Civil and Administrative Tribunal New South Wales Medium Neutral Citation: Health Care Complaints Commission v Aref [2018] NSWCATOD 133 Hearing dates: 1, 2 August 2018 Date of orders: 16 August 2018 Decision date: 16 August 2018 Jurisdiction: Occupational Division Before: J Millbank, Senior Member M McGovern, Senior Member B Clarke, Senior Member J Sillince, General Member Decision: (1) Mr Aref is reprimanded for breach of patient privacy and confidentiality. (2) The practitioner's registration as a nurse is suspended under s 149C(1)(b) of the National Law for a period of six months from the date of these orders. (3) Respondent to pay the Applicant's costs of these proceedings pursuant to cl 13(1) of Sch 5D of the National Law as agreed or as assessed under the Legal Profession Uniform Law Application Act 2014 (NSW). Catchwords: TRADES AND PROFESSIONS ─ nursing ─ health records ─ practitioner improperly accessed centralised health records of six patients and himself ─ patient health records accessed for personal advantage of practitioner Legislation Cited: Civil and Administrative Tribunal Act 2013 (NSW) s 64 Health Practitioner Regulation National Law NSW 2009 (NSW) ss 139B; 139E; Cases Cited: Briginshaw v Briginshaw [1938] HCA 34; Health Care Complaints Commission v BXD (No 1) [2015] NSWCATOD 134; Health Care Complaints Commission v Do [2014] NSWCA 307; Health Care Complaints Commission v Fisher [2016] NSWCATOD 62; Health Care Complaints Commission v Flekser [2016] NSWCATOD 1; Health Care Complaints Commission v Fraser [2014] NSWCATOD 29; Health Care Complaints Commission v Karalasingham [2007] NSWCA 267; Health Care Complaints Commission v Perroux [2011] NSWDC 99; Health Care Complaints Commission v Philipiah [2013] NSWCA 342; Health Care Complaints Commission v Phung (No 1) [2012] 1 NSWDT 3; Health Care Complaints Commission v Simonson [2017] NSWCATOD 87; Lee v HCCC [2012] NSWCA 80; Litchfield v Health Care Complaints Commission (1997) 41 NSWLR 630; Pillai v Messiter (No 2) (1989) 16 NSWLR 197; Sabag v Health Care Complaints Commission [2001] NSWCA 411; Texts Cited: NSW Health Care Code of Conduct and PD2009_76 Use & Management of Misuse of NSW Health Communication Systems; NSW Health Policy Directive, PD2012_018; NSW Health Policy Directive, PD2013_033 Electronic Information Security Policy; Nursing and Midwifery Board of Australia Code of Professional Conduct for Nurses in Australia Category: Principal judgment Parties: Health Care Complaints Commission (Applicant) Shams Aref (Respondent) Representation: Counsel: C Mitchell (Applicant) Respondent self-represented Solicitors: Health Care Complaints Commission (Applicant) File Number(s): 2018/0030199 Publication restriction: A non-publication order under s 64 of the Civil and Administrative Tribunal Act 2013 (NSW) prohibiting disclosure or publication of the names of patients A-F in the schedule to the complaint, and preventing disclosure or publication of the health records of those patients in evidence in the proceedings. REASONS FOR DECISION Background 1. Mr Aref has been a registered nurse since 2007 and holds post-graduate qualifications in Public Health and Health Management. 2. On 14 August 2014 Mr Aref was working on a casual basis at Blacktown Hospital. In the early hours of the morning, Mr Aref accessed a computer that had been logged on by another employee and left unattended by that employee, in order to access district-wide electronic health records of himself and six other individuals, Patients A-F. The access to all seven records occurred between 2.42 and 3.05 am and involved multiple pages of each patient's record being opened and viewed. 3. None of the patients were under the practitioner's care at that time of the incident. Mr Aref did not have computer system credentials that would have allowed him to access those patient records with his own log on, nor did he have any legitimate reason to access them. 4. At the time of the incident Mr Aref was engaged in a long-standing dispute with Patients A-E and was at a critical juncture in acrimonious legal and administrative proceedings with Patient A. The details of those relationships and proceedings are deliberately omitted from these reasons in order for the patients to remain unidentified in keeping with the non-disclosure orders made by this Tribunal. 5. It appears that Patient A suspected Mr Aref of utilising his professional position to access the relevant health records based upon some information contained in court and administrative documents that Mr Aref filed in late 2014 and early 2015. One particular piece of information related to an incident in which police officers took Patient B to a specified hospital for drug testing. 6. In late 2014 and again in early 2015 Patients A, D and C requested a privacy internal review from the Western Sydney Local Health District under the Privacy and Personal Information Protection Act 1998 (NSW) and Health Records and Information and Privacy Act 2002 (NSW)(HRIP Act). The HRIP Act regulates 'health information' through 15 Health Privacy Principles. 7. On 9 March 2015 Mr Aref was interviewed by a panel comprising the hospital Human Resources Manager, Privacy Information Compliance Manager and Director of Nursing for Mental Health. During that interview Mr Aref acknowledged accessing the relevant records but denied using or disclosing them. Mr Aref stated in the interview that all of the information he had relayed in court documents was information that he was already aware of. Mr Aref stated that he knew much of the health information by virtue of his previous personal interactions with Patients A-E and also because of a phone call from a friend over a year earlier reporting the arrival of Patient B at the specified hospital in the presence of police. 8. The internal review concluded that Mr Aref had breached the Health Privacy Principle concerning the retention and security of data, but not the Principles concerning the use and disclosure of health information. This conclusion was based upon an acceptance of Mr Aref's assurances that he had other sources for the information he had accessed and that he had not used or disclosed the material. It is not clear whether there was any attempt to substantiate those claims. 9. The internal review recommended that Mr Aref not be rostered onto shifts that would require him to utilise the relevant health care record system and that he undertake online privacy training. The outcome of the review and a formal apology letter from the Western Sydney Local Health District was sent to Patients A, D and C on 31 March 2015. 10. Patients A-E wrote a joint letter to the Health Care Complaints Commission (HCCC) on 6 August 2015 expressing dissatisfaction with the above outcome and seeking further review. On 25 January 2018 the HCCC filed a complaint with this Tribunal. 11. This matter is not a review of the Western Sydney Local Health District decision on the Privacy Principles. It is a fresh consideration of the professionalism of the practitioner's conduct under the Health Practitioner Regulation National Law NSW 2009 (NSW) (National Law). 12. The matter before the Tribunal consists of seven complaints of unsatisfactory professional conduct concerning each of the relevant health records, and one complaint of professional misconduct based upon either the serious nature or cumulative seriousness of the conduct. Complaints 1-6 allege that Mr Aref's access to Patient A-F's records, respectively, was a breach of the patients' privacy and confidentiality, and was contrary to the NSW Health Policy Directives PD2013_033 Electronic Information Security Policy; PD2012_018 NSW Health Care Code of Conduct and PD2009_76 Use & Management of Misuse of NSW Health Communication Systems; as well as the Nursing and Midwifery Board of Australia Code of Professional Conduct for Nurses in Australia (as they were in force in August 2014). The complaints are all particularised to address the practitioner's inappropriate access to the records, his use of another staff member's log in, and his personal motive in the context of the dispute he was in with Patients A-E. In the case of his own record the breach was said to be improper and contrary to the above policies and codes. 13. The complaints do not allege that the health information was subsequently disclosed in court or administrative proceedings. Relevant Law 1. The Tribunal must be independently satisfied that the complaints are made out to the civil standard in Briginshaw before then proceeding to determine the appropriate protective orders. 2. The Tribunal is required to make findings for each particular if they are not conceded in writing: s 165H National Law. 3. The professional members of the Tribunal are entitled to apply their own specialist expertise to the evidence in forming opinions about whether there has been a departure from the relevant standard of conduct, with appropriate attention to the expert evidence if there is a genuine difference of view: HCCC v Fraser [2014] NSWCATOD 29 at [238]. 4. 'Unsatisfactory professional conduct' is defined in s 139B of the National Law as including: (a) Conduct that demonstrates the knowledge, skill or judgment possessed, or care exercised, by the practitioner in the practice of the practitioner's profession is significantly below the standard reasonably expected of a practitioner of an equivalent level of training or experience. … (l) Any other improper or unethical conduct relating to the practice or purported practice of the practitioner's profession. 1. In making a finding of unsatisfactory professional conduct per (a), the Tribunal must compare the conduct of the practitioner with a standard 'reasonably expected'. In HCCC v Simonson [2017] NSWCATOD 87 the Tribunal noted at [9]: Obviously, there will be many cases where there is no one bright line which typifies the relevant knowledge, skill or judgement or care of such a practitioner. In most cases, the expected standard of relevant knowledge, skill or judgement or care of a practitioner will fall within a band, sometimes narrow and sometimes broader. 1. 'Improper' and 'unethical' are not defined in the National Law. The assessment of what constitutes improper or unethical conduct is based upon their ordinary meaning. In the professional disciplinary context there is necessarily some overlap between the two words. 2. 'Improper' conduct does not need to be intentional and includes conduct not in conformity with standards of professional conduct: HCCC v Phung (No 1) [2012] 1 NSWDT 3 at [68]; HCCC v Fisher [2016] NSWCATOD 62 at [57]; HCCC v Flekser [2016] NSWCATOD 1 at [119]. Improper and unethical conduct may be dishonest, disreputable to the profession, in breach of explicit professional standards such as codes of conduct, guidelines and competencies, and may also be determined by reference to the views of reasonable members of the profession: Slezak, Dr Peter [2011] NSWMPSC 10 at [83] and [87]. 3. The gravity of the conduct must be measured against the extent to which it departs from proper standards, not by reference to the worst cases: Litchfield v HCCC (1997) 41 NSWLR 630 (at 638). 4. 'Professional misconduct' is defined in section 139E of the National Law as: (a) unsatisfactory professional conduct of a sufficiently serious nature to justify suspension or cancellation of the practitioner's registration; or (b) more than one instance of unsatisfactory professional conduct that, when the instances are considered together, amount to conduct of a sufficiently serious nature to justify suspension or cancellation of the practitioner's registration. 1. In determining professional misconduct the Tribunal must assess whether 'when the respondent's contraventions are considered as a whole, they are of a sufficiently serious nature to justify suspension or deregistration': HCCC v Perroux [2011] NSWDC 99 at [18]. This level of seriousness requires more than 'mere incompetence', and can include a deliberate departure from accepted standards, indifference to them, or serious negligence: HCCC v BXD (No 1) [2015] NSWCATOD 134 at [37], quoting Kirby J in Pillai v Messiter (No 2) (1989) 16 NSWLR 197 at 200. 2. Where the Tribunal makes a positive finding of professional misconduct, the Tribunal may suspend the practitioner's registration for a specified period or cancel the registration entirely. The Tribunal has a wide discretion relating to disposition of a complaint establishing professional misconduct. The circumstances of the particular case will determine the appropriate disposition: HCCC v Karalasingham [2007] NSWCA 267 at [67] (Basten JA). Whether the offence(s) are sufficiently serious to warrant suspension or deregistration is a matter of degree and judgment: Sabag v HCCC [2001] NSWCA 411 at [82]. 3. As the paramount consideration is the protection of the health and safety of the public, imposition of restrictions on the practice of a health professional are only to be done in pursuit of this higher objective. Such a determination of necessity and appropriateness are made by considering what measures are needed to ensure future behaviour of the practitioner, and others, is shaped in such a way that is consistent with these protective goals: Lee v HCCC [2012] NSWCA 80 at [34]. 4. Meagher JA, with whom Basten and Emmett JJA agreed, lent greater clarity to these paramount principles, commenting in HCCC v Do [2014] NSWCA 307 at [35]: The objective of protecting the health and safety of the public is not confined to protecting the patients or potential patients of a particular practitioner from the continuing risk of his or her malpractice or incompetence. It includes protecting the public from the similar conduct or incompetence of other practitioners and upholding public confidence in the standards of the profession. That objective is achieved by setting and maintaining those standards and, where appropriate, by cancelling the registration of practitioners who are not competent or otherwise not fit to practise, including those who have been guilty of serious misconduct. Denouncing such misconduct operates both as a deterrent to the individual concerned, as well as to the general body of practitioners. It also maintains public confidence by signalling that those whose conduct does not meet the required standards will not be permitted to practise. 1. Drawing upon the above it is apparent that in fashioning protective orders the Tribunal's jurisdiction is guided by a range of considerations: * First, there may be a need to protect the public against further misconduct by a practitioner; * Secondly, a need for general deterrence; * Thirdly, the high professional standards of the profession must be reinforced, and transgressions must be denounced; * Fourthly, public confidence in the health professions must be maintained. It may be that the circumstances of a particular matter require the Tribunal to give greater weight to some of these considerations, or to consider other matters bearing on the health and safety of the public. 1. As a general rule, costs of proceedings before the Tribunal follow the event: HCCC v Philipiah [2013] NSWCA 342 at [42]. Hearing and Evidence 1. The HCCC filed materials which included documentary evidence concerning the unauthorised computer access, correspondence from Mr Aref to his lawyer in the legal proceedings between him and one of the patients, and a peer expert report. Mr Aref was self-represented at the hearing. On the day of the hearing, with leave and no objection from the HCCC, Mr Aref submitted materials relating to his training, education and professional development. 2. In a response letter from the NSW Nurses and Midwife's Association to the HCCC dated 17 March 2016 on his behalf, Mr Aref acknowledged having accessed the health records in an unauthorised manner. In this letter Mr Aref denied disclosing the information and reiterated the claim made in the 9 March 2015 interview that he had knowledge of the information from other sources. 3. In oral evidence Mr Aref readily acknowledged that his access to the health records was improper and in breach of the relevant policies and codes particularised in the complaint. He conceded that this was unsatisfactory professional conduct. 4. The HCCC peer expert, Carol Martin was strongly critical of the practitioner's conduct. Ms Martin noted that all staff working in the NSW public health system are bound by law, by policies and by a strict code of conduct, to maintain confidentiality of patient information. Ms Martin characterised the conduct as an improper use of professional position and in addition to the violation of patient privacy noted that the conduct evinced a disregard for the potential harm to the professional reputation and career of the staff member whose log in was utilised. 5. Mr Aref initially sought to dispute the allegation that he had 'used another staff member's logon to access' the records. This dispute rested upon a characterisation of what it means to 'log on'. Mr Aref did not actually type in the other staff member's credentials. Rather, when Mr Aref accessed the computer the system it had already been logged in and active for some period of time under another staff member's credentials. However, it was uncontested that Mr Aref's access to the relevant records was unauthorised and involved the use of a database which was accessible only because of that other staff member's credentials. Therefore, this aspect of the complaints was established, and Mr Aref ultimately conceded that this was so. 6. The only real issue in dispute was the practitioner's motivation in accessing the relevant records. This issue was of significance because particular 3 in Complaints 1-6, is that the practitioner accessed the records in pursuit of his own personal interest. In addition, the practitioner's motivation is highly relevant to the question of the whether the conduct was improper and unethical in addition to being significantly below the standard reasonably expected of a practitioner of an equivalent level of training or experience. 7. The HCCC contended that Mr Aref opportunistically sought access to the health records in order to seek information which he could utilise to his advantage in his disputes with the patients. Although the HCCC did not seek to prove that the information was ultimately disclosed in the legal or administrative proceedings that Mr Aref was embroiled in at the time of the incident, it did tender material seeking to demonstrate that Mr Aref had communicated specific information about Patient B to his lawyer shortly after the unauthorised access. 8. Throughout his evidence, Mr Aref continued to insist that he had examined the health records of Patients A-E out of idle curiosity with no intent to utilise the information that he gained access to. 9. Mr Aref maintained under cross examination that the specific piece of information about Patient B which was communicated by him to his lawyer was information that he was already in possession of, and was communicated prior to his unauthorised access of Patient B's health record. 10. The practitioner met with his lawyer the day after the unauthorised access, 15 August 2014. On 7 September 2014 Mr Aref sent an email to his lawyer stating, 'As I mentioned in our second meeting' before then referring to the specific and detailed piece of health information about Patient B. 11. The practitioner sought to argue that his 7 September 2014 email referred to a different meeting with his lawyer than that which occurred on 15 August 2014. Mr Aref sought to establish that the 'second meeting' he had with the lawyer pre-dated the unauthorised access to the health records and that the 15 August 2014 meeting was in fact the third time they had met. In the midst of oral evidence Mr Aref was given leave to introduce into evidence further emails and billing records from his lawyer concerning their meetings. These documents were inconclusive as to whether any additional or earlier meeting occurred. 12. Mr Aref consistently claimed that he had prior knowledge of the incident concerning Patient B because a friend who used to work at the relevant hospital had telephoned him to tell him about it at the time. Mr Aref did not know the friend's last name and did not know whether the friend was actually working at the hospital at the time he called. Nor did Mr Aref originally accurately recall which country he had been in when he received the phone call. 13. Under cross-examination Mr Aref conceded that there were details of the Patient B incident that he was only aware of in September 2014 because of his unauthorised access to Patient B's health record. The email of 7 September 2014 contains those details. 14. The documentary evidence shows that Patient B's health record was accessed twice by Mr Aref on 14 August 2014, and 25 separate tabs were opened in that record. 15. The Tribunal determines that the only logical inference is that the email of 7 September 2014 was referring to the most recent communication that had taken place between Mr Aref and his lawyer, being the meeting of 15 August 2014. 16. Having regard to evidence, the inescapable conclusion is that Mr Aref was seeking information adverse to the interests of Patients A-E when he accessed their confidential health records. Mr Aref searched multiple records in a systematic fashion at a time when he was engaged in dispute with Patients A-E and in litigation with Patient A, and he communicated specific information about Patient B to his lawyer shortly thereafter. 17. Whether or not Mr Aref had an additional source of information about Patient B, or whether he ultimately utilised the confidential information to any effect in the legal and administrative proceedings, is not relevant to these complaints as particularised, and therefore need not be determined. 18. The practitioner gave evidence that his actions on 14 August 2014 were uncharacteristic and were the product of a particularly acute period of personal stress, distress and clouded judgement. In addition to family stresses and the litigation arising out of the dispute with the patients, Mr Aref's father had recently died after a long illness, during which Mr Aref was his primary caregiver. 19. Mr Aref attested that he had never before, and would never again, access health records in an unauthorised manner. He expressed deep remorse and a sense of shame at what had occurred and stated that he had learnt from this mistake. The practitioner submitted evidence that he had undertaken a number of ethics and privacy professional development courses since the incident. 20. The practitioner testified that he had continued to practise for the four years since the incident with no conditions on his practice, no complaints about his professional conduct and no further incident. 21. Mr Aref stated that he is committed to the primacy of patient interests, including privacy and confidentiality. He also stated that he is now much clearer about professional and personal boundaries, and more alert to managing personal stresses. Findings and Appropriate Orders 1. All of the particulars and Complaints 1-7 are established to the required standard. 2. The practitioner unprofessionally and improperly accessed multiple health records. He did so with an intent to advance his own interests and to damage those of at least some of the patients whose privacy he breached. We find that this was a most serious abuse of his professional position. 3. We conclude that the proved complaints must be characterised as professional misconduct both by virtue of the deliberate and unethical nature of the conduct, as well as by reference to the importance of upholding the interest that was breached, patient privacy and confidentiality. Complaint 8 is established. 4. The safekeeping and proper use of health information is vital to the protection of the health and safety of the public. As the peer expert noted, 'Client confidentiality and privacy underpins all health care across Australia.' Patients must be able to trust that the private health information that they provide to health professionals, and which is generated in the course of provision of health care, will be securely held and only accessed lawfully and properly. 5. The duty of health care professionals is to use, and safeguard health information and to only access this information in the best interests of patients to serve their health needs, except in the very limited circumstances where there is an overriding consideration such as the health and safety of the public. Patients, and the health system as a whole, depend upon this professionalism. 6. The HCCC argued for cancellation of the practitioner's registration with a non review period of 6 to 12 months. Counsel for the HCCC submitted that such order was necessary by reference to the need for general deterrence, to reinforce the high professional standards of the nursing profession, and to maintain public confidence, given the deliberate, self-interested nature of Mr Aref's conduct, his lack of insight into his conduct and his lack of candour with the Tribunal. 7. Counsel for the HCCC submitted that the Tribunal could not be satisfied that the practitioner has genuine insight into the seriousness and inappropriate nature of the conduct and as such could not trust him to continue safely in practice. In the alternative the HCCC proposed that a period of suspension should be followed by practice conditions requiring mentoring for at least 12 months and further education. 8. While the Tribunal rejected Mr Aref's account of his motivation in accessing the information, we do not conclude as a consequence that the practitioner was wholly lacking in insight or candour. Mr Aref made early admissions concerning the breaches and he at all times accepted that his conduct was wrong. 9. On balance, we accept the practitioner's evidence that this incident, while extremely serious, represents a one-off lapse of judgement on his part; moreover one which occurred at a uniquely and acutely difficult period of his life. 10. This incident occurred some years ago. While suspension as a disciplinary response may have been more relevant as a specific deterrent to the practitioner closer to the time of events, we have concluded that a period of suspension, combined with a reprimand, remains appropriate in these proceedings particularly in order to signal the gravity of the misconduct to the public and the profession. 11. We encourage Mr Aref to develop stronger professional networks and to seek mentoring and support from colleagues in the future, but do not accept the HCCC submission that conditions to that effect are necessary in this instance in order for the practitioner to practise safely. Costs 1. The HCCC was successful in its case and is entitled to costs. Orders 1. Mr Aref is reprimanded for breach of patient privacy and confidentiality. 2. The practitioner's registration as a nurse is suspended under s 149C(1)(b) of the National Law for a period of six months from the date of these orders. 3. Respondent to pay the Applicant's costs of these proceedings pursuant to cl 13(1) of Sch 5D of the National Law as agreed or as assessed under the Legal Profession Uniform Law Application Act 2014 (NSW). ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 16 August 2018