Health Care Complaints Commission v Payne

Change of name

1. On 22 October 2020, at Ms Payne's request, her surname was changed on the national register of health practitioners maintained by the Australian Health Practitioner Regulation Agency, to Cody Rae Cammarata. Because most of the material referred to in these reasons refers to Ms Cammarata by the surname Payne, for consistency we will use that surname.

Background

1. The individuals whose records Ms Payne accessed were:

• Ms Payne's husband;
• two former partners of the husband;
• three children of the husband (we will refer to the husband, the former partners and the children as "the family members");
• 27 people who appear to have had no association with Ms Payne; and
• Ms Payne herself.

1. At the time Ms Payne accessed their health records, none of the 34 people were patients of the ICU or in the care of Ms Payne.

History of offences

1. In December 2019, NSW Police charged Ms Payne with "11 sequences" of offences of "unauthorised access" under s 308H(1) of the Crimes Act 1900 (NSW) in relation to the family members. Section 308H(1) makes it an offence for a person to cause unauthorised access to "restricted data" held in a computer in circumstances where the person knows that the access is unauthorised and intends to cause that access. Restricted data is defined to mean "data held in a computer, being data to which access is restricted by an access control system associated with a function of the computer": s 308H(3) of the Crimes Act.
2. Ms Payne has not been charged with any offences in relation to her actions in accessing her own health records or the non-family members whose records she accessed.
3. On 8 March 2020, after entering a guilty plea to one "rolled up" charge relating to a sequence of 11 incidents of unauthorised access relating to the family members, the Local Court convicted Ms Payne under s 308H(1) of the Crimes Act. The Local Court made a "conditional release order" under s 9 of the Crimes (Sentencing Procedure) Act 1999 (NSW), commencing 8 March 2020.
4. On 8 March 2021, following an appeal against that sentence, the District Court of NSW quashed Ms Payne's conviction and made a conditional release order under s 10 of the Crimes (Sentencing Procedure) Act, for a period of 12 months.

The Complaint

1. The Complaint consists of five individual complaints:

Complaint 1

1. In Complaint 1, the Commission recites the details of the offences under s 308H(1) of the Crimes Act, for which Ms Payne was found guilty as set out above.

Complaint 2

1. In Complaint 2, the Commission complains that Ms Payne is guilty of "unsatisfactory professional conduct" under s 139B(1)(l) of the National Law for accessing, while working at the Hospital and without authorisation or proper therapeutic or clinical purpose, the medical records of the six people, who were neither patients of the ICU nor under the care of Patient A.

Complaint 3

1. In Complaint 3, the Commission complains that Ms Payne is guilty of unsatisfactory professional conduct under s 139B(1)(l) of the National Law as a consequence of: 1. accessing her own health records; 2. accessing without authorisation, or proper therapeutic or clinical purpose, the health records of the 28 people who were neither patients of the ICU nor under the care of Patient A.

Complaint 4

1. In Complaint 4, the Commission complains that Ms Payne is guilty of unsatisfactory professional conduct under s 139B(1)(b) of the National Law for failing to notify the Nursing and Midwifery Board of Australia (the National Board) within 7 days: 1. that on 21 December 2019 she had been charged with offences punishable by 12 months' imprisonment; and 2. that on 8 October 2020 that she been convicted of offences punishable by imprisonment.

Complaint 5

1. In Complaint 5, the Commission complains that Ms Payne is guilty of professional misconduct under s 139E of the National Law. In support, the Commission relies on Complaints 2, 3 and 4 individually and cumulatively.
2. Ms Payne admits each of the five complaints.

Reasons given for accessing the health records of the family members

1. On 5 September 2019, after being notified of the complaints that she had accessed health records of others without authorisation, in an email she sent to the Health District, Ms Payne acknowledged that her behaviour was "unacceptable" and stated that she was "sincerely apologetic, disgusted and distraught by my actions". She went on to state: "I did access these records, harmlessly I felt and was just looking at them, but never did I use them for my own personal gain, nor for legal proceedings. Anything that has been provided for external legal proceedings have been supplied by my partner with medical letters, receipts etc. he had put away from years ago. The records accessed were my partner's children I had checked birth dates and that they weren't in hospital, on authorisation of my partner."
2. In the s 150 proceedings convened in November 2019 by the NSW Nursing and Midwifery Council, Ms Payne: 1. acknowledged that there was no "justification" for her conduct in accessing health records without authorisation and in doing so she was "breaking the law"; 2. denied accessing the health records so that the information contained in those could be used in Family Court proceedings; 3. claimed that she accessed the records of her husband's children as a spur of the moment thing which she was "pushed" to do out of concern when one of the children failed to arrive for an access visit.
3. In an undated letter, apparently written in January 2021, Ms Payne repeated the claim that the reason she accessed the health records of the children was to check on their birth dates and "as a safety concern". She stated that her behaviour was "inexcusable" but at the time "with the enormous pressure and stress of a messy family law court I felt I had no option". She stated that she now realises that at the time her judgement was clouded and she was under "a huge amount of pressure and stress".
4. She stated that: 1. with time to reflect she now understands the inappropriate nature of her conduct, its effect on the people whose records she accessed and in the future she would not make the same mistake; 2. she had apologised to the mother of the children whose records she had accessed for breaching their privacy; 3. it had never been her intention to be malicious or to access records for personal gain.
5. In cross-examination Ms Payne said: 1. the reason she accessed the children's health records was to check their birthdates, which her husband had asked her to obtain to use in family law proceedings; 2. she could not explain why she accessed the health records of the mother; 3. the reason she accessed her husband's records was because he had asked her to check who was nominated as his next of kin; 4. a further reason she accessed her husband's records was because he was concerned that a relative, who worked as a cleaner at the Hospital, had accessed his records in relation to a compensation claim he made or intended to make; 5. the reason she accessed her own records was because a doctor asked her to check the results of a recent pathology test.
6. When taken to the evidence that she had accessed the health records of the mother on multiple occasions, Ms Payne could not offer an explanation for doing so. Nor could she offer an explanation for looking at parts of those records which related to the treatment the mother had received.

Reasons for accessing the medical records of non-family members

1. Between January 2019 and August 2019, Ms Payne accessed the health records of 27 people (the non-family members), none of whom were patients of the ICU or in the care of Ms Payne when she accessed their records. Of the 27: 1. at least six had never presented at the Hospital and of those, three had never presented at any NSW health facility; 2. one was admitted to the Hospital in 2013; 3. four presented to the Emergency Department only in the time Ms Payne was employed at the Hospital; 4. one died the day before Ms Payne viewed their records.
2. In an email sent on 5 September 2019 to the Health District after being notified of the allegations, Ms Payne acknowledged that her behaviour was "unacceptable" and stated that she was "sincerely apologetic, disgusted and distraught by my actions". She went on to state: "I have looked up numerous records (you have attached) during my course of employment with HNEH but they have always been to do with my employment as a Registered Nurse whether they were patients in ED, patients coming to us from OT, patients I would be looking after and or patients I had looked after and sent to the ward and checking they had made it to rehab or was still thriving on the ward and even the luck patients who skimmed through without needing an ICU admission except being booked. I value the care of each and every one of my patients."
3. In the letter apparently prepared in January 2021, Ms Payne wrote: "As for the other patients I sincerely cannot remember back then when or why I looked them up, nor do I know any of those people listed, but I do admit that if it was on my CAP log in that I would assume I had done it, as I never really left my CAP log in signed in. I know and can admit that I have looked up in the past people in E.D (emergency department) at the hospital I am working with awaiting admission to Intensive Care, retrievals we may be accepting, that I could be looking after or will be in the pod I was working in, theatre cases that may be attending Intensive Care. Whether you would class this as interest in patients' and patient care needs or being too nosey, it was never done maliciously or for any reason and I understand the breech [sic] of privacy and inappropriate nature of doing so and this is not accepted behaviour to do. I never looked up anyone for any reason or to breech [sic] patient privacy or cause any harm or trust issues with the patients."
4. In cross-examination Ms Payne said: 1. that she was not sure why she had accessed the health records of the non-family members; 2. that she did not recognise the names of any of the non-family members, but thought two or three "rang a bell"; 3. that she could not recall why she had looked up the records of the patient who had died the day before; 4. repeated the claim that a possible explanation for accessing the records was because she anticipated that they might be transferred to the ICU; 5. suggested, for the first time, that a possible explanation for accessing some of the files was that they might have been admitted to the paediatric intensive care unit (PICU) and she "worked across that unit".

Reasons for accessing her own medical records

1. According to Ms Payne she had accessed her own health records because a medical practitioner had asked for further details about a pathology test she had undergone for a virus.

Rules governing access to patient records

1. The NSW Health Code of Conduct states: Staff must: 4.5.2 Not use or release official information or records without proper authority 4.5.3 Maintain the security of confidential and/or sensitive information...
2. The Nurses Code of Conduct, issued by the Nursing and Midwifery Board of Australia, 1 March 2018 is to the same effect: "Confidentiality and Privacy" ...nurses must: access records only when professionally involved in the care of the person and authorised.
3. While employed at the Hospital, Ms Payne received training about restrictions on access to health records and the obligation to maintain confidentiality. She said that she understood that access to health records was only permitted for the purpose of providing care to patients. Ms Payne admits that when she accessed the patient records of the family members she understood that she lacked the authority to do so.

Failure to notify National Board

1. Ms Payne admits that s 130(1) of the National Law required her to notify the National Board within seven days of being charged with and later convicted of offences under s 308H(1) of the Crimes Act.
2. In a reply to the Complaint filed on 6 May 2021, Ms Payne stated that at the time she was charged and later convicted with offences under s 308H(1) of the Crimes Act, she was unaware that s 130(1) of the National Law required her to notify the Nursing and Midwifery Board of Australia within seven days of being charged and convicted of those offences. She claimed that she had not sought to hide her actions from the Board and pointed out that the Hospital had referred the results of its investigation to NSW Police and she notified the Commission on the day she was convicted by the Local Court.

What, if any, disciplinary powers should be exercised?

1. Where, as here, a complaint made under the National Law is admitted, the Tribunal may exercise any of the powers in Subdiv 6, Div 3 of Pt 8 of the National Law. They include the powers to caution, reprimand and to impose conditions on a practitioner's registration. Where, as here, the Tribunal is satisfied that a practitioner is guilty of professional misconduct, it may suspend or cancel the practitioner's registration: s 149C(1) of the National Law.
2. In exercising the power to make disciplinary orders, the paramount consideration is the protection of the health and safety of the public: s 3A of the National Law.
3. In Prakash v Health Care Complaints Commission [2006] NSWCA 153, Basten JA commented at [101] that "[T]he adverse consequences for a practitioner may require that no more restrictive an order should be made than is necessary for the proper protection of the community and the other proper purposes of such an order".
4. In Lee v Health Care Complaints Commission [2012] NSWCA 80, Barrett JA observed at [20] that, in making protective orders, the task of the decision-maker centres not on punishment but on the protection of the public and the maintenance of proper professional standards, citing with approval the comments made by Basten JA in Director-General, Department of Ageing, Disability and Home Care v Lambert (2009) 74 NSWLR 523; [2009] NSWCA 102 at [83].

Circumstances surrounding the offending conduct

1. Ms Payne was first registered as a nurse in December 2015. Following registration, Ms Payne worked in several nursing roles until commencing in May 2017 in the Hospital's ICU, apparently on a part-time basis, where she remained working until her employment was terminated in September 2019.
2. In May 2019, Ms Payne commenced at Maitland Private Hospital also on a part-time basis. Apart from a period of maternity leave (June 2020 to February 2021) Ms Payne worked continuously at Maitland Private Hospital. On her return from maternity leave, Ms Payne was appointed to a permanent part-time position, 60 hours per fortnight. She remains in that position.
3. Since November 2019, in accordance with the conditions imposed on her registration, Ms Payne has worked under indirect supervision. Those conditions require that Ms Payne provide the Council with monthly reports prepared by her supervisor.
4. Ms Payne tendered in these proceedings the February, March and April 2020 reports prepared by her supervisor, Ms Katie Lynch, the Nurse Unit Manager of Maitland Private Hospital's intensive care unit. The reports are favourable to Ms Payne, notwithstanding that the earlier reports raise several issues about Ms Payne's clinical practice. In the April 2020 report, Ms Lynch noted that those issues have largely been addressed. None of the reports raised concerns about Ms Payne's integrity. In the April 2020 report, Ms Lynch wrote "multiple reflection with supervisor re confidentiality, moral and ethical values". This, it seems, refers to a process of "reflection" Ms Payne undertook with Ms Lynch in relation to the ethics and standards relating to confidentiality of patient information and records.
5. In a document headed "reflection" dated 13 March 2020, Ms Payne stated that she reflected on the obligation of a nurse to maintain patient confidentiality. She observed that this obligation extended from ensuring that curtains were drawn around a patient's bed to protecting patient health records. She stated that she recognised the vulnerable position of patients and that maintaining confidentiality is an important aspect of care and something, as a nurse, she must strive to do well.
6. In an undated letter, apparently prepared shortly before Ms Payne's return from maternity leave, Ms Lynch wrote that Ms Payne is a "valued member of the ICU team". She wrote that Ms Payne has a strong work ethic and maintains positive relationships with her patients and all members of her team. Ms Lynch stated that while Ms Payne was under her supervision, she "witnessed nil instances of behaviour in which Payne's integrity could be questioned".

Reasons for accessing the health records

1. Ms Payne urges us to take into account the comments made by Ellis DCJ during the appeal proceedings which she asserts support her claim that she did not use the information about family members for "personal gain". The Commission contends that the information available to Tribunal that was not before the District Court, casts doubt on Ellis DCJ's characterisation of Ms Payne's actions as "well meaning".
2. In the appeal to the District Court, Counsel for Ms Payne said: "It's a matter, your Honour, where she was looking into the database for information pertaining to her husband's children. She did not intend to use that information for any gain whatsoever, any personal gain or gain outside of the home other than to know what was happening with the children. There was no word of what was happening. She was aware that one of the children was sick but wasn't aware of the diagnosis or how bad that child was. So certainly her intentions at the time certainly were not malice. Her intention was not to use that information but she certainly, by way of her plea of guilty, she's accepted that she committed the offence that she was charged with in any event and she's certainly remorseful for that, as your Honour will see by the letter under her hand, her letter of remorse."
3. On sentencing Ellis DCJ said, in referring to Ms Payne's actions in accessing to the health records of her husband's children: "[I]t seems to me, there was no malicious intention to abuse the information or to gain money from the information."
4. The evidence of multiple searches made over an extended period casts doubt on the reliability of Ms Payne's claim that the sole reason she accessed the health records of family members was to check on the birth dates of the children and to check on the well-being of the child who failed to attend a planned access visit.
5. In these proceedings, Ms Payne failed to provide a plausible explanation for accessing the records of the mother of the children. It may be that, as alleged by the Health District, that the reason she accessed the health records of family members was to discredit the mother and cast doubt on her suitability as a parent. That allegation was not put to Ms Payne in these proceedings and on the available material is not established.
6. Nonetheless, it is apparent that Ms Payne accessed the health records of family members for the purpose of providing information contained in those records to her husband in the knowledge that it would be used by him in the Family Law proceedings. In addition, she admitted accessing information contained in her husband's health records for use by him in a compensation claim. Whether, as the Commission contends, this can be characterised as being for "personal gain" is beside the point. Her actions were "well meaning" in the sense that at the time she considered it was necessary and appropriate to support her husband. However, her actions in accessing the information for a purpose unrelated to her duties as a nurse were nonetheless, as Ms Payne properly concedes, both improper and unethical.

Submissions

1. The Commission argues that given the seriousness of the conduct the appropriate orders are cancellation together with a 12-month disqualification period.
2. Ms Payne argues that the more appropriate form of order is a caution or reprimand together with the imposition of conditions on her registration. In support she points to the positive reports provided by Ms Lynch together with her acknowledgement of the inappropriateness of her actions. She contends that the Tribunal can be confident that in the future she would not access health records without authorisation. She also points to her personal circumstances. She is currently supporting her husband and their young child. She and her husband have just bought a new home and are reliant on her income.

Consideration

1. A key consideration in deciding the appropriate form of protective orders is whether there is a risk that the conduct the subject of the Complaint will be repeated. It goes without saying that unauthorised access by a health practitioner of health records is conduct of a most serious nature.
2. As Ms Payne concedes, when she accessed the health records the subject of the Complaint she was aware that she was not authorised to do so. She understood that her actions contravened the law.
3. At the time of the offending conduct Ms Payne was young and inexperienced. As she saw it, she was doing the right thing by accessing the information to support her husband in "messy" family law proceedings. She was undoubtedly caught up in the acrimonious dispute between her husband and his former partner which apparently clouded her judgement.
4. While, as Ellis DCJ found, her conduct could not be described as falling at the high end of the scale in terms of criminality, it was, as Ms Payne accepts, a very serious breach of her ethical obligations with respect to the use of health records.
5. The unusual circumstances which caused Ms Payne to access the health records of the six family members are unlikely to be repeated. Maturity, the development of insight, together with the deterrent effect of the criminal proceedings and these disciplinary proceedings, may be sufficient to guard against reoffending. Ms Lynch who has worked closely with Ms Payne appears to hold that view. This can be inferred from her decision to offer Ms Payne a permanent nursing position.
6. Nonetheless, in large part because of the absence of any plausible explanation for Ms Payne's actions in accessing the health records of non-family members, we are left with a sense of unease about whether the offending conduct might be repeated. Even if we accept that Ms Payne accessed the records of those non-family members who were patients of the Hospital because she wanted to prepare for their possible admission to ICU, this does not explain why Ms Payne accessed the records of those non-family members who were not patients at the Hospital when she accessed their records. Any number of reasons may explain Ms Payne's actions, including idle curiosity. However, on the available material we simply do not know why Ms Payne accessed those records. Unless and until some explanation is available, we think that there is an appreciable risk that Ms Payne might again abuse her position as a nurse and access health records without authorisation.
7. In deciding the appropriate form of orders we have taken into account the comment made by Basten JA in Prakash at [101], that the adverse consequences of protective orders for an individual practitioners require that "no more restrictive an order should be made than is necessary for the proper protection of the community and the other proper purposes of such an order".
8. A cancellation order will, no doubt, have adverse financial, social and psychological consequences for Ms Payne and her family. We have considered carefully whether it would be possible to formulate conditions which would adequately protect the public against the risk of Ms Payne accessing health records without authorisation. Regrettably, on the available material we are not satisfied that the risk posed could be reduced to one that it is not appreciable by the imposition of conditions.
9. For that reason, we have decided to cancel Ms Payne's registration. We have decided that a disqualification period of six-months is appropriate.

Date of effect of decision

1. Given the demand for intensive care nursing services during the COVID-19 pandemic, to minimise the impact of this decision on Ms Payne's current employer, we have decided to exercise the discretion conferred by s 61 of the Civil and Administrative Tribunal Act 2013 (NSW) and order that our decision take effect 60 days after publication of our reasons for decision. In the intervening period, the conditions imposed on Ms Payne's registration by the Council will continue to apply.

Orders 1. Pursuant to s 149C(1) of the Health Practitioner Regulation National Law (NSW) Ms Payne's registration as a nurse is cancelled. 2. Pursuant to s 149C(7) of the Health Practitioner Regulation National Law (NSW) Ms Payne may not apply for review of the cancellation order for a period of six months. 3. Pursuant to s 61 of the Civil and Administrative Tribunal Act 2013 (NSW) orders 1 and 2 takes effect 60 days after publication of our reasons for decision.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar

Amendments 23 September 2021 - Approved for publication DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 23 September 2021