Case Note: Privacy and the Health Privacy Principles

Curran v Loddon Campaspe Centre Against Sexual Assault (Human Rights) [2017] VCAT 999 (14 July 2017)

The Victorian Civil and Administrative Tribunal (VCAT) found that the Loddon Campaspe Centre Against Sexual Assault (LCCASA) did not interfere with the privacy of the applicant by breaching the Health Privacy Principles (HPPs) under the Health Records Act 2001 (Vic) (HRA). The applicant alleged that LCCASA breached the HPPs in a number of different ways, including by failing to provide her with access to her health information, failing to protect her health information and including misleading or incorrect information. This case alert will focus on the alleged unauthorised use and disclosure of the applicant’s health information for the purpose of considering a request for clinical supervision and for the purpose of an intervention order proceeding.

Facts

The applicant received counselling from the LCCASA during two periods between June 2010 to December 2011, and April 2013 to December 2013. Ms Natasha Mullings (Ms Mullings) was her counsellor during the first period and for the first four months of the second period before handing over to Ms Jenna Abbott (Ms Abbott). During the second counselling period, the applicant was enrolled in a counselling course and completed a supervised work placement at a local school. Upon completion of the placement, the applicant required a new clinical supervisor to continue counselling some of the students.

In early September 2013, the applicant either called Ms Mullings, who was a client intake officer by this time, or met her in the street and asked her about a clinical supervisor referral to continue counselling a 15-year-old boy with a history of ‘sexually abusive behaviour’. Ms Mullings suggested that the applicant speak to Ms Sue Davidson (Ms Davidson), the client services manager and clinical supervisor at LCCASA. On 6 September 2013, Ms Davidson discouraged the applicant from continuing to counsel the boy on the basis of the complexity of the case and the applicant’s background.

On 20 December 2013, the applicant was agitated and confronted Ms Mullings in the street about disclosing counselling information to Ms Davidson. Ms Mullings sought and was granted an interim intervention order on 23 December 2013 by the Magistrates Court. In making the application, Mr Mullings disclosed that she had previously counselled the applicant and disclosed information about the applicant’s history.

From April 2014 onwards, the applicant made a number of requests to LCCASA for access to her health information under the Freedom of Information Act 1982 (Vic) (the FOI Act) and later under the HRA. The applicant was provided with printed copies of her counselling records.

Issues

The applicant made a complaint to the Health Services Commissioner, which was referred to VCAT under section 63 of the HRA. The matter was heard by Vice President Judge Hampel. The applicant alleged that LCCASA contravened section 18 of the HRA by breaching the HPPs 2, 4 and 6 in relation to her health information.

The key issues for VCAT in considering whether LCCASA breached HPP 2 were whether:

  • the use of the applicant’s name and counselling background was a permitted use under the HRA in considering the applicant’s request for clinical supervision or a referral; and
  • the use of the applicant’s counselling history in the intervention order proceedings was permitted under HPP 2.

VCAT also considered the alleged breaches under HPP’s 4 and 6 regarding alleged failure to provide access to the applicant’s health records, alleged failure to protect the applicant’s health records and including false or misleading information in the health records.

HPP 2: Was there an interference with the applicant’s health privacy by use or disclosure of the applicant’s health information in dealing with the applicant’s request for assistance in finding a supervisor?

The applicant submitted that LCCASA breached HPP 2.1 by Ms Mullings identifying her by name and disclosing the substance of her counselling sessions to Ms Davidson, which Ms Davidson used in the conversation with the applicant about clinical supervision. The applicant submitted that her health information was collected for the primary purpose of counselling sessions and that as a result, LCCASA was restricted to using it in ‘discussions in subsequent counselling sessions’.

LCCASA submitted that it was permitted to use the health information in dealing with the applicant’s request for assistance in finding a clinical supervisor as the primary purpose for which it was collected was providing counselling services, which included dealing with clients in an informed manner. Alternatively, LCCASA submitted that the use or disclosure was further permitted for a secondary purpose under HPP2.2(a), (b) or (f).

Relevantly, HPP 2 provides that:

2.1 An organisation may use or disclose health information about an individual for the primary purpose for which the information was collected in accordance with HPP 1.1.

2.2 An organisation must not use or disclose health information about an individual for a purpose (the secondary purpose) other than the primary purpose for which the information was collected unless at least one of the following paragraphs applies –

(a) both of the following apply –

(i) the secondary purpose is directly related to the primary purpose; and

(ii) the individual would reasonably expect the organisation to use or disclose the information for the secondary purpose; or

(b) the individual consented to the use or disclosure; or

(f) the use or disclosure is for the purpose of –

(i) funding, management, planning, monitoring, improvement or evaluation of health services; or

(ii) training provided by a health service provider to employees or persons working within the organisation –

and –

(iii) that purpose cannot be served by the use or disclosure of information that does not identify the individual or from which the individual’s identity cannot reasonably be ascertained and it is impracticable for the organisation to seek the individual’s consent to the use or disclosure.

As a starting point, VCAT considered that the applicant’s name was health information for the purpose of section 3 of the HRA.

VCAT then considered the primary purpose for which the health information was collected. VCAT accepted evidence from Ms Wright, the current CEO of LCCASA, that the primary purpose for collecting the health information was ‘for the purpose of provision of counselling services to clients, and dealing with them in an informed way that included, but was not limited to, use of past counselling notes in later counselling sessions’. VCAT also took into account the functions and activities set out in the Victorian CASA Standards of Practice Manual. VCAT found the applicant’s characterisation of the primary purpose to be ‘unduly narrow’.

VCAT considered that the use of information for the purpose of dealing with the clinical supervision request was consistent with this primary purpose and was permitted by HPP 2.1. VCAT accepted evidence from Ms Mullings that, in her professional opinion, it was necessary for Ms Davidson to be aware that the applicant was a client of LCCASA in order to properly evaluate the applicant’s clinical supervision request. Further, it accepted evidence from Ms Mullings that information about the applicant’s counselling history was disclosed to Ms Davidson as part of clinical supervision, in which any concerns about clients, whether about the counsellor’s or the client’s safety, or the approach to counselling were discussed. VCAT accepted evidence from Ms Davidson that once she became aware of the applicant’s identity, she considered it necessary to use the information in order to evaluate the possible impact on her of the counselling for which she was seeking supervision.

VCAT rejected the applicant’s submission that she was not aware that her health information might be discussed during clinical supervision, on the basis of evidence from Ms Mullings that all clients were told of the limits of confidentiality at the outset of counselling. This was supported by an entry in the counselling notes from the outset of the second period of counselling. While the counselling notes from the first period did not contain an entry regarding confidentiality, VCAT was nonetheless satisfied that it was discussed with the applicant, and that the applicant was aware from April 2013 at the latest that her counselling history may be discussed in clinical supervision.

VCAT also considered whether the use or disclosure was use for a permitted secondary purpose under HPP 2.2(a), (b) and (f). VCAT considered that HPP 2.2(a) was satisfied on the basis that an individual receiving counselling from a CASA would ‘reasonably expect’ it to ‘use that information for the purpose of evaluating a request for assistance in providing a supervisor’ to continue, as a student, counselling a child with a ‘history of sexually abusive behaviour’. It followed, in VCAT’s view, that the applicant would have reasonably expected the information to be used in the manner it was used. VCAT was not satisfied that the use was permitted under HPP 2.2(b). It held that it could not be ‘implied from the circumstances in which the applicant made her request’ that she consented to the use of the health information. Furthermore, it was not satisfied that the use was permitted under HPP 2.2(f) as a use for the ‘purpose of funding, management, planning, monitoring, improvement or evaluation of health services’.

HPP 2: Was there an interference with the applicant’s health privacy by use or disclosure of the applicant’s health information in the intervention order proceedings?

The applicant contended that LCCASA breached HPP 2 by disclosing her health information in the intervention order proceedings. The applicant contended that Ms Mullings acted outside the scope of her employment in disclosing the information. LCCASA contended that the use or disclosure ‘was for an authorised secondary purpose by reason of HPP 2.2(h)(i) and (k)’. HPP 2.2(h)(i) and (k) read as follows:

2.2 An organisation must not use or disclose health information about an individual for a purpose (the secondary purpose) other than the primary purpose for which the information was collected unless at least one of the following paragraphs applies –

(h) the organisation reasonably believes that the use or disclosure is necessary to lessen or prevent –

(i) a serious and imminent threat to an individual’s life, health, safety or welfare; or

(ii) a serious threat to public health, public safety or public welfare

And the information is used or disclosed in accordance with guidelines, if any, issued or approved by the Health Services Commissioner under section 22 for the purposes of this paragraph;[1] or

(k) the use or disclosure is necessary for the establishment, exercise or defence of a legal or equitable claim.

VCAT was satisfied that the disclosure for the intervention order proceedings fell within both HPP 2.2(h) as a disclosure necessary to lessen or prevent a serious and imminent threat to Ms Mullings’ safety and HPP 2.2(k) as a disclosure to establish Ms Mullings’ legal claim for an intervention order. It accepted evidence that Ms Mullings was acting in accordance with her role with LCCASA, and that she was encouraged by LCCASA, in accordance with its internal policy, to seek an intervention order if she felt unsafe as a result of the applicant’s conduct. Furthermore, it accepted evidence that Ms Mullings acted in good faith and had a genuine fear for her safety. VCAT considered it unnecessary to determine whether it also satisfied HPP 2.2(c) as a disclosure permitted by a law.

Further breaches of the HPPs

VCAT rejected the applicant’s claims that LCCASA breached HPP 6 by failing to provide her with access to all of the health information it held about her. It considered that LCCASA had taken reasonable steps to provide her with access to all health information that it held about her by providing her with copies of the electronic counselling records notwithstanding that it was not able to obtain all electronic backups of those files. Furthermore, it rejected the applicant’s claim that LCCASA breached HPP 4 by destroying or failing to protect the electronic backups of her counselling records.  Finally, VCAT rejected the claim that the applicant’s counselling records containing references to the applicant ‘stalking’ Ms Mullings breached HPP 3.1 as misleading or incorrect or HPP 1.1 as an unnecessary collection of information. VCAT was satisfied that the counselling notes were an accurate recording of Ms Mullings’ impressions.

Compliance Impact

This case demonstrates that a person’s name will constitute health information where it is used to identify the person as a person receiving a health service. It also highlights that the primary purpose of collecting health information is not necessarily confined to providing the health service but can also include making an informed decision when dealing with a related request made by the patient. Furthermore, disclosure of health information in support of a personal court application by an employee will be permitted where the employee makes the application in accordance with organisational policies.

Share this post

Ready to get in touch?