Fair Work Commission|2023-12-19

Carol Sandland v Australian Capital Territory t/as Canberra Health Services [2023] FWC 3389 (19 December 2023)

s.394 - Unfair dismissal

Australian Capital Territory t/as Canberra Health Services

Application for an unfair dismissal remedy - whether dismissal harsh, unjust or unreasonable

[1] For approximately 6 years and 4 months, Ms Carol Sandland was employed by Canberra Health Services (CHS) on behalf of the Australian Capital Territory (ACT) Government. She worked as an Enrolled Nurse at the Dhulwa Secure Mental Health Facility (Dhulwa) until 24 February 2023, when she was dismissed for serious misconduct.

[2] On 15 March 2023, Ms Sandland applied in time for an unfair dismissal remedy under section 394 of the Fair Work Act 2009 (the Act). Ms Sandland is protected from unfair dismissal: at the time of dismissal, Ms Sandland's gross annual salary was below the high income threshold; she had completed the minimum employment period of 6 months; and the ACT Public Sector Nursing and Midwifery Enterprise Agreement 2020-2022 (the Agreement) applied to her employment. The Small Business Fair Dismissal Code did not apply to the dismissal because the ACT Government is not a small business employer. The dismissal was not a case of genuine redundancy.

[3] The question is whether the dismissal of Ms Sandland was harsh, unjust, or unreasonable. I am satisfied that the dismissal was unreasonable. It follows that Ms Sandland has been unfairly dismissed. Compensation is to be the appropriate remedy in the circumstances. These are my reasons.

[4] Dhulwa is a mental health facility charged with the care of people with mental illness who have been in the criminal justice system. Its patients often have complex mental health needs and may engage in violent or other unsafe behaviours. There is no doubt that it is a challenging environment for all concerned, including management, employees, and patients.

[5] Ms Sandland's employment at Dhulwa typically involved patient engagement and assessment, administering medication, daily living care and liaison with other employees and health professionals. In addition to her nursing duties, Ms Sandland was a Health and Safety Representative (HSR) and delegate of the Australian Nursing and Midwifery Federation (ANMF). In these roles, she was responsible for assisting and advocating on behalf of workers at the facility about industrial and safety matters.

[6] The ANMF also had its own separate channels through which it worked with CHS management to support members working at Dhulwa. This included an established practice by which CHS confidentially shared information with the ANMF about incidents at the facility and broader operational and systemic issues.

[7] On 13 February 2022, Ms Sandland was assaulted at work by a patient. After a short period of absence, she commenced a graduated return to work in March 2022. Over the course of the year, Ms Sandland's relationship with local management became increasingly difficult. She thought they were incompetent, anti-union, did not follow their own policies, and played favourites. By early 2023, she felt she was being excluded and "set up" - a perception likely reinforced by an email from Mr Sam Oram of the ANMF on 13 December 2022 in which he warned Ms Sandland that her emails were being audited. There is no evidence that this was true at the time.

[8] Ms Sandland had a particularly strained relationship with the Assistant Director of Nursing, Ms Peta Kleinig. She felt that her approaches to Ms Kleinig were ignored. When she did receive responses to her queries, she perceived them as "B.S." (or in its long form, "bullshit"). Ms Sandland regularly shared her concerns about Dhulwa's management to the ANMF, including with forwarded internal communications and/or supporting documentation. In the process, Ms Sandland disclosed confidential information about patients of Dhulwa to the ANMF. She also sent confidential information about patients to her two private email accounts. She was not authorised to do either of these things.

[9] In January 2023, CHS became aware that Mr Oram had a high level of knowledge about a particular patient at Dhulwa. It suspected breaches of patient privacy by Ms Sandland. An audit of her emails for the two days prior[1] revealed 3 emails to Mr Oram on 19 January 2023 disclosing the patient's name, location and progress notes, and a similar disclosure by another employee at Dhulwa. The audit of Ms Sandland's emails was then expanded to cover a period of approximately 12 months, through which additional disclosures were identified.

[10] On 8 February 2023, a letter was sent to Ms Sandland from Ms Kalena Smitham, CHS Executive Group Manager, People & Culture. The letter was headed "Re: Proposed Summary Termination of Your Employment". Ms Sandland was advised that a preliminary assessment process had been initiated under clause 117 of the Agreement to determine whether further action was required, due to her alleged inappropriate behaviour. A decision had been made not to refer the matter to the Professional Standards Unit (PSU) for investigation and instead to propose the summary termination of her employment.

[11] The allegations against Ms Sandland all related to her forwarding of emails containing patient information to the ANMF and to her private email accounts. This conduct was generally described as "instances of serious breaches of the Health Records (Privacy and Access) Act 1997" (ACT) (the Health Records Act), which were said to constitute offences under the Health Records Act and thus to be criminal acts for the purposes of the Criminal Code Act 1995 (Criminal Code).

[12] Ms Sandland's conduct was also alleged to be in breach of her obligations under:

Section 9 of the Public Sector Management Act 1994 (ACT) (the PSM Act), which required her to follow the laws of the ACT and to treat all people with courtesy and sensitivity to their rights,
Standards 1.1 and 2 of the Enrolled nurse standards for practice (the Standards), which obliged her to demonstrate knowledge and understanding of Commonwealth, State and/or Territory legislation and common law pertinent to nursing practice; to practice nursing in a way that upheld the rights, confidentiality, dignity and respect of people; and to ensure privacy, dignity and confidentiality when providing care, and
The CHS Clinical Records Management Policy (CRM Policy), under which all staff were responsible for the security of personal health information captured and used by CHS. The Policy required staff to limit the sharing of personal health information to members of the treating team, health service providers involved in the care of the patient, and other authorised persons.

[13] Ms Sandland was suspended with pay and asked to show cause why her employment should not be terminated. Her response was sought by 15 February 2023. The response period was subsequently extended to 22 February 2023 at the request of the ANMF, which was one week less than the ANMF had requested.

[14] Inexplicably, neither Ms Sandland nor the ANMF (on her behalf) responded to CHS by the extended deadline of 22 February 2023, either by providing a substantive response or by making another request, such as for additional time or for more information.

[15] On 24 February 2023, Ms Sandland's employment was terminated on the grounds of serious misconduct. The letter of termination confirmed the views earlier expressed by Ms Smitham that Ms Sandland's actions:

were in breach of section 6(1) of the Health Records Act,
failed to demonstrate "reasonable care and diligence" as required in accordance with sub-section 9(1)(d) of the PSM Act,
were inconsistent with her position as a registered health professional in appropriately handling and protecting sensitive information,
undermined the integrity of CHS's handling of personal health information,
were inconsistent with the continuation of her contract of employment due to the inherent connection between the nature of her conduct and her position as a registered health professional,
caused reputational risk to CHS, particularly in the context of open disclosure, and
were "considered a criminal act" under the Criminal Code and the Health Records Act.

[16] The wrong "Attachment A - Reasons for Proposing to Summarily Terminate" was attached to the letter of termination. This was not an insignificant error in the sense that Attachment A set out the detail of CHS's reasons for the summary dismissal of Ms Sandland. Those same reasons had, however, been set out in the letter of 8 February 2023, to which the letter of termination referred. The error was corrected on 28 February 2023.

[17] After the dismissal, CHS reviewed the records it had obtained from the audit of Ms Sandland's emails again in connection with this proceeding and identified further emails of concern sent by Ms Sandland from her work email account.

[18] Section O of the Agreement is titled "Workplace Values and Behaviours". It deals comprehensively with procedures for managing misconduct or alleged misconduct by an employee. Serious misconduct is described as "conduct that is so serious that it may be inconsistent with the continuation of the employee's employment with the Territory". For the purposes of the Agreement, "serious misconduct" has the meaning given to it by Regulation 1.07 of the Fair Work Regulations 2009 (the Regulations). The full text of Regulation 1.07 is set out in the Annexure to this decision.

[19] While Section O of the Agreement contains comprehensive disciplinary procedures, including for dealing with misconduct, clause 151.7 of the Agreement operates to the exclusion of those procedures. It says:

"Notwithstanding the provisions of this Section, the head of service may summarily terminate the employment of an employee without notice for serious misconduct as defined within the Fair Work Regulations."

The Health Records Act and the Privacy Principles

[20] Section 5 of the Health Records Act gives legal force to the Privacy Principles (Schedule 1 to the Health Records Act), including Principles 4.1 and 10. Relevant extracts from the Health Records Act, as well as Privacy Principles 4.1 and 10, are set out in the Annexure to this decision. In summary:

Section 6 of the Health Records Act requires compliance with the Privacy Principles, including in relation to personal information and personal health information.
Privacy Principle 1 provides that where personal health information or health records are required to be collected by someone as part of their employment for the management, funding or quality of a health service received by the consumer, the person is allowed access to the information only for those purposes, unless these principles otherwise provide.
Privacy Principle 4.1 requires record keepers to ensure that health records are protected by reasonable security safeguards against unauthorised access, use, modification or disclosure. If giving a health record to another entity, they must do everything reasonably within their power to prevent its unauthorised use or disclosure.
Privacy Principle 10 prohibits record keepers from disclosing personal health information to third parties, except where a relevant exception applies. In this case, the potential exception of relevance is where the record keeper believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent risk to the life or physical, mental or emotional health of the consumer or someone else.

[21] Ms Sandland submits that there was another relevant exception, which applied if she believed on reasonable grounds that the recipient of the health information would not disclose the personal health information. This exception only applies where the disclosure is necessary for the purpose of research or the compilation or analysis of statistics, in the public interest. There is no evidence that the sharing of information with the ANMF about which this matter is concerned was for such a purpose.

[22] A "health record" is any record, or any part of a record that either: is held by a health service provider and containing personal information; or contains personal health information. "Personal information" and "personal health information" are defined terms for the purposes of the Health Records Act.

[23] Section 4B of the Health Records Act contains a note to the effect that Chapter 2 of the Criminal Code applies to offences against the Health Records Act. Part 5 of the Health Records Act deals with offences in four categories: unlawfully requiring consent by threats, intimidation or false misrepresentation; destruction of records to evade or frustrate the operation of the Health Records Act; unlawfully requesting or obtaining access to health records; and unlawfully penalising people to deter them from accessing their health records. A breach of the Privacy Principles is not of itself an offence, although some of the offences prescribed in Part 5 may also involve a breach of the Privacy Principles. In other words, not all breaches of the Privacy Principles are "considered a criminal act" under the Health Records Act and the Criminal Code.

[24] Section 30 of the Health Records Act requires an unqualified record keeper who lacks the skill or training necessary to perform a function under the Act to obtain and act on advice from someone with the necessary skill and training.

[25] Section 9 of the PSM Act deals with public sector conduct. Relevant extracts from the PSM Act are also set out in the Annexure to this decision. In short, a public servant is required to act lawfully, ethically and in the public interest, including refraining from disclosing confidential information gained through their job without approval. Under section 153(1) of the Crimes Act 1900 (ACT) (the Crimes Act), it is an offence for a public servant to disclose information that it is their duty not to disclose.

[26] The Nursing and Midwifery Board of Australia publishes the Standards. As the Standards explain, they contain "the core practice standards that provide the framework for assessing enrolled nurse (EN) practice". They "communicate to the general public the standards that can be expected from ENs and can be used in a number of ways..." including "by the Nursing and Midwifery Board of Australia (NMBA) and relevant tribunals or courts to assess professional conduct or matters relating to notifications."

[27] Standards 1 and 2 of the Standards are set out in the Annexure to this decision. They include expectations that an Enrolled Nurse will:

demonstrate knowledge and understanding of relevant laws,
fulfil their practice duty of care, and
ensure privacy, dignity and confidentiality when providing care.

[28] The CRM Policy and its related procedures extend to 65 pages. Its purpose "is to outline the required processes for all CHS staff to ensure consistent, effective, and appropriate clinical record and health information management across CHS". Among other things, the CRM Policy:

makes clear that "all clinical records are confidential",
states that health records "should only be accessed, used, and disclosed for the purpose for which the information was collected",
declares the routine practice of monitoring record access and conducting proactive or reactive audits,
specifies that records should not be stored in unsecured network drives, personal files, desktops, or stand-alone specialised IT systems,
explains the circumstances in which the sharing of personal health information is permitted, to:
1. members of the treating team (considered to include staff employed by CHS),
2. health professionals providing follow-up care,
3. community support services (with the patient's consent), and
4. the consumer (patient), if they have consented to email communication - with "extreme care... taken when selecting or entering email addresses".
explains the circumstances in which sharing of personal health information is not permitted:
1. where consent for release has been refused or withdrawn by the patient,
2. if the sharing of information relates to a report under the Children and Young People Act 2008 (ACT) and/or if it would cause significant risk to the health or life of a patient of another person,
3. if the information is being captured or stored on a personal digital device, unless prior approval has been granted by CHS in strict compliance with related policies, and
4. by capturing screen dumps of Clinical Information Services or using mobile phones or other portable devices to take digital photos of clinical record documents.

Was the dismissal harsh, unjust, or unreasonable?

[29] Whether a dismissal was harsh, unjust, or unreasonable depends on an assessment of all the relevant facts and circumstances, including those set out in section 387 of the Act.

[30] There is no dispute that the emails relied upon by CHS in relation to the dismissal were sent by Ms Sandland as alleged. What is in dispute, however, is the nature of her conduct in sending the emails, including whether it was in breach of Ms Sandland's various obligations and duties to CHS and/or its patients, and/or in breach of the law. There are also issues of context, procedural fairness; whether dismissal was a proportionate response to her conduct; the personal history and circumstances of Ms Sandland and fairness as between Ms Sandland and other CHS employees.

Was there a valid reason for the dismissal related to Ms Sandland's capacity or conduct, including its effect on the safety and welfare of other employees?

[31] The reason given for Ms Sandland's dismissal was that she engaged in serious misconduct by improperly disclosing personal health information without authorisation on 8 separate occasions. CHS also relies on separate disclosures identified after the dismissal when it undertook a further review of Ms Sandland's emails.

Did the Health Records Act apply to the disclosures?

[32] The Health Records Act operates in relation to personal health information "wherever it is held in the ACT".[2] It imposes obligations in relation to the access, use and protection of health records on various entities including a person (an individual for the purposes of Part 5 (Offences) but that otherwise includes a corporation[3]), a health service provider, the health services commissioner, a collector, an entity (which includes an unincorporated body and a person, including a person occupying a position or exercising a function of the entity, whether under a delegation, subdelegation or otherwise[4]), and a record keeper (a broader category of entity that includes a 'health service provider' and 'the health services commissioner').

[33] Record keeper is defined as "an entity that has possession or control of a health record." A reference to an "entity" in ACT legislation includes a reference to a person exercising a function of the entity.[5] Under the PSM Act, officers employed by the ACT Government exercise the functions of their office on behalf of the ACT Government. Ms Sandland was an officer appointed to CHS and met the description of an "entity" for the purposes of the Health Records Act.

[34] Did she have possession or control of health records? The words "possession or control" are not defined and in the Health Records Act, have no fixed legal meaning. They are likely not intended to be read as limited to ownership or exclusive possession or control[6] but also to include the holding of health records, whether physically or online. This is because the objects of the Health Records Act are to provide for privacy rights in relation to personal health information; for the integrity of records containing that information; for consumers to access their information and receive explanations in relation to it; and to encourage agreement between those concerned about the exercise of rights, and performance of obligations, under the Health Records Act. These rights would be undermined if the obligations in the Health Records Act only applied to the owners of health records and those who were in control of them. A broader approach to the meaning of the terms "possession" and "control" sits more easily with a framework that has at its heart the rights of consumers to their health information and to safe custody of that information by all of those who hold it.

[35] The Health Records Act recognises that the health records of a person may be held by various entities, and for different purposes. Health records are, by their nature, records that are personal to the individual concerned. Yet they almost always come into existence at the hands of another because their purpose is to assist in the provision of care. Usually, too, they will be owned by someone other than the individual.[7]

[36] The example of a medical certificate is illustrative. A doctor may issue the certificate to a patient and keep a copy in the patient's file. The doctor is a record keeper in relation to the certificate because they have both possession and control of the record. Upon issue of the certificate, the patient also takes possession of the record. They become, at least for a time, a record keeper (as well as a consumer), although their status as a record keeper may have no practical operation because they already have access to the health record in question, and the right to share it (or not) as they choose. If the patient then provides the certificate to their employer, the employer becomes a record keeper because it now has possession of the certificate and must keep it for 7 years.[8] The question of who owns the certificate is, in such cases, immaterial to whether each entity is a record keeper under the Health Records Act.

[37] To be a record keeper, a person must have sufficient power or authority over a health record such that they have the capacity to comply with the Health Records Act including the Privacy Principles.[9] Plainly, CHS is a record-keeper in relation to the health records of patients at Dhulwa. It has general responsibility for the provision of care to its patients, as well as for the activities of CHS employees and for records management in compliance with the Privacy Principles.

[38] The definition of record keeper does not exclude from its ambit the officers and employees of a record keeper, and there is no reason to read it down in this way. In my view, Ms Sandland was a record keeper too. The scope of her responsibility under the Health Records Act may have been narrower than that of CHS, but Ms Sandland regularly held, and in this way had possession of, health records for use in connection with her employment. This included records held in an email account established by CHS for her exclusive use (subject to its Acceptable Use of ICT Resources policy).

[39] Ms Sandland had the capacity to take reasonable steps to keep the records entrusted to her safe, and to prevent their unauthorised access, use or disclosure by third parties, including by adopting the reasonable security safeguards of following relevant CHS policies and not sharing the personal information of patients with anyone outside of CHS without authorisation or lawful excuse.

[40] I find that the Health Records Act applied to the disclosures made by Ms Sandland.

Did the disclosures comply with s.6(1) of the Health Records Act?

[41] It is alleged that on 18 April 2022, Ms Sandland provided "the ANMF with personal health information of a health consumer without authorisation". This involved an email sent by Ms Sandland at 8.44am on Monday 18 April 2022, forwarding an internal email containing a patient's Interim Management Plan, including the patient's first name, ward location and gender, to Mr Oram, Mr Thomas Mason of the ANMF, and to the generic email address anmfact@anmfact.org.au.

[42] Whether the disclosure was in breach of the Health Records Act depends in part on whether the information shared with the ANMF was "personal information". This is defined in the Health Records Act as "any information, recorded or otherwise, about the consumer where the identity of the consumer is apparent, whether the information is fact or opinion; or true or false." Certainly, the disclosure of 18 April 2022 contained information about a consumer who was a patient at Dhulwa. But was their identity apparent from the information provided?

[43] The term "apparent" is not defined in the Health Records Act". Adopting its ordinary meaning, the identity of a person will be apparent for the purposes of the Health Records Act if it is capable of being clearly perceived or understood; if it is plain or clear from the information.[10] Relevantly, however, Privacy Principle 10 describes "identifiable information" as information that identifies a consumer, or from which their identity "can be reasonably worked out". This suggests that the question of whether a person's identity is apparent from information should also be considered from the perspective of whether their identity can be reasonably worked out from the information.[11] In a similar way to other legislative schemes that rely on the "reasonably identifiable" formulation[12], the assessment of whether a person's identity is apparent from the information is an objective one, having regard to the context in which the information is shared.

[44] The term "identity" is also not defined in the Health Records Act. Given its ordinary meaning, it includes "the condition, character, or distinguishing features of person or things"; "official information about" oneself;[13] "a person's name and other facts about who they are".[14] Partial or incomplete information about a person can be sufficient to identify them in a particular context.

[45] The information disclosed by Ms Sandland on 18 April 2022 contained the patient's first name, details of their treating team, their institutional location and part of their health record. The disclosure was not isolated: there had been previous communications between Ms Sandland and the ANMF about the patient to which the disclosure referred. This is evident from Ms Sandland's covering email which says, "this is the patient that..." and goes on to describe events particular to the patient. At the time, Mr Oram was an active participant in discussions about patients at Dhulwa, including with Ms Sandland. The disclosure was made in the context of a small forensic mental health facility that, although it can house up to 17 patients, is not always at capacity, and a secure ward that appears to have housed only 1 or 2 persons at a time. As Counsel for Ms Sandland put it at the hearing, in discussions between employees at Dhulwa and the ANMF about the admission of a new patient in this context, "it's going to be reasonably obvious who" the discussion is about.

[46] In this context, the email of 18 April 2022 contained information from which the identity of one of the patients referred to in the email could reasonably have been worked out. I find that the identity of the patient was apparent to the ANMF from the email. The information shared with the ANMF was personal information for the purposes of the Health Records Act and, because it contained information collected by CHS in relation to the health and illness of the patient, was also personal health information. It was a health record.

[47] Ms Sandland was required by Privacy Principle 4.1 to ensure the protection of this information by implementing reasonable security safeguards against unauthorised access or disclosure. She did the opposite by sending the record to three non-CHS email accounts. There is no evidence that the disclosure was authorised. The weight of evidence is to the contrary. I find that the disclosure was not authorised by CHS.

[48] Ms Sandland was also required by Privacy Principle 10 not to disclose the information to the ANMF, unless (relevantly) she believed on reasonable grounds that the disclosure was necessary to prevent or lessen a serious and imminent risk to the life or physical, mental or emotional health of the consumer or someone else.

[49] Ms Sandland explains the context in which the disclosure occurred. There had been serious incidents involving patients at Dhulwa on the previous week, on 11 and 15 April 2022. Ms Sandland says this caused her to issue a stop work direction under s.85 of the Work Health and Safety Act 2011 (Cth) (the WHS Act) and prompted WorkSafe ACT to issue 13 provisional improvement notices.

[50] The week commencing 11 April 2022 was certainly a challenging one for the staff of Dhulwa. On 11 April 2022, several staff were injured. WorkSafe ACT issued 2 notices about occupational violence and CHS introduced 2 new staff safety communication mechanisms. A further serious injury was sustained by a member of the security staff on 15 April 2022.

[51] Despite what Ms Sandland describes as a "dreadful" approach to the management of safety at Dhulwa, and without seeking to downplay the serious nature of the incidents in April 2022, this was not a typical week. According to the Inquiry into the Legislative, Workplace Governance and Clinical Frameworks of Dhulwa Secure Mental Health Unit (the Deegan Review), "incidents of violence that have resulted in staff requiring time off work have, on average, numbered about two per year since 2019".

[52] Ms Sandland made the disclosure to the ANMF and "Workplace Organising Committee" members Arun Babu and Duvi Gulane, for their information and use in connection with work being done to address the safety of staff at Dhulwa. For at least a period of some months, the ANMF and delegates had been compiling data on aggression and violence at Dhulwa. Their work fed into two reviews commenced into the Dhulwa facility after April 2022 - one at the request of CHS in May 2022 following the incidents on 11 April 2022 (the April Review), and the other (the Deegan Review) announced on 2 May 2022 and finalised by Report on 11 November 2022 after an extensive process including more than 52 stakeholder meetings, 1 roundtable, receipt of 68 submissions and a comprehensive documentation review.

[53] Ms Sandland says she sent the email as part of a handover she was providing about what had been occurring. I do not accept that the email was sent as part of any handover. Her covering email on 18 April 2022 is not in the nature of a handover, and the ANMF had no responsibility for the direct management of the patients concerned. It did not need all the information shared by Ms Sandland to carry out its activities, although the information was useful. Approximately ten minutes earlier, Ms Sandland had responded to an internal email about a "Sunday safety update...". The email from Ms Sonny Ward, Director of Nursing, prompted a response from Ms Sandland about security doors and signed off by "Carol, HSR DMHU". In my view, the email was sent by Ms Sandland in her capacity as HSR for the purpose of sharing information about staff safety at Dhulwa with the ANMF. It was sent to the ANMF for use as it saw fit.

[54] I consider that Ms Sandland had reasonable grounds for believing that the disclosure would assist with efforts to improve safety for staff at Dhulwa. However, I do not find the disclosure to have been necessary to prevent or lessen a serious and imminent risk, either to staff or patients. Firstly, the disclosure of personal information was not necessary. Information about the same safety risks could have easily been shared without disclosing the patient's name or an extract from their health record - for example, by writing a summary of her concerns about aspects of the management plan said to pose safety risks (but without identifying information) instead of simply forwarding part of the patient's clinical file to an external third party. Secondly, I accept that the purpose of the email was to prevent or lessen a serious risk to staff, but I do not find the risk to have been imminent in the circumstances. A patient-specific management plan had been put in place, alongside new responsive steps in relation to the events of 11 April 2022, including as required by WorkSafe ACT.

[55] Ms Sandland says she did not intentionally disclose the name of the patient to the ANMF in her email of 18 April 2022. It is, however, no answer to an alleged breach of the Privacy Principles to say that the conduct in question involved mistake, although it might be a matter relevant to mitigation. Further, I do not accept that this conduct involved mistake. Her covering email refers to another patient as "Patient 1", indicating some effort on her part to avoid identifying a patient by name. Unfortunately, she did not do the same for both patients referred to in the email. I do not accept that this omission was a mistake. The name of the patient appeared both in the subject line and body of the email. The content of the forwarded email was a clinical record. Ms Sandland was alive to the need to protect patient confidentiality and went to the trouble of de‑identifying a patient in her covering email. She did not alter the information in the email she was forwarding on. It seems likely that Ms Sandland did not consider her obligation to protect patient confidentiality extended to the content of the forwarded emails of others, because this was not an isolated example of the conduct.

[56] I also have difficulty reconciling Ms Sandland's actions on 18 April 2022 with her evidence that she thought it was legal to breach patient confidentiality in union communications, although it is easier to accept that she felt safe doing so. As this example demonstrates, when it occurred to her, Ms Sandland did try to protect patient confidentiality in her communications with the ANMF. Ms Sandland knew that she was not authorised to share the personal information of patients with the ANMF without first obtaining relevant consent or approval.

[57] The disclosure did not comply with the Health Records Act.

The second disclosure - 6 November 2022 at 8.56am

[58] It is alleged that on 6 November 2022, Ms Sandland provided "the ANMF with personal health information of a health consumer without authorisation" (being their forensic history and a copy of their health record including a range of identifying information).

[59] At 8.20am on Sunday 6 November 2022, Ms Sandland scanned a copy of what is known as a "DMHU Treatment, Placement, Restrictions, Implementation, Monitoring (TPRIM) Form to her work email address. When scanning the document, Ms Sandland redacted identifying details such as the patient's name and signature by placing what appears to be a blank piece of paper over them. Details remaining included the patient's age and gender, ward location and room, history of mental illness and medication prescriptions. The emailed scan sent to Ms Sandland's email came with the following generic message from CHS:

"This email, and any attachments, may be confidential and also privileged. If you are not the intended recipient, please notify the sender and delete all copies of this transmission along with any attachments immediately. You should not copy or use it for any purpose, nor disclose its contents to any other person."

[60] It seems that Ms Sandland did not heed the message, because approximately half an hour later, at 8.56am on 6 November 2022, Ms Sandland forwarded the scanned TPRIM form to Mr Oram. The covering email explains that the form is "for our newly admitted Patient", suggesting a previous discussion with Mr Oram about the patient and that he knew both of the existence of the patient and that they were new to the facility.

[61] On its face, the purpose of sending the email was to complain of the inexperience and unprofessionalism of the Clinical Development Nurse (CDN) and Clinical Nurse Consultant (CNC) who had worked at Dhulwa two days before. In her email, Ms Sandland alleged that both nurses had previously worked with, and were being protected or treated favourably by, Ms Kleinig, at the expense of two former employees. I cannot be sure, but it may be that one of these was a nurse that had recently been dismissed, to which the April Review referred when commenting about a likely connection between the dismissal and negativity between the nursing team and management.

[62] Ms Sandland says that she shared the record with Mr Oram because of her concerns for the safety of employees tasked with admitting the patient with only very little information. This was a legitimate concern, noting the scant details contained in the TPRIM form compared with the forensic history of the patient. The form itself encourages the provision of a level of detail not met by the answers given in this case. While the record shared with Mr Oram did not disclose the name of the patient, it did disclose their age, forensic history, a clinical record personal to them, their medication, specific ward location and approximate date of admission.

[63] In this context, the email of 6 November 2022 contained information from which the identity of a patient could reasonably be worked out. I find that the identity of the patient was apparent to the ANMF from the email. The information shared with the ANMF was personal information for the purposes of the Health Records Act and also personal health information (information collected by CHS in relation to the health and illness of the patient). It was a health record.

[64] As with the first, this second disclosure did not comply with Privacy Principle 4.1. The only step taken by Ms Sandland to safeguard against the unauthorised access or disclosure of the patient's information was the redaction of their name and contact details from the top of the TPRIM form. This was not sufficient to protect against the disclosure of the patient's personal information given the contents of her covering email containing an extract from another clinical record describing the patient's forensic history in some detail, and other unredacted identifying features in the TPRIM form. The disclosure was not authorised by CHS. On the contrary, it was expressly prohibited by CHS policies, a matter to which I will return.

[65] Ms Sandland was also required by Privacy Principle 10 not to disclose the information to Mr Oram unless a relevant exception applied. I do not find that Ms Sandland reasonably believed the disclosure necessary to prevent or lessen a serious and imminent risk to the life or health of a person. The purpose of the disclosure was to highlight the professional shortcomings of her colleagues. It was not necessary, to make the point, that the personal information of patients be disclosed.

[66] The disclosure of 6 November 2022 did not comply with the Health Records Act.

The third disclosure - 8 November 2022 at 11.39am

[67] It is alleged that on 8 November 2022, Ms Sandland provided _"_the ANMF with personal health information of a health consumer without authorisation" (involving an entry from a health record on an internal record-keeping system detailing a decision relating to a belt).

[68] At 11.39am on Tuesday 8 November 2022, Ms Sandland sent an email to Mr Oram with an extract of an entry made the same day in CHS's internal record keeping system, MAJICER. The entry noted a discussion between the patient's treating team 5 days earlier, on 3 November 2022, where a decision was made with which Ms Sandland did not agree. The email summarised the patient's forensic history to Mr Oram. The name of the patient was redacted, but it is apparent from the forensic history that this was the same patient to whom the earlier forwarded TPRIM form of 6 November 2022 referred. Accordingly, I find that it was personal information and a health record for the purposes of the Health Records Act.

[69] The disclosure was inconsistent with Privacy Principle 4.1, because no reasonable security safeguards were put in place by Ms Sandland to protect against the unauthorised access or disclosure of the information. On the contrary, Ms Sandland disclosed the information to Mr Oram in circumstances where she was not authorised to do so.

[70] The disclosure was also inconsistent with Privacy Principle 10, which required Ms Sandland not to disclose the information to Mr Oram, unless a relevant exception applied. In my view, there were reasonable grounds for Ms Sandland to have believed that this disclosure was necessary to prevent or lessen a serious and imminent risk to the life or health of a person. The risk identified was a serious one, about access to weapons on the ward, and the risk was imminent in that the patient had only recently been admitted and now had access to a potential weapon. A select group of nurses were required to interact with the patient to provide daily care and undertake assessments. Although approval for access to the potential weapon had been given 5 days before the disclosure, the record shared with Mr Oram was made on the same day as the disclosure.

[71] However, I am not satisfied that Ms Sandland held the relevant belief at the time, such that an exception to Privacy Principle 10 applied. Ms Sandland says she sent the email to Mr Oram on 8 November 2022 because she was concerned about patient safety. That may have been part of her concern, but it was more about the competency of her peers in relation to the safety of staff. Ms Sandland was already dealing with concerns about the lack of information given to staff about patients. This prompted subsequent discussion among ANMF representatives about the need for new or revised policies, including a "restricted object approval process".[15]

[72] Her primary purpose in sending the email was to again demonstrate poor and uninformed decision‑making by the patient's treating team (both management and doctor) and to update Mr Oram about progress in dealing with similar concerns of two days earlier. She ended the email with an expression of disdain rather than any urgent call for action, writing: "LOL Really are you kidding... IN UNION".

[73] The disclosure of 8 November 2022 did not comply with the Health Records Act.

The fourth disclosure - 19 January 2023 at 2.16pm

[74] It is alleged that on 19 January 2023, Ms Sandland provided _"_the ANMF with personal health information of a health consumer without authorisation" (being a direct copy of a progress note about a dog visit from the patient's medical health record).

[75] On 9 January 2023, Mr Oram had written to Ms Katie McKenzie, Executive Director, about the need for consultation on new or updated policies, including the "CHS Guideline Animal Visits". In addition to seeking consultation on policies, it appears that Mr Oram was looking for evidence to support a dispute about consultation with CHS. In response to a separate forwarded email from Ms Sandland on 12 January 2023 about whether security would be returned to the acute ward, he wrote:

We can now look at potentially breaching them on consultation."

[76] On 18 January 2023, a patient's dog was brought into the facility. This upset the nurses, some of whom were afraid of dogs, or had allergies, or felt there had been no consultation about having a dog on the acute ward. Someone, who I infer was Ms Sandland due to subsequent events, contacted Mr Oram and told him about it. Mr Oram wrote to Ms Kleinig, copying in Ms Ward and Ms Sandland. He asked for information about the dog and the steps taken in relation to its entry into the facility. He alleged that CHS had not followed its policy on Animal Visits. He described some of what he knew about the patient who owned the dog, including details of their transfer to the ward and whether they were entitled to have a dog visit.

[77] At 1.16pm on Thursday 19 January 2023, Ms Sandland forwarded Mr Oram an email chain between Ms Kleinig and members of the treating team about the patient who was allowed to see their dog. The email contained the name of the patient, information about the dog visit / therapeutic intervention, and discussion at the safety huddle that morning.

[78] At 2.05pm on 19 January 2023, Ms Sandland scanned a copy of the staff safety huddle of the previous day. She forwarded the scan to Mr Oram with a covering note pointing out that there was no mention of the dog in the huddle record, but that the patient transferring from one ward to another was mentioned. CHS says that patient names were partially visible in the huddle record provided to Mr Oram and there is no evidence to the contrary.

[79] Approximately 10 minutes later, at 2.16pm on 19 January 2023, Ms Sandland sent an email to Mr Oram with a copy of a Social Workers' note about the dog visit from the day before. The subject of the email was "Please see Social Workers note from yesterday 18/1/23". The name of the patient referred to in the note was redacted but had been disclosed an hour earlier in a separate email. Unredacted was the remainder of the clinical record shared with Mr Oram, including the name of the patient's dog, its location at an identified boarding kennel, and the gender of the patient.

[80] The information shared with Mr Oram was personal information about a patient at Dhulwa. From the information, the patient was able to be identified by first name, initials, gender and ward location as well as by reference to one or more members of the treating team. The additional information about their dog and its location was information from which the identity of the patient could reasonably have been worked out. I find that the identity of the patient was apparent to the ANMF from the email. The information shared with the ANMF was personal information for the purposes of the Health Records Act and as it contained information collected by CHS in relation to the health and illness of the patient, it was also personal health information and a health record for the purposes of the Health Records Act.

[81] Ms Sandland was required by Privacy Principle 4.1 to ensure the protection of this information by implementing reasonable security safeguards against unauthorised access or disclosure. Rather than taking such steps, she disclosed the information to Mr Oram without authorisation. In doing so, she did not comply with Privacy Principle 4.1.

[82] Privacy Principle 10 required Ms Sandland not to disclose the information to Mr Oram unless a relevant exception applied. Ms Sandland says she sent the 2.16pm email to Mr Oram because there had recently been issues with animals coming on to the ward, including Ms Kleinig's dog who she says was left for staff to look after, and she was concerned about staff safety and CHS not following policy. Ms Sandland does not recall staff being told on 18 January 2023 that the dog would be visiting the facility that day. Her recollection is at odds with records made at the time by Ms Kleinig and by two other nurses, who recalled Ms Kleinig advising (but not consulting) about the dog coming to Dhulwa that afternoon.

[83] Ms Sandland also says she sent the email to protect herself because of different accounts about what had been said at the huddle from staff and Ms Kleinig. She says a huddle record that did not mention the dog being brought in was later changed after her Riskman report. This change made Ms Sandland very angry. She felt she was being set up. If there was such a change however, it can only have been made after sending the 2.16pm email. It did not form part of Ms Sandland's reasons for sending the email to the ANMF at 2.16pm on 19 January 2023.

[84] At 2.17pm on 19 January 2023, Ms Sandland forwarded another email to Mr Oram and others who it appears were involved in the work of the ANMF. The email set out concerns about the dog visit of the day before, and excerpts of the CHS Policy on Animal Visits alleged to have been breached. The email referred to the patient concerned by their initials.

[85] At 9.40am on 20 January 2023, Ms Kleinig replied to Mr Oram's email of 18 January 2023. She told him that the information he had received was not accurate, that there had been a proper clinical process to facilitate the dog visit, and that the Animal Visits policy was a guideline rather than a policy or procedure. She noted that the matter had been discussed in the safety huddle of 18 January 2023 and that employees had not voiced any concerns. She assured him that the guideline had been considered, and no staff were placed at risk.

[86] Mr Oram replied to Ms Kleinig approximately two hours later, expressing concern about the lack of clarity in relation to animal visits at Dhulwa. It is not clear what happened after that, other than that there was a commitment to further communication.

[87] As with her earlier emails, the concerns raised by Ms Sandland about the dog visit were legitimate. It was reasonable for staff at Dhulwa to expect the Animal Visits policy or guideline to be followed. It was appropriate for Ms Sandland to bring the matter to the attention of both CHS and the ANMF so that the concerns of staff could be addressed. But in bringing it to the attention of the ANMF, she did not believe (and could not have believed) on reasonable grounds that the disclosure of the patient's personal health information was necessary to prevent or lessen a serious and imminent risk to life or health. The identified risk was not both serious and imminent - it was in the past, and the potential future. Nothing could have been done to prevent or lessen the risk to any person of the dog visit the day before. The disclosure of the patient's personal information was also not necessary, because what were legitimate concerns held by Ms Sandland, could readily have been brought to the attention of the ANMF in a way that did not make these disclosures.

[88] The disclosure did not comply with the Health Records Act.

[89] It is alleged that on 6 February 2023, Ms Sandland provided _"_the ANMF with personal health information of a health consumer without authorisation" (being detailed notes pertaining to a planned admission, containing a range of identifying information about the patient).

[90] On 2 February 2023, there was an admission planning meeting for a patient with recent violent history. Ms Sandland was sent a copy of the detailed admission planning notes as a member of the nursing staff. She responded to the email from Ms Kleinig by asking if security would be placed back in the nurse's station on the ward. Ms Kleinig responded on 6 February 2023 in a way that Ms Sandland found unsatisfactory. At 1.43pm on 6 February 2023, Ms Sandland forwarded the email chain including the patient's detailed admission notes to Mr Oram in full. There is no evidence that she was authorised to disclose this information outside of CHS. The information included the patient's full name, age, medical and forensic history, medications and management plan. It was a health record for the purposes of the Health Records Act.

[91] The sending of this information to Mr Oram was inconsistent with Privacy Principle 4.1, as it did not ensure the protection of the information through the implementation of reasonable security safeguards against unauthorised access or disclosure. It was also in breach of Privacy Principle 10, which required Ms Sandland not to disclose the information to Mr Oram unless a relevant exception applied.

[92] Ms Sandland says she sent the email because she was concerned about the safety of nurses and wanted the ANMF to raise the matter with management. She says it was a mistake to send the patient's name; that this was not her usual practice; and that she was sorry she did so. I accept Ms Sandland's evidence as to the reason she sent the email, but I do not accept that it was her usual practice not to disclose patient names to the ANMF. The submission is not established on the evidence of her various disclosures to the ANMF (including to Mr Oram). I also do not accept that the failure to redact the patient's name in this instance was a mistake. The disclosure is too obvious to have been overlooked.

[93] I do not find that in disclosing this information to the ANMF, Ms Sandland believed, on reasonable grounds, that disclosure of the information was necessary to prevent or lessen a serious and imminent risk to life or health. Admission of the patient was scheduled for two weeks later. The admission was likely to involve serious risk to staff, certainly. But the risks were not yet imminent, and the concerns of Ms Sandland were capable of being communicated to the ANMF in a way that did not lay the personal health information of the patient bare.

[94] The disclosure did not comply with the Health Records Act.

The sixth, seventh and eighth disclosures - 26 December 2020 and 23, 25-26 July 2022

[95] It is alleged that on each of these dates, Ms Sandland sent "the personal health information of multiple health consumers to her personal email without authorisation."

The emails of 26 December 2020 and 25 July 2022

[96] At 7.49am on 26 December 2020, Ms Sandland forwarded an internal CHS email to her personal email account containing a detailed doctor's review and plan for a patient at Dhulwa. The email included the first name and second initial of the patient, their medical and forensic history, treatment details, treating team, and security arrangements - including dates during which they were a patient at the facility. The forwarded information is so detailed in relation to the patient that their identity is readily apparent. It is personal information and a health record for the purposes of the Health Records Act.

[97] The reason Ms Sandland sent the email to her personal email account in December 2020 remains unexplained. I do not accept that it was so that Ms Sandland could undertake work that CHS required her to perform at home, or so that Ms Sandland could respond to a request from WorkSafe ACT. The former appears to be no more than speculation about an action more than 2 years ago. I do not accept Ms Sandland's general evidence that it was common for nurses to take confidential patient information home or that they were authorised to do so. CHS expressly denies these assertions and CHS policies speak against it. It also seems inherently unlikely in the context of the undisputed and fundamental duty that nurses have to ensure the dignity of patients, including by protecting their privacy. As to the request from WorkSafe ACT, it came approximately 18 months after Ms Sandland sent the email to herself. It cannot have been the reason for the original communication.

[98] The sending of this information to her personal email accounts was inconsistent with Privacy Principle 4.1, as it did not ensure the protection of health records through the implementation of reasonable security safeguards against unauthorised access or disclosure (the obvious safeguard being to store it only in her CHS email account and not outside of CHS). The email of 26 December 2020 remained in Ms Sandland's private email account, on a third‑party server over which CHS had no control, and about which CHS had no knowledge, for at least 18 months. It was then sent back to Ms Sandland's work email on 25 July 2022 at 11.48am.

[99] At 11.52am on 25 July 2022, Ms Sandland forwarded further internal CHS emails from her personal email account to her work email account. The email chain has "Property damage" in the subject line and shows these emails initially being sent from Ms Sandland's work email to the ANMF and copied to her personal email on 8 November 2020. The apparent purpose of the email was to share information with the ANMF (and to keep her own record of the information) about an issue with a broken door. The emails contained information about patients at Dhulwa in 2020, including notes from the treating doctor at the time.

[100] The email sent by Ms Sandland at 11.48am on 25 July 2022 was also inconsistent with Privacy Principle 10. Ms Sandland was required not to disclose the information unless she believed on reasonable grounds that the disclosure was necessary to prevent or lessen a serious and imminent risk to the life or physical, mental or emotional health of the consumer or someone else. I cannot see how this exception could have applied to an email Ms Sandland sent to herself in December 2020 for reasons unexplained.

[101] Ms Sandland says she thought the emails were relevant to WorkSafe looking into things that had happened, but there is no evidence that she sent the emails (or the information it contained) either to WorkSafe or anyone else. The request for information from WorkSafe had been made in May 2022, more than two months earlier. Except for Ms Sandland's assertion, there is nothing in the materials connecting Ms Sandland's activities in July 2022 with WorkSafe (unlike the evidence that exists for May 2022 and October 2022). In an email on 16 May 2022, WorkSafe asked Ms Sandland to send it copies of emails and documents they had spoken about. Ms Sandland responded on 18 May 2022 to say that she would send them from home. It is reasonable to expect that if there was further correspondence with WorkSafe in July 2022 (for example, a copy of an email sent to WorkSafe), this could have been produced by Ms Sandland in answer to Allegation 6. It follows that I do not accept Ms Sandland's explanation that she sent this information to her personal email accounts in response to a request from WorkSafe.

[102] Ms Sandland says she was the only one who had access to the information stored in her private email account. I doubt that to be a correct understanding of the position. Third‑party email servers, such as those in which these emails were stored, are owned and controlled by technology companies that have the ability to access data stored on their servers for a range of purposes, including for monitoring user safety and usage. This is so whether they choose to access the information or not.

[103] On 23 July 2022, Ms Sandland sent multiple emails to her personal email accounts containing personal health information about patients at Dhulwa. This included the email relied upon by CHS in the letter of termination, which was sent by Ms Sandland at 10.58am on 23 July 2022 and forwarded a scanned copy of a Patient Progress record to her two personal email accounts. The Patient Progress record was copied with the patient's name, date of birth and address redacted. Unredacted were the patient's home and mobile phone number, their status as a patient of Dhulwa four months earlier, and notes of discussions between doctors about their leave. I am satisfied that the Patient Progress record was personal information for the purposes of the Health Records Act.

[104] For the same reasons as above, the sending of this information to her personal email accounts was inconsistent with Privacy Principle 4.1, as it did not ensure the protection of health records through the implementation of reasonable security safeguards against unauthorised access or disclosure (the obvious safeguard being to not share it outside of CHS systems). It was also inconsistent with Privacy Principle 10, because there is no basis upon which to find that Ms Sandland believed on reasonable grounds that the disclosure was necessary to prevent or lessen a serious and imminent risk to the life or physical, mental or emotional health of the consumer or someone else. Ms Sandland scanned the document to her email at 6 minutes past midnight on 23 July 2022 and then sent it on to her personal emails approximately 11 hours later. As noted above, there is no evidence that Ms Sandland then sent the information on to WorkSafe. The email was about the leave approval process, and Ms Sandland's concern about the risks arising from the way it was being managed at Dhulwa. There is no basis to find that it was sent for the purposes of mitigating against a serious and imminent risk, or that to do so, it was necessary to share and store the patient's personal information outside of CHS.

[105] At 7.33am on 26 July 2022, Ms Sandland forwarded an email to her two personal email accounts containing scanned documents she had generated at work the night before at 8.56pm. The documents included an email chain about appropriate completion of patient leave application forms, a copy of two such applications (with patient name and personal information redacted on the front page) and a therapeutic leave plan. Despite redactions, the identity of the patient is readily apparent from a reading of the documents together.

The email chain refers to the patient by their first, middle and last name initials. It explains that an application for leave has been submitted and that the patient has been approved for leave before, with a different "leave scale". It describes the window during which the leave is proposed to be taken.
The earlier dated application for leave does not name the patient. The name block has been redacted. Unredacted is the patient's "consumer type", custodial status and mental health order status and name of treating psychiatrist. The type of leave approved is category "E".
The therapeutic leave plan has the patient's personal information redacted on the front page, but describes the same window for leave referred to in the covering email and is signed by the patient on the back page. Their name is set out in full and corresponds with the initials used to describe the patient in the covering email.
The later dated application for leave identifies the patient in full. While an attempt has been made to redact the name block using black ink, it is ineffective. The patient's name, date of birth, gender, care plan basis, identifying number and admission date are visible through the ink. The patient's consumer type, custodial status, mental health order status and name of treating psychiatrist are unredacted and correspond exactly with the information on the earlier dated application for leave. A different type of leave (category "F") is approved, as the covering email identified. Reference is made on the application to the same window for leave described in the patient's Therapeutic Leave Plan.

[106] Once again, the sending of this information to her personal email accounts was inconsistent with Privacy Principle 4.1, as it did not ensure the protection of health records through the implementation of reasonable security safeguards against unauthorised access or disclosure and instead shared and stored it outside of CHS. It was also inconsistent with Privacy Principle 10. When she sent this email to herself on 26 July 2022, Ms Sandland did not believe on reasonable grounds that the disclosure was necessary to prevent or lessen a serious and imminent risk to the life or physical, mental or emotional health of the consumer or someone else. She had ongoing and legitimate concerns about the leave approval process, but her actions were not directed at addressing a serious and imminent risk. It was also not necessary in the circumstances for the personal information of Dhulwa patients to be shared and stored in her personal email accounts.

Further emails relied on by CHS after the dismissal

[107] After the dismissal and in response to matters raised by Ms Sandland in the proceeding, CHS revisited the emails obtained through its earlier audit processes. It identified numerous additional emails sent by Ms Sandland involving the unauthorised disclosure of patient information. Some of those are described above as part of an email chain related to the allegations against Ms Sandland. Others are summarised below.

[108] These emails forwarded an unredacted scan of the same progress note from a patient file from Ms Sandland's work to her personal email account. The progress note includes the full patient name, date of birth, gender, patient number (URN) and details of their care including medications, their DASA score and treatment.

[109] This email forwarded an internal CHS email to Ms Sandland's personal email address. It contains the first and last name and treatment details of a patient at Dhulwa. It is personal information for the purposes of the Health Records Act.

[110] This email is a forwarded email chain between Ms Sandland and Mr Thando Gogwana, a student and former work colleague who had temporarily worked at Dhulwa as a casual nurse. In the email chain, Ms Sandland offered to send Mr Gogwana monthly "DHMU Security and Facility Meeting" papers including Riskman reports, which she received as the new HSW, for his private use. Mr Gogwana responded, including to say:

"In terms of the info, I truly appreciate you're breaking all known confidentiality records, placing yourself at risk of confidentiality/ privacy breach and I promise to keep this discussion and the info private."

[111] He emphasised his interest in "anything in your possession with aggression/violence info." Ms Sandland forwarded the email chain to her personal email address 3 days after her exchange with Mr Gogwana.

[112] This email forwarded an internal email about patient leave from Ms Sandland's work to her personal email account. The email included the patient's full name, treatment details and information about leave.

[113] This email forwarded a "Daily Consumer List" from Ms Sandland's work to her personal email address. It includes information about multiple patients including their first name and initial of surname, dates of birth, Aboriginal and Torres Strait Islander identification status, admission status and dates, aspects of care and leave status.

[114] This email forwarded a copy of 11 progress notes about a patient from Ms Sandland's work to her personal email address. The progress notes detailed information about the patient including their initials, first and last name, gender, medications, behaviour, ward location and admission and treatment information in the previous month.

[115] This email forwarded progress notes about another patient from Ms Sandland's work to her personal email. It contains the patient's full name, date of birth, multiple progress notes and entries about their medication and care, ward location and behaviours.

[116] This email forwarded a patient's progress note from Ms Sandland's work to her personal email. It contains the patient's first name, ward location, and information about an incident involving them and another patient referred to by their initials.

[117] This email forwarded progress notes about a patient from Ms Sandland's work to her personal email. It contains the patient's full name, ward location, and aspects of the patient's care and medication.

[118] As these emails demonstrate, Ms Sandland regularly sent personal health information about Dhulwa patients from her work to her personal email accounts. She did so in circumstances where there is no evidence of her first seeking approval for the conduct or seeking to understand whether it was appropriate, or even by perusing relevant CHS policies. The emails weigh against Ms Sandland's evidence that her usual practice was to redact patient names when sharing information outside of CHS. I am satisfied that sometimes she did try to protect patient privacy by redacting information from her communications. But Ms Sandland did not always do so, and when she did, her efforts were frequently incomplete because they redacted only some, rather than all, of the references to a patient's name or other identifying information in single documents and/or email chains.

[119] The emails are also examples of occasions when Ms Sandland shared the personal information of patients outside of CHS in contravention of Privacy Principles 4.1 and 10 and the Health Records Act. I find no evidence of any relevant circumstance that might have made her disclosures lawful on the grounds that Ms Sandland was authorised to make the disclosures, or that an exception to the Privacy Principles applied.

Did the disclosures fail to demonstrate "reasonable care and diligence" as required by s.9(1)(d) of the PSM Act?

[120] Ms Sandland submits that if her conduct was not in breach of the Health Records Act, all of the allegations against her must fall away. That is neither how the allegations were put to Ms Sandland, nor consistent with the complex regulatory environment in which she worked, including her various separate and distinct obligations under the Health Records Act, the PSM Act, her contract of employment and her duties as a nursing professional.

[121] I have found that Ms Sandland's conduct in relation to each of the emails did not comply with the Health Records Act. On that basis alone, she failed to demonstrate reasonable care and diligence as required by section 9(1)(d) of the PSM Act.

[122] It is not however necessary for conduct to be unlawful to be characterised in this way. The repeated and unauthorised disclosure of patient information to the ANMF was inconsistent with Ms Sandland's obligations as a member of the ACT public service and an employee of CHS bound to follow its lawful and reasonable directions (discussed further below). Through this lens also, Ms Sandland's conduct represented a failure to demonstrate reasonable care and diligence as required by section 9(1)(d) of the PSM Act.

[123] There were simple steps available to Ms Sandland to protect the dignity of patients for whom she had nursing responsibilities. These included providing summaries of her concerns to the ANMF and others instead of simply forwarding source documents containing personal information to them or taking greater care with the attempted redaction of personal information, or not sharing the information outside of CHS in the first place. She could have consulted with either CHS or the ANMF about how best to share information in a way that treated patient privacy as important. She could have found and read the policies dealing with patient privacy and information handling that were available to her through CHS, to better understand or clarify any confusion about how and when such information could be shared. If she could not find relevant policies, she could have asked for them to be provided to her directly.

[124] I reject the submission to the effect that the sheer number and complexity of CHS policies relieved Ms Sandland of her responsibility in relation to them. In her role as delegate and HSR, Ms Sandland was, and should have been, familiar with the importance of workplace policies. There is evidence that she sought to ensure CHS's own compliance with its policies when workplace concerns arose. Although I accept it as unlikely that any employee would be across every detail of every organisational policy in a workplace the size of CHS, this must be weighed against the opportunity made available by CHS for all of its employees to access relevant policies as and when required (either by direction or on their own initiative).

[125] In my view, it would not have been difficult for Ms Sandland to discover how to find policies about the sharing of information outside of CHS, and then to locate and read those policies. Each of these steps were reasonably open to Ms Sandland. None would have unreasonably impinged on her ability to perform her roles as nurse, union delegate or HSR, although it might have meant a little more effort in the preparation of communications, or in the keeping of records specific to her role.

[126] For these reasons, Ms Sandland did not meet the expectations of section 9(1) of the PSM Act when acting in connection with her job as an enrolled nurse at Dhulwa. She did not comply with laws applying in the ACT when she disclosed information outside of CHS contrary to the Health Records Act. This same conduct meant that she did not comply with lawful and reasonable directions given to her through CHS policies to keep this information safe. She did not treat all patients at Dhulwa with sensitivity to their right to privacy and dignity when she shared their personal information, and personal health information, outside of CHS without authorisation or consent. And in each of these ways, Ms Sandland did not act with reasonable care and diligence.

Were the disclosures a "criminal act" under the Criminal Code?

[127] The answer to this question is 'no', insofar as it relates to breaches of the Health Records Act and the Privacy Principles, because Ms Sandland's conduct does not fall within one of the categories of offence in Part 5 of the Health Records Act (see paragraph [23] above). A separate issue arises in relation to whether Ms Sandland's conduct was a crime under the PSM Act because of section 9(2)(d) of the PSM Act, which provides that a public servant must not, without lawful authority, disclose confidential information gained through their job. Under section 153(1) of the Crimes Act 1900 (ACT), it is an offence for a public servant to disclose information that it is their duty not to disclose.

[128] The difficulty is that it was never put to Ms Sandland that her conduct was or may have been an offence under section 153(1) of the Crimes Act 1900 by reason of her duty not to disclose confidential information under the PSM Act. Given the seriousness of the matter, it would not be appropriate to make any findings in this regard. Even if it were, the nature of the Commission's role as a quasi-judicial tribunal tells against it.

Did Ms Sandland appropriately handle and protect sensitive information under the Standards?

[129] I summarised above, the Standards of primary relevance to this case, developed by the Nursing and Midwifery Board of Australia in its regulatory role that includes establishing requirements for the professional and safe practice of nurses in Australia. To restate those briefly, Standards 1.1 and 2 require nurses to demonstrate knowledge and understanding of relevant laws pertinent to nursing practice, and to practice nursing in a way that ensures the rights, confidentiality, dignity and respect of people were upheld, and to ensure privacy, dignity and confidentiality when providing care.

[130] As an experienced enrolled nurse, and as conceded at the hearing, Ms Sandland knows about the importance of patient confidentiality. This is and should be unexceptional in the context of her role and experience. Despite this knowledge, the conduct described above demonstrates that Ms Sandland did not always practice nursing in a way that ensured the privacy, dignity and confidentiality of patients in her care. In other words, Ms Sandland did not always meet the standards expected of her by the nursing profession.

Did the disclosures undermine the integrity of CHS's handling of personal health information?

[131] At the time that she was preparing to commence employment with CHS on 18 July 2016, Ms Sandland completed a form titled "New Employee Information Pack". Under a section headed "My Obligations", the form averted to her obligations as an ACT public servant under "a range of legislation and policy", including the "General Obligations of Public Employees" (including in relation to the unauthorised disclosure of information), the "Workplace Privacy Policy", the "Acceptable Use of ICT Resources Policy" (the ICT Policy) and the relevant enterprise agreement(s). It said:

"As a member of the ACT Public Service, your actions and behaviour are governed by a range of legislation and policy. Your offer of employment with the ACT Public Service is conditional upon reading and understanding the following policy statements. By signing and dating this form you are acknowledging that you have read and understand these policies, conditions and requirements."

[132] Ms Sandland signed and dated the form, and in doing so she acknowledged:

That she had read and understood her obligations, specifically, the General Obligations of Public Employees, the Workplace Privacy Policy and the ICT Policy (to which links had been provided in the form as is made clear from the words "linked above"),
That she had been given the opportunity to read and understand her entitlements as established under Commonwealth and ACT Law, specifically, the Fair Work Information Statement, Superannuation Standard Choice, and Superannuation Entitlements,
That the information she had provided on the form was true and correct, and that any qualifications or proof of professional registration submitted with her application were genuine, and
that she gave consent for her Information to be released to the AFP, Crimtrac and other Australian jurisdictions for the purposes of a national criminal history record check.

[133] On 10 November 2016, Ms Sandland undertook a "Workplace Induction Pathway". In a form describing ACT Health's "organisational context", she declared that she had "been shown where to find relevant Policies, procedures, Guidelines and Standard Operating Procedures".

[134] The General Obligations of Public Employees document is not in evidence. To the extent that it recounts the general obligations of ACT public servants under section 9 of the PSM Act, those are dealt with separately in this decision.

[135] The ICT Policy was in place throughout the period of Ms Sandland's employment and although it had been updated over that time as the amendment history makes plain, its material terms remained over that time. The purpose of the ICT Policy is to instruct ACT Public Service employees and contractors ("staff") in the acceptable use of information and communications technology (ICT) resources, including about acceptable, prohibited use, information security, security practices and compliance. It is based on the overarching principle that employees must comply with the PSM Act, the Public Sector Management Standards 2006 and the Public Sector Code of Conduct.

[136] Among other things, the ICT Policy clearly states:

Do not use ICT resources to engage in any unlawful conduct, or any conduct that contravenes legislation including but not limited to the ... Health Records Act,
Do not disclose confidential information without approval of the delegate,
Do not disclose official information to unauthorised recipients. Authorisation to disclose official information to recipients, including the public, must first be obtained from the data steward for that information,
You must be particularly careful to:
- use personal information only for the purpose for which it has been provided
- take reasonable steps to protect personal information from loss or disclosure, and
- never disclose personal information to unauthorised recipients,
Always follow the applicable ACT and Commonwealth legislation when using personal information related to health, education, legal matters, child protection, corrections and community services,
Do not send sensitive or classified information to external parties unless it is appropriately protected and authorised for use by your directorate or public authority,
Do not send ACT Government information to private email accounts.
- Exceptions to this may apply, i.e. where end-of-employment forms need to be retained as personal copies by the separating employee,
ACT Government monitors staff use of Government computers and ICT systems.
In the absence of an explicit waiver, the use of ICT resources for activities that might be inappropriate is forbidden and may lead to disciplinary action being taken against the staff member, and
Breach of the ICT Policy may constitute misconduct under the PSM Standards. Disciplinary action can include counselling, formal warning, conditions placed on continuing service, deductions from salary, changes to employment contract or termination of engagement.

[137] The Workplace Privacy Policy is also not in evidence. Before me instead are the CHS Policies on Information Privacy and Consumer Privacy. The former does not apply to the management of personal health information and so can be put to one side. The latter deals with the privacy of personal health information, together with (relevantly) the CRM Policy, the Clinical Records Management Procedure and the Confidentiality, Privacy, and Access to Mental Health, Justice Health and Alcohol and Drug Services Clinical Records Operational Procedure (the Confidentiality, Privacy and Access Procedure).

[138] The Consumer Privacy Policy was issued on 20 October 2021 and sets out what consumers have a right to expect. This includes that their personal health information will be protected in accordance with the Health Records Act and that this information may be shared with another person only if this is important for their healthcare or is in accordance with the Health Records Act.

[139] Expressly stated in the Consumer Privacy Policy is that:

"Health professionals have a duty to maintain the confidentiality of all information that is directly or indirectly gained, created or disclosed to them while providing treatment or care to consumers."

[140] The Consumer Privacy Policy also states that:

CHS is committed to ensuring that people who access care at CHS have their privacy safeguarded; a goal that will be achieved by ensuring that all personal health information that CHS holds is secure and protected from unauthorised access or misuse,
Reasonable steps will be taken to ensure that personal health information is securely stored by CHS and not misused,
Members of a consumer's treating team are responsible for only sharing personal health information with other members of the treating team unless by consent or the consumer or where the disclosure is necessary to prevent or lessen a serious imminent risk to the life or physical, mental or emotional health of a person, and that
All CHS team members are responsible for:
1. adhering to the 12 Privacy Principles in the Health Records Act,
2. protecting the privacy and confidentiality of all personal health information,
3. accepting responsibility for all activities undertaken using their login,
4. not removing confidential information from the workplace unless authorised, and
5. reporting any complaints or witnessed privacy breaches to their manager or supervisor.

[141] The term "identifying information" is defined in the Consumer Privacy Policy to mean "Personal health information that identifies the person. At CHS this information is the person's full name, date of birth and medical record number." Although this definition is more restrictive than that found in the Health Records Act, the term "personal health information" is also defined. It means "personal information that is identifying information, or which could reasonably link to identifying information, collected from or about individual people in order to provide them with health services."

[142] The term "privacy breach" is also defined in the Consumer Privacy Policy. It means "unauthorised access to, use or disclosure of a patient's personal health information". The policy goes on to say: "Depending on the gravity of the privacy breach, there may be an investigation and disciplinary action in accordance with the relevant Enterprise Agreement". This includes "disclosing personal health information about a patient to the public."

[143] The CRM Policy makes all staff responsible for the security of personal health information captured and used by CHS and requires them to limit the sharing of personal health information to members of the treating team, health service providers involved in the care of the patient and other authorised persons.

[144] The Confidentiality, Privacy and Access Procedure commenced on 15 March 2018. It has as its purpose to provide relevant staff with an outline for appropriate record keeping, associated with confidentiality, privacy, and access to clinical records. Among other things, adherence to the procedure is intended to ensure that confidential information is only disclosed to people authorised to have the information in accordance with the Health Records Act as well as respect for a person's right not to involve others in their care.

[145] Under the Confidentiality, Privacy and Access Procedure:

Clinical records are the property of ACT Health and are to be kept under adequate security and only removed upon court subpoena, statutory authority or a search warrant.
Only members of a treating team and authorised staff may have access to the personal health information of a person accessing services covered by the policy (which includes Dhulwa).
A signed consent from the person must accompany any requests for clinical records for research purposes.
In all circumstances, when releasing information, all staff will do so in the best interests of the person. Staff are also to actively seek information from carers/family members.
All staff are required to complete Confidentiality and Privacy training.

[146] Each of these policies and procedures applied to Ms Sandland as a member of the ACT public service and employee working at Dhulwa. They each contained lawful and reasonable directions that Ms Sandland was expected to follow. I am satisfied that Ms Sandland's disclosures to the ANMF and to her private email accounts were inconsistent with these policies and procedures. The disclosures had the effect of undermining the integrity of CHS's handling of personal health information. I have already observed that by sending this information to third‑party email servers, the confidentiality of information was compromised. Once stored outside of CHS, the information was no longer within the capacity of CHS to manage or control. This, and the pattern of regular disclosures of personal information to the ANMF, undermined the ability of CHS to meet its own obligations as record-keeper under the Health Records Act to protect and respect the confidentiality of information about the people in its care and control.

[147] There is no evidence that Ms Sandland was authorised to send any personal information of patients at Dhulwa to the ANMF or to store it on a mail server external to CHS. The evidence is to the contrary, including in the express terms of the policies and procedures referred to above. In this respect, I do not accept that Ms Sandland did not know about her general obligations as a nurse and member of the ACT public service. Ms Sandland was on notice of these policies and had access to them from the start of her employment in 2016. In her role of union delegate, an important focus for her was ensuring that CHS complied with its own policies and procedures. She acknowledged the existence of some of these policies about processes that applied at Dhulwa in her evidence and denied knowledge or the reading of others. I am satisfied that Ms Sandland had sufficient knowledge of, and the means to access, CHS policies as and when required (with the potential exception of during the period while she was suspended from work prior to her dismissal).

[148] The troubling revelation that Ms Sandland did not read documents, including those she had been asked to acknowledge and become familiar with as a condition of employment, brings into question how CHS could have confidence that she would follow its written directions in the future. It does not mean that relevant CHS policies can simply be ignored or put to one side in considering whether the dismissal was unfair.

[149] CHS policies are each directed to a particular purpose. Those that deal with safeguarding patient information play an important role in assisting CHS to meet its own statutory obligations, including under the Health Records Act and the Privacy Principles. Requiring Ms Sandland to become familiar, and comply, with these policies was not unreasonable in the circumstances. Although CHS has numerous policies regulating all manner of things, there is a substantial degree of overlap and a commonality of purpose in relation to the protection of confidential and personal information. These policies applied to her employment and Ms Sandland was required to comply with them.

Did the disclosures cause reputational risk to CHS, particularly in the context of open disclosure?

[150] The disclosures made by Ms Sandland to the ANMF had potential to cause reputational risk to CHS in connection with its ability to manage and protect the privacy of vulnerable persons in its care. At the time when much of the disclosures were made, Dhulwa was the subject of at least two separate reviews about matters including safety and culture. Unlike CHS and its employees, the ANMF was not bound to treat the information obtained about patients of Dhulwa with care, although it had undertaken to CHS that it would do so.

[151] Reputational risk also arose from the possibility of undermining trust among patients and their families about CHS's ability to safely manage personal information. However, I am not satisfied that this reputational risk to CHS was heightened in connection with the practice of "open disclosure". Open disclosure involves communicating with an individual when there has been a breach of their privacy, to explain what has happened and what is being done to protect their interests. While open disclosure is normally required within CHS, exceptions can be made where on balance, the benefits of open disclosure are outweighed by competing factors such as the risk to a person of engaging in the practice. In the case of the disclosures made by Ms Sandland, the evidence is not clear as to whether the practice of open disclosure was actually engaged although it seems likely that it did occur, but not universally in relation to patients affected.

Were the disclosures inconsistent with the continuation of Ms Sandland's contract of employment?

[152] The ongoing nature of Ms Sandland's conduct speaks against the continuation of her contract of employment. This is because ensuring the privacy, dignity and confidentiality of patients when providing care is fundamental both to the nature of Ms Sandland's profession and her role as a member of the ACT public service charged with the care of patients with complex needs.

[153] On balance, I am satisfied that there was a valid reason for the dismissal of Ms Sandland: that is, the repeated unauthorised disclosure and storage of personal information and personal health information over many years. Considered in totality, the conduct was a sound, defensible and well‑founded reason for dismissal.

[154] Ms Sandland was notified of the reasons upon which CHS proposed to terminate her employment in the show cause letter on 8 February 2023. This included notification that CHS relied on her repeated unauthorised disclosure of personal information and personal health information both to the ANMF and her private email accounts. Although the notice to Ms Sandland did not address the further emails now relied upon, the additional emails are in the same category of behaviour that was put to Ms Sandland for her response on 8 February 2023. I am satisfied that Ms Sandland was notified of the valid reason for her dismissal before the dismissal took effect.

Was there an opportunity to respond to any capacity or conduct related reason?

[155] Ms Sandland was given an opportunity to respond to the concerns of CHS about her repeated unauthorised disclosure of personal information and personal health information. The letter of allegations on 8 February 2023 summarised the concerns in sufficient detail to enable a response from Ms Sandland. It sought her response by 15 February 2023. After a request from the ANMF, the timeline was extended by one week with a response sought by 22 February 2023.

[156] It remains unexplained why the ANMF did not make any response to the allegations on behalf of Ms Sandland before she was dismissed, either substantively or by seeking a further extension or more information. There is a suggestion that the ANMF was misdirected by CHS after asking for a different decision maker in relation to the matter and assuming no further steps would be taken in the matter until the name of the alternative decision maker was communicated to the ANMF. This was an assumption only, in which CHS played no part. There is otherwise no explanation for why the ANMF ignored CHS's repeated attempts to contact it to ascertain if Ms Sandland wished to make any response. At least four times over the telephone and once by text message, Mr Jim Tosh, Senior Director in People & Culture, tried to seek clarification from Mr Cullen. Mr Cullen's evidence sheds no light on his failure to respond to Mr Tosh or the reasons for it. I infer that his evidence would not have aided Ms Sandland's case.

[157] Even so, I accept the submission put on behalf of Ms Sandland that CHS acted with undue haste when it terminated her employment two days after having received no response, on 24 February 2023. There was no need for it to act in this way. Ms Sandland had been stood down. She was no longer in the workplace and her email access had been suspended such that the risk of further unauthorised disclosures was contained.

[158] CHS could have granted one more week, as sought by the ANMF on behalf of Ms Sandland, for her response. There is no reason why CHS could not have also taken the time to complete its review of the audited emails before Ms Sandland was dismissed. Had it done so, Ms Sandland would likely still have been dismissed. But in reaching its decision, CHS might also have had the benefit of Ms Sandland's response and in particular, whether there were any mitigating factors relevant to the appropriate sanction for her conduct before a final decision was made.

Was there any unreasonable refusal to allow a support person to be present to assist at any discussions relating to dismissal?

[159] There was no unreasonable refusal to allow Ms Sandland to have a support person to assist in discussions about the dismissal. To the extent that there were discussions relating to the dismissal, they were limited to a request for additional time to respond to the show cause letter of 8 February 2023 and a request for a different decision maker in relation to the allegations made against Ms Sandland. In each case, these representations were made by the ANMF on behalf of Ms Sandland.

Was Ms Sandland warned about relevant unsatisfactory performance?

Carol Sandland v Australian Capital Territory t/as Canberra Health Services [2023] FWC 3389

At a glance

Court

Decision date

Source

Judgment (392 paragraphs)

Carol Sandland v Australian Capital Territory t/as Canberra Health Services [2023] FWC 3389 (19 December 2023)

Parties

Legislation Cited (9)