Civil and Administrative Tribunal New South Wales Medium Neutral Citation: CDV v Illawarra Shoalhaven Local Health District [2016] NSWCATAD 302 Hearing dates: 17 March 2016, 19 May 2016. Date of orders: 21 December 2016 Decision date: 21 December 2016 Jurisdiction: Administrative and Equal Opportunity Division Before: J McAteer Senior Member Decision: (1) The decision of the respondent is affirmed. (2) The Tribunal resolves to take no action in respect of the matter. Catchwords: PRIVACY – Personal Information – Health Information – Conflict of Evidence – Weight of Evidence – Civil Standard – Absence of Evidence of Breach – Possibility of Breach - Legislation Cited: Administrative Decisions Review Act 1997 Children and Young Persons (Care and Protection) Act 1998 Civil and Administrative Tribunal Act 2013 Health Records and Information Privacy Act 2002 Privacy and Personal Information Protection Act 1998 Cases Cited: ALZ v WorkCover NSW [2015] NSWCATAP 138 KO & anor v Commissioner of Police, New South Wales Police (GD) [2004] NSWADTAP 21 BQO v Western NSW Local Health District [2015] NSWCATAD 261 Category: Principal judgment Parties: CDV (Applicant) Illawarra Shoalhaven Local Health District -(Respondent) Representation: Solicitors: CDV (Applicant in person) Crown Solicitors Office (Respondent) File Number(s): 1510544 Publication restriction: Section 64 (1) of the Civil and Administrative Tribunal Act 2013 prohibiting or restricting the disclosure of the name of the applicant and her son or any witnesses whose identities are redacted which might constructively identify those persons. Reasons for decision 1. On 10 September 2015 the applicant filed an application for administrative review with the Tribunal. That application concerned how the respondent had dealt the applicant and her child concerning alleged privacy breaches in dealing with the personal and health information of the applicant. 2. CDV is the applicant's pseudonym, in that the Tribunal has de-identified the applicant's name from any open reasons consistent with the practice of the Tribunal in privacy reviews. This is an application for a review of the conduct of the Respondent Public Sector Agency, which was subject to an Internal Review application under Part 5 of the Privacy and Personal Information Protection Act 1998 (the PPIP Act). 3. As the conduct also involved an alleged breach of the privacy provisions in respect of health information under the Health Records and Information Privacy Act 2002 (the HRIP Act), the review of the conduct under section 21 of the HRIP Act is dealt with under the provisions of the PPIP Act as outlined above. 4. Both the PPIP Act and HRIP Act have provisions for a person who is aggrieved by the public sector agency's management of their personal or health information, to request that the matter be reviewed by the Agency. Background 1. CDV was contacted by a service administered by the respondent on 5 August 2013 and that contact appears to be as a result of a referral. CDV was seeking support services in respect of her school age son. The referral was from another Government Department. In the following months various contacts were made between health service providers and CDV during the second half of 2013. It is both the nature and purpose of the contact, (including the purpose of the contact from the health service's perspective), that is contentious between the parties and gives rise to these privacy proceedings. In addition CDV asserts that matters have arisen subsequent to the 2013 contact and that aspects of those matters create further privacy grievances. 2. In my view it is necessary to indicate that from CDV's perspective, the contact related to the provision of support services for CDV and her son. The applicant characterises what she understood to be occurring in the following manner from submissions and evidence. I expected 'R' (the officer) to turn up with all of the relevant assessments relating to my son and discuss what action to take regarding what I thought my son needed. 1. The context of the interactions or contact between CDV and the support services relate to an entity referred to as the Whole of Family Team or WOFT. From material included in the internal review and evidence and material before the Tribunal it appears that the WOFT provides specialist services to families, and works in partnership with other agencies and entities such as Drug and Alcohol Services, Mental Health Services and the relevant Government Department (Community Services / Family and Community Services). 2. However in CDV's view, the respondent collected other information from her and used this information in a manner that was both unauthorised and in CDV's view inappropriate. As the information was interpreted and put to further use, it invariably came to the attention of further individuals who were (without adjudicating the matters at this stage) apparently acting or operating at either cross or contrary purposes to the applicant's understanding (see paragraph 6 – above). 3. It is in this context that CDV alleges various breaches of personal information and health information arising under the PPIP Act and HRIP Act. History of privacy complaint 1. CDV originally contacted the respondent's Privacy Officer around 1 June 2014 by e-mail and lodged a formal request for Internal Review of her privacy grievance or complaint on 5 June 2014. For reasons explained as staffing and administrative difficulties the Privacy Office position was vacant and CDV's application was only acknowledged on 28 November 2014 almost 6 months after lodgement. 2. As outlined in paragraph 1 (above) the applicant then filed an Application for Administrative Review with the Tribunal on 15 September 2014. That application was filed under section 55 of the PPIP Act which provides for a review of the conduct which was the subject of the application for internal review. 3. Section 53 (6) of the PPIP Act provides guidance on the appropriate timeframes for conducting an Internal Review. Whilst the PPIP Act does not specify a strict time, it uses the words that 'the review must be completed as soon as is reasonably practical'. In addition it provides that if the review is not completed within 60 days, the applicant / complainant may apply to the Tribunal for a review of the conduct concerned. 4. In my view the crucial aspect of any request for a review of conduct is determining what if any conduct occurred, whether that conduct involves personal information or health information as defined in the PPIP Act or HRIP Act, and whether such conduct constitutes (in the first instance) a breach of an Information Privacy Principle (IPP) or Health Privacy Principle (HPP). Finally the reviewer must determine whether there was a relevant exemption in place (either in the legislation or subordinate legislation) which permitted the use of the information in the manner alleged. The alleged conduct 1. The Internal Review application of 5 June 2014 stated the following conduct subject of the review: 'Access to private health information from mental health record and disclosure of this information to make a referral to FACS'. Other matters were ventilated by the applicant once the extent of her concerns were identified by access to health information The relevant legislation 1. The HRIP Act provides the following Health Privacy Principles or HPP's relevant to this matter. 7 Access to health information (1) An organisation that holds health information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information. Note. Division 3 (Access to health information) of Part 4 contains provisions applicable to private sector persons in connection with the matters dealt with in this clause. Access to health information held by public sector agencies may also be available under the Government Information (Public Access) Act 2009 or the State Records Act 1998. (2) An organisation is not required to comply with a provision of this clause if: (a) the organisation is lawfully authorised or required not to comply with the provision concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998). 9 Accuracy An organisation that holds health information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 10 Limits on use of health information (1) An organisation that holds health information must not use the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless: (a) Consent the individual to whom the information relates has consented to the use of the information for that secondary purpose, or (b) Direct relation the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose, or Note. For example, if information is collected in order to provide a health service to the individual, the use of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. (c) Serious threat to health or welfare the use of the information for the secondary purpose is reasonably believed by the organisation to be necessary to lessen or prevent: (i) a serious and imminent threat to the life, health or safety of the individual or another person, or (ii) a serious threat to public health or public safety, or (d) Management of health services the use of the information for the secondary purpose is reasonably necessary for the funding, management, planning or evaluation of health services and: (i) either: (A) that purpose cannot be served by the use of information that does not identify the individual or from which the individual's identity cannot reasonably be ascertained and it is impracticable for the organisation to seek the consent of the individual for the use, or (B) reasonable steps are taken to de-identify the information, and (ii) if the information is in a form that could reasonably be expected to identify individuals, the information is not published in a generally available publication, and (iii) the use of the information is in accordance with guidelines, if any, issued by the Privacy Commissioner for the purposes of this paragraph, or (2) An organisation is not required to comply with a provision of this clause if: (a) the organisation is lawfully authorised or required not to comply with the provision concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998). Clauses 1 (c1), (4), (f), (g), (h), (i), (j), (k), 3, 4 and 5 not reproduced. 11 Limits on disclosure of health information (1) An organisation that holds health information must not disclose the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless: (a) Consent the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or (b) Direct relation the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or Note. For example, if information is collected in order to provide a health service to the individual, the disclosure of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. (c) Serious threat to health or welfare the disclosure of the information for the secondary purpose is reasonably believed by the organisation to be necessary to lessen or prevent: (i) a serious and imminent threat to the life, health or safety of the individual or another person, or (ii) a serious threat to public health or public safety, or (d) Management of health services the disclosure of the information for the secondary purpose is reasonably necessary for the funding, management, planning or evaluation of health services and: (i) either: (A) that purpose cannot be served by the disclosure of information that does not identify the individual or from which the individual's identity cannot reasonably be ascertained and it is impracticable for the organisation to seek the consent of the individual for the disclosure, or (B) reasonable steps are taken to de-identify the information, and (ii) if the information could reasonably be expected to identify individuals, the information is not published in a generally available publication, and (iii) the disclosure of the information is in accordance with guidelines, if any, issued by the Privacy Commissioner for the purposes of this paragraph, or (2) An organisation is not required to comply with a provision of this clause if: (a) the organisation is lawfully authorised or required not to comply with the provision concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998), or (c) the organisation is an investigative agency disclosing information to another investigative agency. (5) If health information is disclosed in accordance with subclause (1), the person, body or organisation to whom it was disclosed must not use or disclose the information for a purpose other than the purpose for which the information was given to it. Clauses 1 (c1), (e), (f), (g), (h), (i), (j), (k) and (l), 3, 4, and 6 not reproduced. 1. It is important to note that the HPP's provide for use of health information for the primary purpose, and not for a secondary purpose, unless the specific secondary context as set out in the relevant HPP's are met. The Hearing 1. The matter was heard over two days, with the first day of hearing being in regional New South Wales in order to assist the applicant and witnesses appearing in person for both sides. The second day of the hearing was held in Sydney and the applicant attended and gave oral evidence over the telephone. Applicant's Written Evidence 1. The applicant tendered number of documents as evidence in support of her application. These took the form of signed statements with various annexures. They were all received without objection. * Statement of 1 February 2016 Exhibit A 1. * Document / Statement dated 14 March 2016 attaching written 'Response to Statements of respondent's Submissions' Exhibit A2. * Statement of applicant dated 4 May 2016 (12 pages) Exhibit A3. 1. Other material was before the Tribunal including the applicant's application for review (including attachments), a further document dated 14 March 2016 comprising 12 pages and a further 3 page document, documents in the form of source material tabbed 'a' – 'n' inclusive, and finally documents labelled Item 1 through to Item 26 comprising source materials and other documents relevant to the applicant's case. Respondent's Written Evidence 1. The respondent filed a number of statements in addition to other material. Some of the individual's names have been abbreviated or otherwise anonymised in order to protect the privacy of the applicant and her family by way of constructive identification. * Statement of 'P.R.' dated 3 March 2016 Exhibit 'R 1'. * Statement of 'H.M.' dated 3 March 2016 Exhibit 'R 2'. * Statement of 'S.K.' dated 3 March 2016 Exhibit 'R 3'. * Statement of 'E.S.' dated 3 March 2016 Exhibit 'R 4'. * Compendium of documents / material / section 58 documents Administrative decisions Review Act 1997 under cover letter 9 October 2015 Exhibit 'R 5'. * Original signed consent form dated 5 August 2015 Exhibit 'R 6'. 1. The respondent also filed submissions on 4 March 2016 and further submissions in reply on 16 May 2016. Summary of privacy grievance 1. In addition to the brief outline at paragraphs 6, 7 and 8 (above) prior to examining the evidence I believe it will assist an understanding of the matter to briefly summarise the details of the privacy grievance. 2. From CDV's application / complaint of 1 June 2014, the Whole of Family Team ('WOFT') nurse ('P.R.') attended the applicant's home on 5 August 2013 at CDV's request. The attendance was also on the suggestion of 'S.C.' from an organisation called Noah's Ark, which provides early intervention services. 3. The basis of the 'referral' being that WOFT provided in house / home behavioural training for children. Various consents were sought of the applicant in order to talk to third parties (such as her son's school and G.P.) concerning CDV and her son. 4. CDV asserts that there had been no response to her request for copies of the referrals they made to the WOFT. Further, the WOFT had not responded to CDV's request for copies of the consent forms that she signed, CDV did not consent to the collection of mental health reports, and that 'P.R.' put in requests for mental health officers for intervention and treatment of CDV. Jurisdiction 1. There is no dispute that the Tribunal has jurisdiction to hear this application. Section 55 of the PPIP Act provide for a review by the Tribunal if the matter has been subject to a valid internal review and the applicant is either dissatisfied with the findings of the review, or the review has not been completed within 60 days. It was uncontroversial between the parties that the application to the Tribunal had been lodged after completion of the internal Review, and that that application had been lodged within time as calculated from that completion. 2. A preliminary matter of contention concerned the scope of the initial review and therefore the scope of the conduct under review in the proceedings. Those matters were however close to being resolved by the time of the hearing, suffice to say that aspects of that dispute (scope) went to an interpretation of the factual meaning of various individuals and their conduct, which is bound up within aspects of the substantive dispute. In any event at the outset of the hearing the Tribunal determined that issue before the parties. Evidence at Hearing 1. Most of the evidence on the first day of the hearing was given by witnesses for the respondent. The applicant gave her evidence predominantly on the second hearing date by telephone. However the applicant made a number of submissions at the hearing and both parties provided detailed written submissions. 2. Due to the matters referred to in paragraph 27 and 28 (above), the respondent 's evidence was heard first. Respondent's evidence Witness 1 'E.S'. 1. In evidence in chief the witness stated that they were the co-ordinator of the rehabilitation service for the last 10 years. They had 30 years' experience as a mental health worker. 2. The witness was taken to paragraph 22 of their statement (Exhibit R – 4). The context was an unplanned meeting between the witness and the applicant in the street. During the meeting / discussion there was mention of CDV's difficulties managing her son's behaviour. The witness indicated that he could refer her to the WOFT but at that time he was not aware that referrals only came from the Department of Family and Community Services (FACS). 3. The witness indicated that they were later contacted by FACS concerning whether the applicant would benefit from a referral to the WOFT. The referral was supported but the witness indicated that they were not the applicant's case worker. 4. In cross examination the witness was asked about bringing 'G' to her home, as 'G' was a person who had accompanied the applicant in the casual musical group set up in the past by the witness. The witness could not recall this occurring. 5. The witness gave evidence that they later called the WOFT and was advised that only FACS could handle referrals. The witness was questioned about phone calls from Noah's Ark (not part of the respondent), and 'S.C.' The witness indicated that 'S.C.' called and asked whether they were the applicant's case manager, to which the witness answered 'No'. 6. Finally the witness was asked about whether they had raised an issue about a compact disc (CD) in order to start up the conversation / meeting with the applicant in the street. (The CD had been played to the witness in a social context prior). The Tribunal notes that the witness statement makes extensive reference to the social context of the prior dealings with the applicant. Witness 2 'H.M'. 1. Witness 'H.M.' adopted her statement (Exhibit R -2). The witness works for the Child Protection Counselling Service as a Clinical Psychologist and has a Master's Degree, which focused on disclosure of child sexual assault issues. 2. In cross examination the witness answered that she had not specialised in autism matters involving children, but had significant experience in the area as a clinician. Her evidence was that Autism, Operational Defiance Disorder (ODD) and Attention Deficit Hyperactivity Disorder (ADHD), all have a complex presentation. 3. The witness was questioned by the Tribunal about what information she received about CDV's son. The witness was advised that information had been shared about CDV's past mental health issues. In paragraphs 13 and 14 of her statement the witness indicated that she had understood from CDV that she was unhappy with the service provided by the WOFT. Further a social worker had spoken to the witness and advised that CDV was unhappy with several services provided to her and her son (including an appointment with the witness), however the witness had no recollection of any appointment. Witness 3 'S.K.' 1. In evidence in chief witness 'S.K.' adopted her statement (Exhibit R -3). She recalled attending the applicant's home in August 2013. She could not recall having the applicant sign a consent form but confirmed that would have been the procedure. The witness was asked about the reference to 'persecutory beliefs' in her statement. 2. The witness gave evidence that she was advised that a person had been entering the house, and hiding under the applicant's bed. That person had come out from under the bed from time to time and sexually assaulted the applicant who as a result was forced to have the locks changed. 3. The witness indicated that these 'persecutory' statements arose in the context of a second or subsequent visit by the witness and 'P.R.' In evidence concerning the arrangements for a child and adolescent psychiatrist appointment, the witness indicated that after initially agreeing, the applicant declined to keep the appointment. The witness gave evidence that this health professional was attached to the WOFT and that the 'WOFT' is a voluntary service in that it is not compulsory for referred clients to participate. Witness 4 'P.R.' 1. Witness 'P.R.' adopted his statement (Exhibit R -1). He gave evidence that he had 6 years' experience as a clinical nurse consultant. The witness identified the consent form signed by the applicant, and it was later tendered by the respondent and marked as exhibit R- 6. 2. In describing the contents of exhibit R-6 in his evidence, the witness stated that some of the data on the consent form may have been added at a later time. (Whilst the Form is signed and witnessed and dated 5 August 2013, the form does appear to have other pen entries made in darker ink and possibly under a different hand). 3. The witness gave evidence that the data on the form may have been added, or alternatively pre0existing data may have been ';gone over' with a black ball point pen, or black ink at a later time. Whilst speculative, the witness indicated that in his view it was unlikely that the witness would have signed the form without her name being on it. 4. The witness gave evidence that on 19 July 2013 there was a meeting which he attended along with 'S.K.', a FACS caseworker, and the deputy headmaster of the applicant's son's school. 5. When asked what the witness would have advised the applicant about the consent form and the collection use and other matters relating to the personal and health information the witness advised that they would have provided the standard detailed response. In that the applicant would have been told that they provide assessment reports and that this process takes some weeks to complete due to the assessments being based on multiple observations. 6. In cross examination the witness was asked about a diagnosis that he made of the applicant. The witness denied making any diagnosis. The witness stated that the WOFT role is to assess the relevant family member or members over about 6 weeks. 7. The witness was asked about his attendances at the applicant's home. He answered that he attended on the first occasion for approximately one and a half hours. During this time he mainly listened rather than talked. The witness could not remember during his oral evidence what he talked about with the applicant. 8. The witness was asked about the meeting minutes which were provided to the applicant as part of her HRIP Act access application. (The middle page of the 19 July 2013 document was missing). When asked about specific comments allegedly made by his colleague at the home meeting, the witness answered that he could not recall the other WOFT member making such statements. 9. The witness clarified earlier evidence from his statement, in that when he and his colleague went to the Illawarra Mental Health Unit and went through the applicant's records, they did not call the author or raise with them matters relating to a number of pre-existing or otherwise qualified opinions. Applicant's evidence 1. The applicant gave evidence by telephone on the second day of the hearing which was held in Sydney. No other witness gave evidence at hearing on behalf of the applicant. CDV's Evidence 1. The applicant spoke to paragraph 8 of the respondent's supplementary submissions dated 16 May 2016. This concerned a reference to the applicant's assertions re: 'P.R.'s alleged disclosures. The applicant stated in her evidence that this was not the first time such disclosures by 'P.R.' had occurred however the applicant did not know the specific circumstances but believes such earlier disclosures and 'sharing' of information occurred. 2. The applicant advised that 'P.R.'s observations and comments were now held on the Department of Education file in respect of her son. The witness maintained that the accessing of mental health services prior to the birth of her child should not be a relevant consideration as part of any 'assessment'. 3. The applicant stated that a further diagnosis of 'Dr H' addressed mental health issues and that 'P.R.' was cognisant of those developments and that information. The matters related to where to place her son. In the applicant's view the WOFT were not helping with that, as it was not their task. 4. The applicant referred to the behaviour of staff at her son's school and that in addition there was significant bullying. The applicant referred to an e-mail from witness 'S.C.' who was based at Noah's Ark. That e-mail was attached to the 28 April 2016 bundle. The import of these matters according to the applicant was that 'S.C.' was aware of witness 'H.M.'s' 'misdiagnosis', but that she was not aware that it was in fact a misdiagnosis. 5. Because of these issues (concerning the 'misdiagnosis') in the applicant's view, the problems were amplified and the 'inaccurate' information was 'circulating around'. 6. In the applicant's view 'H.M.'s evidence at the earlier hearing indicates that the diagnosis that was ultimately made, could not reasonably be made unless one first excluded Autism Spectrum Disorder. When asked specifically what the 'misdiagnosis' was, the applicant advised that it was the diagnosis that the child (son) had suffered abuse. 7. The applicant took the Tribunal to earlier material before the Tribunal which refers to the applicant calling an ambulance 10 times in two weeks (due to heart problems). It was suggested by the applicant that the characterisation of these matters was another element of the applicant's behaviour which was utilised by the respondent in an adverse assessment of her mental health. 8. The applicant characterised how she believed the respondent had dealt with the information by the following observation: 'Everything that has been said has been welded and blended together in a way that it wasn't initially said to them', when referring to the information the applicant says that she provided the WOFT. 9. The applicant in her evidence refuted the references to sexual predators coming into her bed and characterised the facts as relating to the need to go to bed due to her heart problems or a similar or related condition. Further the reference to a person coming into her home and hiding under her bed relates to an estate issue whereby valuable and important deeds (and other valuable legal documents) were held in a suitcase stored under her bed. 10. The applicant stated in her evidence that nothing that 'P.R.' said was correct. 11. As the applicant was unrepresented the Tribunal inquired of her as to various issues arising from her evidence and relevant to her application. The respondent was content with this approach and had the opportunity to examine the applicant. 12. The applicant was asked what her understanding of the WOFT's role was. She indicated that they would act as a support advocate and that is why they would seek for the consent to be signed. In her view or to her understanding she believed that was seeking a service and as a result needed to justify to them why and how there were significant needs. 13. In respect of references to an alarm the applicant advised that the alarm was put on (installed) in June because of her concerns about thefts by intruders, and in the applicant's view that stopped the stealing. Documentary evidence about the alarm was provided by the applicant unchallenged. 14. The WOFT workers were present for a lengthy period 1-hour to 1 and a half hours, and the applicant stated that there were two forms to sign (one for each entity that they would access on her behalf etc.). 15. In respect of the 'estate' matter (re: deeds under bed in suitcase), the applicant's evidence was that her role in that was settled or otherwise finalised in January 2013 but that her brother and sister remained in dispute. 16. The applicant stated in her oral evidence that she disagreed with the respondent's submission at paragraph 17 (further submissions dated 16 May 2016). The respondent's submission being that much of the documented evidence that the applicant relies upon relates to concerns, and possibly damage arising from misdiagnosis, incorrect treatment options or differences as to appropriate treatment options and matters arising from those issues. The respondent had submitted that those matters are separate to and do not establish any breaches of privacy under the IPP's or HPP's. 17. The applicant maintained that the information was shared by the respondent without her consent and that some of this occurred prior to the consents (controversial as they were between the parties) even being signed. 18. In respect of the witness 'E.S.' the applicant maintains that the earlier support group, musical program and performance band establishes a conflict of interest in dealing with any future health / treatment issues or services. The applicant stated in her evidence that after the earlier conversation she telephoned 'E.S.' and advised that she did not think that a referral to the WOFT is a good idea, and explained the sequence of events from her recollection. 19. The applicant's evidence on this issue was that initially 'E.S.' called her and asked whether she would like a referral to the WOFT. The applicant said that yes she would like 'E.S.' to make a referral to the WOFT. Later the applicant decided that a WOFT referral would not be a good idea and she called 'E.S.' and asked how she could 'withdraw this' (referral). The applicant's evidence was that 'E.S.' told her that she needed to contact the person 'who made the referral.' The Tribunal notes that on the face of the record this evidence (attributed to 'E.S.') appears somewhat illogical. 20. In cross-examination CDV was taken to the issue of her claim for damages arising from alleged breaches of privacy. The respondent had made the following submission and it was put to the applicant. 17. Some of the materials served by the applicant are said by her to be evidence of the harm suffered by her as a result of the alleged conduct of the respondent. In response to those materials, the respondent submits that the harm said to have been suffered by the applicant arises largely from her allegations as to the incorrect diagnoses and differences of opinion as to treatment options rather than on any breaches of her privacy that are referable to her rights under the applicable legislation. 1. It was put to the applicant that she disagreed with that submission. However the applicant stated that there were no exemptions to the consent issue and that is why the claim is pressed. The respondent suggested that there was no threat to CDV's son arsing from perceived mental health issues. 2. The applicant was taken to Tab D of Exhibit 'R-5' which included the WOFT referral. Page 2 of that referral under the heading 'previous CS history', contains a reference to 23 reports in respect of the son from 2007 to present. The applicant disputes those records and stated in evidence that there were only 9 reports and that the caseworker 'A.H.' had sought to 'rev the matter up'. 3. In cross-examination the applicant stated that both Docs and the Education Department are implicated in the alleged failings in respect of the family supports and incorrect assessment of their needs. 4. Discussion took place around the WOFT and the purpose or function of that entity. The applicant gave evidence that she understood the WOFT to be an 'in home training team' for children. When asked about this assessment the applicant stated that the understanding was gained from information that 'S.C.' (From Noah's Ark) had told her. The applicant stated in evidence that the attending workers told her that 'they were getting information on her son'. 5. It was observed during this aspect of the evidence that the applicant had sought documents from the Department of Education and Communities as well as Community Services around 2014 as part of the discovery process leading to the lodgement of a privacy grievance in June 2014. However there does not appear to be any evidence from that material of any information disclosed or otherwise used (by the Local Health District) prior to 5 August 2013 other than what took place at the Interagency Meeting. Respondent's Submissions 1. The respondent relied on their two sets of written submissions from March and May 2015. 2. The respondent submitted that the case of ALZ v Workcover NSW [2015] NSWCATAP 138 is applicable to the respondent's conduct. At paragraph 88 and 89 the Appeal Panel observed: 88.The primary purpose of HRIPA is 'to promote fair and responsible handling of health information' (s 3(1)). This Principle serves that end. 89.HPP 9 seeks to ensure that agencies fairly use information they hold at the point they are taking actions or making decisions based on it. It is especially directed to old information, and seeks to encourage care in relation to the use of information collected indirectly. 1. Later in their submissions in addition to other privacy cases, the respondent again referred to the case of ALZ. At paragraph 90 the Appeal Panel observed: 90.In contrast to the systemic role played by HPP 6, this is an obligation that applies to the particular circumstances of each case. Whether the organisation has complied will be informed by the evidence as to what occurred in the particular case, and evidence as to the general practices that are observed in the organisation in relation to the type of use made of information of this type. The obligation is expressed in general terms, and leaves wide latitude for judgment, first to the agency in administering the obligation and to the Tribunal on review. 1. The respondent submitted that there was no breach of HPP 9 (concerning accuracy) because 'P.R.' used the information in CDV's health care record and at the time had no reason to believe that it was inaccurate or misleading, and that he did so after consulting CDV's G.P. 2. In respect of HPP 10 (concerning use) use, the respondent submitted that there was no breach because the information was used for the purpose which it was collected for – i.e.: providing the applicant with health services. It was also submitted that any secondary purpose that the respondent put the information to was directly related to the primary purpose and as such was permissible under the HRIP Act, the purpose being the provision of further health information to the applicant and services to the applicant's son. 3. A further matter was submitted that the use and disclosure of some of the information in the context of the Interagency case discussion / meeting, was a permissible matter due to the operation of the exemption in Clause 11 (1) (b) of Schedule 1 of the HRIP Act (HPP 11). This exemption it was submitted arose because of the operation of the Children and Young Persons (Care and Protection) Act 1998 (the 'CARE' Act). Specifically section 245 C provides: 245C Provision of information (1) A prescribed body (the provider) may provide information relating to the safety, welfare or well-being of a particular child or young person or class of children or young persons to another prescribed body (the recipient) if the provider reasonably believes that the provision of the information would assist the recipient: (a) to make any decision, assessment or plan or to initiate or conduct any investigation, or to provide any service, relating to the safety, welfare or well-being of the child or young person or class of children or young persons, or (b) to manage any risk to the child or young person (or class of children or young persons) that might arise in the recipient's capacity as an employer or designated agency. (2) Information may be provided under this section regardless of whether the provider has been requested to provide the information. 1. In addition I note that HPP 11 (2) provides: (2) An organisation is not required to comply with a provision of this clause if: (a) the organisation is lawfully authorised or required not to comply with the provision concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998), or (c) the organisation is an investigative agency disclosing information to another investigative agency. (Emphasis added) 1. In oral submissions the respondent submitted that there was nothing that arises from the applicant's evidence which constitutes a breach of an I.P.P. or a H.P.P. 2. The respondent submitted that the Tribunal should prefer the evidence of 'P.R.' (who had prepared the consent form). It was submitted that it was highly unlikely that this experienced professional would fabricate the form. The witness gave evidence about the completion of the form and the respondent submits that his evidence should be preferred. Applicant's Submissions 1. The applicant in oral submissions drew the Tribunal's attention to the Information and Privacy Commission Fact Sheet which dealt with HPP 4. That Health Principle deals with the collection and privacy notices advising an individual of certain matters at the time of the collection. However the scope of these proceedings concerns HPP's 7, 10 and 11 in respect of Access, Use and Disclosure. 2. In concluding submissions the applicant returned to the issue of the WOFT being a voluntary service, and submitted that they (the WOFT) did not tell her at her home, the things that they now said in their evidence at hearing, particularly the issue as to why they were there, talking to her and making the assessment that they did. Consideration 1. The intentions of the applicant and her understanding of what took place (as set out in her submissions and evidence), are not matters essentially in dispute. It is the basis for what took place and the resultant meaning attributable to that basis that creates the major contention between the parties. 2. In that regard the Tribunal accepts that the applicant held an understanding or belief as to what services she understood to be seeking, and as a result the nature and type of services that she understood she received. Implicit in that is the basis, purpose, application and outcome arising from the matters referred to between the parties. 3. The Tribunal accepts and understands the applicant's apparent dissatisfaction and concern and distress at the respondent's agent's conduct. To the extent relevant the Tribunal also observes similar concerns in the applicant arising from the actions of other service providers not part of the respondent Local Health District, and in the context of these proceedings, not subject to the current jurisdiction of the Tribunal under the HRIP Act. 4. However what the Tribunal must do is examine the evidence and material and weigh up to the civil standard what conduct occurred. The manner in which an administrative review of conduct is best approached concerns the availability of relevant evidence as a subsequent step once the grievance has been identified.. 5. In the case of KO & anor v Commissioner of Police, New South Wales Police (GD) [2004] NSWADTAP 21 the Appeal Panel sought to identify the essential requirements of evidence when an agency conducts an internal review, so as to create an effective pre-condition to any review in the Tribunal. 6. It would appear that in the first instance, the Internal Review was significantly delayed and the substance of the review reached conclusions in the absence of the presentation of relevant evidence and analysis. In respect of HPP 10 the review identified that: The applicant's information collected during the referral process was used for the primary purpose only and this was to facilitate an assessment of (CDV's) mental state. The findings from the conduct assessment found no evidence that this Health Privacy Principle had been breached. 1. Whilst the analysis and finding above may seem determinative to a third party, the significant issue in my view is that it does not substantiate how the major contention between the parties is accounted for. Whilst not mandatory by any means, it does not appear that any statement was taken from the applicant after she lodged her review and that the matter proceeded on the basis of the detailed written communications from the applicant, and a review of the paper based records held by the respondent. It may be that had the respondent directly addressed the HPP 10 issue with the applicant the matter may have proceeded differently. 2. The case of KO referred to above is in my view appropriate guidance on what a respondent agency needs to do in order to effectively address the matters set out in Part 5 of the PPIP Act (which also governs HPP reviews). At paragraph 59 the Appeal Panel observed: 59 The present jurisdiction relates to the conduct of public sector agencies. As noted earlier, the applicant may have a general awareness of the occurrence of conduct that is, on its face, governed by the Privacy Act; and the applicant may not be in a position to identify precisely the details of the conduct. In these circumstances, the Tribunal should play a more active role to ensure that all the relevant facts are before it. In a case of the present kind, relating to suspected disclosure of personal information about an individual as between an agency officer and a third person, if the agency does not willingly supply a statement or affidavit from the officer, the Tribunal should give a direction to that effect. 60 In our view the proceedings miscarried. There was a denial of procedural fairness to the applicants. In the absence of a firm agreement by the applicants to the course of the proceeding only by reference to the contents of the internal review, the Tribunal should have ascertained precisely what was the conduct that occurred on the relevant occasion, i.e. the phone call that Inspector Oswald made to the employer on 21 August, and whether and what further interchanges may have occurred between Inspector Oswald and the employer. 1. Importantly by the time that the matter was to be heard by the Tribunal, the respondent (consistent with the matters set out in KO ) had provided evidence which could be tested at hearing, and avoided the type of deficits referred to in KO. 2. However, notwithstanding that approach, in my view what the Tribunal is left with is a clear (and somewhat glaring) conflict between the evidence of the parties on the crucial issue of the purpose of the referral, assessment and everything that followed on from there. Whilst there were some issues relating to the respondent witnesses evidence, and in particular some obvious discrepancies or uncertainties about the provenance or basis of some of the data in the Consent Form, these matters were unable to be further scrutinised or explained at hearing. 3. In such circumstances what the Tribunal is left with is a discrepancy in the evidence, in this instance it would appear that it cannot be explained by any other means other than that there was a difference of understanding between the parties. 4. In my view the evidence at the conclusion of the hearing showed that the respondent's agents acted consistently in accordance with their understood purpose or function. In that regard their actions would appear to be in accordance with the provisions (including relevant exemptions) under the various HPP's. 5. In the case of BQO v Western NSW Local Health District [2015] NSWCATAD 261 I made the following observation in a factual matrix not dissimilar to the significant dispute in these proceedings. At paragraphs 51 to 54 I observed the following in respect of a difference of understanding between the parties. 51.Privacy reviews essentially go to allegations of conduct, and whether such conduct amounts to a breach of an IPP, or a HPP in the absence of any lawful exemption. This is further outlined at paragraph 16 (above). 52.I have considered all of the evidence and submission filed by the parties even if I have not referred to it specifically in these reasons. In my view the evidence before the Tribunal, in its totality, does not establish conduct which can be shown to the requisite standard, was against the express wishes of the applicant, and therefore amount to a collection and use of personal and health information without her consent. 53.On the contrary, in my view the evidence of both parties indicates that there was a clear misunderstanding as to what type of service or assistance was being sought, and as a result the nature of the service / assistance that was provided. This is an unfortunate state of affairs on the whole, but in particular for the applicant. 54.It is clear that the ensuing creation of significant medical records in the nature of mental health assessment and treatment, is a matter which in the relevant context has caused the applicant great distress. In that regard I note that in the course of the internal review and these proceedings the respondent has offered for the applicant to place her own document(s) on her file by way of an addendum to, in effect, show the context that these records were created, and her view on the facts and circumstances of that context. 1. The current matter (like BQO) involves health information and sensitive issues concerning the mental health and well-being of an applicant. The current matter in addition involves a situation whereby the applicant is attempting to adequately deal with an extremely challenging home environment, clearly (on the uncontested evidence), with minimal supports. The situation which the applicant found herself in with the respondent is understandably distressing and concerning for her in such an environment. 2. It may be that there are steps that health service providers can take for clinicians and other staff to more effectively obtain consent, provide consultation information or other information to better provide services and avoid disputes such as this. However I make no formal recommendation or orders in that regard. 3. It may be however that the Local Health District will review the apparent communication breakdown which ultimately resulted in the applicant not pursuing potential supports, for reasons clear from her evidence. This would appear less than an ideal situation in a medical needs based environment for clients seeking to avail themselves of services or supports. It may be that there are general lessons that the health service sector can observe from CDV's situation. 4. The basis for not making any such determinative recommendations is that I make no positive findings against the respondent in this matter, and I so find. Conclusion 1. As a result there are no breaches of Health Privacy Principles (HPP's). 2. I therefore make the following orders. Orders 1. The decision of the respondent is affirmed. 2. The Tribunal determines to take no action in the matter. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 21 December 2016