1. A purpose of the Act as set out in section 1 is to promote fair and responsible handling of health information.
2. HPP 3 addresses data quality and requires an organisation to take reasonable steps to ensure, having regard to the purpose for which the information is to be used that the health information it collects, uses, holds or discloses is accurate, complete, up to date and relevant to its functions or activities.

1. The applicant complains that the respondent did not verify whether the reports provided to her by Turks Legal/IMO Pty Ltd were accurate. The applicant gave evidence that he had taken issue with many of the health practitioners about the accuracy of their reports and that some of the practitioners had updated their records.
2. In considering the steps taken by the respondent in relation to the collection, use and disclosure of the applicant's health information, HPP 3 requires that I look to what is reasonable in the circumstances having regard to the purpose for which the information is to be used.
3. The respondent was asked by Turks Legal to make her own assessment of the applicant for the purposes of County Court proceedings. She conducted an interview with the applicant and asked questions of him.
4. HPP 3 does not place a positive obligation on the respondent when conducting a medico-legal assessment to return to original sources, investigate whether the conclusions reached were accurate, and query whether there had been a change of mind or reconsideration based on further material which may have been supplied. The reports provided to the respondent by Turks Legal/IMO Pty Ltd were not on their face inherently inaccurate. The respondent relied on material supplied to her through Turks legal/IMO Pty Ltd to provide her with information that was accurate, complete, up to date and relevant**.** I find that she was entitled to do so in the circumstances - namely for the purposes of writing her report.
5. The applicant gave evidence that he advised the respondent of the existence of other reports, which he considered relevant. HPP 3 does not place an obligation on the respondent to consider every word written about the applicant by every other medical practitioner. The extent to which the respondent was guided by extraneous material in making her assessment was a matter for her. The respondent correctly points out that if her subsequent report revealed deficiencies in her approach, those deficiencies could have been fleshed out in cross-examination. As it transpired the respondent was never required to give evidence in the County Court proceedings.
6. The applicant is critical of the fact that the respondent's report does not contain any proper analysis by reference to DSM-IV as requested in the letter from Turks Legal. It is not for this Tribunal to consider whether the respondent addressed all of the issues in preparing the report asked of her by the referring practitioners**.** The purpose of HPP 3 is not to assess the standard of the report prepared by the respondent under the guise of considering alleged breaches of the Act**.**
7. The applicant complains that the time spent with the respondent before she compiled her report was inadequate. The applicant also disputes having said some things which the respondent attributes to him. This does not constitute a breach of HPP 3
8. HPP 3 is not a vehicle through which to challenge a health diagnosis or assessment or to seek to substitute another opinion for the opinion of the author of a report. This is however, what the applicant seeks to do.
9. The applicant further complained that the respondent has shredded the documents collected by her. He did not make this complaint to the Commissioner in relation to HPP 3 but did so in relation to HPP 4. It remains more appropriately dealt with in that context.
10. I find that the complaint in relation to HPP 3 is not proven.

1. HPP 4.1 required the respondent to take reasonable steps to protect the applicant's health information from misuse and loss and from unauthorised access, modification or disclosure. The applicant contends that the respondent failed to do so.

1. The applicant expressed concern about the disclosure by the respondent of her report to IMO Pty Ltd.
2. It must be noted that this complaint is brought some years after the respondent sent her report to IMO Pty Ltd.
3. I accept and it was not contended otherwise by the applicant, that it was standard practice at the time (and may well remain standard practice) for legal firms to request health assessments through intermediaries such as IMO Pty Ltd.
4. The applicant contends that the provision of the respondent's report to IMO Pty Ltd in a word format unsecured document placed the respondent in breach of HPP 4.1. Whilst I agree with the applicant that it may be preferable for health information to be transmitted in a different format, there was no evidence before me to suggest that the respondent would have any reason to believe that the health information would be misused, lost, or subjected to unauthorised access, modification or disclosure.
5. The applicant contends that IMO Pty Ltd without permission from the respondent modified her report. There remains no evidence before me that the body of the report was in fact so modified. That is however not to the point. It is the actions of the respondent that are the subject of the complaint.
6. There is no evidence before me to suggest that at the time the respondent forwarded her report to IMO Pty Ltd that she would have had any basis to conclude that IMO Pty Ltd would treat the health information in breach of HPP 4.1**.**
7. I find that the complaint in relatin to HPP 4.1 is not proven.

1. The applicant contends that the respondent failed to comply with the retention requirements set out in HPP 4.2 and HPP 4.3

1. The respondent concedes that she shredded the documents provided to her by Turks Legal/IMO and did not record the date on which those documents were shredded.
2. The respondent describes her actions as "technical oversights".
3. They are not technical oversights. To delete health information in contravention of HPP 4.2 is not merely a technical oversight. It is a breach of HPP 4.2.
4. Following on from her breach of HPP 4.2, the respondent also failed to make a written note in accordance with HPP 4.3.
5. The respondent nevertheless argues that she has not in doing so interfered with the privacy of the applicant.
6. The respondent argued that whilst the breach of a HPP was a necessary pre-condition to finding an interference with privacy this did not constitute the interference with privacy. She submitted that the applicant must demonstrate an actual interference with his privacy.
7. I disagree.
8. The language of section 18 is unambiguous. Interference with privacy is defined under section 18 of the Act. By definition an act is an interference with privacy if it breaches an HPP in relation to health information that relates to the individual. The ordinary meaning of the words leads to the conclusion that a proven breach of HPP 4 is of itself an interference with privacy. This is consistent with the legislative purpose to ensure the responsible handling of health information.
9. The respondent contended that the documents are in any event available from Turks Legal and could if required have been retrieved. This does not obviate the respondent's obligation to comply with the HPPs.
10. Nevertheless I accept the contention of the respondent that the passage of time has revealed no detriment to the applicant. Although the applicant makes sweeping comments which infer that the respondent must have had some hidden reason for destroying the documents, I do not accept that there is any evidence to support this contention or that it has caused distress, humiliation or injury to the applicant's feelings. There has been no impact on the applicant caused by the respondent's actions. I accept the respondent's submission that it was, in her mind, "a practical and secure alternative to the course sanctioned by the Commissioner that a medico-legal consultant may return documents to the commissioning party".
11. I also accept that the respondent's report is the repository of the health information of the applicant generated by the applicant and that the briefing documents generated by the other health professionals are available to the applicant. I reject the applicant's contentions that the respondent's actions have caused or may cause the obstruction or denial of appropriate opportunity to address a diagnosed health issue.
12. Accordingly although I find this aspect of the complaint proven in accordance with s.78(1)(b) I decline to take any further action in the matter.
13. The applicant made some issue of the fact that the destroyed material may have contained handwritten notes of the respondent. There is no evidence to suggest that the documents contained any handwritten notes.
14. It is noted that the applicant in his particulars made serious allegations against the respondent under section 8 of the Act. There is no evidence to support such an allegation which would not in any event come within the jurisdiction of the Tribunal.

1. HPP 9 limits the circumstances in which an organisation may transfer health information outside Victoria. HPP 9.1 (a) does however enable an organisation to transfer health information if it reasonably believes that the recipient of the health information is subject to a law, binding scheme or contract which effectively upholds principles for fair handling of the information that are substantially similar to the Health Privacy Principles.
2. The applicant alleges that the respondent has breached HPP 9 in transferring her report to Turks Legal back through IMO Pty Ltd. This complaint was yet another variation of the applicant's original complaint pertaining to the involvement of IMO Pty Ltd.

1. There is no evidence before me upon which I could conclude that the respondent did not or could not have the belief set out in HPP 9.1(a).
2. There is for example no evidence before me to suggest that IMO is not subject to the considerations set out in HPP 9.1(a). To the contrary I agree with the respondent that:

the letter from IMO to the applicant dated 28 March 2014 (Appendix 8 to the applicant's complaint to the HSC) demonstrates that its practices are entirely compatible with the HR Act and the HPPs, as IMO complies with the nationally applicable and compatible Privacy Act 1988.

1. Although not argued before me, HPP 9.1(d) may also have permitted the transfer. It is arguable that the transfer was necessary for the conclusion or performance of a contract between the respondent and Turks (the provision of the assessment report) in the interest of the individual (the interest being the provision of a timely report via the same source through which it was requested, not that it would be necessarily a report favourable to the applicant.
2. I find that the complaint in relation to HPP 9 is not proven.

1. The complaint insofar as it alleges a breach by the respondent of the Health Privacy Principle ("HPP") 4.2 and 4.3 as set out in Schedule 1 of the Health Records Act 2001 ("the Act") is proven. Pursuant to s.78 (1)(b) of the Act, I decline to take any further action in the matter.
2. The complaint in respect of all other matters is not proven and pursuant to s.78(1)(c) of the Act is dismissed.

[1] I note his statements accorded with correspondence dated 28 March 2014 obtained by the applicant from IMO Pty Ltd.