In NSW, the Health Privacy Principles (HPPs) contained within the Health Records and Information Privacy Act 2002 (HRIP Act) protect individuals in NSW in relation to the collection, storage, use and disclosure of their health information by NSW public sector agencies and health service providers. The NSW Civil and Administrative Tribunal (Tribunal) has recently considered whether there was a breach of HPPs as a result of the disclosure of personal information to a general practitioner not involved in the care of the patient due to a computing error.
In DKV v Southern NSW Local Health District [2019] NSWCATAD 12, the applicant scheduled an urgent appointment with a specialist at the respondent’s public healthcare facility. On the same day as scheduling the appointment, the applicant also sought treatment from a general practitioner (GP 1). The applicant saw GP 1, who was a visiting medical officer, because the applicant’s usual treating GP (GP 2), was not available.
The following week when the applicant attended a specialist appointment, the specialist prepared a report addressed to the applicant’s GP. Due to a computing error, the program auto-populated the GP’s names in the report template to be both GP 1 and GP 2, and the report was faxed to each accordingly. Upset that GP 1 received the report, the applicant complained in writing directly to the respondent and also lodged an application at the Tribunal for review.
The respondent conducted a comprehensive internal review and conceded breach of the HPPs when it erroneously sent the report to GP 1 and when it failed to inform the applicant about the purpose for collecting the health information and to whom it might be disclosed.
The Tribunal closely considered whether the respondent had breached HPP 9 in relation to the relevance and accuracy of the health information, and whether there had been an additional breach of HPP 11 by sending the report to the treating GP. Ultimately the Tribunal found there had been no breach of HPP 9 and HPP 11, except as conceded by the respondent.
Read the decision in full here.