Administrative Decisions Tribunal New South Wales Medium Neutral Citation: AQB v St Vincent's Hospital Sydney Limited [2013] NSWADT 210 Hearing dates: On the papers Decision date: 24 September 2013 Jurisdiction: General Division Before: Naida Isenberg, Judicial member Decision: The application is dismissed Catchwords: Discharge summary and medical records - whether health information - whole document to be considered as health information Legislation Cited: Health Records and Information Privacy Act 2002 Privacy and Personal Information Protection Act 1998 Category: Principal judgment Parties: AQB (Applicant) St Vincents Hospital (Respondent) Representation: AQB (Applicant in person) St Vincents Hospital (Respondent) File Number(s): 133190 reasons for decision Background 1In late 2012 'AQB', the Applicant was a patient at the Respondent hospital. She was discharged into the care of her General Practitioner, Dr Zaki. 2She complained to the Health Care Complaints Commission ('HCCC') about her treatment by the Respondent. 3On 2 June 2013 'AQB' lodged an application for review of the Respondent's conduct under s.21 of the Health Records and Information Privacy Act 2002 ('HRIP Act') and s.55 of the Privacy and Personal Information Protection Act 1998 ('PPIP Act'), alleging that the Respondent had breached several principles of those Acts. 4The details of the Applicant's claim were quite unclear; however, at a planning meeting I conducted on 23 July 2013 the Applicant summarised her complaint as follows, namely that the Respondent had disclosed: its discharge summary to the Applicant's General Practitioner (Dr Zaki) in breach of both the HRIP Act and PPIP Act; and the Applicant's medical records to the HCCC in breach of the HRIP Act and PPIP Act 5In subsequent submissions the applicant appeared to no longer be concerned about the discharge summary, but for completeness, I have addressed this concern, whether the applicant continues to press it or not. I should also observe that the applicant raised in her submissions complaints about the conduct of others (eg disclosure of personal information to Centrelink and to her employer) but these are outside the scope of the review. 6The Respondent did not dispute that its medical records department had sent the discharge summary together with a cover sheet to Dr Zaki on 20 September 2012, nor that it had supplied the Applicant's medical records to the HCCC. Disclosure of Discharge Summary under the HRIP Act 7Section 6 of the HRIP Act defines health information as: (a) personal information that is information or an opinion about: (i) the physical or mental health or a disability (at any time) of an individual, or (ii) an individual's express wishes about the future provision of health services to him or her, or (iii) a health service provided, or to be provided, to an individual, or (b) other personal information collected to provide, or in providing, a health service, or (c) other personal information about an individual collected in connection with the donation, or intended donation, of an individual's body parts, organs or body substances, or (d) other personal information that is genetic information about an individual arising from a health service provided to the individual in a form that is or could be predictive of the health (at any time) of the individual or of any sibling, relative or descendant of the individual, or (e) healthcare identifiers, but does not include health information, or a class of health information or health information contained in a class of documents, that is prescribed as exempt health information for the purposes of this Act generally or for the purposes of specified provisions of this Act. 8The discharge summary contains information about the Applicant's physical or mental health, medication, diagnoses, and responsible clinicians, her admission and discharge. 9The Respondent submitted, and I agree, that the information contained within the discharge summary falls within the definition of health information and the HRIP Act is relevant to any issue of disclosure of the discharge summary. For practical purposes the whole of the document is properly regarded as health information. 10Schedule 1 of the HRIP Act sets out the Health Privacy Principles ('HPPs'), which include limits on disclosure of health information. 11Principle 11(1)(a) states, relevantly, that an organisation that holds health information must not disclose the information for a purpose other than the purpose for which it was collected unless the individual to whom the information relates has consented to the disclosure of the information for that other purpose. The Respondent provided a copy of notes apparently taken by a member of the Respondent's nursing or medical staff that the applicant was 'happy for team to contact clinical psychologist and LMO and release information'. Notwithstanding the extensive material filed by the Applicant, I do not understand her to deny this consent. I find that the disclosure of the discharge summary to Dr Zaki was therefore made with the consent of the Applicant. The Respondent also provided a copy of its privacy leaflet which informs patients that health information provided by patients may be disclosed to, amongst others, a local doctor. It is unknown if the applicant received the leaflet, but in my view, in the circumstances of this matter, nothing turns on whether she received it or not. 12Principle 11(1)(b) of the HPPs states, relevantly that an organisation that holds health information must not disclose the information for a purpose other than the purpose for which it was collected unless the other purpose is directly related to the purpose for which it was collected and the individual would reasonably expect the organisation to disclose the information for the other purpose. The HPP specifically notes that if information is collected in order to provide a health service to the individual, the disclosure of the information to provide a further health service to the individual is a purpose directly related to the purpose for which it was collected. I find that the information within the discharge summary was collected for the purpose of providing health care services to the Applicant. Further, it is clear that the discharge summary was disclosed to Dr Zaki for the purpose of facilitating the Applicant's ongoing care. As I have observed, the Note to HPP 11 specifically lists facts analogous to these as an example of a directly related purpose. Further, by virtue of the consent referred to above the Applicant should reasonably have expected the Respondent would disclose the discharge summary to Dr Zaki. 13I therefore find that the Respondent did not breach the HRIP Act by disclosing the discharge summary to Dr Zaki. Disclosure of Discharge Summary under the PPIP Act 14Section 4 and 4A of the PPIP Act exclude "health information" within the meaning of the HRIP Act from the definition of "personal information". I have found the discharge summary contains information which is health information and that for practical purposes the whole of the document is properly regarded as health information. The question of disclosure under the PIPP Act therefore does not arise. Disclosure of the Medical Record to the Health Care Complaints Commission under the HRIP Act 15On 9 October 2012 the HCCC received a complaint by the Applicant which alleged the Respondent had discriminated against her on the basis of her ethnicity, and in relation to aspects of her treatment. In the HCCC complaint form the Applicant signed a consent authorising the HCCC to access her personal health records for the purpose of handling the complaint. 16The HCCC has powers under s.21A and s.34A of the Health Care Complaints Act NSW 1993 ('HCC Act') to request the production of documents (including medical records) in its assessment and investigation of a complaint. Information and documents may be provided to the HCCC in compliance with this section despite any other Act or law, which includes privacy law. A request must be complied with unless there is reasonable excuse for the failure to comply. In some circumstances there are penalties for non-compliance. 17By letter dated 11 October 2012 the HCCC asked the Respondent to comment on the Applicant's allegations and, importantly, to provide a copy of the Applicant's medical record. In its response to the HCCC letter about the Applicant's allegations, and in compliance with its obligations under the HCC Act, the Respondent provided a report detailing its response, together with the Applicant's medical record. There was no claim of reasonable excuse not to comply with the request, nor can I see any evidence which would have supported such a claim; the Respondent acted in accordance with its responsibilities under the HCC Act, which, in effect, override its general responsibilities under the HRIP Act. 18Further, the Applicant's medical records contain information which falls within the definition of health information as defined in the HRIP Act. For practical purposes the whole of the medical records are properly regarded as health information. Principle 11(1)(a) of the HPPs discussed above, applies. I find that the Applicant, by virtue of her complaint, impliedly consented to the disclosure of health information by the Respondent to the HCCC. Also, the Applicant, in authorising the HCCC to access her health records for the purpose of handling the complaint, expressly authorised the Respondent to release the information. 19As to Principle 11(1)(b) of the HPPs (discussed above), I find that the health information in the medical records was collected for the purpose of providing health care services to the Applicant and that it was disclosed to the HCCC for the purpose of an investigation, initiated by the Applicant, into allegations of improper conduct and inadequate treatment by the Respondent during its provision of health care to her. I find this purpose is directly related to the provision of health care services. By virtue of Applicant's complaint, it is a matter of commonsense that the HCCC would have had to investigate her complaint and that that would necessarily involve consideration of her medical records. In any event, the Applicant consented to the HCCC accessing her personal health records for the purpose of handling the complaint. In addition, the Respondent was responding to a written request from the HCCC in accordance with its request under its complaints assessment and investigation provisions. 20The Respondent submitted that there were other bases upon which it was entitled or obliged to provide the information to the HCCC, such as HPP11(1)(i) and HPP 11(1)(k) and 11(6). In view of my findings above it was unnecessary to consider those submissions. 21I find that the Respondent did not breach the HPIP Act by disclosing the medical records to the HCCC. Disclosure of the Medical Record to the Health Care Complaints Commission under the PPIP Act 22As discussed above, s.4 and 4A of the PPIP Act exclude "health information" within the meaning of the HRIP Act from the definition of "personal information". I have found the medical records contain health information and that for practical purposes the whole of the medical records is properly regarded as health information. The question of disclosure under the PIPP Act therefore does not arise. DECISION The application is dismissed ********** DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 24 September 2013