DKV v Southern NSW Local Health District [2019] NSWCATAD 12

Civil and Administrative Tribunal New South Wales Medium Neutral Citation: DKV v Southern NSW Local Health District [2019] NSWCATAD 12 Hearing dates: 15 October 2018 Date of orders: 08 January 2019 Decision date: 08 January 2019 Jurisdiction: Administrative and Equal Opportunity Division Before: R L Hamilton S.C, Senior Member Decision: The Tribunal decides to take no action in respect of conduct other than that which the respondent conceded involves a breach of the HPPs. Catchwords: HEALTH – privacy- Health Privacy Principles- jurisdiction of Tribunal- HPP 9 and HPP 11. Legislation Cited: Health Records and Information Privacy Act 2002 Privacy and Personal Information Protection Act 1998 Cases Cited: ALZ v WorkCover NSW [2015] NSWCATAP 138 CEU v University of Technology Sydney [2018] NSW CATAD 13 KJ v Wentworth Area Health Service [2004] NSWADT 84 Texts Cited: Nil Category: Principal judgment Parties: DVK – Applicant Southern NSW Local Health District - Respondent Representation: Solicitors: DVK (Self Represented) (Applicant) Crown Solicitor's Office (Respondent) File Number(s): 2018/00111711 Publication restriction: Nil

REASONS FOR DECISION 1. This is a review by the Tribunal of the respondent agency's conduct in relation to a confidential medical report about the applicant. The applicant considers that the agency contravened the Health Privacy Principles (HPPs) laid down by the Health Records and Information Privacy Act 2002 (HRIP Act). The HPPs protect individuals in relation to the collection, storage, use and disclosure of their health information by 'organisations'. A 'public sector agency' is one of two types of organisation bound by the HRIP Act. The respondent is a 'public sector agency'; and is bound by the Act (ss 4, 11). It has been agreed between the parties (where the applicant appeared by telephone) that this should be done 'on the papers'. 2. In brief the applicant consulted with a specialist in a health facility conducted by the respondent. The specialist took notes. The specialist sent a report on the consultation in a referral letter to GP 1 who was not the current treating GP of the applicant (the wrong GP) and also to GP 2 who was the current treating GP. 3. The applicant has alleged that there have been breaches of the Health Privacy Principles (HPP) and seeks remedial action and compensation. It has been agreed between the parties that the matter of liability will be determined as a preliminary question and the issue of compensation will be dealt with later. 4. The issues are whether there has been a breach of: 1. HPP 2 (collection) being the collection of health information that was irrelevant, excessive, inaccurate or in a manner that was intrusive. This claim gives rise to a question of whether the Tribunal has jurisdiction to determine it, since it was not made in the applicant's complaint and therefore the respondent's IR has not addressed the question. 2. HPP 4 (collection) that the applicant was not informed about the purpose for which the information was being collected or to whom it might be disclosed. 3. HPP 9 (accuracy) in that the respondent did not ensure that the applicant's health information was relevant, accurate and up to date before it was used. 4. HPP 11 (disclosure) when it sent a copy of the specialist's referral letter to both the wrong GP, and the applicant's treating GP. 1. The respondent concedes that it breached HPP 11 by sending the referral letter to the wrong GP. It also concedes that it breached HPP 4 in relation to informing the applicant about the purpose for collecting information and to whom it might be disclosed. 2. For this reason the live questions which remain are whether there was a breach of HPP 11 in the provision of a copy of the referral letter to the treating GP; whether there was a breach of HPP 9; and finally whether the Tribunal has jurisdiction to determine whether there has been a breach of HPP 2.