• Overview
• Disclosure of health information
• Patient access to medical records
• Retention of young people’s health information

OVERVIEW

9.1 Information about an individual’s health is one of the most sensitive types of data, irrespective of the age of the individual. In regulating the disclosure of and access to this type of information, the law must achieve a balance between various competing interests. One of the most fundamental contests is between the patient’s interests in confidentiality and third party interests in disclosure of health information. A further area of tension involves patient access to medical records and the interests that may justify denying access to those records. This chapter considers the ways in which the law currently manages these issues in relation to young people and highlights the areas that may require clarification or change.

DISCLOSURE OF HEALTH INFORMATION

The duty of confidentiality

9.2 The basic legal and ethical position is that medical practitioners must not disclose any health information without the consent of the patient concerned. This position is reflected in the duty of confidentiality, which is owed by all medical practitioners.¹ The duty ensures that patients are able to discuss their health freely with their medical practitioner, safe in the knowledge that the information will remain confidential. In so doing, it promotes both private and public interests in addressing individuals’ health problems and encouraging good health more generally.² Case law confirms that these interests apply equally to young people as to adults.³

Sources of the duty of confidentiality

9.3 The duty of confidentiality is an ethical and legal obligation owed by medical practitioners to their patients. In its legal dimension, the duty may stem from contract, tort, equity or statute.

Ethics

9.4 A duty of confidentiality is imposed by various codes of ethics, which apply to the medical profession. For example, under the Hippocratic Code, which is probably the most widely-known statement of medical ethics, medical practitioners are obliged to keep in confidence patient information that was seen or heard “professionally or privately, which ought not to be divulged.”⁴ A similar obligation is enshrined in the Australian Medical Association’s Code of Ethics:

Maintain your patient’s confidentiality. Exceptions to this must be taken very seriously. They may include where there is a serious risk to the patient or another person, where required by law, where part of approved research, or where there are overwhelming societal interests.⁵

Contract

9.6 The relationship between a medical practitioner and a patient is traditionally regarded as contractual in nature. The medical practitioner performs services in consideration for fees payable by the patient. Case law suggests that in the absence of a special contract between the medical practitioner and patient, the medical practitioner impliedly undertakes to advise and treat the patient with reasonable care and skill, and to maintain or improve the health of the patient generally.⁷ Confidentiality may be regarded as a necessary element of compliance with these duties.

9.7 The traditional contractual view of the medical practitioner/patient relationship may be difficult to sustain where a third party pays the cost of the medical practitioner’s fees. Where a young person receives medical treatment, the consideration for the service is likely to be provided by his or her parents or by a health care system such as Medicare. One view is that in this type of situation, there is no contractual relationship between the medical practitioner and the under-aged patient and consequently no implied duty of confidentiality. The alternative view can be based on one or other argument that submission to treatment by the under-aged patient is a form of consideration⁸ or payment by a third party is properly regarded as payment on behalf of the under-age contracting party.⁹

Tort

9.8 Medical practitioners owe their patients a duty of reasonable care and skill in tort.¹⁰ No case in Australia has considered whether this duty embodies an obligation of confidentiality. However, applying the traditional principles of negligence, it is arguable that disregard of patient confidentiality may breach the duty of care in certain circumstances. These circumstances are as follows:

• the medical practitioner failed to exercise reasonable care in not keeping the information confidential;
• it was reasonably foreseeable that disclosure could harm the patient; and
• the patient has suffered some actual measurable harm or loss as a result of the disclosure.¹¹

9.9 The clearest statements of obligations relating to confidential information are found in equity. Medical practitioners owe their patients an equitable duty of confidence.¹² Disclosure of information about a patient will breach this duty if the information:

• is confidential in nature;
• was imparted in circumstances giving rise to an obligation of confidence; and
• was used without authorisation to the detriment of the patient.¹³

9.11 However, difficulties may arise in establishing the third element of a breach. It will be necessary for the affected individual to demonstrate that some form of detriment flowed from the unauthorised disclosure. As case law accepts that detriment need not be economic, consequences such as distress, humiliation or embarrassment may suffice.¹⁵

Statute

9.12 While various statutes touch on the issue of medical confidentiality,¹⁶ the most comprehensive statutory statements are found in privacy legislation. Commonwealth and State privacy legislation regulates the collection, storage, use and disclosure of health information by public and private sector health service providers. At the federal level, the relevant legislation is the Privacy Act 1988 (Cth).¹⁷ This Act contains ten National Privacy Principles, which set the minimum standards for patient privacy.¹⁸ Principle 2 imposes an indirect statutory duty of confidentiality on health professionals by providing that information must not be disclosed unless certain, specified circumstances exist.¹⁹

9.13 In New South Wales, the privacy of individuals’ health information is addressed by the Health Records and Information Privacy Act 2002 (NSW), which commences on 1 July 2004. It covers every public or private sector organisation that is a health service provider or that collects, holds or uses health information. The primary way in which it regulates the handling of health information is by requiring that these organisations comply with the Health Privacy Principles.²⁰ Principles 10 and 11 regulate the use and disclosure of health information by establishing a basic prohibition on non-consensual use or disclosure, which is accompanied by an exhaustive list of circumstances in which non-consensual use or disclosure is permissible.²¹ Accordingly, like the Privacy Act 1988, the Health Records and Information Privacy Act 2002 imposes an indirect statutory duty of confidentiality on medical practitioners.

Permissible disclosure of health information

9.14 While the duty of confidentiality is an essential element of the relationship between medical practitioners and their patients, the duty is not absolute. This reflects the realities of medical practice and the existence of competing interests, such as the public interest in detecting child abuse. In an effort to achieve a balance between confidentiality and practicality or other interests, the law permits, and sometimes compels, disclosure of confidential health information. There are four particular circumstances in which the law concerning permissible disclosure of young people’s health information may require change or clarification:

• when parents request disclosure of their child’s health information;
• when the consent of the patient renders disclosure permissible;
• when disclosure is authorised by the Health Records and Information Privacy Act 2002 (NSW); and
• when the public interest in preventing harm to a young person requires disclosure.

9.15 It is unclear to what extent young people have a right to have medical information kept confidential from their parents. The prevailing view in the literature is that a young person who has sufficient understanding and intelligence to consent to a particular medical treatment should have the right of confidentiality with respect to that treatment.²² Hence, if a medical practitioner adjudges a young person to be competent to consent to receive advice on contraception, the medical practitioner is obliged not only to give such advice but also to keep the consultation confidential from the young person’s parents. The rationale for this view is that if parents do not have the power to consent to a medical treatment that their child seeks, they do not require the power to obtain medical information about that treatment.

9.16 There are two competing views regarding the position of young people who are incapable of giving valid consent to a medical treatment. One view states that if a young person proves to be incompetent to consent to a treatment, the medical practitioner may disclose the young person’s medical information to the parents.²³ The basis of this view is twofold. First, it is argued that the obligation of confidence is based on a person’s autonomy. No obligation of confidence can be owed to a young person who is incompetent to give consent to a medical treatment, since he or she is, by that token, not capable of exercising autonomy as regards the treatment he or she wanted. Secondly, it is argued that parents have a right to know information necessary to carry out effectively their parental duties of care.²⁴ A parent may not be able to ensure the welfare and health of a young person without information about the young person’s health or medical requirements.

9.17 The alternative view is that even where a young person is found to lack the capacity to consent to a medical treatment, the fact that he or she consulted the medical practitioner, and what the medical practitioner has learned in the process of assessing competence for that particular treatment, must be kept confidential, if the young person expressly objects to the disclosure or gave the information with an expectation that it would not be disclosed to others. Such a test requires an inquiry into whether or not the young person can comprehend an obligation of secrecy with respect to the medical information obtained by the medical practitioner.²⁵ In support of this view, it is argued that the preservation of confidentiality is not based solely on the recognition of the autonomy of certain young people. It is also founded on young people’s right to and need for privacy, which should not be less than those of adults. Moreover, there is a public interest argument relating to effective health services: without the guarantee of confidentiality, many young people will not seek medical advice or treatment.²⁶ For example, almost half of adolescent girls in a US study said they would stop using Planned Parenthood clinics (which provide family planning and reproductive health services) if parental notification of contraceptive services were required, and many would engage in behaviours that increase their risk of pregnancy and sexually infectious diseases.²⁷

 

Case study Sarah is a 13 year old who is sexually active and has been seeing a 15 year old boy. She went to see a medical practitioner because she had some abnormal discharge from her vagina. She tested positive for Chlamydia, for which she was given some medication. The medical practitioner also gave Sarah advice on sexually transmitted diseases and contraception. However, she was not always certain that Sarah fully understood all the information. She was concerned about Sarah’s seeming sexual recklessness and vulnerability to pressure from her peers, especially her boyfriend. She feared Sarah might in the future contract a more serious STD or have an unwanted pregnancy. The medical practitioner assured Sarah that she was welcome to talk to her anytime and in fact planned a few more sessions. However, she also encouraged her talk to her parents about her boyfriend, perhaps even about the fact that she had contracted an STD. Sarah was adamant that her parents should not know about her health situation or any other information she had given. Queries: Should Sarah’s parents have a right to be informed that (1) she had an STD; and (2) she is getting contraceptive advice and treatment?28 Is parental involvement, which allows parents to discuss their values with their children, the most effective way of preventing children’s sexual health problems? Does confidentiality of young people’s health information undermine parental authority and family autonomy? If sexually active young people will refuse to seek care if they have to inform a parent or need to get their parent’s consent, do the benefits of confidentiality outweigh other interests, in particular the rights of the parents to exercise their parental duties?

 
9.18 The issue of disclosure to parents is likely to arise in situations involving health information, which the young person considers to be personal and sensitive in nature, for example those relating to reproduction and sexual health, drug dependency and depression. A young person is unlikely to object to his or her parents being informed about a treatment for a common cold. Clearly, the type of health information involved is significant in problems concerning confidentiality. If a test involving an expectation of non-disclosure were adopted, the nature of the health information in question could simply be a relevant factor in assessing whether or not the test has been met. An alternative approach would be to argue that the content of a right of confidentiality should be based on the type of health information involved. That is, young people should have a right not to disclose to their parents only certain types of health information.

Issue 9.1

(a) Should young people have the right to keep their health information confidential from their parents?

(b) If so, should such a right be confined to situations where a young person can validly consent to their medical treatment? Or should it extend to situations where the young person, while not competent to consent to the treatment in question, had an understanding of the concept of secrecy and gave information to the medical practitioner with an expectation that it would not be disclosed?

(c) What should be the significance of the nature of the health information? Should young person’s right to keep their health information confidential from their parents apply only to certain classes of health information, for example those relating to reproduction and sexual health?

Consent

9.19 The realities of medical practice dictate that it is often necessary for information about patients to be shared among a number of health professionals. For example, a team of health professionals, comprising medical practitioners, nurses and social workers, may share responsibility for a patient who is receiving treatment in a hospital. In order to facilitate the necessary information sharing, the law recognises that disclosure of confidential information will not breach the duty of confidentiality if it is done with the patient’s consent.²⁹ Consensual disclosure also enables information to be given to other third parties, such as family members, insurance companies or legal advisers.

9.20 An issue that arises in relation to under-age patients is whether, and in what circumstances, they have the capacity to consent to the disclosure of their medical information. In considering this issue, it may be appropriate to distinguish between a situation where a young person was competent to consent to the medical treatment in question and one where he or she was not. As regards the first situation, it is probable that capacity to consent to disclose health information depends on whether the young person was competent to and in fact gave consent to the treatment in question. There appears to be no justification for requiring a higher degree of competency in the area of disclosure than in that of treatment.

9.21 With regard to the situation where a young person is adjudged incompetent to consent to a treatment, it may be appropriate to shift the focus from capacity to consent to treatment to capacity to comprehend the notion of secrecy coupled by an expectation of confidentiality. On this approach, a young person who is incompetent to consent to a particular treatment but who nevertheless had an understanding and expectation of confidentiality when he or she disclosed the information to the medical practitioner is competent to consent to disclosure. A possible objection to this argument is that the potential implications and consequences of disclosure are more complicated than the concept of secrecy. It follows from this view that it is inappropriate to equate capacity to comprehend confidentiality with capacity to consent to disclosure. These concerns appear to be reflected in the Health Records and Information Privacy Act 2002 (NSW), which indirectly provides that an individual is incapable of providing valid consent to disclosure if that individual does not understand the general nature and effect of giving consent.³⁰ Accordingly, even though a young person may understand the idea of secrecy, he or she will nevertheless be unable to provide valid consent to disclosure under the Act if the consequences of that consent are not understood.

Issue 9.2

(a) What should be the test in determining whether or not a young person can give a valid consent to disclose his or her health information?

(b) Should young people who are competent to consent to medical treatment automatically be competent to consent to the disclosure of the health information obtained from that particular treatment?

(c) Should young people who are not competent to consent to medical treatment be able to provide a valid consent to the disclosure of their health information? If so, in what circumstances?

(d) Should the nature of the health information affect the response to any of these issues?

Issue 9.3

(a) Where a young person cannot consent to disclosure of his or her health information, should the young person’s parents have the authority to do so?

(b) If so, should there be any limitations on the exercise of such authority?

9.23 In addition to providing statutory authorisation for consensual disclosure, the Health Records and Information Privacy Act 2002 (NSW) specifies a range of circumstances in which non-consensual disclosure of health information is permissible. These circumstances are:

• where the purpose of disclosure (the secondary purpose) is directly related to the primary purpose for which the information was collected and the individual would reasonably expect the organisation to disclose the information for that secondary purpose;³³
• where disclosure is reasonably believed to be necessary to lessen or prevent a serious and imminent threat to the life, health or safety of the individual or another person;
• where disclosure is reasonably believed to be necessary to lessen or prevent a serious threat to public health or public safety;
• where disclosure is reasonably necessary for the funding, management, planning or evaluation of health services and reasonable steps are taken to de-identify the information or, if the information cannot serve its purpose if it is de-identified, it is not published in a generally available publication;
• where disclosure is reasonably necessary for the training of employees of the organisation or persons working with the organisation and reasonable steps are taken to de-identify the information or, if the information cannot serve its purpose if it is de-identified, it is not published in a generally available publication;
• where disclosure is reasonably necessary for research, or the compilation or analysis of statistics, in the public interest and reasonable steps are taken to de-identify the information or, if the information cannot serve its purpose if it is de-identified, the research will not be published in a form that identifies particular individuals or from which an individual’s identity can reasonably be ascertained;
• where the disclosure is to provide the information to an immediate family member of the individual for compassionate reasons and the individual is incapable of giving consent to the disclosure;³⁴
• where the disclosure is to a law enforcement agency for the purposes of ascertaining the whereabouts of an individual who has been reported as a missing person;
• where the organisation has reasonable grounds to suspect that a person has engaged in unlawful activity, in conduct that amounts to unsatisfactory professional conduct or professional misconduct under a health registration Act or in conduct that may be grounds for disciplinary action and discloses the information as a necessary part of its investigation of the matter or in reporting its concerns to relevant authorities;
• where the disclosure is reasonably necessary for the exercise of law enforcement functions by law enforcement agencies in circumstances where there are reasonable grounds to believe that an offence may have been, or may be, committed; or
• where the disclosure is reasonably necessary for the exercise of complaint handling functions or investigative functions by investigative agencies.³⁵

(a) Should non-consensual disclosure of a young person’s health information be permitted in any circumstances other than those listed in the Health Records and Information Privacy Act 2002 (NSW)?

(b) Should the Health Records and Information Privacy Act 2002 (NSW) impose any additional limitations or controls on non-consensual disclosure of a young person’s health information?

9.24 A general exception to confidentiality arises where the public interest in disclosure outweighs the interest in confidentiality. English courts have couched the exception in terms of the balancing of competing public interests:

[T]he process is to consider fairly the strength and value of the interest in preserving confidentiality and the damage which may be caused by breaking it .... This is a more complex process than merely using the scales: it is an exercise in judicial judgement.³⁶

9.26 In New South Wales, Parliament has effectively recognised a public interest exception to confidentiality where there is a risk of harm to a child. Section 27 of the Children and Young Persons (Care and Protection Act) 1998 (NSW) provides that medical practitioners (among others) who have reasonable grounds to suspect that a child is at risk of harm, and those grounds arise during the course of or from the person’s work, must report to the Director-General of the Department of Youth and Community Services the name, or a description, of the child and the grounds for suspecting that the child is at risk of harm.⁴⁰ The Director-General has the power to direct certain bodies, including an area health service and a hospital, to furnish the information concerning the child.⁴¹ The Director-General also has powers to take whatever action is necessary to safeguard or promote the safety, welfare and well-being of a child or young person.⁴²

9.27 The mandatory reporting requirement in s 27 of the Act applies to children, defined as persons under the age of 16 years.⁴³ It does not apply to 16 and 17 years olds, referred to by the Act as young persons.⁴⁴

Issue 9.5

Should the mandatory reporting requirement contained in s 27 of the Children and Young Persons (Care and Protection) Act 1998 (NSW) apply also to 16 and 17 year olds?

• the basic physical or psychological needs of a child or young person are not being met or are at risk of not being met;
• the parents or other caregivers have not arranged and are unable or unwilling to arrange for the child or young person to receive necessary medical care;
• the child or young person has been, or is at risk of being, physically or sexually abused or ill-treated;
• the child or young person is living in a household where there have been incidents of domestic violence and, as a consequence, the child or young person is at risk of serious physical or psychological harm; or
• a parent or other caregiver has behaved in such a way towards the child or young person that the child or young person has suffered or is at risk of suffering serious psychological harm.⁴⁵
Issue 9.6

Are there other situations that should be added to the list in s 23 of the Children and Young Persons (Care and Protection) Act 1998 (NSW)?

9.29 Medical records are a core feature of most healthcare systems. They ensure that a comprehensive medical history is available to the individual who is the subject of the record and also to those involved in that individual’s current and future healthcare. In addition, they provide a record of the diagnosis and treatment in case of future inquiry or dispute. Given these functions and the highly personal nature of the information contained in medical records, patients have an obvious interest in obtaining access to them. However, patient access is not automatic and unlimited. The following discussion seeks to identify the arguments for and against granting patient access to records and to outline the ways in which the law facilitates and controls that access.

Arguments in support of granting patient access

9.30 The information in medical records concerns the personal integrity and autonomy of a patient.⁴⁶ Given the nature of the information, the patient has an unquestionable interest in the records, and this constitutes strong justification for being granted access to them. As noted above, medical records ensure that a comprehensive medical history, containing details of diagnosis and treatment, is available to the individual concerned. It may be argued that their value in providing such a history would be frustrated if patients could not obtain access to them, either for their own reference or to pass on to a third party such as a legal or medical adviser. The ability to provide medical records to third parties is becoming increasingly important as people become more mobile and have a wider array of choices on health care. Many people, including young people, seek the services of several different healthcare professionals, such as general practitioners, nurses and specialists, as well as of allied healthcare professionals such as physiotherapists, chiropractors, osteopaths, optometrists, pharmacists, psychologists, etc. Patients and their medical advisers need each of the pieces of information held by these various health care professionals to form a whole picture of the patient’s health.⁴⁷

9.31 There are other practical reasons for giving patients access to their records. For example, it improves the relationship between patients and medical practitioners, which contributes to better health care for patients. Several studies suggest that sharing medical records with patients improves communication between patients and medical practitioners, increases patients’ trust and confidence in their medical practitioners, helps them deal with their condition and increases their compliance with treatments.⁴⁸

Arguments against granting patient access

9.32 A key objection to granting patient access is that the records may be meaningless to the patient or may be misinterpreted. This argument may have particular validity when the patient is a young person. However, it has been said that if the records are in fact meaningless, while they may not help the patient, neither will they cause harm.⁴⁹ As regards the risk of misinterpretation, this can be minimised through the use of non-technical terminology or by advising a patient that they should seek assistance in understanding the records from a healthcare professional or other third party, such as a parent.⁵⁰

9.33 The cost of providing access may be raised as a practical justification for denying or limiting it. However, it has been pointed out that changes in technology, in relation to both information and medical technology, make the provision of a patient’s file realistic and inexpensive.⁵¹ Furthermore, access to and copying of the files may be made conditional on payment by the patient of reasonable costs.

9.34 There is a concern that patient access may lead to a decrease in completeness and candour in medical records. However, medical practitioners have an obligation to keep accurate records and failure to do so may make them liable for professional misconduct or negligence.⁵² Given this background, it is unlikely that a responsible and ethical medical practitioner would omit from a medical record information that, in the interests of medical care, belonged in it merely because of the possibility that the patient may ask to inspect it.⁵³ Indeed, some studies suggest that recording of patient information is not materially affected by the knowledge that patients may be given access to the records.⁵⁴

9.35 A further common concern is that in certain circumstances, granting access to records may cause distress to the patient to an extent that may hinder treatment. The argument is that patients may become so emotionally distraught on disclosure of medical information that they may not be able to make a rational decision about their treatment or may suffer psychological damage. However, some studies indicate that access to records does not make patients unduly anxious. On the contrary, access to their health information is reassuring, informative and helpful to patients.⁵⁵

The common law position

9.36 In Australia, a patient has no right of access to his or her medical records apart from statute.⁵⁶ However, an exception to this general position may arise if the records are documents that the medical practitioner obtained on behalf of the patient, such as x-ray photographs:

Documents created merely for the purposes of the doctor, for example, as records of his practice, as material from which to assess charges and the like will be the property of the doctor. On the other hand, some documents created for the purpose of enabling the doctor to diagnose and to determine the treatment to be recommended may be the property of the patient. Thus, a document, though held by the doctor, may be the property of the patient because it was procured by or for the patient and has been paid for by her. X-rays, pathology reports and some reports by consultant specialists may be such .… Correspondence with consultant specialists or with treating hospitals may, if of this kind, be the property of the patient.⁵⁷

Legislation allowing access to medical records

9.38 Although there is no common law right of access to medical records, legislation in New South Wales allows patients to obtain access to their records, subject to certain limitations.

Freedom of Information Act 1989 (NSW)

9.39 Patients of State hospitals or other public sector healthcare providers may invoke the Freedom of Information Act 1989 (NSW), which gives a person “a legally enforceable right to be given access to [a public sector] agency’s documents in accordance with this Act.”⁶⁰ It is acceptable for a parent to make an application on behalf of a child.⁶¹ However, where disclosure of a young person’s medical records would prejudice his or her interests or otherwise be “unreasonable”, a parent may be denied access.⁶² Young people may also make an independent application for access to their medical records under this Act, although the Freedom of Information Procedure Manual, issued by the NSW Premier’s Department, advises that if the young person cannot understand the nature of the Freedom of Information Act process, the agency may decide to grant access via a third party, such as the young person’s parent.⁶³

9.40 Access to medical records is subject to a significant condition. The Act provides that in the case of documents containing information of a medical or psychiatric nature, if the agency considers that disclosure of the information may have an adverse effect on the physical or mental health of the applicant, it is sufficient compliance if access to the document is given to a registered medical practitioner nominated by the applicant.⁶⁴

Issue 9.7

(a) Should the Freedom of Information Act 1989 (NSW) contain additional limitations on access to medical records by a young person, such as those found in the NSW Premier’s Department’s Freedom of Information Procedure Manual?

(b) Is the “unreasonable” disclosure provision in the Freedom of Information Act 1989 (NSW) a sufficient control on parental access to medical records?

9.41 Patients in private hospitals have an express right of access to their medical records. The Private Hospitals Regulation 1996 (NSW) requires private hospitals to maintain clinical records of every patient. Access to these records can be requested by and granted to a patient or a patient’s representative.⁶⁵ If the patient is under the age of 16 years, his or her parents are automatically considered to be a “patient’s representative” and can therefore request and be granted access to the patient’s medical record without the consent of the patient.⁶⁶ However, the hospital may refuse access to a patient’s representative, as well as to the patient, if:

• the medical practitioner or dentist in charge of the care of the patient advises that the request should be refused; and
• the licensee of the private hospital is satisfied that access by the patient or representative would be prejudicial to the patient’s physical or mental health.⁶⁷
Issue 9.8

(a) Should the Private Hospitals Regulation 1996 (NSW) contain any additional limits on the right of young people to access their clinical records? For example, should the ability to request access be limited by a test of capacity?

(b) Should the Private Hospitals Regulation 1996 (NSW) contain additional grounds of refusal to grant access to a young person’s parent, in their capacity as a patient’s representative? For example, should access by a parent be dependent upon access being in the under-age patient’s best interests or some other test?

9.42 The Health Records and Information Privacy Act 2002 (NSW) confers a general right of patient access to medical records. In so doing, it extends the scope of patient access beyond records held by public or private hospitals to records held by general practitioners and specialists who have their own practice. The Act provides that “[a]n organisation that holds health information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information.”⁶⁸ For public sector agencies, the limitations and conditions under the Freedom of Information Act 1989 (NSW) continue to apply.⁶⁹ More detailed scope to deny access is given to private sector organisations. A private sector health professional is not required to provide an individual with access to their medical records if:

• providing access would pose a serious threat to the life or health of the individual or any other person and refusing access is in accordance with guidelines issued by the Privacy Commissioner;⁷⁰
• providing access would have an unreasonable impact on the privacy of other individuals and refusing access is in accordance with guidelines issued by the Privacy Commissioner;
• the information relates to existing or anticipated legal proceedings between the private sector person and the individual and the information would not be accessible by the process of discovery in those proceedings or is subject to legal professional privilege;
• providing access would reveal the intentions of the private sector person in relation to negotiations, other than about the provision of a health service, with the individual in such a way as to expose the private sector person unreasonably to disadvantage;
• providing access would be unlawful;
• denying access is required or authorised by or under law;
• providing access would be likely to prejudice an investigation of possible unlawful activity;
• providing access would be likely to prejudice a law enforcement function by or on behalf of a law enforcement agency;
• a law enforcement agency performing a lawful security function asks the private sector person not to provide access to the information on the basis that providing access would be likely to cause damage to the security of Australia;
• the request for access is of a kind that has been made unsuccessfully on at least one previous occasion and there are no reasonable grounds for making the request again; or
• the individual has been provided with access to the health information in accordance with this Act and is making an unreasonable, repeated request for access to the same information in the same manner.⁷¹

Issue 9.9

(a) Should the right of access to medical records, conferred by the Health Records and Information Privacy Act 2002 (NSW), be extended to all young people?

(b) If not, is the statutory test of capacity an appropriate limitation on access or would some other test be more appropriate?

(c) Should the Health Records and Information Privacy Act 2002 (NSW) contain any additional limitations on the exercise of the right of access by those young people who have that right?

(d) Should parents have an independent right of access to their children’s medical records in circumstances where the young person is capable of exercising his or her own right of access? If so, under what circumstances?

9.44 The Health Records and Information Privacy Act 2002 (NSW) provides general principles on the retention of health information:

• The information is kept for no longer than is necessary for the purposes for which the information may lawfully be used.
• The information is to be disposed of securely and in accordance with any requirements for the retention and disposal of health information.⁷⁶

9.46 The rules that apply to public health service providers are different and are governed by regulations issued pursuant to the State Records Act 1998 (NSW). The time limits depend on the nature of the information and the agency that holds it:

• records relating to patients admitted to a hospital - 15 years after young person turns 18;
• records of attendance and treatment of patients presenting to accident and emergency/casualty - 7 years after young person turns 18;
• records of attendance and treatment of clients of a community health centre – 7 years after young person turns 18;
• records maintained by school screening nurses to monitor the health of school children
  – retain until the child leaves school if no abnormality was detected,

  – retain as a community health record if abnormality was detected.⁷⁸

Issue 9.10

Is the law dealing with the retention of young people’s health information adequate?

1. See generally L Skene, Law and medical practice: rights, duties, claims and defences (2^nd edition, LexisNexis Butterworths, Sydney, 2004), Chapter 9.

2. See, for example, the comments in X v Y [1988] 2 All ER 648 at 653 (Rose J) concerning the importance of confidentiality in respect of patients who are HIV positive.

3. “Children, like adults, are entitled to confidentiality in respect of certain information. Medical records is the obvious example”: Venables v News Group Newspaper Ltd [2001] 1 All ER 908 at 939. See also Re C (a minor) (wardship: medical treatment) (No 2) [1989] 2 All ER 791.

4. See G Lloyd (ed), Hippocratic writings (Penguin, Harmondsworth, 1978) at 67.

5. Australian Medical Association, Code of ethics (2003) at para 1.1(l).

6. See Hoile v Medical Board of South Australia (1960) 104 CLR 157 at 163; Medical Practice Act 1992 (NSW) s 36(1)(m). See also para 8.20, 8.24.

7. Breen v Williams (1996) 186 CLR 71.

8. Breen v Williams (1996) 186 CLR 71 at 78 (Brennan CJ).

9. Furniss v Fitchett [1958] NZLR 396 at 399 (Barrowclough CJ).

10. Rogers v Whitaker (1992) 175 CLR 479.

11. See Furniss v Fitchett [1958] NZLR 396.

12. W v Egdell [1990] Ch 359 at 389 (Scott J).

13. Coco v AN Clark (Engineers) Ltd [1969] RPC 41 at 47 (Megarry J). This test has been approved in Australia in Commonwealth of Australia v John Fairfax & Son Ltd (1980) 147 CLR 39 at 51 (Mason J).

14. See W v Egdell [1990] Ch 359 at 389 (Scott J) and Stephens v Avery [1988] 2 All ER 477 at 482 (Browne-Wilkinson V-C).

15. See Attorney-General (UK) v Heinemann Publishers Australia Pty Ltd (1987) 8 NSWLR 86 at 90 (McHugh J). In addition, it should be noted that the need to demonstrate any form of detriment has been questioned: NRMA v Geeson (2001) 40 ACSR 1 at [58] (Bryson J).

16. See, for example, the Health Administration Act 1982 (NSW).

17. The applicability of this Act was extended to the private sector by the Privacy Amendment (Private Sector) Act 2000 (Cth).

18. The Principles are set out in Schedule 3 of the Privacy Act 1988 (Cth).

19. Privacy Act 1988 (Cth) Sch 3.

20. These Principles are contained in Health Records and Information Privacy Act 2002 (NSW) Sch 1.

21. These circumstances are discussed below at para 9.24.

22. I O’Connor and A McMillan, “Youth, the law and health: emerging issue in service delivery “(April 1987) Queensland Law Society Journal 95; S P De Cruz, “Parents, doctors and children: the Gillick case and beyond” [1987] Journal of Social Welfare Law 93; I Kennedy, “The doctor, the pill and the fifteen year old girl” in I Kennedy (ed) Treat me right (Oxford, Clarendon Press, 1988). In the UK, the General Medical Council’s guidance on confidentiality, Confidentiality: protecting and providing information (2000), contains special rules on children who cannot consent to medical treatment. The guidance’s general rules, that is, those that must be observed in relation to adult patients, apply to children who are competent to consent to a medical treatment.

23. See I Kennedy, “The doctor, the pill and the fifteen year old girl” in I Kennedy (ed) Treat me right (Oxford, Clarendon Press, 1988) at 111-114.

24. See Family Law Act 1975 (Cth) s 61C(1) regarding the concept of “parental responsibility”.

25. J Loughrey, “Medical Information, confidentiality and a child’s right to privacy” (2003) 23 Legal Studies 510.

26. T Bartholomew and S Paxton, “General practitioners’ perspectives re competence and confidentiality in an adolescent with suspected anorexia nervosa: legal and ethical considerations” (2003) 10 Journal of Law and Medicine 308 at 314.

27. D Reddy, R Fleming and C Swain, “Effect of mandatory parental notification on adolescent girls use of sexual health care services” (2002) 288 Journal of American Medical Association 710.

28. In the United States, parental notification is required in cases of minors seeking contraception services from federally funded family-planning clinics, except for treatment for STD’s and when such notification would lead to physical harm of the minor: Parental notification requirements applicable to projects for family planning services, 48 Federal Regulations 3600, 3614 (1983).

29. Austen v Civil Aviation Authority (1994) 50 FCR 272 at 277.

30. Health Records and Information Privacy Act 2002 (NSW) s 7(1).

31. Health Records and Information Privacy Act 2002 (NSW) s 7(2). The issue of capacity is addressed by Health Records and Information Privacy Act 2002 (NSW) s 7(1).

32. Section 8(1)(c).

33. For example, if information is collected in order to provide a health service to the individual, the disclosure of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose: Health Records and Information Privacy Act 2002 (NSW) Sch 1 Health Privacy Principle 11 (1)(b) Note.

34. See also the additional conditions in Health Records and Information Privacy Act 2002 (NSW) Sch 1 Health Privacy Principle 11(1)(g).

35. Health Records and Information Privacy Act 2002 (NSW) Sch 1 Health Privacy Principle 4(1). Disclosure in other circumstances may be authorised by regulation: Health Records and Information Privacy Act 2002 (NSW) Sch 1 Health Privacy Principle 4(1)(l).

36. Science Research Council v Nasse [1980] AC 1028 at 1067 (Lord Wilberforce); British Steel Corporation v Granada Television Ltd [1981] AC 1096 at 1140 (Watkins LJ).

37. W v Edgell [1990] 1 All ER 835 (The patient committed multiple killings under the disability of serious mental illness. A consultant psychiatrist who was asked by the patient’s solicitors to examine the patient made his report available to the hospital where the patient was confined, without the patient’s consent to the disclosure).

38. Duncan v Medical Practitioners Disciplinary Committee [1986] 1 NZLR 513 (The patient was a bus driver who suffered two heart attacks and underwent a triple coronary heart bypass. The doctor sought the assistance of police to have the patient’s licence revoked and in the process discussed the patient’s medical condition with others).

39. J Montgomery, Health care law (Oxford, Oxford University Press, 2003) at 269-270. See para 5.31-5.36.

40. See also Health Records and Information Privacy Act 2002 (NSW) Sch 1 Health Privacy Principle 11(1)(c).

41. Children and Young Persons (Care and Protection) Act 1998 (NSW) s 248.

42. Section s 34.

43. Section 3.

44. In contrast, s 24 of the Act, which allows (but does not compel) any person to make a report to the Director-General about suspicions of risk of harm, applies to children and young persons.

45. Section 3.

46. Breen v Williams (1994) 35 NSWLR 522 at 547 (Kirby P).

47. See the discussion in McInerney v McDonald (1992) 93 DLR (4^th) 415 at 421 (La Forest J).

48. F Tomson, “Sharing problem cards with patients” (1985) 35 Journal of the Royal College of General Practitioners 534; A P Bird and M Walji, “Our patients have access to their medical records” (1986) 292 British Medical Journal 595; M Baldry, C Cheal, B Fisher, M Gillet and V Huet, “Giving patients their own records in general practice: experience of patients and staff” (1986) 292 British Medical Journal 596.

49. McInerney v McDonald (1992) 93 DLR (4^th) 415 at 428 (La Forest J).

50. McInerney v McDonald (1992) 93 DLR (4^th) 415 at 429 (La Forest J) .

51. Breen v Williams (1994) 35 NSWLR 522 at 547 (Kirby P).

52. McInerney v McDonald (1992) 93 DLR (4^th) 415 at 429 (La Forest J).

53. See Ontario, Commission of Inquiry into the Confidentiality of Health Information, Report of the commission of inquiry into the confidentiality of health information (Toronto, 1980) vol 2 at 487.

54. A P Bird and M Walji, “Our patients have access to their medical records” (1986) 292 British Medical Journal 595; S Bloch, C Riddell and T Sleep, “Can patients safely be allowed to look after their own medical records?” (1994) 161 Medical Journal of Australia 665.

55. See studies cited in M Gilhooly and S McGhee, “Medical records: practicalities and principles of patient possession” (1991) 17 Journal of Medical Ethics 138 at 140-141.

56. Breen v Williams (1996) 186 CLR 71.

57. Breen v Williams (1994) 35 NSWLR 522 at 560-561 (Mahoney JA); see also Breen v Williams (1996) 186 CLR 71 at 88 (Dawson and Toohey JJ).

58. McInerney v MacDonald [1992] 2 SCR 138.

59. R v Mid Glamorgan Family Health Services Authority; ex parte Martin [1995] 1 WLR 110. The right of patients in the UK is also recognised in legislation: see Access to Health Records Act 1990 (UK).

60. Freedom of Information Act 1989 (NSW) s 16. Patients in public hospitals may also invoke s 14 of the Privacy and Personal Information Act 1988 (NSW), which requires a public sector agency that holds personal information about an individual to provide that individual with access to the information. However, when the Health Records and Information Privacy Act 2002 (NSW) becomes effective, the definition of “personal information” in Privacy and Personal Information Act will not include health information within the meaning of the new Act.

61. NSW Premier’s Department, Freedom of information procedure manual (3^rd ed, 1994) at para 4.3.1.

62. Freedom of Information Act 1989 (NSW) Sch 1 Pt 2 cl 6.

63. NSW Premier’s Department, Freedom of information procedure manual (3^rd edn, 1994) at para 4.3.2.1.

64. Freedom of Information Act 1989 (NSW) s 31(4). Section 25 of the Act lists the general grounds for refusing access to personal information (for example, if it is a document that is usually available for purchase or is an exempt document under the Act) but they do not seem to apply to medical records.

65. Private Hospitals Regulation 1996 (NSW) Sch 1 cl 42(1) and (2).

66. Clause 4(1).

67. Schedule 1 cl 42(3). A similar right is given to residents of nursing homes: Nursing Homes Regulations 1990 (NSW) Sch 1 cl 47.

68. Health Records and Information Privacy Act 2002 (NSW) Sch 1 Health Privacy Principle 7(1).

69. Health Records and Information Privacy Act 2002 (NSW) s 22.

70. If the refusal is based on the ground of serious threat to the life or health of the individual who requested access, the individual may request that access to the information be given to their nominated registered medical practitioner: Health Records and Information Privacy Act 2002 (NSW) s 30.

71. Section 29.

72. Section 7(1).

73. Section 8(1)(c).

74. Section 7(2).

75. Section 7(3).

76. Schedule 1 (Health Privacy Principle 5).

77. Section 25(1).

78. General Disposal Authority – Public Health Services: Patient/Client Records (GDA5) (1999) (NSW). This Disposal Authority was issued under Part 3, s 21(2)(c) of the State Records Act 1998 (NSW). It has been approved by the Board of the State Records Authority in accordance with Part 3, s 21(3) of the State Records Act 1998 (NSW).