AYT v Sydney Local Health District [2014] NSWCATAD 29 | Case summary

The evidence 28In support of her case, the applicant tendered into evidence a copy of the documents she had been provided, by the respondent, in response to a number of access requests she had made in October and November 2012. 29The respondent tendered into evidence a statement of Ms Elaine Pan, an employee of the respondent. Ms Pan is employed as the acting Performance Analysis and Decision Support Officer, Performance Monitoring, Casemix and Innovation Unit. Ms Pan had responded to requests made by the applicant's husband, on 1 November 2012, and is familiar with RPAH's medical records electronic storage system and the process used by the Hospital in responding to a subpoena and other forms of access requests. 30Ms Pan also gave oral evidence and was cross examined at the hearing. 31In summary, on the evidence before the Tribunal, the sequence of events is as follows: (a) On 5 May 2011, the applicant's solicitor wrote to Medical Records Officer of RPAH, seeking copies of the entire medical records of the applicant that it held, including the medical records from the 'Pain Management Centre and any additional records held by [RPAH] or under [its] control.' (b) On 16 June 2011, Ms Pan, the then Medico-Legal Manager of RPAH, wrote to the applicant's solicitor enclosing copies of the requested medical records. These copies did not include any medical record of the applicant's treatment at the AC&R Clinic. In her letter, Ms Pan advised that, pursuant to the HRIP Act, some information had been removed from those records, as the information affected the personal affairs of a person other than the applicant. In her letter Ms Pan also said: 'Please note that additional information (such as correspondence and documents from other agencies) may exist but is not released as a matter of routine unless you specifically request such information.' (c) Sometime in 2012, and prior to 24 May 2012, the applicant commenced proceedings, in the District Court, in regard to her occupier's liability claim. (d) As I have already mentioned, on 24 May 2012, the District Court issued the subpoena, as requested by the defendant to the applicant's occupier's liability claim. The subpoena, addressed to the Medical Superintendent of RPAH and returnable on 2 July 2012, ordered the production of the following records: 'All records relating to the abovenamed plaintiff and, without limiting the generality of the foregoing all clinical notes, nurse's reports, operation reports, x-ray films, x-ray reports, discharge summaries, out-patient records and any other document or thing relating to any tests or procedures whether surgical or otherwise carried out in relation to the said plaintiff [name of the applicant and her date of birth].' (e) The subpoena was served on RPAH and, in accordance with the procedures of the hospital it was forwarded to the Medical Records Department (MR Department) to action. (f) The MR Department produced documents (including those relating to the applicant's treatment at the AC&R Clinic) to the District Court. Subsequently, the District Court made orders in regard to access to the documents that had been produced to the Court. The Court ordered that the applicant (i.e. the plaintiff in those proceedings), be granted first access to the documents, from 3 July to 9 July 2012. The applicant, nor her solicitor, viewed the produced documents during this time. The defendant obtained access to the produced documents (including those of the Camperdown AC&R Clinic), on 12 July 2012. (g) On 26 July 2012, the District Court, at the request of the defendant in the applicant's occupier's liability claim, issued a further subpoena addressed to the Medical Records Officer, Royal Prince Alfred Pain Management Centre, ordering production of 'all records held relating to all consultations, examinations and treatment had with or administered to the [applicant], ...' The subpoena was sent to the MR Department to action. The Department subsequently produced, to the District Court, the relevant records of the applicant held by the Pain Management Centre. (h) On 1 November 2012, on behalf of the applicant, the applicant's husband telephoned RPAH to complain about RPAH having produced, to the District Court, documents about the applicant, which should not have been produced. He spoke to Ms Pan and identified the documents of concern being those of the AC&R Clinic. (i) After having made inquiries with the staff in the MR Department, Ms Pan ascertained that the AC&R Clinic documents were produced in response to the subpoena issued on 24 May 2012. (j) Ms Pan, believing that the AC&R Clinic documents had been inadvertently produced, asked the District Court to return all the documents produced in response to the May subpoena. The Court returned the documents. Ms Pan removed the AC&R Clinic documents and returned the remaining documents to the Court. (k) On 19 November 2012, Ms Pan had a conversation with the applicant's husband. She informed him of the actions she had taken and she also agreed that the AC&R Clinic documents had been inadvertently produced to the District Court. Ms Pan also provided the applicant's husband with advice on how to make a privacy complaint and obtain copies of the applicant's AC&R Clinic records. 32The applicant did not provide any details as to when her claim in the District Court was settled. I have assumed it was after 26 July and before 1 November 2012, when the applicant's husband contacted Ms Pan. Even if my assumption is incorrect, this has no bearing on the matters in issue regarding liability of the respondent under the HRIP Act. 33In her evidence, Ms Pan explained that RPAH has an electronic patient administration system (the eMR system), which contains the medical records of patients. The system, she explained is indexed in accordance with a specific identification number (i.e. Medical Record Number) that is given to each patient. 34Ms Pan went on to explain that some time ago a decision was made to integrate the AC&R Clinic patient medical records with that of RPAH. Hence, every patient of the AC&R Clinic is also given a specific identification number, and where the Hospital has already given the patient a specific identification number, the same number is used. Accordingly, a search on the eMR system for the medical records of a particular patient will identify any medical records of that patient, from the Hospital and/or the AC&R Clinic, held on that system. 35Ms Pan explained that the MR Department actions all applications for access to patient medical records and any Court subpoena served on RPAH. She said, where an access application or subpoena is to be actioned, an officer of the MR Department conducts an initial search on RPAH's electronic patient administration system (eMR system). That system, she explained, also enables the officer to electronically access the actual medical records of the patient which have been recorded on the system, or are otherwise connected to the system. However, where a record has not been recorded on the system and it is not otherwise connected to that system, the officer is required to make a copy from the actual physical document held by the Hospital or the AC&R Clinic. 36Ms Pan's evidence was that in responding to the May 2012 subpoena, the relevant officer of the MR Department had produced, to the District Court, copies of the applicant's medical records, as indexed under her specific Medical Record Number, in the eMR system, at that time. This included those records of the applicant from the AC&R Clinic. 37In regard to her actions in retrieving the produced documents from the District Court and then extracting the AC&R Clinic documents, Ms Pan said she believed, at that time, that the documents had been inadvertently produced. That is, at the time she believed they were documents that should not have been produced in response to the subpoena. She said it was on the basis of this belief that she agreed with the proposition of the applicant's husband, on 19 November 2012, that these documents had been produced in error. Ms Pan went on to say that she also informed the applicant's husband that the AC&R Clinic and the Hospital used the same patient Medical Record Number for the applicant when creating a medical record for the applicant. 38It was the evidence of Ms Pan that it was not until she was spoken to by the respondent's internal reviewer, of the applicant's privacy application, that she realised that her belief, as expressed to the applicant's husband, was incorrect. In this regard, Ms Pan said the respondent's internal reviewer, informed her as follows: 'a) At the time the AC&R eMR system was being implemented, a decision was made to integrate the AC&R Camperdown records with those of RPAH, and to use the same Medical Record Number (which indicates the patient to which the records relate). The policy reason behind this decision was to enable continuity of care between the AC&R unit and the Hospital where the patients were receiving treatment. b) Administratively, all of the patient records generated by the Camperdown AC&R unit are considered to be part of the RPAH's medical record, and can be accessed in appropriate circumstances (that is, for the purpose of providing medical services to patients). Documents created by the AC&R unit within the eMR system are stored centrally with the rest of the RPAH's records. They are considered to be integrated as part of the patient record. Staff in the Medical Records Department, by virtue of their role, necessarily have access to these records. c) All patients who receive treatment at Camperdown AC&R ... are required to complete a "AC&R Consent for Assessment and Information Sharing" form. This form ... requires that a person who signs the form has read and understood the Local health District's brochure entitled "Privacy Information for Patient/Clients". d) The "Privacy Information" brochure ... informs patients of the creation of a Medical Record Number for each patient and also informs them that authorised users throughout the Local Health District will be able to access health records which are linked to that Medical Record Number. ...' 39Ms Pan's evidence was that the applicant had been provided with the abovementioned 'Privacy Information' brochure when she became a patient of the Hospital.

Consideration 40Written submissions were filed by both parties and I have read them carefully. The applicant's submissions are, in my view, misconceived in that they do not address issues relevant to the provisions of the HRIP Act. Instead, issues in regard to negligence are raised, which are not relevant in the context of this application. I draw no adverse inference from this as the applicant and her husband are not legally trained. 41There is no dispute that the disclosure of the applicant's medical records to the District Court was a disclosure for a secondary purpose and not the primary purpose for which they had been collected by RPAH and the AC&R Clinic. They had clearly been collected for the purpose of providing health services to the applicant and not for any other purpose. Hence, RPAH's conduct, in disclosing the applicant's medical records to the District Court, is prima facie a breach of the disclosure HPP, in clause 11(1) of Schedule 1 of the HRIP Act, unless one of the prescribed exceptions apply, or the respondent was not required to comply by reason of one of the circumstances prescribed in clause 11(2). 42It is accepted that the exceptions in para (a) to (l) of clause 11(1) do not apply. 43However, for the reasons set out below, I accept the general contentions of the respondent about a subpoena, addressed to it, to produce documents. That is, as a general rule, the respondent is not required to comply with the requirement in clause 11(1) when responding to a subpoena, because, by reason of clause 11(2)(a) and (b) of Schedule 1 of the HRIP Act, the subpoena provisions of the Civil Procedure Act 2005 (CP Act) and the Uniform Civil Procedure Rules 2005 (UCP Rules) lawfully authorises it not to comply, or requires it not to comply. However, this non-compliance with the requirements of clause 11(1) only extends to the production of health information falling within the terms of the subpoena and that which is 'held' by the respondent. 44Section 68 of the CP Act, gives a court (including the District Court) the power to issue a subpoena requiring a person to produce a document to the court, and/or attend the court to give evidence. The procedure in regard to issuing, serving and responding to a subpoena is set out in rule 33 of the UCP Rules. 45Rule 33.1(1) of the UCP Rules defines a 'subpoena' to be an order in writing requiring the addressee to give evidence, or to produce the subpoena or a copy of it and a document or thing, or to do both of these. Rule 33.2 sets out the circumstances where a court may issue a subpoena and when a subpoena has been issued (i.e. when the issuing officer of the court has sealed the subpoena with the seal of the court). 46In this application there is no dispute that the May 2012 subpoena was appropriately issued by the District Court and served on the addressee, RPAH, in accordance with rule 33 of the UCP Rules. As I have mentioned, it was a subpoena requiring the production of specified documents concerning the applicant. A failure, by RPHA, to produce the documents could have amounted to contempt of the District Court: see rule 33.6 and 33.12 of the UCP Rules. 47RPAH's obligation (also the respondent's obligation) in regard to the documents it was required to produce extended to those documents, concerning the applicant, that were within its possession, custody and control (i.e. those it 'held'): see Rochfort v Trade Practices Commission (1982) 153 CLR 134; 43 ALR 659. 48As pointed out by the respondent, the word 'document', as used in any Act or instrument is broadly defined, in s 21(1) of the Interpretation Act 1987, to include 'anything on which there is writing' and 'anything from which ...writings can be reproduced with or without the aid of anything else.' 49On the basis of the evidence of Ms Pan, I accept that the AC&R Clinic health records of the applicant, were records (i.e. documents), within the possession, custody and control of RPAH at the relevant time (i.e. held by RPAH). As explained by Ms Pan, these records were accessible on RPAH's electronic patient administration system and were readily identifiable through the medical record number attributed to the applicant when she initially became a patient at RPAH. 50I also find, on the basis of the terms of the May 2012 subpoena, that the AC& R Clinic health records of the applicant fell within these terms, because the subpoena expressly requested 'all records relating' to the applicant. 51Ms Pan's advice to the applicant's husband in November 2012 and her conduct in retrieving the applicant's AC&R Clinic health records from the documents, produced in response to the May 2012 subpoena, was clearly misconceived. 52On the basis of my findings above, I also find that the conduct of RPAH (i.e. the respondent) in producing, to the District Court, the AC&R Clinic health records of the applicant, did not amount to a breach of the retention and security HPP in cl 5 of Schedule 1 of the HRIP Act. In this regard I note that there is no evidence to suggest that the respondent had at any time failed to protect the applicant's health information against loss, or unauthorised access or disclosure. 53On the basis of my findings, the appropriate order is to decide, pursuant to s 55(2) of the PPIP Act, to take no further action on the applicant's application. 54Whether the applicant has any other avenue of redress for what she perceives to have led to the loss of her occupiers liability claim is not a matter for the Tribunal. 55There is, however, one matter that did arise in the course of the hearing of this application which warrants further comment. This matter arises from the evidence of Ms Pan in that she said there was a difference in the procedures of the MR Department of RPAH when responding to an access application, including an application under the Government Information (Public Access) Act 2012 (GIPA Act) and clause 7 of Schedule 1 of the HRIP Act. 56It was the evidence of Ms Pan that in response to such access applications, the MR Department will only search for and identify the RPAH records of that patient. That is, unlike the procedure for responding to a subpoena, no broader search is made on RPAH's electronic patient administration system. Ms Pan's evidence was that the person seeking access is nevertheless informed that 'additional information ... may exist but not released as a matter of routine unless ... specifically requested'. 57Ms Pan explained that this was why no copies of the applicant's AC&R Clinic health records were included in RPAH's response to the May 2011 access request, by the applicant's solicitor. As mentioned above, the applicant's solicitor was however advised, in the usual terms, that additional information may exist. 58Although it was not an issue in this application, I was left with the impressions from the evidence of Ms Pan that an application for access to a patient's health information, under the GIPA Act or clause 7 of Schedule 1 of the HRIP Act, would be treated differently to a subpoena requiring production of the same class of information. I note that the applicant's solicitor did not make a request under these provisions. However, I understood Ms Pan to say that had the request been made under these provisions, it would have been dealt with in the same manner. That is, in responding to any access application, RPAH only searches for the persons RPAH health records and not any other health records held by it. 59In my view, there should be no difference in approach in identifying relevant documents/information in response to a subpoena and that used for responding to access application made under the GIPA Act or clause 7 of Schedule 1 of the HRIP Act. They all require RPAH to identify every record it 'holds' containing the information sought. Whether access is granted to the information sought and held by RPAH, is of course another matter. This is determined in accordance with the provisions of the Act under which the access application was made. 60In making these remarks I am not critical of Ms Pan. However, I recommend that RPAH examines its procedures in regard to access applications to ensure they comply with the provisions of the GIPA Act and the HRIP Act. Conclusions and orders 61For the reasons set out above, I have found that the conduct of the respondent in producing, to the District Court, pursuant to a subpoena, the applicant's AC&R Clinic medical records did not amount to a breach of a HPP under the HRIP Act. 62On the basis of my findings I order: Pursuant to subs 55(2) of the Privacy and Personal Information Protection Act 1989, the Tribunal decides not to take any action on the matter. I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 19 March 2014

AYT v Sydney Local Health District

At a glance

Court

Decision date

Source

Judgment (5 paragraphs)

Parties

Cases Cited (1)

Cited By (1)