FHP v Baig Medical Services Pty Ltd [2024] NSWCATAD 280 | Case summary

Consideration

In order to finalise this inquiry, the Tribunal must pose and answer the following questions: (i) Is Baig a "health service provider" within the meaning of s 11 to which the HRIP Act applies? (ii) If the answer to (i) is "yes", did Baig provide a "health service" as defined to the applicant? (iii) If the answer to (ii) is "yes", is the applicant's complaint to the Privacy Commissioner which involves an allegation of breach of s 27 of the HRIP Act (HPP 7(1) substantiated as against Baig? (iii) If the answer to (iii) is "yes" what remedy, if any, ought the Tribunal order pursuant to s 54 of the HRIP Act? (iii) Having regard to the evidence that emerged in the conduct of this inquiry insofar as it concerned Baig, do any of the findings reached in the earlier decision insofar as this inquiry concerned Arys Health Pty Ltd require revision? (iv) If the answer to (v) is "yes" is the applicant entitled to any remedy as against Arys Health Pty Ltd arising from these revised findings.
A 'health service provider' is defined in s 4 of the HRIP Act, relevantly, to be an organisation that provides a health service which does not include an organisation that merely arranges for a health service to be provided to an individual by another organisation.
Section 11 of the HRIP Act provides that the Act applies to every organisation that is a health service provider or that collects, holds, or uses health information. In this respect "organisation" is defined to mean, relevantly, a private sector person (as distinct from a public sector agency), which includes, relevantly, a body corporate provided it is not a small business operator.
The meaning of the term "small business operator" for the purposes of the HRIP Act is found is s 6D of the Privacy Act 1988 (Cth), which provides: What is a small business? (1) A business is a small business at a time (the test time) in a financial year (the current year) if its annual turnover for the previous financial year is $3,000,000.00 or less … What is a small business operator? (3) A small business operator is an individual, body corporate, partnership, unincorporated association or trust that: (a) Carries on one or more small businesses; and (b) Does not carry on a business that is not a small business. Entities that are not small business operators (4) However, an individual, body corporate, partnership, unincorporated association or trust is not a small business operator if he, she or it: … (b) provides a health service to another individual and holds any health information except in an employee record … …
Baig is a body corporate for the purposes of the definition of "private sector person". However, whether it is a private sector person in fact depends on whether it is a small business operator within the meaning of the Privacy Act 1988 (Cth). That involves consideration of two issues. First whether Baig had an annual turnover in the previous financial year that is equal to or less than $3,000,000.00 about which there is no evidence. Second, if Baig provides a health service to an individual and holds any health information except in an employee record.
The question of whether Baig is a "health service provider" is also posed by s 11(1) of the HRIP Act which requires consideration of the definition of that term and "health service" in s 4 of that Act. In this respect, there is no issue that Dr Baig provides health services, because he provides "medical services", being those of a General Practitioner. However, his company Baig Medical Services Pty Ltd contracts with other entities for those services to be provided by (or through) those entities.
Relevantly to this inquiry, Baig Medical Services Pty Ltd contracted with Arys Health Pty Ltd for Dr Baig's services as a General Practitioner to be provided to patients of Arys Health Pty Ltd's medical practice.
In those circumstances it appears to me that Baig is not a health service provider because it falls within the paragraph (b) exception in the definition of "health service provider"; that is, Baig merely arranged for a health service (Dr Baig's services as a medical practitioner) to be provided to a patient by another organisation (Arys Health Pty Ltd's medical practice).
The HRIP Act may apply to Baig on the alternative basis that it "collects, holds or uses health information". However, despite my findings in the first stage of this inquiry, I am now not satisfied that this is not the case. I am satisfied that at all material times the entity that collected, held, and used the applicant's relevant health information was Arys Health Pty Ltd. That is because, to the extent that Dr Baig provided health services to the applicant, he did so on behalf of Arys Health Pty Ltd and it was that organisation to which the obligations of a private sector agency attached under the HRIP Act.
For completeness I note that for this reason the exception to the application of the HRIP Act is not negatived by s 6D(4)(b) of the definition of small business operator contained in the Privacy Act 1988 (Cth). However, the issue of whether Baig is exempted from the operation of the HRIP Act because it is a small business cannot be taken further in the absence of any evidence of its annual turnover.
Nevertheless, for the reasons set out above Baig is not a private sector health service provider to which the obligations imposed by the HRIP Act apply. It did not provide a health service to the applicant at any time. This inquiry should not continue as against Baig for this reason.
With respect to the conclusions I have reached above, I must revise the findings I made in my earlier decision as follows: 1. there are/were not two private sector persons which hold the health records that were the subject of the applicant's requests (paragraphs 2 and 81 of the earlier decision). Only one private sector person, Arys Health Pty Ltd, held those health records, 2. Baig Medical Services Pty Ltd t/a Arys Health Medical Centre did not operate a medical practice from 280 Pitt Street (paragraph 5 of the earlier decision). At all times that Dr Baig operated from that address he was contracted by Baig by provide his services to Arys Health Pty Ltd, 3. Baig Medical Services Pty Ltd does not itself operate a medical practice from 428 George Street (paragraph 5 of my earlier decision). Dr Baig provides General Practitioner services at that address through Wellshare Pty Ltd. However, he continues to use variations of the name "Arys Health" in marketing materials and in communications related to that practice, 4. the medical practice at 280 Pitt Street conducted by Arys Health Pty Ltd did not cease operation in about May 2021 (paragraphs 6 and 91 of my earlier decision). It did so sometime later (probably about May 2022), but in any event Arys Health Pty Ltd was still conducting that practice on 16 and 17 August 2021 when the applicant last attended on Dr Baig in relation to obtaining a health service, 5. the Patient Health Summary provided to the applicant on 16 March 2022 was not "an integrated medical record created and/or maintained by Baig that incorporates the attendance of the applicant at the medical practice conducted by Arys Health Pty Ltd and that conducted by Baig" (paragraph 52 of my earlier decision). It was a summary of Arys Health Pty Ltd's medical records for the applicant, 6. Baig never provided health services to the applicant and consequently did not become responsible for the retention of any of his health records (paragraph 55 of my earlier decision), 7. the applicant's first and second requests for copies of his health records were lodged with Arys Health Pty Ltd. Dr Baig was at those times providing his medical services through that entity (paragraph 106(i) of my earlier decision). That must lead to the conclusion that Arys Health Pty Ltd, was, or ought to have been, on notice as to these requests at least on an informal basis, contrary to my finding at paragraph 106(i) of my earlier decision.
I now turn to the question of whether my decision to take no action in the matter insofar as it concerns Arys Health Pty Ltd ought to be revisited in light of my further findings in this inquiry with respect to Baig and otherwise as set out above. After careful consideration, and not without some misgivings, I have decided this decision should stand for the following reasons.
It now appears that Arys Health Pty Ltd wound up its medical practice at 280 Pitt Street in May 2022. The applicant and the Commissioner attempted to communicate with "Arys Health" after that date, but there is uncertainty as to who in fact those communications were directed to.
The applicant received email responses from, or at least on behalf of Dr Baig, but there is no evidence that Dr Baig was an authorised representative of Arys Health Pty Ltd at that time.
The evidence I accepted from Ms Scott in the first hearing was that V Plus Corporation Pty Ltd was at that time engaged by Arys Health Pty Ltd to administer its patient health records. I also accepted Ms Scott's evidence that V Plus Corporation Pty Ltd had no knowledge of the applicant's second request for health records or the Commissioner's Investigation of his complaint that these records had not been provided to him.
The failure of Arys Health Pty Ltd to respond to the applicant's second request and to the Commissioner's second complaint investigation may have arisen from acts and omissions of Dr Baig, or his current practice, in purporting to act in relation to the applicant's request (but then failing to) including by failing to refer his, and later the Commissioner's, correspondence to V Plus Corporation Pty Ltd for action. If that was the case, it is not a shortcoming for which Arys Health Pty Ltd can be held responsible.
In any event, there is no evidence before me that could satisfy me to the civil standard that Arys Health Pty Ltd via its representative V Plus Corporation Pty Ltd knew of, and failed to act in relation to, the applicant's second request for his health records at a material time before the applicant's institution of this proceeding.
The essential issue in this respect is that at no stage up to mid-way through this inquiry was the proper respondent to the applicant's complaints identified by its legal name, Arys Health Pty Ltd. Prior to this the respondent was identified as "Arys Health" which is an informal trading name used by both Arys Health Pty Ltd and Baig in relation to the medical practice conducted by Dr Baig for Wellshare Pty Ltd. In this context, it is not sufficiently clear for the purposes of determining breach of ss 27 and 59 of the HRIP Act to whom the applicant's and Commissioner's communications were being directed.
It is a serious matter to find a contravention of ss 27 and 59 of the HRIP Act by a private sector person. As at the end of this inquiry I cannot be satisfied to the requisite standard that Arys Health Pty Ltd, through its medical records management agency, V Plus Corporation Pty Ltd, was on notice, practically as well as legally, as to the applicant's second complaint and the Commissioner's section 59 requirement. I remain of the view that it is inappropriate to make adverse findings against Arys Health Pty Ltd or order it to provide a remedy to the applicant in these circumstances.

Introduction

This decision arises from the finalisation of an inquiry which I have undertaken pursuant to s 49 of the Health Records and Information Privacy Act 2002 (the HRIP Act) into complaints made by FHP (the applicant) to the Privacy Commissioner (the Commissioner) against a private sector person, identified as "Arys Health" within the meaning of Part 6 of that Act which were the subject of a report by the Commissioner under s 47 of that Act (the complaints, the impugned conduct).
I commenced this inquiry on 31 May 2023. In a decision published on 30 January 2024 I determined, for reasons given, that insofar as the inquiry concerned Arys Health Pty Ltd, the Tribunal would take no action on the matter. However, also for reasons given, I determined that the inquiry should continue in relation to another entity, being Baig Medical Services Pty Ltd (Baig), which on the evidence as it then stood, appeared to be a private sector person also involved in the impugned conduct that was the subject of the s 47 report: FHP v Arys Health Pty Ltd [2024] NSWCATAD 27 (the earlier decision).
However, my further inquiry insofar as it concerns Baig has led me to the conclusion that Baig is not a private sector health service provider to which the HRIP Act applies. It is merely a corporate body through which Dr Baig contracts his services as a General Practitioner to private sector health service providers to which the HRIP does apply. At the material time for this inquiry that was Arys Health Pty Ltd. For this reason, I have determined to take no further action in the matter insofar as it concerns Baig.
My further inquiry and findings in relation to Baig have required me to reconsider some of the factual findings I made in relation to Arys Health Pty Ltd in the earlier decision. I have set out my revised findings in the reasons that follow. However, my revised factual findings have not led me to revise my conclusion that no further action should be taken in this matter insofar as it concerns Arys Health Pty Ltd.
The essential issue in this respect is that at no stage up to mid-way through this inquiry was the proper respondent to the applicant's complaints identified by its legal name, Arys Health Pty Ltd. Prior to this the respondent was identified as "Arys Health" which is an informal trading name used by both Arys Health Pty Ltd and Baig in relation to the medical practice conducted by Dr Baig for Wellshare Pty Ltd. In this context, it is not sufficiently clear for the purposes of determining breach of ss 27 and 59 of the HRIP Act to whom the applicant's and Commissioner's communications were being directed.
It is a serious matter to find a contravention of ss 27 and 59 of the HRIP Act by a private sector person. As at the end of this inquiry I cannot be satisfied to the requisite standard (the Briginshaw standard [1] ) that Arys Health Pty Ltd, through its medical records management agency, V Plus Corporation Pty Ltd, was on notice, practically as well as legally, as to the applicant's second complaint and the Commissioner's section 59 requirement. I remain of the view that it is inappropriate to make adverse findings against Arys Health Pty Ltd or order it to provide a remedy to the applicant in these circumstances.
Nevertheless, it must be acknowledged that the manner in which the applicant's requests for his health records were dealt with by various persons under the guise of "Arys Health" is unsatisfactory.
Having said that, and despite the applicant's continuing doubts about the matter, I am confident on the evidence before me that he was provided with a copy of the whole of his extant medical records held by Arys Health Pty Ltd on or about 3 March 2023. That was the object of his requests to Arys Health, the failure to respond to which became the impugned conduct in the complaints before the Commissioner, and then before this Tribunal in this inquiry. At least he has obtained that outcome.

FHP v Baig Medical Services Pty Ltd

At a glance

Court

Decision date

Source

Judgment (6 paragraphs)

Parties

Legislation Cited (5)

Cases Cited (3)