|
Where am I now? Lawlink > privacynsw > Case Law > KJ v Wentworth Area Health Service
|
Print page
|
KJ v Wentworth Area Health Service
[2004] NSWADT 84
Date of Decision: 3 May 2004
Case Note
Background
KJ was receiving treatment for cancer in hospital. The notes of KJ’s consultations with the hospital’s psychologist and psychiatrist were placed on KJ’s general medical file held by the hospital. There was also evidence that KJ’s psychological information was disclosed to two doctors outside of the hospital.
Issues
(i) Collection of information (section 10)
KJ alleged that she was not informed that her psychological information would be held on her general medical file and therefore accessible to members of hospital staff other than the psychologist and psychiatrist; nor was she informed that her psychological information would be sent to doctors outside of the hospital. KJ claimed that this conduct breached section 10 of the Privacy and Personal Information Protection Act 1998 (PPIP Act). The requirements of section 10 include taking reasonable steps to tell individuals about the purposes for which their information is being collected and the intended recipients of the information.
The Area Health Service argued that section 10 did not require it to inform individuals about the recipients of the information if those recipients were employed by the Area Health Service. The Tribunal disagreed with this submission: “Such an artificial distinction (between employees and those outside the agency) is not consistent with the (PPIP) Act purpose of establishing principles for dealing with personal information in an open and accountable manner” (para. 33).
The Tribunal agreed with the Privacy Commissioner’s submissions that the type of personal information at issue is relevant in determining whether an agency has taken such steps as are reasonable in the circumstances to make an individual aware of the matters in section 10 (para. 36). The Tribunal was not satisfied in this case that the Area Health Service took such steps as were reasonably necessary to make KJ aware of the intended recipients of the information.
(ii) Disclosure of personal information (section 19)
KJ alleged that the disclosure of her psychological information to two doctors outside of the hospital, without her knowledge or consent, was a breach of section 19 of the PPIP Act. The Privacy Commissioner submitted that disclosure may also be relevant in some instances where a dissemination of information occurs within an agency if the agency consists of discrete units and/or the information is particularly sensitive.
The Tribunal generally agreed with the Privacy Commissioner’s submissions that disclosure of information could occur within a public sector agency:
While generally speaking the expression “disclosure” refers to making personal information available to people outside an agency, in the case of large public sector agencies consisting of specialised units, the exchange of personal information between units may constitute disclosure (para 50).
The Tribunal found that the Area Health Service had breached section 19 in disclosing KJ’s psychological information to two outside doctors. Further, while there was no evidence that there had been a disclosure of KJ’s information to hospital staff, Tribunal Member Montgomery stated that:
(I)t is my view that by placing the sensitive information on KJ’s general medical file, the Agency was at risk of disclosing that information. The exchange of the information between units within the Agency could, in my view, constitute disclosure (para 51).
(iii) Consent to disclosure of information
KJ submitted that the patient registration form used by the hospital was inadequate for the purpose of obtaining informed consent from individuals to the collection of health information and the sharing of this information among clinicians in a multidisciplinary treating ‘team’. In particular KD asserted that there was no need for psychosocial information to be disclosed to members of the treating ‘team’ as a standard procedure, and that this should only occur with the consent of the patient.
While the Tribunal did not have jurisdiction to deal with the issue of whether the patient registration form was adequate for obtaining informed consent, Judicial Member Montgomery stated that:
(I)t is my view that the matter should be given further consideration by the Agency so as to ensure that any procedures it adopts will ensure that it can comply with the requirements of the Privacy Act and that any consent provided by its clients is informed consent.
Orders
The Tribunal made orders refraining the Area Health Service from further breaching sections 10 and 19 of the PPIP Act in relation to KJ’s personal information.
Comments
This case highlights the need for agencies to be open and clear with individuals when collecting their sensitive personal information such as health information, and to ensure that individuals are informed about who their information may be disclosed to (whether the recipients are external to or within an agency). The case may also provide guidance in relation to the requirements of the Health Records and Information Privacy Act 2002 when that Act commences.
|
|
