AJD v Royal Prince Alfred Hospital [2014] NSWCATAD 125

Civil and Administrative Tribunal New South Wales Medium Neutral Citation: AJD v Royal Prince Alfred Hospital [2014] NSWCATAD 125 Hearing dates: On the papers Decision date: 02 September 2014 Jurisdiction: Administrative and Equal Opportunity Division Before: S Montgomery, Senior Member Decision: The matter is listed for a planning meeting at 2pm on 14 October 2014 Catchwords: Health Information - health privacy principles - disclosure Legislation Cited: Administrative Decisions Tribunal Act 1997 Civil and Administrative Tribunal Act 2013 Privacy and Personal Information Protection Act 1998 Health Records and Information Privacy Act 2002 Cases Cited: AFC v Sydney Children Hospitals Specialty Network [2012] NSWADT 189 Category: Principal judgment Parties: AJD (Applicant) Royal Prince Alfred Hospital (Respondent) Representation: Counsel P Rooney Surry Hills Legal Centre (Applicant) GILD insurance Litigation Pty Ltd (Respondent) Privacy Commissioner File Number(s): 123079 Publication restriction: The name of the Applicant is not to be made publicly available. Paragraphs 34, 80 and 85 are not to be made publicly available.

reasons for decision 1This matter was commenced in the General Division of the Administrative Decisions Tribunal ("the ADT"). On 1 January 2014, the ADT was abolished and its functions were taken over by the Civil and Administrative Tribunal of New South Wales ('NCAT'). The present decision is therefore a decision of NCAT. But because the proceedings to which it relates are 'part heard proceedings' as defined in clause 6(1) of Schedule 1 of the Civil and Administrative Tribunal Act 2013, they are to be determined as if that Act had not been enacted (see clause 7(3)(b) of this Schedule). 2These reasons concern a review of conduct by the Respondent, the Royal Prince Alfred Hospital under the Privacy and Personal Information Protection Act 1998 ("the PPIP Act") and the Health Records and Information Privacy Act 2002 ("the HRIP Act"). The names of private individuals, and other information which might identify them, have been anonymised so as to preserve the privacy of their personal affairs. I have also limited my discussion of some issues in order to the privacy of their personal affairs. In these reasons the Applicant is referred to as AJD. 3It is common ground that the Respondent is and was at all relevant times a health service provider within the meaning of section 4 of the HRIP Act. AJD has been a patient of the Respondent. She suffered from a serious and chronic illness and received health services provided by the Respondent. AJD also delivered two children ("the children") at the Respondent's maternity unit. The Respondent held health information, as defined in section 6 of the HRIP Act, about AJD and the children. 4AJD and the children's father ("the father") are divorced but both parents have equal custodial rights and responsibilities for the children. 5The father lodged requests with the Respondent for the children's medical records. In response to that request, the Respondent supplied copies of its medical records of the children to the father. 6These records relating to the time around each of the children's births contained both the children's health information and information regarding AJD's health. The records indicated that AJD suffered from a serious chronic illness and also contained other information about her health. 7AJD lodged a request for an Internal Review of the conduct. She asserted that her privacy was breached by the Respondent having used and disclosed personal health information to the father, an unauthorised third party, without her consent or without lawful purpose. AJD further says that the Respondent failed to ensure the security of her personal health information against unauthorised misuse and disclosure. 8The review considered whether there had been breaches of Health Privacy Principle ("HPPs"). It considered HPP 5 (Retention and Security), HPP 10 (Limits on Use of Health Information), and HPP 11 (Limits on Disclosure of Health Information). In the review, the Respondent conceded that information regarding AJD's health was contained within the children's medical records and that this information was provided to the father as part of the children's records. However, the review found that no HPPs had been breached. 9The reviewer found that there was no evidence to substantiate the allegation that the Respondent had failed to ensure the security of AJD's health information against unauthorised use and disclosure. The reviewer found that the Respondent did not use AJD's health information other than for the primary purpose of providing health services to AJD and the children. 10The Respondent considered that the information of AJD's condition was of significant relevance to the ongoing care of the children and the medical records were released in their entirety to the father. The review also indicated that documentation in the children's medical records indicated that the father was already aware of AJD's serious chronic condition. 11AJD has applied to the Tribunal for external review of the conduct. In that application she sought a number of orders including compensation for damage suffered as result of alleged breaches of the HRIP Act.