Administrative Decisions Tribunal New South Wales Medium Neutral Citation: AOZ and Rail Corporation New South Wales [2013] NSWADT 279 Hearing dates: On the papers Decision date: 04 December 2013 Jurisdiction: General Division Before: Judicial Member Naida Isenberg Decision: The application is dismissed Catchwords: Privacy -health information - workers compensation - clinical notes Legislation Cited: HYPERLINK "http://www.austlii.edu.au/au/legis/nsw/consol_act/papipa1998464/" Privacy and Personal Information Protection Act 1998HYPERLINK "http://www.austlii.edu.au/au/legis/nsw/consol_act/hraipa2002370/"Health Records and Information Privacy Act 2002 Workers Compensation Act 1987 Workplace Injury Management and Workers Compensation Act 1998 Cases Cited: HW v Commissioner of Police, NSW Police and Anor [2003 NSWADT 214 Y v Department of Education & Training [2001] NSWADT 149 Department of Education & Training v PN (GD) [2006] NSWADTAP 66 GL v Director General, Department of Education & Training [2003] NSWADT 166 PN v Department of Education & Training [2006] NSWADT 122 Department of Education & Training v PN (GD) [2006) NSWADTAP 66 AF v Healthquest & Another [2011] NSWADT 99 AF v Minister for Health; Minister for Health v AF [2012] NSWADTAP 16 LN v Sydney South West Area Health Service (No 2) [2010| NSWADT 38 Director General Department of Education and Training v MT (GD) [2005] NSWADTAP 77 Category: Principal judgment Parties: AOZ (Applicant) RailCorp NSW (Respondent) Representation: AOZ (Applicant in person) Sparke Helmore (Respondent) File Number(s): 133037 reasons for decision 1The Applicant, AOZ complains that the Respondent's Workers Compensation Unit ('RailCorp'), breached the Health Records and Information Privacy Act 2002 ('HRIP Act'). The alleged breaches relate to the collection, use and disclosure of health information in clinical notes from her treating doctors in the course of assessing and managing her claim for workers compensation. The Respondent denies that it engaged in conduct in breach of the HRIP Act: 2The complaint was the subject of an internal review dated 23 January 2013 under s.21 of the HRIP Act and s.53 of the Privacy and Personal Information Protection Act 1998 ('PPIP Act'). The Applicant seeks review by the Tribunal under s55 of the PPIP Act. 3In particular, the Applicant seeks: * An apology and financial compensation for the violation and distress caused in obtaining complete medical history; * Reimbursement by RailCorp for private lawyer fees (not at ADT) pertaining to correspondence sent in relation to privacy breach ($1400.00) * Imposing a special condition on RailCorp's self insurer's license whereby ongoing independent audits are completed in line with the application of legislation pertaining to workers compensation in general and alignment to Health Privacy Principles. Within this identified period, RailCorp be required to report findings to both WorkCover, the Privacy Commissioner and the Minister for Transport Relevant legislation 4Both the PPIP and the HRIP Acts place obligations on how agencies handle personal and health information. "Personal information" includes any information or opinion that is capable of identifying a person: s.4 PPIP Act and s.5 HRIP Act. "Health information" includes personal information about the physical or mental health or a disability of an individual: s.6 HRIP Act. 5Schedule 1 of the HRIP Act sets out the Health Privacy Principles ('HPPs'). Those relevant to the Applicant's claim are conveniently summarized as follows: * HPP 1. When an organisation collects health information, the information must be collected for a lawful purpose. It must also be directly related to the organisation's activities and necessary for that purpose. * · HPP 2. The organisation must ensure that your health information is relevant, accurate, up to date and not excessive. The collection should not unreasonably intrude into the person's personal affairs. * · HPP 4. A person must be told why their health information is being collected, what will be done with it, and who else might see it. A person must also be told how they can see and correct their health information, and any consequences if the person decides not to provide it. Even if an organisation collects health information about a person from someone else, they must still take reasonable steps to ensure that the person is aware of the above points. * · HPP 10. The organisation can only use your health information for the purpose for which it was collected, or a directly related purpose that you would expect. Otherwise they can only use it with your consent (unless one of the exemptions in HPP 10 applies). * · HPP 11. The organisation can only disclose your health information for the purpose for which it was collected, or a directly related purpose that you would expect. Otherwise they can only disclose it with your consent (unless one of the exemptions in HPP 11 applies). Evidence 6The Applicant provided a detailed affidavit. Some of her contentions appeared to canvass the outcome of the Workers Compensation proceedings and aspects of her medical condition which are not relevant to the matter at hand. She also provided details of her claim for damages, which, having regard to my findings below, need not be discussed further. 7The Applicant claimed in her application for review that the Respondent had breached her privacy by requesting (and receiving) her complete medical history from two medical centres. 8She said some of her concerns were: * She had received correspondence from RailCorp's solicitor identifying that their client felt "obliged to obtain the full file rather than be selective". They also advised that they had returned the medical files to both medical centres. She claimed this breached HPP 1. * She said the information obtained by Railcorp - which exceeded 330 pages - was highly sensitive and confidential and much of which had no bearing on the claim. This caused her considerable undue stress and feelings of being violated and she noted her relationship with her doctor had broken down as a result. She claimed a breach of HPP 2. * RailCorp had provided all her medical records to the Workers Compensation Commission ('the Commission') even though she had placed strong objection prior to this occurring. Also, prior to providing the medical records, she had requested (via her solicitor), that as all her records were collected on the basis of the "consent" in a WorkCover certificate, she required these records to be destroyed, not used as part of arbitration or provided to third parties at that time or in the future. She claimed a breach of HPPs 10 and 11. * She claimed that the correspondence sent by RailCorp to the medical centres was the subject of a WorkCover investigation, as a result of which Railcorp was directed to change its letters of request and consent form; they were also directed that they would be audited as part of their self insurer's licence. She seeks a copy of RailCorp's revised letter/consent form. * She raised other issues about the Respondent contacting specialists but this did not form part of her original complaint. 9She said that when requesting her medical history, RailCorp made no attempts to subpoena this information whereby she would have been afforded the opportunity to object to its release. She submitted that a signed WorkCover certificate should not be considered consent for requesting a complete medical history. The "claims form" is the appropriate record to request the release of information in relation to the claim only. This was not provided to her solicitor as part of the expedited assessment process for the Commission. Alternatively, if a full medical file is requested, this leaves those requesting open to scrutiny in terms of "in relation to the claim". It is the doctor's responsibility to determine what is to be released in relation to the claim. At no stage did she sign an "Authority to Consent to Release Medical Information hence she was not duly notified." She claimed the Respondent had breached HPP 4. 10The Respondent provided a statement by Ms K. Hobson (formerly Faulks) who is a Senior Case Manager in the Respondent's Workers Compensation Unit, which unit is responsible for managing workers compensation claims from all agencies in the Transport portfolio, including RailCorp, and had been so employed since April 2009. She is responsible for managing workers compensation claims made by RailCorp employees, which includes assessing a worker's entitlements to workers compensation and providing injury management and return to work services for injured employees. The Respondent also provided a statement by Ms R Giffin, the Principal Manager, Injury & Claims Management, Transport Shared Services, Human Resources Service Delivery, a position she has held since January 2013. Prior to that time she had worked in the field of workers compensation and affiliated services for over 25 years and had been Manager, Injury Management and Claims Services in Roads and Maritime Services for 13 years. CONSIDERATION 11From Ms Hobson's evidence it appears that in late October 2011, AOZ contacted the RailCorp and indicated that she was making a claim in relation to back pain and that it was an aggravation of an injury in 2004 that had been accepted as compensable. AOZ provided Railcorp with, amongst other things, a Workcover certificate issued by Dr E. Roseth which identified the date of injury as '27/08/2004'. Dr Roseth issued two further WorkCover medical certificates. HPPs 1 & 2: PURPOSE FOR WHICH THE INFORMATION WAS COLLECTED 12RaiiCorp is a self-insurer. Claims for workers compensation are managed under the Workers Compensation Act 1987 ('WC Act') and the Workplace Injury Management and Workers Compensation Act 1998 ('WIMWC Act'). Essentially, an injured worker is entitled to receive workers compensation providing the worker's employment was a substantial contributing factor to the injury: ss. 9 and 9A WC Act. Ms Hobson provided examples of matters to be taken into account for the purposes of determining whether a worker's employment was a substantial contributing factor to an injury, including the probability that the injury or a similar injury would have happened anyway, at about the same time or at the same stage of the worker's life, if he or she had not been at work or had not worked in that employment, the worker's state of health before the injury and the existence of any hereditary risks, the worker's lifestyle and his or her activities outside the workplace: s.9A(2) WC Act. This includes assessing health information relating to the worker which could indicate if there are other reasons, such as a degenerative condition, unrelated to any work injury. 13The Applicant's medical certificate related to an exacerbation of an injury from 2004. The diagnosis was L4/5 disc injury. 14Ms Hobson wrote that she sent letters to the doctors who had previously treated the Applicant in order to obtain medical reports, including clinical notes, but, at first, no responses were received. Ms Giffin wrote that in her experience, the response of doctors to requests for clinical notes varies from providing all the notes, providing some of the notes to not responding at all. 15Presumably in order to progress the Applicant's claim, in the absence of the information requested, the Applicant was then assessed by a doctor nominated by the Respondent. Her claim was declined. When a review was sought Ms Hobson again wrote to Dr Roseth and to the Practice Manager at Brookvale as Dr Chiu and Dr Artinian from that practice had been the Applicant's treating doctors at the time of the original claim in 2004. The letters to the doctors referred to the claim numbers and date of the original injury. The letters requested all of the clinical notes relating to the Applicant: ... from the date the worker first attended [the practice] in respect of any illness or injury. 16A copy of the 'consent' (discussed below) was also provided. The Respondent did not dispute that, in effect, the request asked for all of the doctors' clinical notes. Ms Hobson said this was necessary in order to assess whether the Applicant's injury was work-related and compensable. 17The Applicant, referring to HPP 1 and 2 alleged that the Respondent had sought more information than was required to consider her claim. Further, she contended that it had used 'unlawful means' to obtain that information. 18Both doctors provided their clinical notes to the Respondent. Dr Artinian's clinical notes dating from 1999 were reviewed in the course of the Applicant's subsequent claim to the Commission. These clinical notes provided evidence of AOZ's earlier back problems, prior to the 2004 work injury. The Commission arbitrator found that whilst there was evidence she had a lower back problem in 1999, there was no evidence to suggest she had any treatment from 1999 until the work accident in 2004. The arbitrator found that this reduced the significance of the Respondent's findings in assessing the claim that she had a long standing pre-existing back condition which recurred from time to time, as she had had no apparent recurrent episodes of back pain until after 2004. As it transpired, the Applicant had had a number of instances of acute back pain in the years between the 2004 injury and the claimed aggravation of October 2011: see statement of reasons at [7]. 19Ms Hobson wrote that the purpose for which all of the clinical notes were collected from her treating doctors was to determine whether the back pain was work-related or if work was a significant contributing factor or whether it was due to another condition which was not work-related. I accept this to be the case. 20The Respondent submitted that AOZ's health information was collected for the lawful purpose of discharging its statutory obligations under the workers compensation legislation and was necessary for the purpose of determining whether her claim was in relation to a work-related illness or injury and whether work was a substantial contributing factor. Given its obligation to assess whether there is liability under the workers compensation legislation and the fact that the Applicant's claim related to back pain, in the circumstances it was reasonable and not excessive to collect her treating doctors' clinical notes of to determine if she had any conditions which were not work-related and relevant to the claim such as other conditions that would result in back pain. 21The internal review of the present matter recommended amendments to the Respondent's correspondence to doctors to "include specific reference to the particular injury/illness to which the claim relates". The Applicant complained to Privacy Commissioner ('OPC') the about the breadth of the request to the doctors. The OPC considered that the request for health information had not been not limited to what was relevant and invited disclosures that are significantly wider than what the Guidelines (discussed below) authorise. I consider this to be an unduly narrow interpretation that does not take into account the Respondent's overall responsibilities in assessing a claim. I accept that without all of the clinical notes, there would be little or no information available to the Respondent in assessing the Applicant's claim regarding other conditions which could have the same symptoms but not be work-related. 22I find that the purpose of the collection of the Applicant's health information was to manage her workers compensation claim in accordance with the WC Act and WIMWC Act. I accept that it was necessary for RailCorp to review AOZ's complete history to determine if the 2011 back pain was due to the 2004 injury or some another condition. CONSENT 23The Workers Compensation Regulation 2010 and 'Workcover Guidelines For Claiming Compensation Benefits' ('the Guidelines') are made under the WIMWC Act. The Guidelines include as a 'Governing Principle' that the insurer obtain the worker's consent to "the collection, use and disclosure of personal and health information when they sign a claim form or medical certificate". 24Claim forms used by insurers include consent provisions for the employer to access the claimant's medical records. The Applicant had signed such a consent in her 2004 claim form. I accept Ms Hobson's evidence that as the applicant alleged in 2011 that her incapacity and need for further treatment at that time resulted from her previous workplace injury in 2004, a new claim form was not required in relation to the exacerbation. 25The Applicant invited my attention to the 2004 claim form and the consent provision in which she: ... authorise[d] the Compensation Section of Rail Corporation New South Wales to obtain such reports and details of [her] injury its treatment, therapy and rehabilitation and any other condition which restricts or inhibits my returning to my normal classified duties, from [her] treating doctors, treating specialists, hospitals, clinics and from whomsoever I receive treatment, therapy, surgery, medical attention or rehabilitation for this and any related injury or condition. 26She contended that the words "any other condition which restricts [a person] returning to pre-injury duty" is reviewed by the nominated treating doctor in consultation with the injured worker. In her case, it was agreed between all parties that she would not be returning to pre-injury duties as a Transit Officer. The Respondent at the time, she said, was kept informed as she had a rehabilitation provider. At no stage, she said, was there a requirement for RailCorp to be aware of any other medical condition. I think this approach is a misunderstanding of the obligations of an insurer in assessing a claim and the information upon which it is entitled to take into account is broader than that that might be provided by a rehabilitation provider. 27The Applicant noted, by contrast the 2012 version of RailCorp's Workers Compensation Claim Form which states: I hereby authorise any medical practitioner, other persons treating me & others who may have information relating to my claim or a person or government department or any state or territory or Commonwealth who may be providing me with a benefit to provide such information as will allow RailCorp to manage my claim (Applicant's emphasis) 28I draw no inference from a revision of the claim form consent. 29WorkCover has also determined a standard form of medical certificate by treating doctors. All WorkCover medical certificates include the following section at the end: 5. Injured Worker Consent I confirm the information I have given is correct; I nominate as my Nominated Treating Doctor; I consent to my Nominated Treating Doctor, my employer, the insurer, other treating practitioners, rehabilitation providers and WorkCover NSW exchanging information for the purposes of managing my injury and workers compensation claim. I understand this information will be used by WorkCover and insurers to fulfil their functions under the workers compensation legislation. 30The injured worker indicates their consent by signing under the above statement. AOZ signed three WorkCover medical certificates with the above consent on 24 October, 2 and 23 November 2011. 31In her statement Ms Rae wrote that where the notes are provided, this is done under the consent provided by the worker on the claim form and/or the Workers Compensation Medical Certificate issued by the doctor and signed by the worker. The Applicant however claimed that in signing the WorkCover Certificate she did not consent to RailCorp obtaining her full medical files. 32In the context of the HRIP Act, the consent on the Workcover medical certificate permits the insurer to collect information from the treating doctors and expressly permits the insurer to use that information to fulfil its functions under the legislation. I have found that it was necessary for RailCorp to review AOZ's complete history to determine if the 2011 back pain was due to the 2004 injury or some another condition and that the purpose of the collection of that information was to manage her workers compensation claim in accordance with the WC Act and WIMWC Act. By signing the consent on the medical certificates, Applicant consented to RailCorp collecting, using and disclosing that information for the purpose of managing her claim and injury. 33I find that AOZ provided her consent to the collection, use and disclosure of her health information for the purposes of managing her workers compensation claim on three Workcover medical certificates issued in 2011. In addition, as she was claiming that the back pain was due to the compensable injury she had in 2004, the Respondent was entitled to rely on the consent she provided in the 2004 claim form. HPP 4: MAKING INDIVIDUAL AWARE OF CERTAIN INFORMATION 34As discussed above, HPP 4 requires, amongst other things, that a person must be told why their health information is being collected, what will be done with it, and who else might see it. HPP 4(4)(a) provides that an organisation need not comply with its obligations under HPP 4 where the person has expressly consented to the organisation not complying with the requirements of the HPP. 35The Applicant said that RailCorp only informed her solicitor approximately five months after the request and collection of her medical files. Prior to that, she was unaware they had been obtained in their entirety. Further, she contended, the WorkCover medical certificate consent does not support notifying an "injured worker" that an insurer can request, collect and store medical records in their entirety and outside scope of claim, nor does it fulfill functions under WorkCover legislation. 36AOZ signed the consent on three Workcover medical certificates in 2011 and the 2004 claim form. As a result she did not need to be further advised that RailCorp was collecting the information and RailCorp was not obliged to comply with HPP 4(2). HPP 10: USE OF HEALTH INFORMATION 37There was no evidence that RailCorp used the clinical notes other than for the purpose of determining AOZ's aggravation claim and asserting its position before the Commission. 'Disclosure to the Commission' is discussed below. 38I find that the health information which is the subject of the Applicant's complaint was only used by RailCorp for the purpose for which it was collected, that is, in connection with her 2011 workers compensation claim. HPP 11: DISCLOSURE OF HEALTH INFORMATION 39The alleged breach of HPP 11 is that RailCorp disclosed AOZ's clinical notes to the Commission. Under the WIMWC Act, the objectives of the Commission include "providing a fair and cost effective system for the resolution of disputes under the Workers Compensation Acts": s.367 of the WIMWC Act. 40RailCorp had used information from the clinical notes in reaching its decision and internal review. As a result, it was obliged to provide all of those notes to the Commission and to AOZ's solicitors as part of the Workers Compensation proceedings. In that way, both the Commission and the Applicant's solicitors would be clear as to what information RailCorp had relied on in reaching its decisions. The Applicant provided a copy of a letter from her solicitors that indicated that they had previously been unaware of some of the documents, including clinical notes from Drs Roseth and Artinian. With respect, that seems to me to be more a reflection upon her solicitor's preparation and/or the Applicant's candour with her own legal advisers. From the Commission's decision the Applicant had objected, apparently with some vehemence, to the use of some of the documents on the basis of relevance. The parties agreed at a conciliation conference which documents were to be admitted into evidence in the Workers Compensation proceedings with the balance being removed and returned to the Applicant's solicitors for destruction. That course is not unusual. 41It was not clear what documents remained before the Commission and thereby agreed as being relevant. However, paragraph 29 of the statement of reasons indicates that the Commission had before it clinical notes from Dr Artinian, which RailCorp had relied upon in its argument that AOZ's back pain was due to a degenerative condition and not work-related. The Commission appears to have accepted that there was evidence of AOZ having back problems in 1999 but found there were no references to back pain in the clinical notes between 1999 and the 2004 injury. As mentioned above, the statement of reasons notes the Applicant had a number of instances of acute back pain in the years between the 2004 injury and the claimed aggravation of October 2011. It is unclear from where that information may have been obtained but it is likely to have been referenced in the clinical notes of the Applicant's treating doctors. That information would be likely to have been relevant to the arbitrator's consideration of whether AOZ's back pain was related to the 2004 injury. 42I find that the health information which is the subject of this complaint was only disclosed to the Commission for the purpose for which it was collected, that is, in the workers compensation proceedings commenced by AOZ. CONCLUSION 43I therefore find that the clinical notes relating to AOZ were collected, used and disclosed for the sole purpose of RailCorp fulfilling its statutory obligations under the WC Act and WIMWC Act. As a result, there was no breach of the HRIP Act in relation to the clinical notes from AOZ's treating doctors. DECISION 44The application is dismissed. I hereby certify that this is a true and accurate record of the reasons for decision of the Administrative Decisions Tribunal. Registrar ********** DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 04 December 2013