DMP v Sydney Local Health District

DMP v Sydney Local Health District - [2022] NSWCATAP 357 - NSWCATAP 2022 case summary — Zoe

[4]

Fresh Evidence

DMP confirmed at the appeal hearing that he had not provided to the Appeal Panel, all the material that had been provided to the Tribunal in the primary proceedings.
DMP has provided volumes of additional material that he seeks to adduce as fresh evidence. DMP seeks leave to rely on those documents as a matter of public importance. Leave to rely on new evidence is also raised by ground 17 of DMP's grounds of appeal.
A party seeking to adduce fresh evidence in an appeal may only do so with the leave of the Appeal Panel. To exercise the discretion, we must be "affirmatively satisfied" that, having regard to the findings of the Tribunal in the primary proceedings, the further evidence is "likely to have produced a different result": Building Professionals Board v Hans (2008) NSWADTAP 13 at [54].
DMP seeks firstly to rely on an access application he made to the Ministry of Health under the Government Information (Public Access) Act 2009 (NSW) (GIPA Act). DMP submits there was an attempt to conceal policy document by Ministry of Health and that is relevant to his appeal because it demonstrates corrupt conduct by various employees of SLHD and the Minister of Health. He says the evidence only came into existence after the hearing. DMP submits that the evidence is reliable and that there is no innocent explanation for the concealment by the SLHD. He states that the material: … offers robust evidence of the existence of a government conspiracy. With the addition of this evidence DMP no longer appears as crazy as he initially did. There are three data points linking Hon Brad Hazzard (Minister for Health) to the NSW Health Crime Family.'
DMP also seeks to rely on further audit reports of records held within the non-production database of the eMR, called "eCERT". The documents include what DMP describes as a 'reconstruction of an audit report.' DMP asserts that an inference can be drawn from that reconstructed audit report that the eCERT was destroyed shortly after the commencement of the internal review on 1 June 2018. DMP submits that this reveals consciousness of guilt and further substantiates his allegation of widespread, unauthorised access and remote access and the repeated destruction of evidence is indicative of the obstruction of justice. DMP alleges that the reconstructed report would have challenged the hearsay evidence of Ms Wagstaff who gave evidence for SLHD in the proceedings. DMP says he did not previously file the documents because, although he alleged the eCERT was destroyed, he was not aware that he had been provided with a 'fake audit'. DMP submits that, not only should this evidence be admitted, but the conduct of the SLHD and various others should also be referred to the Supreme Court. He also says that the new evidence substantiates modification of the records for the secondary purpose of murdering him. In that regard, failure to allow the fresh evidence would allow the government to get "away with a conspiracy to commit murder."
Having considered those submissions, we do not grant leave for the consideration of the fresh evidence on appeal. The allegations being raised before the Appeal Panel, are not relevant to the issues that needed to be determined by the Tribunal in the primary proceedings. Some of the conduct being alleged occurred after the proceedings. The fresh material includes extracts from textbooks, journal articles, newspaper articles, blog posts, NSW Health guidelines, SLHD Annual Reports, and Tribunal fact sheets. We are not prepared to allow leave for voluminous documents based on the generalised allegations made by DMP, in the absence of particularisation of which documents would establish the appeal grounds raised. Leave to rely on fresh evidence is refused and ground 17 of the appeal fails.
As a consequence, we will not refer to or further consider the fresh evidence.

[5]

The Tribunal's Reasons

The primary proceedings were heard over four days. The first day is referred to by DMP as a 'planning day'. The Tribunal dealt with all three applications in the reasons for the decisions (the Reasons).
The Tribunal set out at [17] of the Reasons, the allegation in relation to application 2018/00199878 (application 1) as follows: (a) that his health information has been unlawfully used by SLHD for eMR training in breach of HPP 10 as it does not have a training exemption to do so; (b) that there was no implied consent that his health information relating to his attendance at a methadone clinic on 14 October 2008 could be used for eMR training; (c) even in the absence of an authorised access to his information, his health information was exposed to an unreasonably high risk of unauthorised access through eCERT; (d) when access logs prior to 21 November 2014 were deleted, SLHD destroyed evidence; (e) even after being made aware of his express refusal to consent to secondary uses of his information, SLHD continued to retain his health information and used it for eMR training.
The Tribunal set out at [19] of the Reasons, that in application 2019/00199878 (application 2), DMP alleged similar breaches as contained in application 1 and raised the further issues as follows: (a) any eMR training sessions between 10 January 2018 and 15 March 2018 involving the use of the non-production environment eCERT and where his identifiable health information had been present within eCERT; (b) the presence of his identifiable health information within a non-production environment other than eCERT for any purpose between 10 January 2018 and 15 March 2018; (c) any eMR training sessions between 11 January 2018 and 15 March 2018 involving the use of the non-production environment eCERT and where identifiable health information relating to his prior attendance at a methadone clinic was present; (d) failure of SLHD between 1 January 2018 and 15 March 2018 to restrict access (within both the eMR and non-production environments) to health information relating to his attendance at a methadone clinic; (e) exposure of his health information to an unreasonably high risk of unauthorised access through the use of any non-production environment, including but not limited to eCERT even in the absence of any unauthorised access of his information from 11 January 2018 to 15 March 2018; (f) unlawful retention and use of his health information within eCERT and any other non-production environment for any secondary purposes following enforcement of his "express refusal notice" between 11 January 2018 and 15 March 2018; (g) the conduct of SLHD between 12 December 2017 and 15 March 2018 in not informing him whether use of his information was continuing in breach of HPP 6; (h) unlawful disclosure by SLHD of his health information to the NSW Information and Privacy Commissioner sometime between 7 March 2018 and 13 March 2018; (i) someone in SLHD unlawfully used his health information for the purposes of unlawfully de-identifying it on 23 May 2018; (j) failure to safeguard his health information by exposing it to the Chief Executive as well as the Clinical Governance Unit; (k) failure of SLHD to update his health information to reflect his Advance Care Directive and his requirement that 100 points of identification be collected prior to treatment of anyone claiming to be him; (l) the unlicensed retention, use and/or disclosure of the health information of Mr A, Mr B and Mr C (and possibly Mr D who DMP refers to in submissions) without consent to do so.
The Tribunal considered applications 1 and 2 together.
The Tribunal determined that DMP had not identified any "use" of his health information, in breach of HPP 10(1) in the eMR training session in January 2013, or in other training sessions before or after that training session. The Tribunal also determined that there was no evidence (other than the DMP's own statement) that there had been widespread access to his DMP's or others information. In relation to adequate safeguards, the Tribunal stated at [58] of the Reasons that: Overall, while there may be aspects of the security safeguards put in place by SLHD which might not meet best practice, I am satisfied that the system of safeguards put in place to protect the information against unauthorised access were reasonable in the circumstances and were not inadequate. It must be said that no system can guard entirely against wilful disregard and desire to circumvent the safeguards in place.
The Tribunal also found there was no breach regarding SLHD updating DMP's health information or disclosing certain information to the Information and Privacy Commissioner for the purposes of investigation.
In relation to application 2018/00355100 (application 3), the Tribunal set out at [89] of the Reasons, that DMP alleged the following contraventions which had resulted after he presented to a hospital in the SLHD with severe abdominal pain on 6 June 2018: (1) HPP 13 - by refusing to treat him anonymously when it was both lawful and practical for him to receive treatment under a pseudonym; (2) HPP 1 - by unlawfully collecting his name and/or Medicare number because it was not reasonably necessary, and HPP 2 - as the collection of that information was excessive and/or irrelevant for the purposes claimed; (3) HPP 1 - by coercing him into providing information (his Medicare details) that it knew was not required in breach of s 70 of the Act, rendering the collection of that information unlawful; (4) HPP 4 - even though DMP stated he would pay cash, he was told he needed to supply his Medicare card. This was a breach of HPP 4 because he was not told the purpose of collection and there could be no lawful reason to hand over his Medicare card in the circumstances; and (5) HPP 5 - by exposing his identifiable health information to an unreasonably high risk of unauthorised access and misuse by failing to protect it against those responsible for safeguarding it. (This alleged contravention relates to the retention of DMP's health information in the eMR non-production environment.)
The Tribunal also found no breach in relation to that incident.

[10]

Legal Principles

A failure to give proper reasons may amount to an error of law: Stoker v Adecco Gemuale Constructions Pty Ltd [2004] NSWCA 449 per Santow JA at [41]; New South Wales Land and Housing Corporation v Orr [2019] NSWCA 231 (Orr) per Bell P (as His Honour then was) at [66].
Regarding delay, in NRM Corporation Pty Ltd v Australian Competition and Consumer Commission [2016] FCAFC 98 the Court said at [134] It is thus to be accepted that the "circumstances in which delay, of itself, will vitiate proceedings, or a decision, are rare": NAIS v Minister for Immigration and Multicultural and Indigenous Affairs [2005] HCA 77 at [5], (2005) 228 CLR 470 at 473 per Gleeson CJ. The Chief Justice there went on to observe that a court "may conclude that delay in giving judgment has contributed to error, or made a decision unsafe" but that "the ground of appellate intervention is the error, or the infirmity of the decision, not the delay itself".
In Monie v Commonwealth [2005] NSWCA 25; 63 NSWLR 729 (Monie), the Court of Appeal dealt with an appeal in which the first instance decision was delivered more than seventeen months after judgment had been reserved. Each of the grounds raised by the appellant in the appeal were based on the delay of the judge in giving judgment and on the consequences that were said to have flowed from the delay. The appeal was allowed, and a new trial was ordered on all issues. Hunt AJA set out at [43] of the decision, principles from various cases regarding delay in the delivery of reasons and the proper approach of an appeal court. His Honour concluded at [44]: 44 It must, however, be emphasised that delay between taking evidence and the delivery of judgment does not, in itself, justify upholding an appeal against the judgment given. Error must still be established on the part of the trial judge warranting either a reversal of the judgment or the grant of a new trial. Delay may assist an appellant in establishing such error because, as the approach identified by the Full Federal Court demonstrates, the inference will more readily be drawn that a trial judge's failure to deal in a significantly delayed judgment with particular matters on which the appellant relied in contradiction of the findings made in that judgment resulted from those matters being overlooked by the judge - either because of the time which has passed or because of the pressure on the judge in the end to complete the judgment. In Boodhoo v Attorney General of Trinidad and Tobago [2004] 1 WLR 1689 at [11], the Privy Council acknowledged that the delay in giving the decision may adversely affect its quality to such an extent that it cannot be allowed to stand. That is what must be shown in order to demonstrate error resulting from delay which warrants either a reversal or a new trial. That is what I understand the judgment in Expectation Pty Ltd v PRD Realty Pty Ltd at [69] et seq to be saying.
Bryson JA agreed with Hunt AJA. Giles JA did also, subject to matters his Honour set out at [2] - [4] of his decision regarding the principles relating to delay.
Monie was discussed by Allsop P in MM Constructions (Aust) Pty Ltd v Port Stephens Council [2012] NSWCA 417; 191 LGERA 292. At [11] His Honour stated: Delay is regrettable. The "sorry tale" (to quote Giles JA) of the delay in Monie is set out in detail in the reasons of Hunt AJA at [36]-[42]. The delay was 17 months. The deep deficiencies of the judgment in that case in its grappling with the issues are recounted by Hunt AJA and need not be repeated here. Implicit in Hunt AJA's reasons and explicit in Giles JA's reasons is the importance of the quality of the work produced by the judge in assessing what may be seen to be the operative effect of the delay.
In Meacham v Commissioner of Police [2020] NSWCATAP 107 (Meacham), the NCAT Appeal Panel citing the decision in In New South Wales Land and Housing Corporation v Orr [2019] NSWCA 231, considered at [33] - [ 35], what is required by reasons and the quality and detail of reasoning process that must be exposed: … Bell P outlined the following requirements additional to those in s 62(3), drawing particularly on case authorities relating to judicial review (citations omitted) at [73]-[75] and [77]: - While a detailed exposition of every element of the evidence and arguments is not necessary, a basic explanation of the fundamental reasons which led the Tribunal to its conclusion is required; - It is not necessary to detail each factor found to be relevant or irrelevant, or to make an explicit finding on each disputed piece of evidence. It will be sufficient if the inference to what is found is appropriately clear, and the basis of the decision is made apparent; - The reasons must indicate to the parties why the decision was made, and allow them to exercise any rights that may be available to them in respect of the decision (including any avenue of appeal); - The reasons must provide an explanation connecting any findings of fact with the decision reached; - It is not necessary to decide each factual issue in isolation from the others, and expressing conclusions in a certain sequence does not indicate a failure to consider the evidence as a whole. 34 Further, in reviewing the adequacy of a decision maker's reasons, an appellate court (and, by extension, this Appeal Panel): - should not read passages from the reasons for decision in isolation from others to which they may be related; - must read the reasons fairly and as a whole; - should not inspect the reasons with a finetooth comb attuned to identifying error; and - should have a degree of tolerance for looseness in the language of the Tribunal, unhappy phrasing of the Tribunal's thoughts or verbal slips: Orr at [77]. 35 In line with the authorities referred to in Orr, it has also generally been accepted that, while not every submission or piece of evidence put forward by the parties must be referred to, "central controversies" put up for resolution by the parties must be dealt with, and the competing evidence relevant to those controversies analysed and resolved: Mitchell v Cullingral Pty Ltd [2012] NSWCA 389 ("Mitchell") at [2].
With the principles raised by the above-mentioned cases in mind, we have considered each of the grounds raised by DMP in relation to the adequacy of reasons.

[11]

Ground 16 - Delay in giving reasons

DMP submits that the Tribunal's delay in delivering reasons gives rise to a question of law. The decision was reserved for 756 days. DMP developed a script to scan the CaseLaw database and has provided a comparative table of time taken to complete decisions in these types of matters. He submits that this is the longest time a matter of this type was reserved and that the delay gives rise to a question of law.
SLHD submits that that the delay in providing reasons in this matter did not vitiate the decision and that there is no identifiable error on the part of the Tribunal in relation to the reasons. They submit that the quality of reasons provided meets the standard required and that no form of error has occurred.
In these proceedings, the Tribunal delayed in providing reasons for a period of just over two years. That is a substantial delay. There is nothing in the Reasons to explain that delay. At [4] - [5] of the Reasons the Tribunal stated: 4 A significant volume of material has been filed by both parties in relation to these applications. It has not been possible in these reasons to refer to every document filed, nor is it necessary to do so. 5 Unfortunately, much of DMP's submissions is difficult to understand, is circuitous, puts forward conjecture as evidence and contains hyperbole. His complaints also appear to have expanded over time and through his many submissions. The scope of the matters before the Tribunal is determined by the scope of his internal review applications in these matters (KO v Commissioner of Police (NSW) [2005] NSWADTAP 56 at [13]; Department of Education v ZR (No 2) [2009] NSWADTAP 44 at [16]).
Similarly, in this appeal, DMP produced volumes of materials which included submissions. Much of the material was repetitive and irrelevant. We also found it difficult at times to follow DMP's submissions. That does make determining a matter such as this difficult.
Whatever the cause of the delay, for the appeal to be allowed, DMP needs to demonstrate that the delay in providing the decision and had some 'operative effect' on the Reasons.
DMP has also made a general assertion that the Tribunal failed to give reasons. The Tribunal did give reasons for the decision and no question of law can arise in that regard.
We have understood from DMP's other grounds, that what he asserts by this ground, is that the delay has affected the quality of the Reasons and gives rise to errors by the Tribunal as illustrated by many of the claimed defects in the Reasons that he raises in his appeal. On that basis, we have considered the delay and its impact on those appeal points when determining whether a question of law arises.

[12]

Ground 1 - Reasons in relation to the background of the matter

In relation to ground 1, DMP submits the Tribunal's Reasons at [10] - [16] are a 'cut-and-paste' of the SLHD's submissions and that the Tribunal failed to consider his submissions in reply. Those parts of the reasons are under the heading 'Background' and set out the following: 10 The uncontroverted background to DMP's applications is that, as a third year medical student about to commence work at a hospital in SLHD, in January 2013 he undertook training in how to use the eMR. DMP states that the purpose of the training was to learn how to search for and access health records, with a view that students would know how to navigate the system during clinical rotations. 11 Prior to undertaking the training DMP signed the "eMR User Access Request form and data security declaration" in which he acknowledged that he had read and understood the following responsibilities and obligations: You are aware of your responsibilities under the Health Records Information Privacy Act 2002 and the Privacy and Personal Information Protection Act 1998, as outlined in NSW Health, SLHD. SWSLHD and (where appropriate) SSWAHS policy documents. As such, you understand that you are not to access your own records unless in the presence of your medical practitioner. You are not to access work colleagues, friends or family members records. 12 On the day he attended the training, DMP completed a checklist which included the statement "I agree that I have attended formal training and I have been instructed in the above and I understand my responsibilities under Privacy and Security Legislation". 13 DMP states that during the training session he accessed his own records. He states that he also suspects that someone else accessed his records during a training session (not necessarily the session he took part in). He also states that he looked up the records of other people he knew and someone else in the training session implied they did likewise. 14 DMP first made contact with SLHD about any concerns in November 2016. On 3 November 2017 DMP wrote to SLHD in the following terms: I kindly ask that you cease all use of my health records for any secondary purposes. This includes use of my records for eMR training sessions, as well the inclusion of my records in a larger training dataset where its presence could result in it being accessed during training sessions. 15 There then followed a good deal of correspondence between DMP and SLHD about his concerns and an investigation was undertaken. On 28 February 2018 DMP was provided with a report on the investigation in which it was proposed that his name on eCERT be changed to an alias and that an electronic alert be placed on eCERT indicating that access to the record was restricted. DMP responded on 7 March 2018 stating that he did not agree with the proposed restriction on his records and indicated he wished his records to be deleted from eCERT. 16 SLHD advises that on 23 May 2018, following further correspondence with DMP, information about him on eCERT was de-identified in that his last name was changed to "UNKNOWN" and his first name was changed to "Male" wherever they appeared. DMP's patient record on eCERT was also deactivated in that it was made unsearchable by end-users.
DMP asserts he analysed the decision by running it though a plagiarism check, and he has highlighted sections in the Reasons which he believes are plagiarised from the submissions. We have considered the Reasons against the submissions and the Reasons do not demonstrate a blanket "cut and paste" of the background. It is not unusual or inappropriate that the Tribunal should repeat submissions in the Reasons that are uncontroversial.
DMP submits that the Tribunal's statement at [10] of the Reasons, that the background was an "uncontroverted background", was inaccurate because DMP had a different interpretation of events. A summary of events, under the heading 'facts', was contained in Part III of SLHD's submissions to the Tribunal dated 17 December 2018. In his Notice of Appeal, DMP refers to his submissions in reply, at 5.5 with the heading, 'Correction to timeline'. Those submission appear at page 1958 of part 5 of 5, of what is referred to as the applicants Court book. DMP states: It appears that SLHD and I are operating off a different timeline. Some events have been overlooked while for others, I have a significantly different interpretation of them.
In our view, consistent with the principles set out by Bell P in Orr, it was not necessary for the Tribunal in these proceedings to detail every factor raised by the parties in the background to make the relevant findings in relation to the breaches alleged by DMP.
DMP has failed to identify the relevance of any omission or alternative to the timeline, raised by his submissions, which would have been pertinent to the determination of the issues in dispute. On that basis there is no question of law that arises from ground 1.

[13]

Ground 2 - Most serious allegations glossed over and Tribunal failed to give reasons for findings

DMP says that there was an error in the Tribunal's determination that there was nothing improper about SLHD providing a copy of a report of to the Information and Privacy Commissioner. DMP submits he was deceived by SLHD into withdrawing his internal review request to the Information and Privacy Commissioner.
At [71] - [75] of the reasons the Tribunal found that SLHD's disclosure of DMP's health information to the Information and Privacy Commissioner was not in breach of HPP 11.
HPP 11 relates to the limits on disclosure of health information and relevantly provides: (1) An organisation that holds health information must not disclose the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless - (a) Consent the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or (b) Direct relation the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or … (k) Investigative agencies the disclosure of the information for the secondary purpose is reasonably necessary for the exercise of complaint handling functions or investigative functions by investigative agencies, …
At [75] of the Reasons, the Tribunal found that the IPC was investigating or otherwise handling a complaint made by DMP and that the disclosure of his health information was reasonably necessary for the exercise of that function. HPP 11 (1)(k) allows such an exception, and in our view, it was open to the Tribunal to make that determination.
DMP also alleges that improper conduct and a 'fake internal review' was not considered by the Tribunal. Contrary to DMP's assertions, there was no evidence before the Tribunal which would demonstrate improper conduct or a 'fake internal review'. The Information and Privacy Commissioner was "investigating or otherwise handling" a complaint from DMP that "could be referred" to it, and the disclosure was reasonably necessary for the exercise of the Information and Privacy Commissioner's complaint handling functions. DMP went onto allege that he later withdrew his complaint to the IPC, because he was misled. This does not change the fact that disclosure of his personal and health information was necessary for the IPC to carry out its investigative functions following his complaint: see s 21 of HRIP Act and s 54 of the PPIP Act with respect to the IPC's role in internal reviews.
DMP also submits that the most serious allegations he made regarding this matter were 'glossed over' in the Reasons and no findings were made in relation to his serious allegations about the corrupt conduct of employees of SLHD and the Minister for Health regarding HPP 6.
HPP 6 relates to the holding of health information and relevantly provides: (1) An organisation that holds health information must take such steps as are, in the circumstances, reasonable to enable any individual to ascertain - (a) whether the organisation holds health information, and (b) whether the organisation holds health information relating to that individual, and (c) if the organisation holds health information relating to that individual - (i) the nature of that information, and (ii) the main purposes for which the information is used, and (iii) that person's entitlement to request access to the information. (2) An organisation is not required to comply with a provision of this clause if - (a) the organisation is lawfully authorised or required not to comply with the provision concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).
At [79] - [80] of the Reasons the Tribunal stated: 79 As I understand it, DMP alleges that SLHD did not respond to his requests about whether his health information was still being used for training after he withdrew his consent on 3 November 2017 for his health information to be used for training purposes. He states that SLHD's conduct was in breach of HPP 6 which relates to the obligation placed on agencies to enable an individual to obtain details about information held about them. 80 There was considerable correspondence between DMP and SLHD and an offer was made (which he rejected) to alias his information in response to his request. I am satisfied that SLHD took such steps as were reasonable in the circumstances to satisfy the requirements of HPP 6.
Consistent with the reasoning in Meacham and in line with the authorities referred to in Orr, not every submission or piece of evidence put forward by the parties must be referred to by the Tribunal. Only "central controversies" which are put up for resolution by the parties must be dealt with. In this case, the central controversy was whether there had been a breach of HPP 6. There was no basis for the Tribunal to make findings based on DMP's unsubstantiated and unsupported assertions about corrupt conduct by employees of SLHD and the Minister for Health. No question of law is raised regarding the Tribunal's findings about breach of HPP 6.

[15]

Procedural Fairness

Section 36 of the NCAT Act sets out the guiding principle to be applied to practice and procedure of the Tribunal as follows: (1) The guiding principle for this Act and the procedural rules, in their application to proceedings in the Tribunal, is to facilitate the just, quick and cheap resolution of the real issues in the proceedings. (2) The Tribunal must seek to give effect to the guiding principle when it - (a) exercises any power given to it by this Act or the procedural rules, or (b) interprets any provision of this Act or the procedural rules. (3) Each of the following persons is under a duty to co-operate with the Tribunal to give effect to the guiding principle and, for that purpose, to participate in the processes of the Tribunal and to comply with directions and orders of the Tribunal - (a) a party to proceedings in the Tribunal, (b) an Australian legal practitioner or other person who is representing a party in proceedings in the Tribunal. (4) In addition, the practice and procedure of the Tribunal should be implemented so as to facilitate the resolution of the issues between the parties in such a way that the cost to the parties and the Tribunal is proportionate to the importance and complexity of the subject-matter of the proceedings.
Section 38(2) of the NCAT Act provides that: [t]he Tribunal is not bound by the rules of evidence and may inquire into and inform itself on any matter in such manner as it thinks fit, subject to the rules of natural justice.
Section 38(5) of the NCAT Act provides: The Tribunal is to take such measures as are reasonably practicable: (a) to ensure that the parties to the proceedings before it understand the nature of the proceedings, and (b) if requested to do so-to explain to the parties any aspect of the procedure of the Tribunal, or any decision or ruling made by the Tribunal, that relates to the proceedings, and (c) to ensure that the parties have a reasonable opportunity to be heard or otherwise have their submissions considered in the proceedings.
DMP raises several grounds that he says amount to a denial of procedural fairness. A failure to afford procedural fairness can give rise to a question of law: Italiano v Carbone [2005] NSWCA 177. We have dealt with each ground in turn. It should be noted that DMP had initially raised apprehended bias as a ground. That was not pressed at the appeal hearing.

[16]

Ground 12 - Refusal of adjournment

DMP refers to a request for an adjournment that he says he made at the "planning meeting" on 3 July 2019. He states that in the context of the Tribunal taking 756 days to provide the Reasons, the refusal demonstrates a failure of discretion. DMP submits that the reason he sought the adjournment was because of 'evidence tampering and forged documents' that he was given by the Crowns Solicitors Office in the lead up to the hearing, including audit reports and evidence about modifying his eMR data. He submits: If I had been granted an adjournment, I would have been able to examine the audit report more thoroughly and file it into evidence. These public sector gangsters attempted to murder me.
SLHD denies that any application for an adjournment was in fact made by DMP on 3 July 2019.
On review of the transcript of the hearing, we can find no formal application made by DMP for an adjournment. DMP referred to a summons he wished to be issued. In that regard the following relevant exchange occurred between the Tribunal and DMP (pg. 1684 -1685 of SLHD's appeal bundle): DMP: I've got a summons application. I'd like to submit that. Senior Member: This matter is listed for hearing. It's been before the tribunal for quite some time. So, we're not going to prolong it. We're going to proceed. … Senior Member: This is the hearing DMP: I thought this was the planning hearing Mr King (Counsel for SLHD): It may have been described that way on a previous occasion. Senior Member: was it? Ms Langford (Solicitor for SLHD): Yeah. That's my understanding also. As in in today, 3 July. We had understood that 10 July would be the hearing --- …. Senior Member: Right. That's not what I was told, but that's fine. I'm happy to treat it that way. So, what have you been able to do?
The Tribunal then proceeded. It allowed DMP an opportunity to provide further documents by 8 July 2019 and advised the parties that the hearing would proceed on 10 July 2019, including for the filing of any summons.
A refusal of an adjournment may amount to a denial of procedural fairness if it is likely to deny a party a reasonable opportunity to present their case. See Minister for Immigration and Multicultural Affairs v Bhardwaj (2002) 209 CLR 597 at [40].
In the matter of Dubois v R & B Bergin Pty Ltd [2011] NSWCA 309, Young JA, with whom Giles JA agreed, stated at [43] - [46] 43. As the Full Federal Court said in Petrovic at 460, it is not sufficient that the Court of Appeal considers that an adjournment should have been granted, the applicant must show that refusal of the adjournment produced, in the circumstances, an injustice. It must be remembered too, that the decision is a discretionary judgment. 44. "Injustice" is a coloured word with pejorative overtones. What is meant is that the refusal of the adjournment must not set up a situation where there is a likelihood that there cannot be a fair trial unless that factor is outweighed by prejudice to the opposing party. 45. In making the balanced judgment required, a judge must also take into account the public interest that the judicial process must be just, cheap and quick. 46. Again this matter must be considered in a balanced way. Mr Romaniuk relied on what the plurality said in Aon Risk Services Australia v National Australia University [2009] HCA 27; 239 CLR 175, 214 at [102], that the objectives of modern court rules do not require that every application for amendment (and by analogy, adjournment) should be refused just because it wastes costs and causes some delay. Whilst these are significant matters, they are not necessarily overriding considerations. I accept that submission
We are not satisfied that DMP sought an adjournment. Even if the Tribunal was under some apprehension about what the matter was listed for on 3 July 2019, that was corrected. The transcript reveals that the Tribunal proceeded to treat the matter like it would a direction's hearing and attempted to identify the issues in dispute. The Tribunal also allowed the applicant an opportunity to provide further material. There is no suggestion on any of the other days that an adjournment was sought. On that basis this ground must fail.

[17]

Grounds 6 and 7 - Failure to consider submissions

In relation to ground 6, DMP says that at an earlier hearing of an interim application, he was told to provide a 'summary of legal argument' and that he interpreted that to mean that he should not write as much and so he wrote in his submissions the 'bare minimum' he thought he needed to win his case. After receiving SLHD's submissions of 17 December 2018, he decided that in his reply submissions he needed to deal with the matter in more detail. DMP submits, that the Tribunal failed to consider his reply submissions and the events of 6 June 2016, which are referred to in those submissions. DMP refers to [34] of the Reasons, in which the Tribunal sets out the particulars of the conduct in connection with the eMR training sessions that was alleged by DMP to amount to breach of HPP 5. 34 DMP submits that SLHD did not employ reasonable safeguards to protect his health information within eCERT. He alleges the following conduct amounts to a breach of HPP 5: - the use of throwaway login credentials by students during eMR training e.g. User101; - failure to implement user access controls so that records of real patients, including his, were accessible to those being trained; - failure to log user access; and - failure to audit access logs. DMP also argues that even if his health information has not been used in eMR training, SLHD has retained his information unlawfully in breach of HPP 5 as information must not be kept any longer than is required for lawful use. This is particularly the case as eCERT is a duplicate of the eMR.
Those points were taken from DMP's written submissions in chief dated 16 October 2018. However, DMP says that the Tribunal made no further mention of the further failures particularised by DMP in his reply submissions dated 16 January 2019 and in particular section 9 of those reply submissions. Those failures are summarised at the outset of DMP's reply submissions as follows: One way to make sense of what SLHD has done is to frame this as a cascade of failures that have all lined up: 1. Non-production environment was populated with 20% of state's health records 2. Non-production environment was used for eMR training 3. End users were given user privileges not even required for eMR training 4. Generic or throwaway login credentials were shared and not registered to end users 5. Non-production environment was remotely accessible with an insecure connection 6. Access logs of non-production environment were not retained 7. Access logs were never audited for unauthorised access 8. No privacy training given prior to undertaking introductory eMR training 9. Privacy Officer who was completely unfit to safeguard health information 10. Slow and inadequate response to readily identifiable security concerns
HPP 5 relates to retention and security of information held and sets out: (1) An organisation that holds health information must ensure that - (a) the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) the information is disposed of securely and in accordance with any requirements for the retention and disposal of health information, and (c) the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) if it is necessary for the information to be given to a person in connection with the provision of a service to the organisation, everything reasonably within the power of the organisation is done to prevent unauthorised use or disclosure of the information. Note - Division 2 (Retention of health information) of Part 4 contains provisions applicable to private sector persons in connection with the matters dealt with in this clause. (2) An organisation is not required to comply with a requirement of this clause if - (a) the organisation is lawfully authorised or required not to comply with it, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998). (3) An investigative agency is not required to comply with subclause (1) (a).
DMP alleged that SLHD failed to employ reasonable safeguards to protect his health information held within eCERT.
The alleged breach was addressed by the Tribunal at [34] - [58] of the Reasons and it is helpful to set out the reasons at [55] to [58]: 55 Importantly, trainees are required to complete the data security declaration before undertaking the training and are required to acknowledge at the end of the training that they understand the security and privacy requirements. Trainers are also required to advise students of their obligations. If DMP's account is accepted, it does appear that the trainer in his session was somewhat perfunctory in this regard, but that does not mean that they system itself was lacking. The introduction of a standard pre-prepared script, as is now in place, is obviously a step forward. The fact that DMP ignored his obligations with respect to privacy and data security, knowing that it was wrong to do so, also does not indicate a general systemic issue or lack of safeguards. 56 I am satisfied on the evidence that has been provided that it is possible to audit the non-production environment to obtain records of access. While it does appear that there is a period prior to November 2014 when access records are now incomplete, that position was remedied and a sophisticated auditing tool now runs continuously. I also accept the evidence that audits were undertaken, albeit on an ad hoc basis prior to the introduction of quarterly reports. 57 As noted above, contrary to DMP's belief that there has been widespread access to his and others information held in the non-production environment, there is simply no evidence, other than his statement that he accessed his own records and believes that someone else did as well, that there has been any such access. 58 Overall, while there may be aspects of the security safeguards put in place by SLHD which might not meet best practice, I am satisfied that the system of safeguards put in place to protect the information against unauthorised access were reasonable in the circumstances and were not inadequate. It must be said that no system can guard entirely against wilful disregard and desire to circumvent the safeguards in place.
Those paragraphs demonstrate the Tribunal did consider the issues that the applicant made submissions about in the reply submissions. Again, it is not necessary for the Tribunal, to repeat in the reasons, every submission raised by a party. The Reasons demonstrate that the Tribunal dealt with the issues that arose out of DMP's submissions relating to the way in which non-production environment was used for eMR training and the issues that arose from that, including the generic credentials, remote access to the non-production environment and auditing of the non-production environment. The fact that the Tribunal did not, in summarising the complaint, list the failures as reframed in DMP's reply submissions does not establish that the Tribunal failed to have regard to those submissions. This ground fails to raise a question of law.
DMP makes a similar complaint in ground 7. He submits that the Tribunal failed to make express reference to the contents of DMP's written submissions. Again, the fact that the Tribunal did not make express reference to the submissions does not raise a question of law and we find no question arises in relation to ground 7. We have dealt with ground 7 in more detail under 'leave to appeal' below.

[18]

Ground 3 - Failed to provide an opportunity to make submissions and decided a matter when the Tribunal did not have jurisdiction.

DMP alleges that the Tribunal reviewed conduct for which he made no submissions. He also says that the Tribunal reached the incorrect decision in finding that there was no jurisdiction to review the alleged conduct.
DMP refers to the Tribunal's reasons at [81] - [86]. Those parts of the Reasons appear under the heading 'Complaints made as "health information broker" in relation to third parties' and state: 81 DMP alleges that SLHD breached HPPs 5, 10 and 11 in relation to its handling of the health information of third parties including Mr A, Mr B and Mr C. Copies of letters signed by Mr B and Mr C have been provided to the Tribunal. These letters relate to the alleged unlawful use by SLHD of their personal health information for eMR training. There is also a letter of authority from Mr C authorising DMP to act as his agent as his health information broker. DMP, acting as agent, submitted an internal review application on behalf of Mr C to SLHD. 82 DMP states that he is a person aggrieved by the conduct as he is "the state's premiere consent-based health information broker" and SLHD's "failure to comply with the express refusal notices that I prepared for them" gives him standing as this has interfered with his commercial and ideological interests. In one of his submissions DMP states he will be seeking to recover $40,000 in "lost brokerage fees". 83 Review of a breach of an HPP by a public sector agency is conduct to which Part 5 (Review of certain conduct) of the PPIP Act applies. Section 53(1) the PPIP Act provides that a person is entitled to review of an agency's conduct if the person is "aggrieved" by that conduct. SLHD submits that DMP is not a person "aggrieved" by the conduct alleged against it and therefore the Tribunal does not have jurisdiction to review the alleged conduct. 84 In Altaranesi v Administrative Decisions Tribunal [2004] NSWCA 19 it was suggested that a person can fall within the definition of an "aggrieved" person for the purposes of s 53(1) if they can demonstrate that the alleged conduct has had a prejudicial effect on them. In certain circumstances the Tribunal has found a person to be a person "aggrieved" even if their personal information was not the subject of the conduct (see for example KO & Anor v Commissioner of Police, NSW Police [2004] NSWADT 3; NR and NP v Roads and Traffic Authority [2004] NSWADT 276). 85 It is possible that interference with financial interests could give a person standing to seek review of conduct. However, in this case, there is no evidence of any prejudicial effect upon DMP of the alleged conduct in relation to the named persons. There is certainly no evidence that there has been any interference with his financial interests or that indeed there was any commercial relationship between DMP and the other men. 86 To the extent that DMP complains about SLHD's dealings with the health information of Messrs A, B and C, there is no evidence that would establish that he is a person "aggrieved" by the alleged conduct of SLHD. Simply having a similar interest is insufficient. The Tribunal therefore does not have jurisdiction to review the alleged conduct.
At [19] of the Tribunal Reasons (reproduced at [18] above), the issue of unlicensed retention, use and/or disclosure of information relating to Mr A, Mr B and (and possibly Mr D) without consent, was identified by the Tribunal as a breach alleged by DMP.
The transcript of the hearing reveals that DMP made submissions about the issue on the 3 July 2019 (contained at pages 1738 - 1740 of SLHD's appeal bundle). DMP did not advise the Tribunal that he wished to withdraw that complaint, and, in our view, it was proper for the Tribunal to consider the matter as raised by the applicant. DMP has not demonstrated that he sought to make further submissions in relation to the issue or was denied that opportunity. The Senior Member dealt with the issue based on the material that was before the Tribunal.
In our view, the Tribunal's determination that DMP was not a person aggrieved was correct and it was correct for the Tribunal to find that there was no jurisdiction to review that conduct.
Accordingly, there has been no denial of procedural fairness in relation to grounds 3, 6, 7 or 12. This ground raises no question of law.

[19]

Ground 4 - Conduct for which there was no jurisdiction was reviewed

By ground 4 of the appeal, DMP submits that the Tribunal reviewed conduct for which there was no jurisdiction. In the notice of appeal, DMP states: The reason why there was no jurisdiction was because the internal review in question was completed as a birthday gift, then its delivery was coordinated to act as some 'tactical ramming device' to rattle me.
At the hearing before us, DMP stated that the Tribunal wrongly concluded that it had jurisdiction and that there was no breach of HPP 8. SLHD noted that lack of jurisdiction was not raised before the Tribunal by DMP.
DMP refers to [66] - [70] of the Reasons under the heading, "Failure to update health information". The Tribunal determined: 66 The terms of the "Advance Care Directive" supplied by DMP to SLHD on 29 July 2018 had an enforcement date of 1 July 2019. In it he asked that SLHD confirm whether or not it would accept the document as lawful and valid, and if so ensure that it was attached to his records. Under the terms of the document, DMP stated "I refuse all treatment under all circumstances". The document, however, then went on to say that, if he was registered anonymously as UNKNOWN and, in effect, there was no cross-referencing between the records in his own name and those of UNKNOWN, then he consented to treatment. 67 SLHD states that the document was not attached to DMP's record at the time because it had a start date of 1 July 2019 and because it was concerned that to attach the document to DMP's patient record would be inconsistent with its general law duty of care to him. 68 SLHD submits that it was not required to comply with the request in circumstances where HPP 8(4)(b) provides that "non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law". The phrase "any other law" has been held in relation to the equivalent Information Privacy Principle under the PPIP Act to include the common law of Australia (Director General, Department of Education and Training v MT [2005] NSWADTAP 77 at [83] CCM v Western Sydney University [2019] NSWCATAP 103 at [65]). 69 It is certainly arguable that SLHD has a general duty of care to those who present seeking its services. In addition, the Health Services Act 1997 in section 10 gives it a number of functions including to promote, protect and maintain the health of the residents of its area and to achieve and maintain adequate standards of patient care and services. This it is difficult to envisage how complying with DMP's request would be in keeping with SLHD's legislated functions. 70 In my view there is no breach of HPP 8.
The conduct alleged by DMP was that SLHD failed to update DMP's health information. The Tribunal found at [70] of the Reasons that the conduct did not amount to a breach of HPP 8. DMP says he submitted his application for internal review on 11 July 2018, then submitted an addendum to that application on 15 November 2018 relating to SLHD's conduct that had occurred after 11 July 2018 (failing to amend his health information).
Section 21 of the HRIP Act provides that: (1) The following conduct by a public sector agency is conduct to which Part 5 (Review of certain conduct) of the PPIP Act applies - (a) the contravention of a Health Privacy Principle that applies to the agency, (b) the contravention of a health privacy code of practice that applies to the agency.
Part 5 of the PPIP Act consists of s 51 to s 55. Section 53 of the PPIPA provides for internal reviews to be conducted by the agency concerned on application by a person aggrieved. Section 53(6) requires that internal reviews "be completed as soon as is reasonably practicable in the circumstances" with the applicant being entitled to administrative review of the conduct from the Tribunal if it is not completed within 60 days. Section 55 of the PPIPA provides persons not satisfied with the outcome of an internal review to seek administrative review under the ADR Act of the conduct that was the subject of the application under section 53. Such an administrative review application is to be made within 28 days of notification of the outcome of the internal review, or, if an internal review has not been completed, within 28 days of the 60-day period: see r. 24(4) of the NCAT Rules.
The internal review had not been completed by SLHD within 60 days and it was open to DMP to make his applications to the Tribunal. Even if we are wrong, these were DMP's applications, and he sought review of the conduct. It is now trite for DMP to submit that the Tribunal did not have jurisdiction to review conduct which he had raised and he alleged breached the HPPs. In any case, the Tribunal found that there was no breach of HPP8. The alleged error, even if it did occur, would make no material difference to the outcome of the decision, as the Tribunal found not breach.

At a glance

Court

Decision date

Catchwords

Source

Catchwords

Judgment (28 paragraphs)

Parties

Legislation Cited (7)

Cases Cited (20)

Cited By (3)