FDL v South Western Sydney Local Health District

Privacy Commissioner

1. Section 55(6) of the PPIP Act requires the Tribunal to notify the Privacy Commissioner of any application for administrative review made under section 55 of that Act. I am satisfied that such notice has been given in this case. By letter to the Divisional Registrar receipted on 22 October 2021 the delegate of the Information and Privacy Commissioner notified the Tribunal that the Commissioner did not intend to participate in the proceedings.

Determination process and material considered

1. By directions made by the Tribunal on 9 November 2021, the parties had the opportunity to file and exchange the documentary evidence and submissions that they intended to rely on at the final hearing. This resulted in the following material being before the Tribunal.

Applicant

1. The applicant relied upon the contents of his initiating application which attached a copy of the agency's internal review determination dated 16 June 2020. He also sent emails to the Tribunal dated 6 and 7 October 2021 and 26 November 2021. These emails contain submissions. The Registrar provided copies of those emails to the agency on 16 December 2021.

Respondent

1. The respondent relied upon the report of the internal review carried out by Linda Hunt, Principal Investigations, Privacy and Compliance Officer, which is dated 16 June 2020.

Hearing

1. This administrative review was conducted by way of an oral hearing in a Virtual Meeting Room (VMR) in accordance with the Tribunal COVID-19 Revised Hearing Procedure. The applicant attended the hearing in person and gave oral evidence under oath. Ms Tegan Clemetson, who is the agency's Principal Investigations, Privacy and Compliance Officer, and Dr Brett Oliver, who is a Medical Director of the agency, attended the hearing on the agency's behalf. They gave oral evidence under oath and affirmation respectively. The parties had the opportunity to present their respective cases, to ask each other questions, and to make final submissions to the Tribunal.

Background

1. The following summary is taken from the agency's internal review report dated 16 June 2020. There is no dispute between the parties as to this factual background.
2. The applicant was married to a person who I shall refer to, with no disrespect, as his former spouse in 2010. The applicant and his former spouse formally separated in January 2020.
3. On 4 April 2020 the applicant was admitted as a patient to Liverpool Hospital. Liverpool Hospital is a medical facility operated by the agency. While he was being assessed in the Emergency Department (ED), at approximately 8:30pm, someone claiming to be his sister called Liverpool Hospital and asked for information about his condition. A nurse working in ED discussed the call with the applicant before responding to the inquiry. The applicant advised the nurse that the person calling was not his sister because she did not live in Australia. He instructed the nurse that he did not want any information about him to be disclosed to the caller. He became concerned that information about his health status may have already been disclosed to the caller.
4. During the course of his admission to Liverpool Hospital the applicant requested that his former spouse be removed from his patient records as his next of kin.
5. After his discharge from Liverpool Hospital the applicant became aware from a friend that his former spouse had obtained information about his health status during the course of his admission and had sent text messages to his friend containing this information. He came to believe this information had been obtained by a nurse working at Bankstown-Lidcombe Hospital (which is another medical facility operated by the agency) by accessing his electronic medical records at the request of his former spouse, who also worked at Bankstown-Lidcombe Hospital as a nurse.
6. On 14 April 2020 the applicant submitted a complaint to the agency which alleged that unlawful access had been obtained to his personal health information and that there had been a breach of his privacy. The agency contacted the applicant about his complaint later that day, and after consultation, he advised that he wished his complaint to be dealt with by way of an internal review.
7. The agency conducted an internal review pursuant to Part 5 (s 53) of the PPIP Act. In doing so, it treated the applicant's complaint as an allegation of a contravention of a public sector agency of a health privacy principle of the agency contrary to section 11 of the HRIP Act. It considered that Health Privacy Principles (HPP) 5, 10 and 11 were engaged by the applicant's complaint (as to which see following).
8. In the course of its internal review the agency established the following facts which are not in issue for the purposes of this administrative review.
9. It was the applicant's former spouse who telephoned Liverpool Hospital ED at approximately 8:30pm on 4 April 2020 to inquire about the applicant's health status. However, no information was disclosed to her about the applicant's condition at that time. The applicant's former spouse then contacted two nurse colleagues at Bankstown-Lidcombe Hospital at different times to request that they obtain information about the applicant's health status by accessing his electronic medical records, which they did. The applicant's former spouse used this information to advise others about his health status, including the friend who brought this to his attention, who received this information by text message. The agency was able to make these findings in part because the applicant's former spouse and the two Bankstown-Lidcombe nurses admitted to what they had done.
10. The conclusion of the internal review is encapsulated in the following passages: … The review has determined that while the applicant's health information was accessed and disclosed by staff of Bankstown-Lidcombe Hospital, the actions of these staff did not represent a use or disclosure of the information by [the agency]. The actions of these staff were for their own private purposes, and were knowingly in contradiction of the NSW Health Code of Conduct, and other policies and procedures which govern access to and use of information in the [electronic medical record system]. In these circumstances, by the application of the principles in Director General, Department of Education and Training v MT (2006) 67 NSWLR 237, the conduct of the staff members cannot be attributed to the [agency]. 6. SUMMARY OF FINDINGS The review has found that the applicant's wife unsuccessfully attempted to obtain the applicant's health information from Liverpool Hospital. Two staff from Bankstown-Lidcombe Hospital accessed the health information of the applicant at the request of his wife, and they disclosed the information to the applicant's wife. The applicant's wife disclosed the applicant's health information to a third party. The actions of the Bankstown-Lidcombe Hospital staff members were knowingly contrary to the requirements of their role, and were in breach of the NSW Health Code of Conduct. These actions are attributable to the individuals involved and not to the [agency]. It is found that the [agency] has not breached HPP5, HPP10, or HPP 11. 7. RECOMMENDATIONS Section 53(7) of the PPIP Act sets out the list of possible recommendations that may be provided at the end of an internal review … In this case, the applicant has requested that serious action be taken against the staff involved to avoid a similar incident happening in the future, including that they be punished properly. While these outcomes requested by the applicant are outside the scope of the actions envisaged by the PPIP Act, they may be considered by Bankstown-Lidcombe Hospital in its management response to this incident. The concerns arising from this review about three staff from Bankstown-Lidcombe Hospital are being managed under the NSW Health Managing Misconduct Policy Directive. Pending the outcome of that process, it is recommended that Bankstown-Lidcombe Hospital: 1. Take appropriate disciplinary and/or remedial action against the three involved staff members, consistent with the requirements of the NSW Health Managing Misconduct Policy Directive. It is recommended, consistent with the requirements of privacy legislation, that [the agency]: 2. Provide the applicant with information about the outcome of the internal review 3. Provide the applicant with information on his review rights.

Applicant

1. The applicant's case, doing the best that I can to ascertain it, is that the agency's internal review was unsatisfactory in process and outcome because the delegate failed to properly consult him about the consequences that his former spouse and the two nurses at Bankstown-Lidcombe Hospital who accessed his electronic medical records should suffer because of their conduct. He complains that these 3 staff are still in the employment of the agency when they should have been sacked for what they did. In effect, he asks the Tribunal to order or recommend that these staff be sacked as a result of this administrative review.
2. Other than this, the applicant does not take issue with the findings of the internal review, including that there was no contravention of a HHP by the agency because the staff involved acted entirely outside their professional roles and did so knowing that they were violating agency policy. Nor does the applicant press any personal remedy as a result of this administrative review (such as compensation or an apology, for example)

Agency

1. The agency's primary submission is that there has been no contravention, by the agency, of any health privacy principle that could give rise to a personal remedy for the applicant either under s 53(7) or s 55(2). It contends that the three staff members who dealt with the applicant's health information acted outside their professional roles and did so knowing that they were contravening specific policies of the agency that prohibited this conduct. In this respect the agency relies upon the principles established by the Court of Appeal in Director General, Department of Education and Training v MT [2006] NSWCA 270. In that case at [43], [54] and [55] the Court held, in broadly equivalent circumstances and with respect to a broadly equivalent statutory scheme, that the unlawful disclosure of personal information by a staff member for a purpose that is extraneous to any purpose of an agency should not be characterised as "use" or "disclosure" or "conduct" by the agency.
2. The agency denies that it failed to consult with the applicant in the course of its internal review. It submits that it has no direct power under s 53(7) to impose any disciplinary penalty on the staff members concerned. However, it draws attention to the fact that the internal review recommended that their conduct be referred to Bankstown-Lidcombe Hospital for management in accordance with the NSW Health Managing Misconduct Directive. It submits that this recommendation was adopted and the referral made.
3. The agency submits that it is not able to provide the applicant with any specific information about what, if any, disciplinary action has been taken against each staff member as a result of that recommendation because this would contravene policies that protect their privacy.

The Tribunal's role in an administrative review

1. As has been set out above, by operation of s 21 of the HRIP Act, the agency's internal review was required to be carried out in accordance with the requirements of s 53 of the PPIP Act. That section relevantly provides: 53 Internal review by public sector agencies (1) A person ("the applicant") who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. … (2) The review is to be undertaken by the public sector agency concerned. … (4) Except as provided by section 54(3), the application must be dealt with by an individual within a public sector agency who is directed by the agency to deal with the application. That individual must be, as far as practicable, a person - (a) who was not substantially involved in any matter relating to the conduct the subject of the application, and (b) who is an employee or officer of the agency, and (c) who is otherwise suitably qualified to deal with the matters raised by the application. (5) In reviewing the conduct the subject of the application, the individual deal with the application must consider any relevant material submitted by - (a) the applicant, and (b) the Privacy Commissioner (6) The review must be completed as soon as is reasonably practicable in the circumstances…. (7) Following the completion of the review, the public sector agency whose conduct was the subject of the application may do any one or more of the following - (a) take no further action on the matter, (b) make a formal apology to the applicant, (c) take such remedial action as it thinks appropriate (eg the payment of monetary compensation to the applicant). (d) provide undertakings that the conduct will not occur again, (e) implement administrative measures to ensure that the conduct will not occur again. … (8) As soon as practicable (or in any event within 14 days) after the completion of the review, the public sector agency must notify the applicant in writing of - (a) the findings of the review (and the reasons for those findings), and (b) the action taken by the agency (and the reasons for taking that action), and (c) the right of the person to have those findings, and the agency's proposed action, administratively reviewed by the Tribunal.
2. Section 55(2) of the PPIP Act sets out the Tribunal's role when it conducts an administrative review of an internal review decision made under s 53: (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders - (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate.
3. Section 55(2) does not limit any other powers that the Tribunal has under Division 3 of Part 3 of the ADR Act: s 55(3) of the PPIP Act. However, it is unnecessary in this case to consider those additional powers. Sections 55(4) and (4A) qualify the operation of s 55(2)(a), but nothing arises in relation to any of those provisions in this case. Section 55(5) also contains further specific powers the Tribunal has in the disposition of an administrative review under section 55(1) but those additional provisions are not relevant in this case.

The HRIP scheme

1. The administrative review undertaken in the context of the HRIP Act. The purpose and objects of the HRIP Act are found in s 3 of that Act. Relevantly to this administrative review it is the purpose of the Act to promote the fair and responsible handling of health information by protecting the privacy of an individual's health information that is held in the public sector (s 3(1)(b)) and by providing an accessible framework for the resolution of complaints regarding the handling of health information (s 3(1)(c)).
2. The HRIP Act applies to every organisation that is a health service provider or that collects, holds or uses health information: s 11(1).
3. It is sufficient for present purposes to note that the HRIP Act regulates the collection, storage, security, use, release and amendment of personal health information via a schedule of Health Privacy Principles found in Schedule 1 of that Act. The HPPs that are relevant in this administrative review are HPP 5, 10 and 11 which relevantly provide. 5 RETENTION AND SECURITY (1) An organisation that holds health information must ensure that-- … (c) the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and … 10 LIMITS ON USE OF HEALTH INFORMATION (1) An organisation that holds health information must not use the information for a purpose (a "secondary purpose") other than the purpose (the"primary purpose" ) for which it was collected unless - (a) the individual to whom the information relates has consented to the use of the information for that secondary purpose, or (b) the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose, or … 11 LIMITS ON DISCLOSURE OF HEALTH INFORMATION (1) An organisation that holds health information must not disclose the information for a purpose (a "secondary purpose" ) other than the purpose (the "primary purpose" ) for which it was collected unless - (a) the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or (b) the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, …

Source of power to conduct the review

1. By operation of s 9 of the ADR Act, s 55(2) of the PPIP Act confers jurisdiction on the Tribunal to conduct an administrative review under the ADR Act of conduct that was the subject of an application for internal review under s 53 of the PPIP Act on the application of a person who made the application for internal review in circumstances where that person is not satisfied with the findings of the internal review or by the action taken by the public sector agency in relation to the application for internal review. Section 21(1)(a) of the HRIP Act provides that the contravention of a Health Privacy Principle that applies to an agency is conduct to which Part 5 (Review of certain conduct) of the PPIP Act applies. Sections 53 and 55 of the PPIP Act are found in Part 5 of that Act.

Time period in which an application for administrative review must be made

1. Section 55 of the PPIP Act does not specify the time period within which an application under s 55(1) must be made to the Tribunal, and nor is such a limitation period specified elsewhere in that Act. Rule 24(4)(a1) of the NCAT Rules therefore applies. Unless the time in which to make an application is extended under section 41 of the NCAT Act, such an application must be made, relevantly to the circumstances of this case, within 28 days after the applicant was notified of the result of the internal review conducted by the agency under s 53 of the PPIP Act.
2. The agency's internal review determination is dated 20 June 2020. There is no direct evidence of when the applicant was notified of that decision, and the applicant does not answer that question on the application form. However, both parties have conducted their cases on the basis that the applicant was advised of the outcome of the internal review on or about 16 June 2020. Out of an abundance of caution I will assume that he received notice on 25 June 2020, being 7 working days after the date of the decision, which would allow for the decision to be served on him by post in accordance with s 76(1)(b) of the Interpretation Act 1987.
3. In order to comply with Rule 24(4)(a1) the applicant therefore had to make his application to the Tribunal on or before 23 July 2020. His application was not made until 6 October 2021, which is 14.5 months, or 441 days, outside the time period permitted.
4. I pause at this point to note that the agency has not sought summary dismissal of this application on the basis that it is out of time and nor was this issue agitated in any other way by the agency. Nevertheless, the Tribunal exercises limited statutory jurisdiction only. It is required to determine for itself if it has jurisdiction to deal with an application that is before it: Lam v Steve Jarvin Motors Pty Ltd [2016] NSWCATAP 186 at [38]

Consideration

1. The threshold issue in this case is therefore whether the Tribunal ought to dismiss the application on the basis it has no jurisdiction to deal with it because it has been brought outside the time period permitted by Rule 24(4)(a1), or whether time should be extended to 6 October 2021 for the application to be made, being the date the application was made, so that the Tribunal will have jurisdiction to deal with it.
2. Section 41 of the NCAT Act confers discretion on the Tribunal to extend the time in which an application may be made. That discretion is unfettered but must be exercised judicially having regard to established principle. In short summary, time limits are to be strictly enforced unless to do so would work an injustice to an applicant. The relevant considerations are the length of the delay, the applicant's explanation for the delay, any relevant prejudice that would be suffered by the respondent as a result of time being extended, and the merits of the applicant's claim. In this last respect, if the delay is relatively short, it is necessary for the applicant to show that their claim is fairly arguable. If the delay is lengthy, the applicant must show that their claim has substantial merit: Jackson v NSW Land and Housing Corporation [2014] NSWCATAP 22.
3. I now apply these principles in the circumstances of this case.
4. A delay of 441 days is a very significant delay in the making of an application under section 55(1) of the PPIP Act. It is also 16 times the time period within which such an application can be made if it is within time. This consideration weighs heavily against time being extended.
5. The applicant's explanation for the delay, as I apprehend it, is that he has been waiting to see the outcome of the referral of the conduct of the three staff members to Bankstown-Lidcombe Hospital for management in accordance with NSW Health's Managing Misconduct Policy Directive. That is, he has been waiting to see that they have been sacked. Because that had not happened by early October 2021, which was some 18 months after the incident, he came to believe that no appropriate disciplinary action had been taken, which is why he decided to apply to the Tribunal for administrative review of the internal review decision. While I understand the applicant's argument, it cannot constitute a satisfactory explanation of the delay for the purposes of the exercise of the discretion conferred by 41 of the NCAT Act. That is because, as I will elaborate below, an administrative review cannot result in the outcome sought by the applicant. This consideration weighs against time being extended.
6. I do not ascertain any relevant prejudice to the agency from an extension of time being granted to the applicant to make this application, and none was contended for by the agency. This consideration weighs in favour of time being extended.
7. Due to the extensive delay in the application being made, it is necessary for the applicant to show that his application for administrative review has substantial merit. That is, that there is a reasonable likelihood that a review of the agency's conduct by the Tribunal would result in a different outcome that is more beneficial to the applicant and/or closer to the outcome he contends for.
8. On any reasonable assessment the internal review vindicated the applicant in that it substantiated all of the particulars of his complaint as well as revealing to him further details of the contraventions of agency policies and procedures related to his person health information by the staff concerned. In this respect, this administrative review could produce no better outcome for the applicant than he obtained from the internal review.
9. The applicant has not challenged the agency's contention that the relevant "use", "disclosure" and "conduct" in relation to his personal information about which he complains was that of the staff members involved and not that of the agency itself. He does not challenge the agency's contention that this conduct was extraneous to the professional roles of those staff, and directly contrary to the agency's policies and procedures. In any event, it is clear to me that the principle established in Director General, Department of Education and Training v MT [2006] NSWCA 270 applies in this case. There has therefore been no contravention of any HPP by the agency that could give rise to a personal remedy such as the payment of compensation or the provision of an apology to the applicant. An administrative review of the conduct complained of could not produce such an outcome even if it were sought by the applicant, which it is not.
10. The applicant does not contend for any change in agency policy or procedure or any other administrative measure to ensure the conduct he complained of does not occur again. Nor is the need for any such measure apparent from any of the material before the Tribunal. The internal review sets out a robust policy framework for the protection of personal health information that was contravened by its staff. Those contraventions are being dealt with as professional misconduct. There is nothing to suggest that an administrative review would produce any better state of affairs than already exists in this respect.
11. The applicant' sole purpose in pursuing this administrative review is to obtain some form of order or direction from the Tribunal that would compel the agency to dismiss from employment the three staff members concerned. The orders the Tribunal is capable of making on an administrative review conducted under s 55(2) are set out above. It will be apparent from a reading of that section that the Tribunal has no power to make the order or directions sought by the applicant.
12. I therefore conclude that the applicant's case has no reasonable prospect of success. He cannot achieve the outcome he is seeking by an administrative review of the agency's internal review, and there is nothing in the evidence before the Tribunal to suggest that an administrative review would vary the outcome of the internal review in any way. This weighs heavily against time being extended.
13. For the foregoing reasons I am not satisfied that strict enforcement of the time limit for the making of an application for administrative review would work an injustice to the applicant in the circumstances of this case. The delay in the applicant making the application is too significant, there is no reasonable explanation for the delay, and the application has no reasonable prospect of achieving the outcome sought by the applicant. In all of the circumstances set out above, the Tribunal would determine to take no further action on the matter.

Orders

1. For the foregoing reasons: 1. An extension of time in which to make this application is refused. 2. The application is dismissed.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 08 February 2022