Civil and Administrative Tribunal New South Wales Medium Neutral Citation: AOZ v Rail Corporation NSW [2014] NSWCATAP 76 Hearing dates: 2 May 2014, 24 June 2014 Decision date: 05 November 2014 Jurisdiction: Appeal Panel Before: Acting Judge K P O'Connor, AM, Deputy President S Montgomery, Senior Member M Bolt, General Member Decision: 1.The appeal is extended to the merits in relation to the issue of whether the respondent complied with Health Privacy Principle 4 in respect of the collection of the appellant's medical and related records from treating practitioners. 2.The Appeal Panel finds that the respondent failed to comply with HPP 4(2). 3.The appeal is to be listed for directions in relation to the hearing and determination of any order in light of this finding. 4.The appeal is otherwise dismissed. Catchwords: PRIVACY OF HEALTH INFORMATION - Collection, use and disclosure of employee's health information in connection with a workers compensation claim - whether compliance with Health Privacy Principles - application for review of conduct dismissed - appeal - whether errors of law - findings as to compliance with HPPs 1, 2, 10 and 11 ones of fact - whether compliance with HPP 4, governing notices as to collection practices and related matters - Tribunal erred in law - appeal extended to merits - finding of non-compliance by organisation. Health Records and Information Privacy Act 2002. Legislation Cited: Administrative Decisions Tribunal Act 1997 Civil and Administrative Tribunal Act 2013 Health Records and Information Privacy Act 2002 Cases Cited: - Texts Cited: European Union, Directive on the Protection of Individuals with regard to the Processing of Personal Data and on the Free Movement of such Data, 1995 OECD Guidelines on the Protection of Privacy and Transborder Data Flows, 1980 Category: Principal judgment Parties: AOZ (Appellant) Rail Corporation NSW (Respondent) Representation: In person (A) C Mantziaris (R) Spark Helmore (R) File Number(s): AP 14/46278 Decision under appeal Jurisdiction: 150001 Citation: AOZ v Rail Corporation NSW [2013] NSWADT 279 Date of Decision: 2013-12-04 00:00:00 Before: Naida Isenberg, Judicial Member File Number(s): 133037 reasons for decision 1This appeal concerns practices by an employer and self-insurer, Rail Corporation NSW (RailCorp), in connection with the management of personal health information of a claimant for workers compensation. 2RailCorp is bound by the Health Records and Information Privacy Act 2002 (HRIPA). HRIPA provides, s 21, that complaints relating to public sector agencies that are subject to HRIPA are to be handled in the way provided in the Privacy and Personal Information Protection Act 1998 (PPIPA). Accordingly the appellant applied on 16 November 2012 to RailCorp for an internal review of conduct that she considered may have breached various obligations imposed by HRIPA. She and RailCorp were in dispute at the time over a claim she had made for continuing compensation based on alleged exacerbation of a work-related injury. 3In its internal review report dated 23 January 2013, RailCorp found that it had not breached any of its obligations under HRIPA. The appellant then applied, under s 55 of PPIPA, for review of RailCorp's conduct by the Tribunal. The Tribunal dismissed her application. She now appeals against the Tribunal's decision. 4Because the decision under appeal was made by the former Administrative Decisions Tribunal, the appeal is one that is governed by the provisions relating to appeal then in force, in particular Administrative Decisions Tribunal Act, s 113. See further, Civil and Administrative Tribunal Act 2013, Sched 1 cll 9(1)(c), 9(2) and 10. 5Accordingly, an appeal may be made on a 'question of law' as of right, and may, with the leave of the Appeal Panel, extended to the merits. 6The appeal was lodged on 3 January 2014, and used, appropriately, the old ADT appeal form. The appellant does not have legal representation. The form was not completed with clarity as to whether a question of law appeal was being pressed, or whether the matters raised in the notice of appeal only went to the merits, for which leave was required. The case has proceeded on the basis that it is an appeal that seeks to raise questions of law, and seeks leave to extend the appeal to the merits. Background 7As previously noted, the conduct of which the appellant complains arose in connection with a workers compensation dispute between her and her then employer, RailCorp. 8She commenced work with RailCorp in January 2004 as a transit officer. She was injured in the course of her work on 27 August 2004, suffering a back injury while she and other transit officers were trying to apprehend a man who was causing a disturbance at a railway station. RailCorp accepted liability provisionally for that injury. She returned to work on 13 September 2004, and continued to experience back pain. In August 2005, she transferred to a different position, that of an occupational health and safety officer. She continued to suffer from back pain. RailCorp disputed ongoing liability, though, on several occasions, after review, it decided to reinstate her claim provisionally, and continued to make weekly payments for ongoing treatment expenses. 9As noted earlier, RailCorp is a self insurer. On 15 December 2011 it issued a notice under s 74 of the Workplace Injury Management and Workers Compensation Act 1998 (WIMWC Act) formally disputing the claim her claim for injury to the lumbar spine sustained on 27 August 2004 made pursuant to the provisions of the Workers Compensation Act 1987 (WC Act), and provided a summary of its reasons. In September 2012 the appellant commenced proceedings for an expedited assessment in the Workers Compensation Commission (WCC). A conciliation/arbitration conference was held before an arbitrator (Mr B Batchelor) on 11 June 2013. 10RailCorp submitted that she suffered from a back condition (a degenerative condition at her L4/5 spine) that pre-existed the event of 27 August 2004, and that the various exacerbations that had occurred to her condition from 2004 onwards were as a result of activity engaged in at that time and not related to the injury of 27 August 2004. It submitted that the effects of the 27 August 2004 injury had ceased by the end of 2005. In support of its case, RailCorp referred to clinical notes from 1999, and assessments made by doctors to whom it had referred the appellant. 11On 27 June 2013 the WCC issued its determination. The WCC found that she had since 27 August 2004 suffered from exacerbations of back pain as a result of injury to her lumbar spine on that date, and continued to suffer from the effects of that injury. The WCC granted her application for a cost of treatment and expenses order under s 60 of the WC Act. She left RailCorp in 2013. 12HRIPA requires organisations to observe a series of Health Privacy Principles (HPPs) in the way it handles health information. RailCorp is an organisation within the meaning of the Act. The Tribunal was satisfied that RailCorp had complied in relation to the conduct raised with the five HPPs in issue before it, HPP 1, 2, 4, 10 and 11. 13HPP 1 limits the purposes of collection of health information by organisations. HPP 2 requires organisations to ensure that information that is collected is relevant, not excessive, accurate and not intrusive. HPP 4 places obligations on organisations to ensure that individuals whose health information is collected are made generally aware of a range of matters relating to the agency's practices. HPP 10 places constraints on the use of health information other than for the primary purpose for which it was collected, with it being permissible to use health information for a secondary purpose in specified circumstances, one of which is where the individual has given consent to the secondary purpose. HPP 11 places similar constraints on the disclosure of health information to other organisations and bodies. 14Original Complaint in relation to breach of HRIPA. In her original complaint to RailCorp over the handling of her health information, she noted that she had become aware of the conduct that concerned her from material received from her workers compensation solicitors on 25 September 2012 that showed that RailCorp had approached two medical centres where she had been a patient and asked for her complete medical history (Warringah Mall Medical Centre where she was a patient until 2009; Dee Why Grand Medical Centre, 2010-2012). She learnt that RailCorp had provided the medical centres with a form bearing her signature as proof of her consent. Her complaint in essence was that the making of requests for her medical history were general in scope and went beyond the specific issue of her back condition and that the consent relied upon was not a consent that should have been relied upon for that purpose. 15Further Matter. Before the Tribunal a second matter was canvassed. RailCorp provided many of the records that it had obtained from the medical centres to the WCC in connection with its hearing. She raised her objections with the WCC. She claimed that the records had been collected on the basis of an inapplicable consent, and that they should be destroyed and not used for the purposes of the hearing. Pre-hearing directions were made in relation to these concerns by the WCC on 13 February 2013. The Appeal 16We indicated to parties during submissions on the first hearing date (confined to a two hour session), 2 May 2014, that we were concerned about the Tribunal's treatment of the question of compliance with HPP 4; and considered that its reasons were unsatisfactory. We invited further submissions from RailCorp on the issue. In effect, we extended this aspect of the hearing to the merits. We were unable to complete the hearing that day, and resumed on 26 June 2014. 17In the reasons that follow we will first deal with the issues raised in relation to the Tribunal's rulings that RailCorp complied with HPPs 1, 2, 10 and 11. We have dismissed the appeal as it relates to HPPs 1, 2, 10 and 11. We will deal separately with the issues raised in relation to RailCorp's compliance with HPP 4. Obtaining Private Medical Records from Subject's Treating Doctors 18This is the matter that was the subject of the original complaint. The Tribunal noted in its reasons that the medical records collected by RailCorp were 330 pages in length (the appellant at hearing put the number at 374 pages). The Tribunal noted that in the appellant's opinion much it was highly personal, highly sensitive and confidential in nature, and had no bearing at all on the claim. This caused her, she said, considerable stress and led to a breakdown of her relationship with her treating doctor. 19She said that had she known of the requests for her medical information she would have objected to the width of the request and any possible release. She referred to the stricter position that applies when subpoenas are issued. These comments are relevant to the HPP 4 issue which, as noted, we deal with separately below. 20On 18 April 2012, RailCorp sent identical letters to the appellant's current nominated medical practitioner at the Dee Why Grand Medical Centre, and to the practice that she had attended prior to 2009, the Warringah Mall Medical Centre. 21The letters were in common form. They commenced by referring to her workers compensation claim, the date of the injury and made the following request: This matter is the subject of a workers compensation claim. In order that we may properly manage the claim, it will be appreciated if you please provide a copy of your medical records in respect of your treatment of the worker, commencing from the date the worker first attended your clinic in respect to any illness or injury. The documents should include, but are not limited to, clinical notes (handwritten or typed), correspondence, letters of referral to and from other medical practitioners, letters/reports to and from other medical practitioners, radiology test reports, diagnostic test reports, pathology test reports and medical certificates. We herewith enclose a copy of the Worker's Consent dated NSW [sic] authorising their treating medical practitioners to release information to us. 22The enclosed 'worker's consent' consisted of the authorisation that appears at the foot of the WorkCover NSW Medical Certificate that had been signed by the appellant on 23 November 2011. The authorisation stated: I confirm the information I have given is correct; I nominate [name of doctor, and address] as my Nominated Treating Doctor. I consent to my Nominated Treating Doctor, my employer, the insurer, other treating practitioners, rehabilitation providers and WorkCover NSW exchanging information for the purposes of managing my injury and workers compensation claim. I understand this information will be used by WorkCover and insurers to fulfil their functions under the workers compensation legislation. 23The form named the appellant's then current treating doctor at Dee Why. RailCorp relied on the reference to 'other treating practitioners' as providing consent to obtain records from her previous treating doctors at Warringah. In its internal review report RailCorp noted that the letters of 18 April 2012 were the last in a series of letters seeking information in relation to her back condition. 24HPPs 1 and 2: HPPs 1 and 2 provide in full: 1 Purposes of collection of health information (1) An organisation must not collect health information unless: (a) the information is collected for a lawful purpose that is directly related to a function or activity of the organisation, and (b) the collection of the information is reasonably necessary for that purpose. (2) An organisation must not collect health information by any unlawful means. 2 Information must be relevant, not excessive, accurate and not intrusive An organisation that collects health information from an individual must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that: (a) the information collected is relevant to that purpose, is not excessive and is accurate, up to date and complete, and (b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates. 25The reviewer noted that the consent was expressed to be for the purpose of managing the signatory's injury and workers compensation claim. She noted that in that signed certificate referred under point 2 to 'Medical Certification, Diagnosis: L4/5 disc injury'. She referred to earlier letters to the medical centres, which had produced medical information that indicated the appearance of a back related condition that preceded the date of injury and stated that this information, 'necessitating a wider request to obtain further information considered highly relevant to the assessment of the claim.' The reviewer considered that the collections were necessary for the purpose of RailCorp fulfilling its insurer functions under the NSW workers compensation legislation, and therefore HPP 1 was not infringed. 26As to the HPP 2 question, the reviewer referred to the scope of the authorisation given by the signed certificate and also to the authorisation given by her soon after the injury. The authorisation provided by her on 28 August 2004 stated: I claim workers' compensation pursuant to [the WC Act] ..., and I authorise the Compensation Section of [RailCorp] to obtain such reports and details of my injury, its treatment, therapy and rehabilitation, and any other condition which restricts or inhibits my returning to normal classified duties, from my treating doctors, treating specialists, hospitals, clinics, and from whomsoever I receive treatment, therapy, surgery, medical attention or rehabilitation for this and any related injury or condition. 27While the reviewer considered that the authorisations relied upon were sufficient to justify the collection of the clinical records, she did state: However, I am of the view that the words contained in the second paragraph of RailCorp's request letter should be amended to include specific reference to the particular injury/illness to which the claim relates. Such amendment would ensure that all records relevant to the claim and management of the injury/illness are provided. 28The appellant sought to draw on this concession to argue that it amounted to an admission that HPP2 had not been met by the organisation. 29The Tribunal was satisfied that RailCorp had complied with HPP 1 and HPP2, and said in conclusion on the HPP 2 issue: 21 The internal review of the present matter recommended amendments to the Respondent's correspondence to doctors to "include specific reference to the particular injury/illness to which the claim relates". The Applicant complained to Privacy Commissioner ('OPC') the about the breadth of the request to the doctors. The OPC considered that the request for health information had not been not limited to what was relevant and invited disclosures that are significantly wider than what the Guidelines (discussed below) authorise. I consider this to be an unduly narrow interpretation that does not take into account the Respondent's overall responsibilities in assessing a claim. I accept that without all of the clinical notes, there would be little or no information available to the Respondent in assessing the Applicant's claim regarding other conditions which could have the same symptoms but not be work-related. 22 I find that the purpose of the collection of the Applicant's health information was to manage her workers compensation claim in accordance with the WC Act and WIMWC Act. I accept that it was necessary for RailCorp to review AOZ's complete history to determine if the 2011 back pain was due to the 2004 injury or some another condition. 30The appellant challenged the Tribunal's conclusion that the collection was for a lawful purpose, and referred to s 270 of WIMWC Act. 31This provision deals with the obligations of an insurer who commences weekly payments, and allows the insurer to require from the worker a medical certificate as to the worker's incapacity for work and a form of authority authorising providers of medical services and treatment, and rehabilitation services, and the like 'to give the insurer information regarding the treatment or service provided or the worker's medical condition or treatment relevant to the injury'. 32She submitted that the 2011 certificate on which RailCorp had relied was issued under s 270, and did not comply with it. She argued that s 270 confined the meaning of 'injury' to the harm she suffered on 27 August 2004. She submitted that it did not supply an authority for the global requests that the letters of 18 April 2012 made. She expressed concern that aspects of her health history which she saw as having no bearing on the workers compensation dispute, and no tenable connection had been made known to RailCorp and the WCC. Further, even if HPP1(a) ('lawful purpose' etc), HPP 1(b) was not met, in that the wider collection was not 'reasonably necessary' for that purpose. 33It will be seen that the terms of both HPP 1(a) and (b) are broad. The language of both provisions is simple, and the task required of the Tribunal is essentially to make findings of fact. The Tribunal engaged in the task required of it. 34The Tribunal was not bound in the strict way suggested by the appellant's submissions to limit its consideration to the terms of s 270 of the WIMWC Act. The determination of the 'lawful purpose' of an organisation allows for a broad examination of the circumstances of the case, and a consideration of the usual obligations of the organisation in the particular context, here an organisation that is both the employer and the insurer, dealing with the management of a workers compensation claims. There was evidence that the appellant had a degenerative back condition that predated the injury. The WCC in its determination accepted that she had been consistent and open throughout in her dealings with WorkCover in relation to the issue. The WCC's reasons noted that she had received treatment going back to 1993. However, contrary to RailCorp's case, it did not accept that the degenerative condition had given rise to back pain prior to the event of 27 August 2004. 35The Tribunal found, in essence, that RailCorp had as its lawful purpose the management of the claim, and that the broad collection of prior treatment records was justified given the doubt RailCorp reasonably held as to the whether the ongoing condition was attributable to the workplace injury or attributable to a private health condition unrelated to the event that resulted in the injury. This is a commonplace issue in workers compensation administration. The Tribunal's findings are ones of fact, only capable of disturbance as errors of law on very narrow grounds. The same applies in relation to the Tribunal's conclusion that the collection was 'reasonably necessary' for the purpose. 36In its reasons at [23]-[33] the Tribunal considered the appellant's submission in relation to the validity of the consent. It did not explain to which HPPs it saw the issue as relevant. HPPs 1 and 2 do not refer expressly to the issue of subject consent. They focus on the lawfulness of the purpose for which information is collected, the lawfulness of the means used and the scope of the collection. The absence of consent might go to lawfulness, but that would depend on the circumstances of the case, and the power under which the organisation has acted to collect the information. 37In her submissions appellant also drew support for her criticisms of the way in which consents given by her in 2004 and 2011 had been used from the changes that RailCorp had now made in relation to the texts of the authorisations and consents it obtain. She said that as a result of a WorkCover investigation of what had occurred in her case, RailCorp was directed to change its letters of request and consent forms. These concerns, along with some others, are outlined by the Tribunal at [9] and [10] of its reasons. 38While subject consent is not a matter directly referred to in HPPs 1 and 2, it is directly referred to in HPPs 4, 10 and 11. 39In responding to the appellant's case that the authorisations she had given were invalid, the Tribunal expressly related its findings to HPPs 10 and 11. The Tribunal stated: 31 In her statement Ms Rae [Griffen] wrote that where the notes are provided, this is done under the consent provided by the worker on the claim form and/or the Workers Compensation Medical Certificate issued by the doctor and signed by the worker. The Applicant however claimed that in signing the WorkCover Certificate she did not consent to RailCorp obtaining her full medical files. 32 In the context of the HRIP Act, the consent on the Workcover medical certificate permits the insurer to collect information from the treating doctors and expressly permits the insurer to use that information to fulfil its functions under the legislation. I have found that it was necessary for RailCorp to review AOZ's complete history to determine if the 2011 back pain was due to the 2004 injury or some another condition and that the purpose of the collection of that information was to manage her workers compensation claim in accordance with the WC Act and WIMWC Act. By signing the consent on the medical certificates, Applicant consented to RailCorp collecting, using and disclosing that information for the purpose of managing her claim and injury. 33 I find that AOZ provided her consent to the collection, use and disclosure of her health information for the purposes of managing her workers compensation claim on three Workcover medical certificates issued in 2011. In addition, as she was claiming that the back pain was due to the compensable injury she had in 2004, the Respondent was entitled to rely on the consent she provided in the 2004 claim form. 40The appellant reiterated on appeal her arguments that the authorisations given in the certificates and the declaration did not authorise the extent of collection that occurred on this occasion. In our view, the Tribunal was engaged in making findings of fact on these points and no error of law arises. 41HPP 10: HPP 10 provides first: 10 Limits on use of health information (1) An organisation that holds health information must not use the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless: 42It then specifies a number of exceptions, the ones possibly relevant to this case being: (a) Consentthe individual to whom the information relates has consented to the use of the information for that secondary purpose, or (b) Direct relationthe secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose, or Note. For example, if information is collected in order to provide a health service to the individual, the use of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. 43In the internal review report, the RailCorp reviewer concluded that that the information it had obtained from the two medical practices had been used for the primary purpose of its collection, i.e. that is to fulfil the insurer's functions under workers compensation legislation. The reviewer did not concede that the information was used for a secondary purpose, relying in this instance of RailCorp's dual status in relation to workers compensation claims of being the employer and the (self) insurer. 44As already noted the Tribunal found that the consent exception applied in any case. 45At [37] and [38] the Tribunal upheld RailCorp's primary claim that the information collected was used for its primary purpose, to which consent is not applicable. It stated: HPP 10: USE OF HEALTH INFORMATION 37There was no evidence that RailCorp used the clinical notes other than for the purpose of determining AOZ's aggravation claim and asserting its position before the Commission. 'Disclosure to the Commission' is discussed below. 38I find that the health information which is the subject of the Applicant's complaint was only used by RailCorp for the purpose for which it was collected, that is, in connection with her 2011 workers compensation claim. 46RailCorp's evidence in the case included detailed affidavits from two senior case managers, first, Ms Griffen, who explained the case management process for claims seen as problematic and where there is a history that may point to a cause not connected to the workplace; and secondly from Ms Hobson (formerly Faulks), who referred in detail to the history of this case, and the communications with treating doctors, the provision of material to the WCC, and the return of documents. 47The Tribunal had evidence before it on the issue to which HPP 10 is addressed. Its findings, above, are to be read in conjunction with that evidence. It was open to it to find as it did, and the points we made in relation to the findings with respect to HPPs 1 and 2 apply. There is no error of law. Providing all records obtained to Workers Compensation Commission 48HPP 11: HPP 11 provides first, like HPP 10: 11 Limits on disclosure of health information (1) An organisation that holds health information must not disclose the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless: 49It then specifies a number of exceptions, the one possibly relevant to this case being: (a) Consentthe individual to whom the information relates has consented to the disclosure of the information for that secondary purpose. 50The Tribunal said: HPP 11: DISCLOSURE OF HEALTH INFORMATION 39 The alleged breach of HPP 11 is that RailCorp disclosed AOZ's clinical notes to the Commission. Under the WIMWC Act, the objectives of the Commission include "providing a fair and cost effective system for the resolution of disputes under the Workers Compensation Acts": s.367 of the WIMWC Act. 40 RailCorp had used information from the clinical notes in reaching its decision and internal review. As a result, it was obliged to provide all of those notes to the Commission and to AOZ's solicitors as part of the Workers Compensation proceedings. In that way, both the Commission and the Applicant's solicitors would be clear as to what information RailCorp had relied on in reaching its decisions. The Applicant provided a copy of a letter from her solicitors that indicated that they had previously been unaware of some of the documents, including clinical notes from Drs Roseth and Artinian. With respect, that seems to me to be more a reflection upon her solicitor's preparation and/or the Applicant's candour with her own legal advisers. From the Commission's decision the Applicant had objected, apparently with some vehemence, to the use of some of the documents on the basis of relevance. The parties agreed at a conciliation conference which documents were to be admitted into evidence in the Workers Compensation proceedings with the balance being removed and returned to the Applicant's solicitors for destruction. That course is not unusual. 41 It was not clear what documents remained before the Commission and thereby agreed as being relevant. However, paragraph 29 of the statement of reasons indicates that the Commission had before it clinical notes from Dr Artinian, which RailCorp had relied upon in its argument that AOZ's back pain was due to a degenerative condition and not work-related. The Commission appears to have accepted that there was evidence of AOZ having back problems in 1999 but found there were no references to back pain in the clinical notes between 1999 and the 2004 injury. As mentioned above, the statement of reasons notes the Applicant had a number of instances of acute back pain in the years between the 2004 injury and the claimed aggravation of October 2011. It is unclear from where that information may have been obtained but it is likely to have been referenced in the clinical notes of the Applicant's treating doctors. That information would be likely to have been relevant to the arbitrator's consideration of whether AOZ's back pain was related to the 2004 injury. 42 I find that the health information which is the subject of this complaint was only disclosed to the Commission for the purpose for which it was collected, that is, in the workers compensation proceedings commenced by AOZ. 51As already noted the Tribunal found that the consent exception would have applied in any case. Again, in our view the Tribunal had relevant evidence, and was engaged in a fact-finding process, and our observations in relation to its findings in respect of HPP 1, 2 and 10 apply. There was no error of law. Notice to the Subject of Agency Practices and Rights of Access 52HPP 4: HPP 4 is an important provision in the scheme of privacy and data protection laws. It requires organisations to have practices which make an individual reasonably aware of why it is collecting information, what it does with the information, and what rights the individual has to see and correct that information. It is a notice provision. 53Such a notice "helps promote transparency about an organisation's collection and handling of personal and health information. It also informs individuals about important rights and obligations related to the provision and access to this information" (Victorian Privacy Commissioner, Service Agreement Information Kit for Non-funded Organisations, 3.17.3). Notices of this kind are a key aspect of many laws that seek to promote transparency of organisational practices, and to inform affected persons of their rights including in this instance the right to access any data collected. 54Australia's data protection laws have as their conceptual origin the OECD Guidelines on the Protection of Privacy and Transborder Data Flows, issued 1980 (see Long Title, Commonwealth Privacy Act 1988, No 119, as enacted). The content of those Guidelines was in turn heavily influenced by the work at that time of the European Union - as to which, see now European Union Directive on the Protection of Individuals with regard to the Processing of Personal Data and on the Free Movement of such Data, 1995/46/EC, with a notice standard set out in Article 10. 55HPP 4 deals first with the requirements that apply to a direct collection of information from the individual (HPP 4(1)), and then deals with the requirements that apply to a non-direct collection, a collection from a third party, the case here (HPP4(2)). 56HPP 4 provides: 4 Individual to be made aware of certain matters (1) An organisation that collects health information about an individual from the individual must, at or before the time that it collects the information (or if that is not practicable, as soon as practicable after that time), take steps that are reasonable in the circumstances to ensure that the individual is aware of the following: (a) the identity of the organisation and how to contact it, (b) the fact that the individual is able to request access to the information, (c) the purposes for which the information is collected, (d) the persons to whom (or the types of persons to whom) the organisation usually discloses information of that kind, (e) any law that requires the particular information to be collected, (f) the main consequences (if any) for the individual if all or part of the information is not provided. (2) If an organisation collects health information about an individual from someone else, it must take any steps that are reasonable in the circumstances to ensure that the individual is generally aware of the matters listed in subclause (1) except to the extent that: (a) making the individual aware of the matters would pose a serious threat to the life or health of any individual, or (b) the collection is made in accordance with guidelines issued under subclause (3). (3) The Privacy Commissioner may issue guidelines setting out circumstances in which an organisation is not required to comply with subclause (2). (4) An organisation is not required to comply with a requirement of this clause if: (a) the individual to whom the information relates has expressly consented to the organisation not complying with it, or (b) the organisation is lawfully authorised or required not to comply with it, or (c) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including theState Records Act 1998), or (d) compliance by the organisation would, in the circumstances, prejudice the interests of the individual to whom the information relates, or (e) the information concerned is collected for law enforcement purposes, or (f) the organisation is an investigative agency and compliance might detrimentally affect (or prevent the proper exercise of) its complaint handling functions or any of its investigative functions. (5) If the organisation reasonably believes that the individual is incapable of understanding the general nature of the matters listed in subclause (1), the organisation must take steps that are reasonable in the circumstances to ensure that any authorised representative of the individual is aware of those matters. (6) Subclause (4) (e) does not remove any protection provided by any other law in relation to the rights of accused persons or persons suspected of having committed an offence. (7) The exemption provided by subclause (4) (f) extends to any public sector agency, or public sector official, who is investigating or otherwise handling a complaint or other matter that could be referred or made to an investigative agency, or that has been referred from or made by an investigative agency. 57It will be seen that the obligation in HPP 4(1) is cast in stricter terms than HPP 4(2). Under HPP 4(1) the organisation 'must ... take steps that are reasonable in the circumstances to ensure that the individual is aware [of matters (a) to (f)]. HPP 4(2), the provision relevant to this case states that the organisation 'must take any steps that are reasonable in the circumstances to ensure that the individual is generally aware of the matters listed [in (a) to (f)]', subject to certain qualifications not relevant to this case (emphasis added). 58RailCorp did not rely on any special notice or form that referred to its obligations under HRIPA and gave an itemised account of the matters to which HPP 4 refers. In its internal review report, the reviewer referred to the terms of the consent of 23 November 2011 and two consents of a similar kind during that year. The reviewer also referred the declaration given 28 August 2004. In that respect, she noted the following paragraphs (additional to those we set out earlier in these reasons): I authorise the Compensation Section to release such information as is necessary for the purposes of any rehabilitation or retraining, and I will declare all activities undertaken by me as soon as such are undertaken, including but not restricted to income producing activities whilst I am considered totally or partially incapacitated for carrying out my normal duties, and I acknowledge if I fail to do so [there is reference to the statutory penalty] I acknowledge my obligations under the Act to undertake a return to work program, rehabilitation or retraining, which is more appropriate [and there is a reference to the penalty if not performed]. 59The reviewer did not express any final conclusion on whether the above material met the obligation imposed on RailCorp by HPP 4. 60In its reasons the Tribunal said: HPP 4: MAKING INDIVIDUAL AWARE OF CERTAIN INFORMATION 34 As discussed above, HPP 4 requires, amongst other things, that a person must be told why their health information is being collected, what will be done with it, and who else might see it. HPP 4(4)(a) provides that an organisation need not comply with its obligations under HPP 4 where the person has expressly consented to the organisation not complying with the requirements of the HPP. 35 The Applicant said that RailCorp only informed her solicitor approximately five months after the request and collection of her medical files. Prior to that, she was unaware they had been obtained in their entirety. Further, she contended, the WorkCover medical certificate consent does not support notifying an "injured worker" that an insurer can request, collect and store medical records in their entirety and outside scope of claim, nor does it fulfill functions under WorkCover legislation. 36 AOZ signed the consent on three Workcover medical certificates in 2011 and the 2004 claim form. As a result she did not need to be further advised that RailCorp was collecting the information and RailCorp was not obliged to comply with HPP 4(2). 61It will be seen that the Tribunal relied on HPP 4(a) as excepting RailCorp from its obligation under HPP 4(2), i.e.: (4) An organisation is not required to comply with a requirement of this clause if: (a) the individual to whom the information relates has expressly consented to the organisation not complying with it. 62The Tribunal provides no explanation as to how the authorisations of 2011 or the declaration of 2004 provide an 'express' consent to the organisation not complying with HPP 4(2). 63As noted above, we indicated to the parties on our first session that we regarded the decision in relation to compliance with HPP 4 as unsatisfactory. 64In our view, the Tribunal's ruling in relation to HPP 4 misconstrues the meaning of HPP 4(2)(a). The provision is to be read strictly. It is an exception to an important right. It referred to no evidence that such an express consent had been furnished. Accordingly RailCorp needed to show that its conduct satisfied the requirements of HPP 4(2) itself. 65It is an established rule of statutory construction that where a legislative provision places an obligation on a party and also provides for a distinct exception, or exceptions to that obligation, the onus of proving the exception on the balance of probabilities lies with the person seeking to rely on it: see for example Dowling v Bowie [1952] HCA 63; (1952) 86 CLR 136. 66In the case of HPP 4(1) there is a requirement on an agency to take positive steps to ensure that individuals whose health information is collected are made generally aware of a range of matters relating to the agency's practices. However, HPP 4(2) provides for circumstances in which the agency need not take those steps. If an agency asserts that the circumstances of the matter fall within any one of the exceptions provided, the burden of establishing the exception falls on the agency. Generally, it is not sufficient that the agency merely makes the assertion that the exception applies. It will be necessary that the agency present evidence to prove the exception on the balance of probabilities. If for example, as in this matter, an agency asserts that express consent has been given, it is for the agency to present evidence of that consent. Further Submissions 67The appellant submitted that the principle of prior notice of the third party collections was not observed. She submitted that the WorkCover certificates she had signed do not constitute notices that comply with HPP 4. She contended that had she been informed that requests for all medical records were to flow from the authorisations she had given, she might have been able to seek an explanation, and question the necessity for the action. She drew an analogy with the rights that apply when subpoenas are issued (though the analogy is inexact, in that the right of objection is one conferred on the respondent to the subpoena not the person who may be the subject of the records to which the subpoena relates). She considered that should have provided her with a notice dealing separately with each of the matters (a) to (f). 68RailCorp submitted that while the Tribunal's reasons on this issue were 'scant' the conclusion was not wrong. RailCorp noted, as we have above, that the wording of HPP 4(2) is less strict than the wording of HPP 4(1), the obligation under HPP 4(2) is to make the subject 'generally aware' of the matters to which paragraphs (a) to (f) refer. RailCorp submitted that the circumstances read allowed for a finding of compliance with HPP 4(2). 69As we understand the submission, it is that she knew from the consent she signed that any medical or other health service provider she had seen might be contacted. So as practical matter she knew of the fact of collections from third parties of this kind, and necessarily because of her prior association she knew the 'the identity of the organisation and how to contact it', the matter to which paragraph (a) is addressed. She was not specifically informed by the RailCorp authorisations as to whether she was 'able to request access to the information' (the paragraph (b) matter). On the other hand the records were ones made by her health practitioners about her, and she had a right, in law, to access to them. The submission was that the authorisations met the requirement of paragraph (c) in that their content and the context in which they were provided defined 'the purposes for which the information is collected'. There was nothing in the authorisations addressing paragraph (d), 'the persons to whom (or the types of persons to whom) the organisation usually discloses information of that kind', but the submission as we understood it was that the context within which the material was obtained supplied the answer to that issue, and they were regulated by the practices of the workers compensation jurisdiction. Paragraph (e) was not addressed, but again the material was being obtained pursuant to a legal framework for the assessment, management and determination of claims. Finally, as to paragraph (f) the consequences of non-supply of the information would have been that her claim would not have proceeded as efficiently, and she would have understood that. 70It is apparent that a number of assumptions and conclusions from surrounding circumstances have to be drawn in order to make a finding of compliance with HPP 4(2). In our view, analysis of this degree defeats the protective purpose of HPP 4(2). In our view the provision is one that requires of agencies a practice that clearly addresses the matters, in paragraphs (a) to (f) to the extent applicable and relevant. This was not a situation of an ad hoc event of collection of health information from third parties. It was a routine aspect of this area of administration of RailCorp. There should, in our view, have been a standard notice in place to address the matters to which HPP 4(2) refers. There was not. 71In our view, the matters to which RailCorp referred to do not satisfy HPP 4(2). 72The question then becomes whether one of the exceptions applies to exonerate RailCorp from compliance. For the reasons already given we do not think that the authorisations and consents relied upon, demonstrate that the appellant 'expressly consented' to RailCorp not complying with HPP 4(2). 73The final submission of RailCorp relies on the exception at HPP 4(2)(b), i.e. 'the organisation is lawfully authorised ... not to comply with [a requirement of this clause]' 74RailCorp argued that the practices it followed derived from the requirements of workers compensation law, in particular the two Acts (WCA and WIMWCA) and the WorkCover Guidelines for Claiming Compensation Benefits. We accept that the administration of workers compensation claims occurs within a complex legal framework informed by guidelines and similar instruments. We were provided with a copy of the Guidelines now in force (13 March 2012 edition, replacing the guidelines dated 17 April 2009). While these guidelines lay down a strict scheme of procedure for cases where a s 74 notice has been issued, they do not, in our view, displace the agency's obligation to comply with the requirements of HPP 4. Our attention was not drawn to any provision that prevented RailCorp from complying with HPP 4. 75Our finding is that RailCorp failed to comply with HPP 4(2) by not taking reasonable steps to make the appellant generally aware of the matters listed in sub-clause (1). We should indicate, however and in reply to the appellant's submissions, that we do not regard the failure as a grave one in the circumstances of the case, as for reasons we have given above, some of the matters to which sub-clause (1) refers would, or ought reasonably have been known to her. Other Matters 76The appellant criticised the Tribunal for not dealing with her submissions in relation to compliance with HPP 5, the HPP that obliges organisations to have security, data retention and data disposal practices that meet the standards laid down in HPP 5. This was not a matter addressed by the original review report. RailCorp said that she did not raise it in her submissions to the Tribunal, she disputed that and referred to a part of her submissions where the issue was raised. The basic rule in this jurisdiction is that the parameters of the original complaint set the parameters of the internal review process and similarly the parameters of the external review undertaken by the Tribunal. In this case, as we explained earlier, the parties and the Tribunal allowed to be added to the case before the Tribunal the subsequent issue of the provision of the records to the WCC. We are not satisfied that there was any acceptance that the HPP 5 issue could be added. Therefore we will not deal with this aspect of the appellant's appeal. Disposal of Appeal 77We have made an adverse finding against RailCorp in relation to one aspect of the case. 78We will reconvene for a short hearing to consider an appropriate order. The order-making powers range from an order 'not to take any action on the matter' to a variety of other orders, the most significant of which is an order for monetary compensation for proven financial loss, or proven psychological injury or physical harm because of the conduct of the organisation. See further, PPIPA, s 55. Order 1.The appeal is extended to the merits in relation to the issue of whether the respondent complied with Health Privacy Principle 4 in respect of the collection of the appellant's medical and related records from treating practitioners. 2.The Appeal Panel finds that the respondent failed to comply with HPP 4(2). 3.The appeal is to be listed for directions in relation to the hearing and determination of any order in light of this finding. 4.The appeal is otherwise dismissed. I hereby certify that this is a true and accurate record of the reasons for decision of the New South Wales Civil and Administrative Tribunal. Principal Registrar ******** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 05 November 2014