Civil and Administrative Tribunal New South Wales Medium Neutral Citation: BGQ v Sydney Local Health District [2014] NSWCATAD 174 Hearing dates: On the papers Decision date: 20 October 2014 Jurisdiction: Administrative and Equal Opportunity Division Before: S Montgomery, Senior Member Decision: The Application is dismissed. Catchwords: Health Information - health privacy principles - conduct Legislation Cited: Civil and Administrative Tribunal Act 2013 Health Records and Information Privacy Act 2002 Privacy and Personal Information Protection Act 1998 Cases Cited: GL v Director General, Department of Education & Training [2003] NSWADT 166 JD v Director-General, NSW Department of Health [2004] NSWADT 7 NZ v Commissioner of Police [2007] NSWADT 132 ON v Marrickville Council [2005] NSWADT 274 Wykanak v Department of Local Government-[2002] NSWADT 208 Category: Principal judgment Parties: BGQ (Applicant) Sydney Local Health District (Respondent) Representation: Peter Condon & Associates (Applicant) Crown Solicitor's Office (Respondent) File Number(s): 1410188 reasons for decision 1The application relates to a request from the Applicant under the Privacy and Personal Information Protection Act 1998 ("the PPIP Act") and the Health Records and Information Privacy Act 2002 ("the HRIP Act") for (i) access to personal health information held by the Sydney Local Health District ("the SLHD") and (ii) de-identification of personal health information held by the SLHD. 2It is common ground that the SLHD is and was at all relevant times a health service provider within the meaning of section 4 of the HRIP Act. The Applicant has been a patient of the SLHD. She is also an employee of the SLHD. 3In these reasons the names of private individuals, and other information which might identify them, have been anonymised so as to preserve the privacy of their personal affairs. I have also limited my discussion of some issues in order to preserve the privacy of their personal affairs. In these reasons the Applicant is referred to as BGQ. 4It is the de-identification of BGQ's health information that is the subject of these proceedings. BGQ requested that her health information be de-identified in order to ensure her anonymity. She sought: "Remove all personal identifying details (such as name, phone number, address etc) from existing and future records held by SLHD, whether electronic or hard copy. Documents containing personal health information would only contain the Medical Record Number (MRN) as an identifier, akin to what happens in research, whereby a participant is provided with a research ID and documents do not contain any personal identifying details". 5The SLHD completed an internal review and declined to de-identify BGQ's records in the manner that she requested. However, the internal review report recommended that BGQ be offered a "two MRN system" to address her concerns regarding unauthorised access to her health information. The effect of this system would be that a person who entered BGQ's details into the SLHD's electronic records system would be presented with a second MRN which would not contain any of her medical records but would include a warning about unauthorised access and would provide the MRN that contains her medical records. 6BGQ was not satisfied with the determination and applied to this Tribunal for external review. In her application to the Tribunal she set out the following grounds for the application and indicated the orders that she is seeking: I am seeking to have MRN 2 and Name removed from the instructions held in MRN 1. SLHD has attempted to find a solution to protect my identity and prevent unauthorised access to my medical records and information. Their proposal involves the allocation of two medical record numbers, which are linked. One (MRN 1) which has instructions ... and which is "retrieved" if my real name is entered into the IT system; and one (MRN 2) which is given a "code" and "hidden" and which contains my medical history ... I believe it is reasonable for a person wishing to access my personal health information via the "identified" MRN 1 to be instructed to seek further information from the Medical Records department rather than being directly provided with the "de-identified" MRN 2 within the MRN 1. The system reflected in the consent form allows access to my personal health information without my consent and I am seeking to have MRN 2 and Name removed from the instructions held in MRN 1. In this way my electronic medical records (eMR) will be protected from unauthorised access (intentional or unintentional) in the same way that my paper medical records are currently protected in the security of the Medical Records department. My eMR contain highly sensitive data, I work at a number of SLHD facilities and I am related to a member of staff who is known to members of the SLHD Executive. 7In regard to the instructions for accessing the second record, BGQ explained that a specific message is placed in MRN 1 to advise that the clinical information for the patient has been secured and what to do to obtain clinical information - for example, clinicians need to contact the Medical Records Department at their hospital for further information. 8It appears that the order sought is an amendment to the message placed in MRN 1. 9The SLHD has raised a preliminary issue regarding the Tribunal's jurisdiction to deal with this application. Solicitors for the SLHD have provided written submissions in regard to the application for dismissal of the proceedings on the basis that the Tribunal does not have jurisdiction to deal with the application or alternatively that the application is misconceived or lacking in substance. BGQ has not provided any submissions in regard to the SLHD's application. Jurisdiction of the Tribunal 10Section 53 of the PPIP Act provides that a person who is aggrieved by the conduct of a public sector agency is entitled to an internal review of that conduct. The type of conduct that is subject to review is that set out in section 52 of the PPIP Act which provides: 52 Application of Part (1) This Part applies to the following conduct: (a) the contravention by a public sector agency of an information protection principle that applies to the agency, (b) the contravention by a public sector agency of a privacy code of practice that applies to the agency, (c) the disclosure by a public sector agency of personal information kept in a public register. (2) A reference in this Part to conduct includes a reference to alleged conduct. 11The primary issue raised by the SLHD is whether BGQ's request for internal review under section 53 of the PPIP Act identified any conduct by the SLHD that constitutes a contravention or alleged contravention of any of the Health Privacy Principles ("HPPs") of the HRIP Act or of any of the Information Protection Principles ("IPPs") of the PPIP Act or any applicable privacy code of practice within the meaning of section 52(1) of the PPIP Act. 12The SLHD contends that the Tribunal does not have jurisdiction to hear or determine the application for review. In support of that contention the SLHD relies on the following: (1)Section 53(1) of the PPIP Act allows a person to apply to an agency for review of certain conduct. The Tribunal's jurisdiction arises under section 55(1) of the PPIP Act, which provides that if a person who has made an application for internal review under section 53 of the PPIP Act is not satisfied with the findings or the action taken by the agency, the person may apply to the Tribunal for an administrative review of the conduct that was the subject of the application. (2)Section 52 of the PPIP Act relevantly provides that Part 5 (which includes sections 53 and 55) applies to the types of conduct referred to above. (3)By reason of section 21(1) of the HRIP Act, Part 5 of the PPIP Act also applies to the contravention, or alleged contravention, of a HPP or health privacy code of practice. (4)There is no requirement for an applicant to identify the precise contravention on which he or she relies. If the contravention is not specified, it is up to the agency, or the Tribunal, to identify the relevant contravention with the assistance of the applicant: GL v Director General, Department of Education & Training [2003] NSWADT 166 at paragraph [26]. (5)However, the applicant for review is required to identify the conduct of the public sector agency that he or she alleges breaches the PPIP Act. The conduct must be relevant conduct for the purposes of section 52(1) of the PPIP Act since that is the only conduct that the agency or Tribunal can review: GL v Director General, Department of Education & Training at [26]; JD v Director-General, NSW Department of Health [2004] NSWADT 7 at [38]. (6)Judicial Member Higgins described the jurisdiction of the Tribunal as follows in NZ v Commissioner of Police [2007] NSWADT 132 at [22]: "...the tribunal's jurisdiction to hear and determine an application for review under the Privacy Act arises under s 53(1) of the Privacy Act... that jurisdiction is to review 'conduct' that falls within s 52(1) of that Act, including conduct that contravenes an IPP [here, a HPP] as set out in the Act (i.e. 'relevant conduct'). Furthermore, a pre-requisite to the tribunal's jurisdiction is that the applicant has sought internal review of 'relevant conduct' 13The SLHD submits that at its highest, the allegations of conduct contained within the application for internal review might be seen as an allegation that the SLHD: (a)declined to anonymise BGQ's past health records; and (b)declined to provide assurances about the anonymisation of BGQ's future records. 14The SLHD further submits that the only HPPs that could conceivably be relevant are HPP 13 and, to a lesser extent, HPP 8 and HPP 2. 15HPP 2 provides: 2 Information must be relevant, not excessive, accurate and not intrusive An organisation that collects health information from an individual must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that: (a) the information collected is relevant to that purpose, is not excessive and is accurate, up to date and complete, and (b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates. 16HPP 8 provides: 8 Amendment of health information (1) An organisation that holds health information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the health information: (a) is accurate, and (b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading. (2) If an organisation is not prepared to amend health information under subclause (1) in accordance with a request by the individual to whom the information relates, the organisation must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought. (3) If health information is amended in accordance with this clause, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the organisation. Note : Division 4 (Amendment of health information) of Part 4 contains provisions applicable to private sector persons in connection with the matters dealt with in this clause. Amendment of health information held by public sector agencies may also be able to be sought under the Privacy and Personal Information Protection Act 1998 . (4) An organisation is not required to comply with a provision of this clause if: (a) the organisation is lawfully authorised or required not to comply with the provision concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998). 17HPP 13 provides: 13 Anonymity Wherever it is lawful and practicable, individuals must be given the opportunity to not identify themselves when entering into transactions with or receiving health services from an organisation. Submission in regard to HPP 2 18The SLHD submits that it has not collected information in a way that has intruded to an unreasonable extent on BGQ's personal affairs. It argues that its records simply contain accurate information that identifies BGQ. It submits that this conduct is not in breach of HPP 2. Submission in regard to HPP 8 19The SLHD submits that HPP 8 is irrelevant to the present application because BGQ has not alleged that any of her health records are inaccurate. Submission in regard to HPP 13 20The SLHD submits that HPP 13 provides the opportunity for a person not to identify themselves but that the opportunity arises at the time that the person enters into a transaction or when the person receives health services. The SLHD submits that HPP 13 does not confer any right on a person who has previously presented using his or her name to seek subsequently to have those records anonymised. Nor does it confer a right on a person to seek a prospective determination from an organisation about whether, at some unknown time in the future, that person will be treated anonymously when entering into transactions or receiving health services from the organisation. 21The SLHD further contends that the question of whether a person can be given services or enter a transaction anonymously will depend on the particular type of treatment or service that the person seeks. For instance, it is unlawful to provide Medicare benefits and prescription drugs to a person without obtaining his or her name. It follows that an assessment of whether it is lawful or practicable to provide services anonymously can only be made at the time that the person is entering the transaction or receiving the service. 22The SLHD relies on decisions in Wykanak v Department of Local Government-[2002] NSWADT 208 and ON v Marrickville Council [2005] NSWADT 274 in support of its submission that the 'plain meaning of section 52 of the PPIP Act is that the conduct in issue must have occurred at the time of the application. Possible future conduct is not covered. 23In Wykanak Deputy President Hennessy stated at paragraph [17] - [18]: 17 The conduct Mr Wykanak complained of was conduct which he assumed may occur in the future. The plain meaning of s 52 is that the conduct must have occurred at the time of the application. Possible future conduct is not covered. There is no reference to an intention to commit future acts. Consequently, the conduct about which Mr Wykanak complained is not covered by any of the matters listed in s 52 of the PPIP Act and the Tribunal does not have jurisdiction to review it. 18 ... That conduct occurred after the date he lodged his application with the Director General and before the internal review was conducted. ... the conduct referred to in Part 5 of the PPIP Act, is the conduct complained of, not conduct which occurred subsequently. The Director General did not review that conduct. Whether or not he did so is irrelevant because, neither he, nor the Tribunal, had power to do so. 24In ON v Marrickville Council I stated at paragraphs [31] - [32]: 31 In order to determine the issue of whether ON is a person aggrieved for the purposes of the Privacy Act it is necessary to determine whether the drafting and use of the LEP is 'conduct' for the purposes of the Privacy Act. 32 ON asserts that the inclusion of 'alleged conduct' within the meaning of 'conduct' provides the basis for a complaint about conduct that would involve a breach of the Privacy Act without the need for the conduct to have actually taken place. I do not agree with this submission. In my view, the provision is intended to permit an individual to seek review of conduct where the individual has reason to believe that some conduct has occurred in breach of the Privacy Act but they have insufficient knowledge of an agency's actions to identify specific conduct. This situation may arise for example where an individual becomes aware of a document containing personal information that was produced by an agency and apparently disclosed to a third party, but the individual has no knowledge of the agency's actions in disclosing the personal information. In such a case the individual can only refer to 'alleged conduct' as they have no knowledge of what actually took place. In my view, the provision is not intended to allow an individual to seek review of anticipated conduct. An applicant will only have standing to make a complaint or to bring proceedings before the Tribunal if they are able to point to some conduct or alleged conduct that falls within the section 52 definitions. Submission in regard to Applicable privacy code of practice 25The SLHD submits that the only applicable privacy code of practice is the Health Records and Information Privacy Code of Practice 2005, which does not contain any relevant provisions. The orders the Tribunal can make 26The SLHD submits that even if the Tribunal were to identify reviewable conduct, it only has power to make the orders specified in section 55(2) of the PPIP Act. That section provides: (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. 27The SLHD submits that the application is misconceived in that the Tribunal would not have power to grant the relief that BGQ seeks. Submissions on Dismissal 28BGQ's request for internal review was couched as a request pursuant to HPP 13. The SLHD submits that the request does not concern relevant conduct, being a breach or alleged breach of any HPP or privacy code of practice. It follows that the application for review does not enliven the Tribunal's jurisdiction. 29The SLHD further submits that even if the Tribunal is satisfied that it has jurisdiction, then the proceedings should be dismissed on the basis that the application is "misconceived" or "lacking in substance" pursuant to section 55(l)(b) of the Civil and Administrative Tribunal Act 2013 or section 52(1) of the HRIP Act. 30Those provisions allow the Tribunal to dismiss an application if it is satisfied that the proceedings are frivolous, vexatious, misconceived or lacking in substance. In addition, section 52(1) of the HRIP Act confers a power on the Tribunal to dismiss an application if it is satisfied "for any other reason the complaint should not be dealt with". Discussion 31I agree with the Respondent's argument regarding the Tribunal's jurisdiction. It is clear from the material before me that the internal review application has not raised any allegation of breaches of either HPPs or IPPs. As Judicial Member Higgins noted in NZ v Commissioner of Police, the Tribunal's jurisdiction is to review 'conduct' that falls within section 52(1) of the PPIP Act. A pre-requisite to the Tribunal's jurisdiction is that the applicant has sought internal review of 'relevant conduct'. The purpose of this provision is to provide the agency with the opportunity to address an applicant's concerns before external review is sought. 32In this matter there is no suggestion that the SLHD has engaged in conduct that is in breach of the legislation. Similarly there is no suggestion of a breach of any privacy code of practice. At its highest, BGQ is seeking to prevent future breaches of the HPPs. However, as noted above, BGQ only has standing to bring proceedings before the Tribunal if she is able to point to some conduct or alleged conduct that falls within the section 52 definitions. 33In my view, BGQ does not satisfy the requirement of section 53 of the PPIP Act in that she is not a person who is aggrieved by the conduct of a public sector agency. The conduct of which she complains is not 'conduct' of the type that falls within the meaning of that expression provided by section 52 of the PPIP Act. 34That being the case, this Tribunal does not have the jurisdiction to hear and determine this matter. Accordingly it should be dismissed. 35If I am wrong on that issue, I note that I also agree that the orders that BGQ seeks are not orders that the Tribunal can make under section 55(2) of the PPIP Act. Therefore, the application must fail. The application is misconceived in that the Tribunal would not have power to grant the relief that BGQ seeks. 36My view is that the application should be dismissed for want of jurisdiction, or alternatively it should be dismissed on the basis that it is misconceived or lacking in substance. Order The Application is dismissed. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 20 October 2014