the entire file provided to the Tribunal, including documents provided on a confidential basis. If so, he fails to see any benefit or utility in him now determining FOI application. The information in issue has been disclosed to [QB]. -The sufficiency of the search for documents conducted by the agency is not in issue before him. If it was, the Tribunal in any case does not have jurisdiction under the Freedom of Information Act to review sufficiency of search. Mr Molony has asked me to advise you that he does not wish to embark on what appears to be a pointless exercise. He asks that [QB] formally withdraw her FOI application in writing. Mr Molony will proceed to consider the review of conduct under the privacy and health records legislation in ADT file number 093220. If the application under the Freedom of Information Act is not withdrawn, Mr Molony intends to take account of the letters from both parties advising that the entire file has been disclosed to [QB], when determining it. 34QB has subsequently written to the Registrar withdrawing her FOI application. As a consequence I will make orders noting it is withdrawn and dismissing it accordingly. 35As a result the substantive matter to be determined is that concerned with the review of conduct under the HRIP Act and the PIPP Act. The agency's conduct 36In reality there is little conflict about the conduct which gives rise QB's complaints. The issue is whether that conduct breached any of the HPP's. 37The agency has provided copies of its original documents and notes to the Tribunal. The statements filed by the agency go to the policies of the agency (Ms Fowlers' statements) and its conduct of the various complaints and reviews that have followed (Mr Jacobs's statements). They do not address the events themselves. 38QB has not filed any evidence challenging the record of events as outlined in the agency's file. She was, until the final days, unaware of them. 39As a result I accept that copies produced by the agency documents those events and I have relied on them as such. 40It is necessary to understand that the agency has in place a number of structures designed to facilitate the receipt of health and personal information about individuals, from third persons who are concerned about the individual's mental health. These procedures are set out in its Mental Health Intake and Triage Policy . 41That procedure provides - Aim: To guide GSAHS Mental Health Service staff in the provision of an appropriate and timely response to people requiring service intervention according to prioritised need. (1) Standard: The Mental Health Service can be entered at multiple sites which are coordinated through a single entry process. The entry process to the Mental Health Service can be undertaken in a variety of ways which are sensitive to the needs of the consumer, their carers and the defined community. The entry process to the Mental Health Service is specialised and complementary to any existing generic health or welfare intake systems. An appropriately qualified and experienced mental health professional is available at all times to assist consumers to enter into mental health care. The Mental Health Service has a system for prioritising referrals according to risk, urgency, distress, dysfunction and disability. Wherever possible, the Mental Health Service conducts face-to-face assessments but may use telephone and video technologies where this is not possible due to distance or the consumer's preference. The Mental Health Service ensures effective, equitable access to services for each person in the defined community. Scope: All GSAHS Mental Health Service staff, consumers and potential referrers as well as AccessLine/Intake Service and all GSAHS hospital's Emergency Department (ED) staff. Criteria: No person accessing the Mental Health Service should have to make more than one contact to initiate a service, irrespective of internal boundaries or exclusion criteria. (1) 1. Access 1.1 Telephone triage, intake and referral, crisis management and Mental Health counselling services are provided 24 hours a day through the AccessLine/Intake Service for residents of the Greater Southern Area Health Service. 1.2 GSAHS Emergency Departments and Mental Health Emergency Care (MHEC) Support Centres provide triage, assessment, referral and mental health crisis management 24 hours a day. Triage 2.1 AccessLine/Intake Service obtains sufficient information from the caller to briefly assess the type of assistance required by the customer and to triage the urgency of the provision of that assistance. Triage information and other current consumer information is faxed to ED staff, Community Mental Health Teams (CMHT) and MHEC Support Centre staff, as appropriate. 2.2 ED staff will obtain sufficient information on presentation to triage the consumer and conduct a preliminary risk assessment. (Refer to the GSAHS Suicide Risk Assessment and Management Policy & Procedure 2007). ED staff contact the Mental Health Emergency Care (MHEC) Support Centre for assessment and advice re: initial management. Prioritisation. 3.1 Accessline/Intake Service will triage all calls using the 'Urgency of Response' scale. 3.2 ED Staff will triage all presentations using the Australasian Triage Scale - ATS. Initial Management 4.1 Response priority and evaluation of information obtained, will determine if initial management of the consumer shall remain the responsibility of ED, MHEC Support Centre, or the CMHT. 4.2 Consumers requiring further MH management will receive a comprehensive assessment (MH-OAT Al) as soon as possible and in accordance with the Urgency of Response rating at triage. The comprehensive assessment will be conducted face-to-face preferably, via telephone or by teleconference and will be dependent on the consumer's location and/or condition. 4.3 Proposed intervention and any decision to refer to alternate agencies will be collaborative and multidisciplinary and include discussion with consumer and their carers. 4.4 All Accessline/Intake Service provision, triage information and teleconferencing information is subject to the same privacy, confidentiality and documentation guidelines as all health information. (1) (See GSAHS Mental Health Service Policy and Procedure Privacy and Confidentiality, 2007. GSAHS Mental Health Service Documentation Requirements for Individual Health Records.2007. GMAHS Mental Health Telehealth Policy & Procedures, 2004.) Contra Indications / Alerts : When the above criteria are not met. Safe Operating Procedures: At Clinical Competency; Patient Education; Standard Precautions. PROCEDURE 1. All initial intake and referrals to GSAHS MHS are directed through Accessline/Intake Service for triage. Consumers who have presented at hospital EDs will be assessed by the MHEC Support Centre and the MHEC Support Centre will fax copies of the triage information and assessment to the AccessLine/Intake Service for uploading onto that database. 2(a). Consumers who present directly to a Mental Health Service seeking support will be provided with a face-to-face triage if a mental health worker is available at that time and if the worker considers that it is the most appropriate intervention (For example: if the person is agitated or distressed). If a Mental Health clinician is not available, the consumer should be provided with access to a private area and telephone to contact AccessLine/Intake Service, where appropriate. 2(b) In these instances the worker must provide a report back to AccessLine/Intake Service so that the information can be recorded. 3. After the triage has been completed, triage information is faxed to the appropriate Mental Health and, where indicated, Emergency Care Services and the following actions occur according to the Urgency of Response rating allocated at triage: Category A - Extreme Urgency The AccessLine/Intake Service will: a. phone emergency services - (police, ambulance) and mobilise to respond; b. phone appropriate ED to provide early not cation of potential presentation - ED to contact MHEC Support Centre when consumer presents; c. fax the triage information and any previous case management, medication or AccessLine/Intake Service contact information to the ED & MHEC Support Centre to assist clinical management decisions - this is to be done regardless of presentation at District Hospital or Base Hospital d. fax the triage information to the appropriate CMHT. If a consumer with Category A or B presents to an ED: a) ED staff are to contact MHEC Support Centre with minimal data to request immediate assessment and assistance with clinical management decisions. (Refer also to the GSAHS Mental Health Inpatient Unit Admissions Policy and Procedure. 2007)(6) Category B - High Urgency - To be seen within 2 hours The AccessLine/Intake Service will: a. refer the client to the nearest ED; b. ring the appropriate hospital ED to provide early notification of potential presentation; c. fax the triage information and any previous case management, medication or AccessLine/Intake Service contact information to the ED & MHEC Support Centre to assist clinical management decisions - this is to be done regardless of presentation at District Hospital or Base Hospital d. phone the hospital ED shortly after consumer's estimated time of arrival (ETA) to confirm consumer's arrival. If the consumer has not arrived, Access Line/Intake service will phone the caller. If the consumer does not respond, AccessLine/Intake Service shall escalate the urgency response to Category A. e. fax the triage information to the appropriate CMHT. Category C - Medium Urgency - to be seen within 24 hours . The AccessLine/Intake Service will: a. establish an interim management plan for the consumer; b. fax the triage and management plan information to the appropriate CMHT, local ED & MHEC Support Centre - for reference should the consumer present to ED later; c. In the event the AccessLine/Intake Service is unable to establish an interim management plan with the consumer or the CMHT is unable to receive the referral within 24hours (eg Weekends), the AccessLine/Intake Service will escalate the urgency response category to Category B. d. If the client presents to the ED following contact with AccessLine/Intake Service and development of an interim management plan, ED staff will contact MHEC Support Centre as with Category A and B. Category D - Low Urgency - to be seen within 48 hours. The Access Line will: a. establish an interim management plan for the consumer, and b. fax the triage & management plan info to the ED where appropriate, for reference should the consumer present to ED later (although for most Category D referrals, the ED will not be involved). If the consumer presents to ED: a. staff to contact MHEC Support Centre with minimal data to request assessment and/or immediate fax to ED of any previous case management, medication or other information to assist clinical management decisions. b. For Category D rated consumers (i.e. low risk , low urgency), ED staff and the MO in ED would be expected to assess and implement an interim management plan, with or without dialogue from MHEC Support Centre worker. This may include prescribing form of medication whilst the consumer awaits follow-up from the CMHT. Category E - Non Urgent - to be seen in 2 weeks. The AccessLine/Intake Service will: a. provide the caller with information regarding available services, and b. fax the triage info to the appropriate CMHT for follow up. If the consumer presents ED: a. ED staff to contact MHECSC with minimal data to request immediate fax to ED of any previous case management, medication or AccessLine/Intake Service contact information to assist clinical management decisions. b. For Category E rated consumers, ED staff and the MO in ED would be expected to assess and implement an interim management plan, with or without dialogue from MHEC Support Centre. This may include prescribing some form of medication whilst the consumer awaits follow-up from the CMHT. Category F No ground service contact required. a. In this instance the Accessline/Intake Service will not contact the Health Service. b. Where the triage establishes a caller requires a service other than Mental Health (eg drug and alcohol, sexual assault), the AccessLine/Intake Service will fax a referral to the appropriate service and provide the caller with contact details of that service. 5.1 All Community Mental Health Teams will hold daily weekday intake/allocation meetings to coordinate responses to triaged referrals from the AccessLine/Intake Service as well as assessments and recommendations from MHEC Support Centre utilising the Clinical Review Model. Senior Clinician input should always be sought in relation to decisions on intake and entry. 5.2 On weekends, the rostered weekend worker/s will ensure that all urgent referrals, assessments and recommendations are attended to, and provide feedback on these to the multi-disciplinary team at the Monday intake/allocation meeting (or next working day following public holidays). 5.3 Where staff are located in different sites, telephone or video conferencing may be used to facilitate these meetings. 6 Wherever possible, consumers triaged and referred through the Accessline/Intake Service will be assessed face to face as soon as practicable and in accordance with the Urgency of Response rating allocated at triage. 7 During times of staff shortages or unavailability, Team Managers must inform Accessline/Intake Service and make alternative arrangements for responses to triages. 42In her statements Ms Fowler, Manager of Community Operations for Mental Health/Drug & Alcohol Services for the agency, explained that individuals subject to a mental health referral by third parties may not, for health reasons, be in a position to provide the agency with their personal or health information, The events in issue 43Having examined the material before me, I have set out a chronology of relevant events in tabular form. 31 December 2007 H (a third party) contacts the agency's AccessLine expressing concern about QB's mental health. 1 January 2008 An AccessLine Handover report to the mental health Team (MHT) was generated. It records that H provided detailed information relating to QB's health and personal circumstances. This includes details of her symptoms. These notes appear, from the language used, to be enmeshed with the opinions reached by the worker concerned from what she was told. The report recorded that QB had been previously hospitalised for mental health issues at an interstate hospital. It did not suggest that QB was a danger to herself or others, but raised concerns that she was fearful of others. It noted concerns that she was being overly generous with her money, and was contemplating going overseas. The information was ambivalent as to whether or not QB was taking prescribed medications. It included a notation that another individual, J, associated with QB, was presently away and to ring back on 7 January 2010. It classified QB at category D under the Health Intake and Triage Policy . 3 January 2008 The MHT sent a fax to the interstate hospital requesting "background information" with respect to QB. It received a copy of QB's discharge form from that hospital, which contained her health information. 7 January 2008 H and J attended at the MHT's premises and discussed their concerns about QB's mental health with staff, Their observations and expressions of opinion about QB's condition were noted in Community Health Progress Notes relating to QB. The notes record further personal and health information relating to QB, including an allegation that she had not taken prescribed medications since shortly after her discharge. They record claims of unusual behaviour on QB's part and of the expression by QB of "persecutory delusions". It was noted that the informant "would prefer that the MHT did not arrive at the home ... or even make phone calls." The notes recorded that QB had previously been diagnosed with "first episode psychosis, probable schizophrenia." They documented a plan to encourage QB to see Dr Y, a general practitioner, and to provide the discharge summary to him "if needed." Worker A sent a six-page fax to Dr Y on that day. The cover sheet shows that the subject was "D/C summary from [the interstate hospital]." 15 January 2008 Worker B received a phone call from a different person, K, expressing opinions and concerns about QB's condition. The notes conclude, "Informed ... we would await further referral if safety is not an issue." Worker B received a phone call from H reporting on QB's presentation and expressing opinions about her health. The notes record that QB had made an appointment with Dr Z, to get immunisations for her planned overseas travel. The staff member informed H that she would, "contact [Dr Z] to inform of current situation and provide necessary background." The worker also spoke J who was distressed by QB's condition. The worker arranged to meet with J the next day "to provide education and gather further information on [QB's] presentation." The worker spoke with Dr Z and discussed QB's "recent mental health history." She got the doctors fax number, "to fax info". She faxed Dr Z some information, but it is not clear from the fax coversheet precisely what was included. Dr Z contacted Worker B. The worker's note reads: "P/C from [Dr Z] who refused to respond to [QB's] presentation if unwell due to not knowing the pt but would contact [the MHT] if observed 'unusual behaviour.'" 16 January 2009 On the same day H, together with another person, L, attended the MHT. Worker B's notes record information: Provided by H with respect to the circumstances leading up to QB's admission to the interstate hospital in 2007. Suggesting that QB's mental health was deteriorating. That QB isolated herself. That comments she makes suggest she is "suspicious' that she is being followed. The worker informed H and L that she would recommend a follow up and seek advice as to "how to manage the situation if [QB] falls under the M.H. Act" Worker B received a phone call from Dr Z who stated that QB "was appropriate at the Dr's surgery & was not 'observed' to be displaying 'unusual' or 'odd' behaviour." The worker recorded a phone call from L. The notes record L as saying that QB was "secretive" about her injections today. "[L] stated that [QB's] behaviour is 'hard to pinpoint but it doesn't add up'." The notes recorded that L was concerned about going behind QB's back, but considered that she was "quite paranoid" about her hospital admission. The worker then contacted an AccessLine (A/L) worker regarding QB so that they would be aware of the situation in the event of more third party contact. The notes record that the AccessLine worker said "she would put a memo out regarding this presentation and advise that A/L NOT call house" unless requested. An AccessLine handover report documenting that conversation contains the following note: 17 January 2008 "[QB] is reportedly very guarded and currently very angry with her family and blames them for her recent Inpt Admission. They are reluctant to seek further MH input at this time. She may be relapsing and compliance with medications is unknown. She is currently making plans to leave the country, obtaining travel vaccinations, giving things away and giving money away from her inheritance. ? presentation suggestive of a hypomanic component of ? Schizoaffective Disorder." This AccessLine handover report categorised QB at category F - await contact from consumer/referrer. The worker attempted to make contact with QB's manager from the interstate mental health service responsible for care during her earlier hospital admission. He was not available, but arrangements were made for the worker to speak with Dr M, formerly QB's treating physiatrist. 18 January 2008 Dr M returned her call and said that QB had been "quite unwell" when hospitalised. Dr M would support a further mental health assessment given the concerns raised. The notes continue - Explained [QB's] resistance to have a M. H. assessment. [Dr M] stated she would contact [QB] and encourage f/u post d/c as req'd. There is an additional undated note of a further call the worker made to Dr M - ...stating [QB] was refusing assessment and the difficulty of involuntary assessment based on the families concerns. [Dr M] stated she would contact [QB]." Worker B received a phone call for Dr M advising that she had spoken to QB who was agreeable to an assessment. 21 January 2008 The worker then rang QB who "presented as quite friendly and agreeable to an assessment today.,," The assessment was conducted. During the assessment the notes record that QB was friendly and cooperative until "[L] presented to state that [QB] was not taking her medication. [QB] then became quite guarded and whispered to [L] 'don't' tell her anything.'" 44Following that assessment no action was taken with respect to QB under the Mental Health Act. The notes record advice received that out patient follow up should be considered, as it was not possible to schedule QB. The matter was resolved with QB agreeing to see Dr M before she left for her overseas trip. The Mental Health Act 2007 45Underlying the events in issue is the fact that among the MHT's functions is the consideration and assessment of whether persons are mentally ill or mentally disordered with the meaning of the Mental Health Act 2007 (the MH Act). 46Section 14 provides for when a person is mentally ill - (1) A person is a mentally ill person if the person is suffering from mental illness and, owing to that illness, there are reasonable grounds for believing that care, treatment or control of the person is necessary: (a) for the person's own protection from serious harm, or (b) for the protection of others from serious harm. (2) In considering whether a person is a mentally ill person, the continuing condition of the person, including any likely deterioration in the person's condition and the likely effects of any such deterioration, are to be taken into account. 47"Serious harm" is not defined in the Act. Given the objects and purposes of the Act it should not be construed as relating to physical harm alone, but extends to serious harm to relationships, finances, and reputation, and as a result of neglect of self or others: see the Mental Health Review Tribunal Hearing Kit , Section 1, The reference in sub-s (2) to persons "continuing condition" in the context of an assessment of whether a person is mentally ill, points to the relevance to such an assessment of past medical records relating to a persons mental health. 48Section 15 is concerned with mentally disordered persons - A person (whether or not the person is suffering from mental illness) is a mentally disordered person if the person's behaviour for the time being is so irrational as to justify a conclusion on reasonable grounds that temporary care, treatment or control of the person is necessary: (a) for the person's own protection from serious physical harm, or (b) for the protection of others from serious physical harm. 49The Act provides for the detention of persona in declared mental health facilities in defined circumstances (s 18 - s 26). Once detained they are to be examined by a medical officer within 12 hours, and are to be released unless that officer certifies that the person is a mentally ill person or a mentally disordered person (s 27(a)). If so certified, then a second examination is conducted by a psychiatrist who is required to form an opinion as to whether the person is mentally ill or mentally disordered (s27(b)). If the second examiner is not of that opinion, then a third examination is to be conducted by a psychiatrist (s 27(c)). Persons found to be either mentally ill or mentally disordered is steps 1, and 2 or 3, are to be presented before the Mental Health Review Tribunal (MHRT) for a mental health inquiry under s 34 the Act. If not so found, the person is to be released after the third examination(s 27(d)). On a mental health inquiry the MHRT, if satisfied that the person is mentally ill, may make orders for the continuing detention and treatment as involuntary patients for up to three months, for their release into the care of a primary carer, or a community treatment order (s 35(5)). Persons detained as involuntary patients or subject to a community treatment order are required to comply with treatment plans. If not satisfied that the person is mentally ill the MHRT is to order their release (s 35(4)). The Act makes provision for the regular review of involuntary patients (s37) and for the review and variation of community treatment orders (s 63). 50In providing care to patients under the MH Act s 68 sets out a number of principles which have effect. Relevantly, it provides - It is the intention of Parliament that the following principles are, as far as practicable, to be given effect to with respect to the care and treatment of people with a mental illness or mental disorder: (a) people with a mental illness or mental disorder should receive the best possible care and treatment in the least restrictive environment enabling the care and treatment to be effectively given, (b) people with a mental illness or mental disorder should be provided with timely and high quality treatment and care in accordance with professionally accepted standards, (c) the provision of care and treatment should be designed to assist people with a mental illness or mental disorder, wherever possible, to live, work and participate in the community, (d) the prescription of medicine to a person with a mental illness or mental disorder should meet the health needs of the person and should be given only for therapeutic or diagnostic needs and not as a punishment or for the convenience of others, (e) people with a mental illness or mental disorder should be provided with appropriate information about treatment, treatment alternatives and the effects of treatment, (f) any restriction on the liberty of patients and other people with a mental illness or mental disorder and any interference with their rights, dignity and self-respect is to be kept to the minimum necessary in the circumstances, (g) the age-related, gender-related, religious, cultural, language and other special needs of people with a mental illness or mental disorder should be recognised, (h) every effort that is reasonably practicable should be made to involve persons with a mental illness or mental disorder in the development of treatment plans and plans for ongoing care, (i) people with a mental illness or mental disorder should be informed of their legal rights and other entitlements under this Act and all reasonable efforts should be made to ensure the information is given in the language, mode of communication or terms that they are most likely to understand, ... 51The MH Act does not repose in those administering it any investigative powers. 52It is important to note that under the MH Act the focus of workers on intake and assessment is whether the person is at risk of serious harm. Past mental health history is relevant to that assessment. In contrast, the focus of the HPPs is on the protection of an individual's health information. The exceptions to the principles relating to collection, use and disclosure pf health information involve a consideration of different criteria to the substantial harm criteria created by the MH Act: see the discussion below. As the HRIP Act applies to mental health agencies in their day-to-day work the distinct and differing requirements of the applicable legislation needs to be borne clearly in mind. The Health Privacy Code of Practice 53Under s 38 of the HRIP Act the Privacy Commissioner may issue health privacy codes of practice. Such codes may modify the application of any one of more of the HPPs, 54Using these powers the Privacy Commissioner has issued the Health Records and Information Privacy Code 2005. Among other things, that code allows for the collection, use and disclosure by a mental health service of health information about an individual from or to another human services agency or allied agency: see clause 4. Such collection use or disclosure is to be undertaken in accordance with a written authorisation of a senior officer of the agency. Clause 4(4) provides - (4) A senior officer may give an authorisation under subclause (2) only if the officer is satisfied that: (a) the individual to whom the specified information relates is a person to whom services are provided or proposed to be provided by a human services agency or an allied agency, and (b) the individual (or if the individual is incapable, within the meaning of section 7 (1) of the Act, of giving consent, the individual's authorised representative) has failed to consent to the agency collecting or using the specified information, or disclosing the specified information to the specified agencies, and (c) there are reasonable grounds to believe that there is a risk of substantial adverse impact on the individual or some other person if collection or use of the specified information, or disclosure of the specified information to the specified agencies, does not occur, and (d) the collection or use of the specified information, or disclosure of the specified information to the specified agencies, is likely to assist in developing or giving effect to a case management plan or service delivery plan that relates to the individual, and (e) reasonable steps have been taken to ensure that the individual has been notified by the agency of each of the following: (i) the specified information, (ii) the specified agencies, (iii) the period for which the authorisation is proposed to be sought to have effect. Note. Notification under this paragraph would normally be in writing. However, other notification methods may be more appropriate in the case of certain clients. For example, if the client is illiterate. 55In QB's case there is no suggestion that any such authorisation exists. Issues 56In this case there is no dispute and I accept that: * The information collected by the agency is health information within the meaning of s 6 of the HRIP Act. * The agency is a health service provider as defined in s 4 of the Act, to which the Act applies (s 11). 57With respect to the review of conduct the following issues arise for determination: * Whether there has been any and what breach of the collection principles in HPP 3. * Whether there has been a breach of HPP 4 which imposes obligations on agency's which collect health information about an individual to make the individual aware of the fact. * Whether there has been a breach of HPP 5 which imposes obligations to agencies regarding the security of health information. * Whether there has been a breach of the provisions of HPP 7 relating to access to health information. * Whether there has been any and what breaches of HPP 9 which relates to the accuracy of health information. * Whether there has been any and what breach of HPP 10 which relates to the use of health information . * Whether there has been a breach of HPP 11 which relates to the disclosure of health information. * Whether there has been a breach of HPP 14 which relates, among other things, to the transfer of health information about an individual to a person outside the state. 58While these are broader than those identified by the internal review, they each, in my view, fall within the scope of QB's initial privacy complaint when reasonably construed. Has there been a breach of HPP3? 59HPP 3 provides - (1) An organisation must collect health information about an individual only from that individual, unless it is unreasonable or impracticable to do so. (2) Health information is to be collected in accordance with any guidelines issued by the Privacy Commissioner for the purposes of this clause. 60In my view QB's complaint raises for consideration five areas of conduct to be considered in the light of HPP3. They are: * The initial AccessLine collection of health information relating to QB volunteered by a third person. This is documented in AccessLine handover reports and a Registration form. * The subsequent collection of information volunteered by a number of by a number of individuals to the Mental Health Service. * The collection of health information from the interstate hospital * The collection of health information from Dr Z. * The collection of health information from Dr M. * The collection of health information from L during the interview with QB on 21 January 2008. 61In four of these instances the health information was obtained orally by staff from the Mental Health Service and reduced to writing in the form of notes or completed intake forms. The exception is the discharge summary which was requested from the interstate hospital. Was information volunteered unsolicited information? 62Because, in the first four instances, the health information was voluntarily offered by third parties to the agency an issue arises as to whether it was collected within the meaning of the HRIP Act, because it was unsolicited. Section 10 provides - For the purposes of this Act, health information is not collected by an organisation if the receipt of the information by the organisation is unsolicited. 63Following the decision of the Appeal Panel in ZR v Department of Education & Training [ 2010] NSWADTAP 75 at [52-58] it is clear that where an agency has in place a structure for the receipt of information, and that information is relevant to the agency's purposes, then information volunteered to the agency is not unsolicited and is collected by the agency. In QB's case the agency has in place a policy ( Health Intake and Triage Policy ) which makes provision for the receipt and collection of information relating to the mental health of individuals volunteered by third parties. It includes procedures for the recording and use of that information by the agency. The Policy provides for decisions to be made and action taken by the agency based on such information in fulfilling the agency's function. 64As a consequence the receipt of QB's health information form a third party in the AccessLine contact on 1 January was not unsolicited, and s 10 does not apply. I add that if that were not the case the recording of the information and its use by the agency would, in any case, amount to a collection: OA v NSW Department of Housing (No 2) [2006] NSWADT 94 and ZR v Department of Education & Training [ 2010] NSWADTAP 75. 65Similarly the subsequent receipt of QB's health information from individual third parties who volunteered the information was clearly contemplated by and undertaken in accordance with the procedures and policies of the agency. It was not unsolicited, and was recorded and used by the agency. Collecting the Access Line health information 66On 1 January 2008 QB's health information was collected by the agency in accordance with a process and structure it had put in place for the receipt of information relevant to its purpose of providing mental health services to the community. Despite being unsolicited, the information was therefore collected within the meaning of HPP 3. The issue is whether it was unreasonable or impracticable to collect the information from QB. 67This Access Line was the first notification to the agency with respect to QB. The health information was apparently collected from a third person concerned with QB's health and well being, I am satisfied that in the circumstances of a first notification it was both impractical and unreasonable for the agency to collect that information from QB directly, There is therefore no breach of the collection principle. Collecting the health information in the discharge summary 68On 3 January 2008 the Mental Health Service sent a fax to the interstate hospital requesting "background information" with respect to QB. It received a copy of QB's discharge form from that hospital which contained her health information. There can be no doubt that this was a collection by the agency within the meaning of HPP 3. The question that then arises was whether it was unreasonable or impracticable to collect the information from QB herself? 69At that time the agency was in receipt of information that raised concerns about QB's mental health. The intake process did not suggest that QB was a danger to herself or others, but raised concerns that she was fearful of others. The information was ambivalent as to whether or not QB was taking prescribed medications. At intake QB was triaged at category D. 70I accept, as outlined in Ms Fowler's statements, that some individuals who are the subject of a mental health referral by third parties may not, for health reasons, be in a position to provide the agency with their personal or health information, In those circumstances it would be impracticable and unreasonable to require the agency to obtain such information from the individual concerned. In cases of high or extreme urgency, which require a response immediately (category A) or within two hours (category B) I can see that collecting health information from the prison concerned may be impracticable and unreasonable. Similarly in those cases in which there is material suggesting that the individual is incapable of meaningful communication or likely to be a danger to themselves, workers or others, I can accept that collecting health information directly from them may be impracticable and unreasonable. 71In QB's case, however, there was no suggestion in the AccessLine Handover Report that she was a danger to herself others, or that her ability to communicate was impaired. Similarly, the referral did not advise or contain any cautions about approaching QB. The third party "request" that QB not be contacted had not been made at the time the discharge report was requested. 72No explanation has been given by the agency as to why approaching the interstate hospital for a copy of its discharge summary was "an appropriate course of action" in the circumstances, as determined by the internal review. No explanation has been advanced as to why QB was not approached directly. QB could have been approached on 3 January 2008 and asked to provide information about her condition. Such a course of action would have been entirely consistent with the agency's Health Intake and Triage Policy . If that had occurred, QB would no doubt have been asked about her previous admissions, and could have been asked to authorise the agency to obtain a copy of the discharge summary. 73Despite the agency's submissions to the contrary, there is no basis for a conclusion that it was either unreasonable or impracticable for the agency, at the relevant time, to seek to obtain information relating to OB's discharge summary for QB directly. That was what HPP3 obliged it to do, 74As a result I am satisfied that by obtaining QB's discharge summary from the interstate hospital, and not from QB herself (or with her consent) the agency engaged in conduct which breached HPP3. Collecting health information from third parties - 7 January to 16 January 2008 75A review of the notes prepared by agency's workers reveals that mental health workers obtained health information relating to QB from third parties, after the referral to the MHT, on the following occasions - * On 7 January 2008 from H and J. * On 15 January 2008 from K. * On 16 January 2008 from J, H and L. * On 17 January 2008 from L 76The information obtained as a result of these third party contacts was obtained and recorded in the context of the agency's ongoing management of the initial referral. In her statements Ms Fowler devoted much of her attention to the need to ensure the confidentiality of third parties. She pointed out that the Health Intake and Triage Policy provides for obtaining information in this manner. What she did not address was why, in the circumstances, the agency had not obtained, and did not attempt to obtain, QB's health and personal information from QB herself. That is what the agency's policy and HPP3 required. 77Ms Fowler did not advance any good reason as to why it was unreasonable or impracticable to do so. There is nothing in the material before me which points to why it was either unreasonable or impractical for the agency to do so. 78The third party consultations took place as a follow-up to the original referral. QB was registered as a client of the agency (without her knowledge) on 1 January 2008: six days before the first third pry consultation and sixteen days before the last. Contact had not been made with QB within 48 hours as required by that policy. Rather, the agency had embarked on a process of acquiring her health information in apparent disregard of its own policy. 79There is nothing in the material before me which points to why it was either unreasonable or impracticable for the agency to approach QB directly before the meeting with third parties on 8 January 2008, or before the subsequent third party consultations. Given the time that had passed since the initial referral, both HPP 3 and the agency's own policy obliged it to seek to collect QB's health information directly from her. It did not do so. 80Agency staff, in the course of the third party consultations, obtained further health information relating to QB. Importantly, the notes of the meeting of 7 January 2008 do not record the third party expressing disquiet or concern about QB's reaction should she be approached by the agency. Rather, they note that the third party would "prefer" that QB not be approached at home or contacted by phone. 81The expressed preference of a third party does not provide a rational basis for concluding that it would be unreasonable or impracticable to obtain QB's health information directly form her. 82There is no explanation in any of the notes or reports as to why a worker did not approach QB directly, or why the matter reached the point where AccessLine staff noted that they were not to call QB's house unless requested to do so (by third parties). The only explanation which suggests itself, from the notes, is that this was for the convenience and comfort of the third parties. It meant that QB would not be alerted to the fact that they were concerned about her health, and were providing health information to the MHT about her, without her knowledge. 83If that is the explanation for the failure to contact QB, it does not justify a conclusion that it was unreasonable or impracticable to contact QB. 84I am satisfied that by obtaining health information relating to QB in the third party consultations on from 7 to 18 January 2008, and not from QB herself, the agency engaged in conduct which breached HPP 3. Collecting health information from Dr Z 85On 16 January 2008 MHT staff approached Dr Z to provide information in relation to Dr Z's observation of QB when she presented for her vaccinations the next day. Dr Z was provided with unspecified documentation relating to QB's mental health. Dr Z was understandably cautious about this approach, but did advise the worker, the next day, that QB "was appropriate at the Dr's surgery & was not 'observed' to be displaying 'unusual' or 'odd' behaviour." 86In the context this was health information relating to QB that was collected by the agency from Dr Z. It was collected in a covert manner, apparently designed to ensure that QB was not aware that the information was being collected by the MHT. 87The information collected from Dr Z was a medical opinion regarding QB's presentation, It was nonetheless information that could have been obtained by a mental health worker speaking with QB, and making observations of her presentation, reactions and behaviour. This is what the agency's policy expected workers to do. It is also what HPP3 required. There is no credible explanation advanced as to why it was either unreasonable or impracticable for a worker to do so, and no such explanation is discernable form the documents. 88As a result I am satisfied that by obtaining health information relating to QB from Dr Z on 17 January 2008, and not from QB herself, the agency engaged in conduct which breached HPP3. Collecting health information from Dr M 89On 18 January 2008 an agency worker contacted Dr M and obtained information in relation to QB's health around the time of her admission to the interstate hospital. The notes of that conversation reveal that Dr M was told that QB was refusing an assessment, but that the family held concerns. 90On the material before the Tribunal there was no basis, in fact, for the suggestion that QB was refusing an assessment. She had not been approached by the MHT, let alone asked to participate in a mental health assessment. Rather, the MHT had been engaged in a process of covert collection of QB health information for eighteen days. The most recent information, aside from expressions of concern by family members, was Dr Z's favourable report of QB's presentation. There is no note of Dr M being told about that. 91Once again there is no explanation discernable form the material as to why it was unreasonable or impracticable to obtain the health information provided by Dr M from QB, or to obtain QB's consent to the MHT contacting Dr M. The information received from Dr Z the previous day highlights this. 92I am satisfied that by obtaining health information relating to QB from Dr M on 17 January 2008, and not from QB herself, the agency engaged in conduct which breached HPP3. Collecting health information from L on 21 January 2008 93QB voluntarily saw the worker at the MHT's premises on 21 January 2010. In her correspondence she alleges that L was invited into that discussion without her permission or consent. The internal review addressed this by advising that Worker B denied that this was the case. 94Aside from assertions in correspondence form the parties, the only direct evidence I have relating to these events are the worker's notes that - "[L] presented to state that [QB] was not taking her medication." This is health information relating to QB. 95The note does not state how it came to be that L presented during QB's assessment interview. The note can be read as being consistent with an organised confrontation of QB. If that were the case, and L was present without QB's consent, then there would be a clear and apparent breach of HPP 3. 96Due to the state of the evidence, however, I am not able to reach a positive conclusion as to whether L was present with or without QB's consent. As a result I am not satisfied that there is a breach of HPP 3 in this regard: KP v Narrandera Shire Council [2011] NSWADTAP 15 at [31]. Has there been a breach of HPP 4? 97HPP 4 places obligations on agencies which collect health information about an individual to make that individual aware of certain matters. It provides - (1) An organisation that collects health information about an individual from the individual must, at or before the time that it collects the information (or if that is not practicable, as soon as practicable after that time), take steps that are reasonable in the circumstances to ensure that the individual is aware of the following: (a) the identity of the organisation and how to contact it, (b) the fact that the individual is able to request access to the information, (c) the purposes for which the information is collected, (d) the persons to whom (or the types of persons to whom) the organisation usually discloses information of that kind, (e) any law that requires the particular information to be collected, (f) the main consequences (if any) for the individual if all or part of the information is not provided. (2) If an organisation collects health information about an individual from someone else, it must take any steps that are reasonable in the circumstances to ensure that the individual is generally aware of the matters listed in subclause (1) except to the extent that: (a) making the individual aware of the matters would pose a serious threat to the life or health of any individual, or (b) the collection is made in accordance with guidelines issued under subclause (3). (3) The Privacy Commissioner may issue guidelines setting out circumstances in which an organisation is not required to comply with subclause (2). (4) An organisation is not required to comply with a requirement of this clause if: (a) the individual to whom the information relates has expressly consented to the organisation not complying with it, or (b) the organisation is lawfully authorised or required not to comply with it, or (c) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1 9 98 ), or (d) compliance by the organisation would, in the circumstances, prejudice the interests of the individual to whom the information relates, or (e) the information concerned is collected for law enforcement purposes, or (f) the organisation is an investigative agency and compliance might detrimentally affect (or prevent the proper exercise of) its complaint handling functions or any of its investigative functions. (5) If the organisation reasonably believes that the individual is incapable of understanding the general nature of the matters listed in subclause (1), the organisation must take steps that are reasonable in the circumstances to ensure that any authorised representative of the individual is aware of those matters. (6) Subclause (4) (e) does not remove any protection provided by any other law in relation to the rights of accused persons or persons suspected of having committed an offence. (7) The exemption provided by subclause (4) (f) extends to any public sector agency, or public sector official, who is investigating or otherwise handling a complaint or other matter that could be referred or made to an investigative agency, or that has been referred from or made by an investigative agency. 98There no evidence, with respect to all the health information the agency collected about QB, that the agency complied with any of the requirements of ss (1). I am satisfied that it thereby breached HPP 4(1). 99With respect to HPP 4(2) there is no evidence that the agency took any steps to notify QB of the information required. Similarly there is no evidence to suggest that notifying her posed a serious threat to the life or health of any individual. QB was perfectly capable of understanding such a communication. There was nothing about the circumstances of the collection which took it within the exemptions in clause 4. The Privacy Commissioner had not issued guidelines authorising non-compliance. As a result I am satisfied that the agency breached HPP 4(2). Has there been a breach of HPP 7? 100HPP 7 relates to access to health information. It provides - (1) An organisation that holds health information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information. Note. Division 3 (Access to health information) of Part 4 contains provisions applicable to private sector persons in connection with the matters dealt with in this clause. Access to health information held by public sector agencies may also be available under the Government Information (Public Access) Act 2009 or the State Records Act 1998 . (2) An organisation is not required to comply with a provision of this clause if: (a) the organisation is lawfully authorised or required not to comply with the provision concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998 ). 101The only conduct I can identify which could be viewed as falling within the scope is that the agency redacted information which would disclose the identity of third parties when providing QB with access to her records under the Freedom of Information Act 1989 . The refusal was based on Cl. 13(b) of Schedule 1 f the FOI Act which provided - A document is an exempt document: (a) ... (b) if it contains matter the disclosure of which: (i) would otherwise disclose information obtained in confidence, and (ii) could reasonably be expected to prejudice the future supply of such information to the Government or to an agency, and (iii) would, on balance, be contrary to the public interest. 102At the relevant time s 22 of the HRIP Act provided - (1) Nothing in this Act affects the operation of the Fr e edom of Information Act 1989 . (2) In particular, this Act does not operate: (a) to modify any exemption under the Freedom of Information Act 1989 , or (b) to lessen any obligations under that Act in respect of a public sector agency. (3) Without limiting the generality of subsection (1), the provisions of the Freedom of Information Act 1989 that impose conditions or limitations (however expressed) with respect to any matter referred to in HPP 6 (Information about health information held by organisations), HPP 7 (Access to health information) or HPP 8 (Amendment of health information) are not affected by this Act, and those provisions continue to apply in relation to any such matter as if those provisions were part of this Act. 103Section 22 makes it clear that HPP 7 does not affect the power of an agency to lawfully claim exemption under the FOI Act with respect to health information about which an individual seeks access under the HPP7. As already noted, while I initially intended to considered the correctness of the decision to claim those exemptions in the QB's case, subsequent events have made that unnecessary. 104I am not satisfied that there has been a breach of HPP 7. Has there been a breach of HPP 9? 105HPP 9, which is concerned with the accuracy of health information. It provides - An organisation that holds health information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 106There are three areas of the agency's conduct that require consideration in the light of HPP 9. Thy are - * The incorrect information recorded on the registration form. * Alleged incorrect notes of QB's meeting with the worker on 21 January 2008. * Disagreements with the "clinical assessments" made by agency staff and other clinicians. Incorrect information in the registration form 107The internal review accepted that the registration form incorrectly recorded QB's age and next of kin, and recommended that they be amended. 108I agree with that conclusion and recommendation. Incorrect notes of the assessment meeting on 21 January 2008 109QB's principal issue concerns the following notation made by Worker B [QB] presented for assessment (in file) QB was friendly and cooperative until [L] presented to state QB was not taking medication. [QB] then became quite guarded and whispered to [L] "Don't tell her anything." . 110In her letter of 7 December 2008 to the MHT QB set out a different version of those events in which she suggests that [L] entered the interview room with Worker B's permission but without her consent. She denies saying "don't tell her anything." 111Worker B's notes of her interview with QB, and the assessment document she completed, were made for the purposes of evaluating QB's mental health. It is important to observe that neither the notes nor the assessment record the circumstances in which L came to participate in that assessment. Both Worker B and QB agree that L was there. Because the notes do not record how L came to be there I do not accept they are inaccurate in that regard. 112With respect to the issue of whether or not QB said "don't tell her anything" the reality is that I have there are untested competing versions from QB and Worker B abut this. In those circumstances I am not persuaded the notes is inaccurate. Clinical assessment 113In her assessment Worker B recorded that QB demonstrated - Poor engagement i.e changeable and guarded ->cousin attended assessment. QB stated ""Don't tell her anything." 114This is plainly Worker B's opinion of QB's presentation. There is no evidence that Worker B did not hold that opinion honestly: EN v UTS (No 2) [2009] NSWADT 193. As such, I do not accept that it is inaccurate. Has there been a breach of HPP 10? 115HPP 10 relevantly provides - (1) An organisation that holds health information must not use the information for a purpose (a secondary purpose ) other than the purpose (the primary purpose ) for which it was collected unless: (a) Consent the individual to whom the information relates has consented to the use of the information for that secondary purpose, or (b) Direct relation the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose, or Note. For example, if information is collected in order to provide a health service to the individual, the use of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. (c) Serious threat to health or welfare the use of the information for the secondary purpose is reasonably believed by the organisation to be necessary to lessen or prevent: (i) a serious and imminent threat to the life, health or safety of the individual or another person, or (ii) a serious threat to public health or public safety, or 116Agency workers used QB's health information for the purposes of informing their own consideration of what if any action should be taken with respect to the concerns expressed about her mental health. 117I agree with the internal review that the use the workers made of the health information, in their consideration and management of QB's case, was for the primary purpose of which it was collected. There is no breach of HPP 10 in this regard. Has there been a breach of HPP 11? 118HPP 11 relevantly provides - (1) An organisation that holds health information must not disclose the information for a purpose (a secondary purpose ) other than the purpose (the primary purpose ) for which it was collected unless: (a) Consent the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or (b) Direct relation the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or Note. For example, if information is collected in order to provide a health service to the individual, the disclosure of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. (c) Serious threat to health or welfare the disclosure of the information for the secondary purpose is reasonably believed by the organisation to be necessary to lessen or prevent: (i) a serious and imminent threat to the life, health or safety of the individual or another person, or (ii) a serious threat to public health or public safety, or ... 119There are three areas of the agency's conduct that require consideration in the light of HPP 9. They are the disclosures of QB's health information to Dr Y, Dr Z and Dr M. The disclosure to Dr Y 120Dr Y is not an employee of the agency, but a general practitioner in private practice. A MHT worker faxed a copy of QB's discharge summary to him, without QB's consent or knowledge on 7 January 2008. This was done apparently in the hope that QB could be persuaded to visit Dr Y. Dr Y being informed of her history might then be able to make an assessment and communicate it to the MHT. 121The internal review concluded that the provision of the discharge summary to Dr Y breached HPP 11. The internal review reached that conclusion without explaining its reasoning. 122The discharge summary was collected from the interstate hospital for the purpose of informing the MHT of QB's mental health history, so as to enable a treatment plan to be made and implemented. There was, at that time and subsequently, nothing in the records that pointed to there being an imminent risk to the life, health and safety of QB or others, or public health or safety. QB did not consent to disclosure. 123The apparent purpose underlying the disclosure of the discharge summary to Dr Y was to either, to obtain treatment from Dr Y, or to obtain further information about QB to inform the MHT's decision making. These are both secondary purposes directly related to the primary purpose for which the discharge summary was initially collected, albeit without QB's knowledge or consent. 124As such, the disclosure would not have breached HPP 11 if "the individual would reasonably expect the organisation to disclose the information for the secondary purpose." 125Here the agency faces an insurmountable problem. It collected the discharge summary without QB's knowledge or consent, and in breach of HPP 3. It is apparent from her complaint that QB objects to the fact that the discharge summary was disclosed to Dr Y. That, however, is not the test. The test is whether the individual would reasonably expect the organisation to disclose the information for the secondary purpose. As QB did not know that the agency had the information, and as it has been collected in breach of HPP 3, it cannot be held that she should reasonably have expected the agency to disclose it to Dr Y for the secondary purpose. 126I am satisfied that by disclosing the discharge summary to Dr Y the agency breached HPP 11. The disclosure to Dr Z 127Dr Z is not an employee of the agency, but a general practitioner in private practice. Worker B discussed QB's mental health with Dr Z on 16 January 2008 and faxed documents concerning QB to Dr Z on that day. Given the course of events I conclude that at minimum this fax included the discharge summary form the interstate hospital. It may also have included the original AccessLine handover report. 128I accept that in both those phone discussions, and the fax, the agency disclosed QB's health information to Dr Z. Once again this was done without QB's consent or knowledge. 129The workers notes make it clear that Dr Z, not knowing QB, refused to treat QB who was to see her for vaccinations for overseas travel. Dr Z did agree to contact the MHT if QB displayed unusual behaviour. 130As with the disclosure of the discharge summary to Dr Y, the purpose of the disclosure of QB's health information to Dr Z was to obtain further information about QB, to inform the MHT's decision making. This is a secondary purpose directly related to the primary purpose for which the health information was initially collected. 131I accept that had she known of the disclosure QB would not have consented to it. 132The internal reviewer spoke with the worker who dealt with Dr Z. She proffered the following explanations for the disclosure - * There was an imminent threat to QB's health and welfare and an assessment needed to be made as soon as possible. * She was conscious that QB might react negatively to an approach by the MHT. * In those circumstances she approached Dr Z who agreed to report unusual behaviour. 133At the time the worker spoke with Dr Z, QB had been an unknowing "client" of the agency for sixteen days. There was no suggestion in any of the notes or records that there was an imminent risk to the life, health and safety of QB or others, or public health or safety. She had been triaged at Category D, This required face to face contact within 48 hours. That contact had not occurred. Rather, the MHT had engaged in a surreptitious process of information gathering and acquisition. The worker had not acted on her professed concerns for QB's safety and welfare by, for example, re-categorising her, seeing her, or contemplating action under the Mental Health Act. I do not accept, on the material before me, that the worker considered that QB's health or welfare was in imminent danger. 134Similarly, on the worker's own notes, I do not accept that there was any good reason for her concern that QB might react negatively to an approach by the MHT. The notes point to a desire on the part of third parties that QB not be approached directly: perhaps out of their concerns that QB might take a dim view of them going behind her back to consult the MHT. One would expect ramifications of that ilk to be an ordinary incident associated with MHT contacts. There is no suggestion in the notes or records that QB posed a risk of serious and imminent threat to the life, health or safety of herself or another person, or public health or safety. The worker's explanation does not impress me as a good or coherent reason for the MHT failing to contact QB as the agency's policy required. 135As a result I am not satisfied that disclosure of QB's health information was reasonably believed by the agency to be necessary to prevent a serious or imminent threat to QB's life health or safety, or that of others. 136Similarly, for the same reasons as those I gave with respect to disclosure to Dr Y, I am not satisfied that the disclosure to Dr Z for the secondary purpose of obtaining further information was one that QB would reasonably have expected the agency to disclose, for that secondary purpose. QB did not know that the agency had the information, as it has been collected in breach of HPP 3. It cannot be held that she should reasonably have expected the agency to disclose it to Dr Y for the secondary purpose. 137I am satisfied that the agency breached HPP 11 by disclosing QB's health information to Dr Z. The disclosures to Dr M 138Dr M is a psychiatrist in the employ of an interstate mental health service. She is not an employee of the agency. 139Worker B had a telephone discussion with Dr M on 18 January 2008. In the conversation the worker both collected from and disclosed to Dr M QB's health information. The notes are silent as to whether the worker disclosed Dr Z's observations of QB's behaviour, the day before, to Dr M. The worker did "explain QB's resistance" to having a mental health assessment to Dr M: a resistance which was assumed or inferred from third party communications, but never tested, by approaching QB directly. 140Following the conversation with the worker, Dr M rang QB who agreed to an assessment. Dr M advised the worker of this on 21 January 2008, the same day QB attended the MHT for the assessment. 141The internal review appears to have accepted that at the time of the conversations with Dr M the worker considered that QB's health or welfare was in imminent danger. For substantially the same reasons I gave with respect to the disclosure to Dr Z, I reject this contention. I would add that by then QB's tirage category had been changed to category F, which is the least urgent category. There was nothing in the report the worker obtained from Dr Z which would have given the rise to a concern that QB's was at risk of serious and imminent threat to the life, health or safety of herself or another person, or public health or safety. On the contrary, Dr Z's observations of QB were not a cause for concern. 142As with the disclosure of the discharge summary to Dr Y, the purpose of the disclosure of QB's health information to Dr M on 18 January 2008 was to either obtain treatment for OB, or to obtain further information about QB to inform the MHT's decision making. This is a secondary purpose to that for which the health information has been received. 143Again, for the same reasons as those I gave with respect to disclosure to Dr Y and Dr Z, I am not satisfied that the disclosure to Dr M on 18 January 2008, for the secondary purpose of obtaining treatment or further health information about QB, was one that QB would reasonably have expected the agency to disclose, for that secondary purpose. Once again, as QB did not know that the agency held the information, as it has been collected in breach of HPP 3, it cannot be said that she should reasonably have expected the agency to disclose it to Dr Y for the secondary purpose. 144I am satisfied that the agency breached HPP 11 by disclosing QB's health information to Dr Z. Has there been a breach of HPP 5? 145HPP 5 is concerned with the security of health information. Relevantly it provides - (1) An organisation that holds health information must ensure that: (a) the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) the information is disposed of securely and in accordance with any requirements for the retention and disposal of health information, and (c) the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) if it is necessary for the information to be given to a person in connection with the provision of a service to the organisation, everything reasonably within the power of the organisation is done to prevent unauthorised use or disclosure of the information. Note. Division 2 (Retention of health information) of Part 4 contains provisions applicable to private sector persons in connection with the matters dealt with in this clause. 146QB's concern is that she has no information relating to the security of her health information that was disclosed to Dr Y and Dr Z without her consent, 147Section 25 of the HRIP Act places obligations on medical practitioners as health service providers to retain health information the collect relating to adults for 7 years. The HPP's apply equally to all health service providers. As a consequence both Dr Y and Dr Z were under an obligation to secure QB's health information. In transferring health information to other health service providers the agency was entitled to take account of the fact that they are bound by the HPPs and, in the absence of good reason for not doing so, assume compliance by them with the HPPs. 148That, however, does not mean that that the disclosure of QB's health information to Dr Y and Dr Z was "necessary" as required by HPP 5(1)(d). Indeed, my findings concerning breaches of HPP 11 in relation to those disclosures points to the contrary conclusion. Has there been a breach of HPP 14? 149HPP 14 is concerned, among other things, with the transfer of health information about a person to an interstate person or agency. Relevantly, it provides - An organisation must not transfer health information about an individual to any person or body who is in a jurisdiction outside New South Wales or to a Commonwealth agency unless: (a) the organisation reasonably believes that the recipient of the information is subject to a law, binding scheme or contract that effectively upholds principles for fair handling of the information that are substantially similar to the Health Privacy Principles, or (b) the individual consents to the transfer, or ... 150Worker B provided QB's health information to Dr M, who works with an interstate mental health service, without QB's consent. 151The interstate health service is located in Victoria. As such it is an agency subject to the provisions of the Health Records Act 2001 (Vic). That Act effectively upholds principles for the fair handling of the information that are substantially similar to the Health Privacy Principles. 152As a result I am not satisfied that there has been a breach of HPP 14. Summary of findings 153In the light of all the above the Tribunal is satisfied that agency by its conduct has breached: * the collection principles in HPP 3. * HPP 4 which imposes obligations on agency's which collect health information about an individual to make the individual aware of specified maters. * HPP 5 in relation to the unnecessary disclosure of health information. * HPP 9 which relates to the accuracy of health information. * HPP 11 which relates to the disclosure of health information. 154The Tribunal is not satisfied that there has been a breach of HPP 7, 10 or 14. Remedy 155In her application indicated that she wished to see steps taken to ensure that what happened to her will not happen again. She also sought an order for costs. 156Section 55(2) of PPIP Act provides that on a review of conduct - (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. 157At the heart of the agency's breaches is the failure by its workers to comply with HPP 3. Compliance with its own policy, which required that agency worker's contact QB within 48 hours of initial categorisation at Category D, may well have prevented many of the subsequent breaches from occurring. Rather than contacting QB, however, the workers engaged in a complicated process whereby QB's health information was, covertly from QB, collected, disclosed and acquired, without lawful authority and in breach of the HPPs. 158I am willing to accept, although QB does not, that the motivation of the workers was what they perceived as the pursuit of her best interest. Their view of QB's best interest is not, however, the determinative factor. If their concerns about QB's mental health were sufficiently serious they could seek to take action under the MH Act. It is apparent that the concerns expressed were never regarded as likely to merit her diagnosis as a mentally ill or mentally disturbed person. There was no evidence that she was not a threat to herself or others, nor clear evidence that she was at risk of serious harm. That being the case, the workers were required to comply with the HPPs and the agencies own policies. They were not entitled to put their (or other's) views as to what was in her best interest ahead of their lawful obligations. To my mind, this unjustified and covert collection of health information about OB by MHT workers is egregious. 159I will make an order requiring the agency to refrain from any conduct or action in contravention of, and to perform, HPPs 3, 4, 9 and 11. 160I will also order, under s 55(e) and (g), requiring the agency to apologise in writing to QB for each of the breaches I have found within 30 days of the publication of these reasons. I do so cognizant of the apologies already proffered. 161Also under s 55(e) and (g), within 60 days of the publication of these reasons the agency shall: - write to Dr Y and Dr Z seeking to recover QB's health information disclosed to them in breach of HPP 11; and, - if that health information is recovered, ensure that it is safely secured; and, -whether or not the health information is recovered, advise QB in writing of the outcome of the request for recovery, and, if the health information is recovered, provide QB with details of what has been recovered and how it is secured. 162I also minded to make two ancillary orders under s 55(g) with the aim of ensuring future compliance with HPPs 3, 4, 9 and 11. Because those orders are likely to involve a cost to the agency, which may impact on its other operations, I will give each party an opportunity to be heard as to whether they should be made in any and what form. In draft from they are: 1. Within 90 days the agency shall review and reissue its Health Intake and Triage Policy so that the policy provides specific directions, compliant with the Health Privacy Principles, regarding: a. the circumstances in which health information about a person can be collected from third parties, medical practitioners or other agencies, where the person has not consented to that collection and is not at risk of serious and imminent threat to the life, health or safety to him or herself, or another person, or to the public health or safety, and is able to communicate. b. the obligations of the agency to advise the person of and about information so collected. c. the circumstances in which health information about a person may be disclosed to third parties, medical practitioners or other agencies, where the person has not consented to that collection and is not a danger to themselves or others and is able to communicate. 2. Within 6 months of completion of order 1, the agency shall provide a course of training to mental health workers in its employ with respect to the requirements and operation of the HPP's in the context of their duties, and of the protections the HPPs establish for health information of the agency's clients. 163The agency shall file and serve any submissions it wishes to make with respect to the form and content of that draft order within 30 days of the publication of these reasons. 164OB shall file and serve any submissions within a further 21 days. 165Finally, I will note that QB's FOI application is withdrawn and dismiss it accordingly. Costs 166I note that in her application QB forecast an application for costs. She should be aware that as a self-represented litigant the costs she can recover are limited (see the Tribunal's practice direction on costs) and that the Tribunal's power to award costs is limited to the circumstances set out in s 88 of the ADT Act. 167Any application for costs should be filed and served by QB within 30 days specifying the costs sought, and providing proof of expenses claimed. If such a claim is made then the agency shall have a further 21 days to file and serve submissions in reply. I hereby certify that this is a true and accurate record of the reasons for decision of the Administrative Decisions Tribunal. Registrar ********** Amendments 07 March 2012 - Party name updated Amended paragraphs: 33, 109 DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 07 March 2012