Case Citation:

L v Health Service Provider [2006] PrivCmrA 11

Subject Heading:

Access to sensitive personal information.

Law:

National Privacy Principle 6 in Schedule 3 of the Privacy Act 1988 (Cth)

Facts: 

The complainant was referred to a health service provider by their employer for a work-related medical assessment for a worker''s compensation claim.   After the complainant attended the medical appointment, a medical report was provided by the health service provider to the insurance company responsible for assessment of worker''s compensation claims for the employer.  

The complainant requested access to their personal information held by the health service provider but the request was denied.  

Issues: 

The Privacy Commissioner opened a formal investigation under section 40(1) of the Privacy Act. 

National Privacy Principle 6 provides a general right of access to individuals to obtain information held about themselves by organisations.  However, there are some exceptions.

In this case, the health service provider was reluctant to provide access on the grounds that the medical report had been prepared for another organisation for a fee. The health service provider argued that the employer''s insurance company owned the report and that, for this reason, it was not obliged to provide the individual with access to any information collected in relation the report.

The issue before the Commissioner was whether the health service provider''s refusal to provide access for this reason satisfied any of the exceptions to National Privacy Principle 6.   

Outcome: 

In response to the Commissioner''s investigation, the health service provider''s legal representative argued that it would be unreasonable to expect the health service provider to disclose the contents of a report prepared for the employer''s insurance company, as this would otherwise expose the health service provider to potential litigation action by the insurance company (as the owner of the document). 

The Commissioner''s view is that where an organisation collects and is holding a record of personal information, all the personal information in the record is subject to National Privacy Principle 6.  This right to access information applies regardless of whether the documents have been written by the organisation or by another entity, or whether the document is marked ''in confidence'', unless an exception to National Privacy Principle 6 applies.  

The Commissioner contacted the insurance company to explain this view regarding the application of National Privacy Principle 6 and to establish whether the insurance company considered there may be grounds under the Privacy Act for it to withhold the information to which the complainant sought access. 

The insurance company advised the Commissioner that it would voluntarily authorise release of the information to the complainant, and would not seek to claim legal privilege over any of the information to which the complainant was seeking access. The insurance company noted that it may have had grounds for claiming legal privilege over the information but it would not seek to test the claim in this instance.  The Commissioner advised the health service provider of the insurance company''s response. The health service provider in turn agreed to give the complainant complete access to their personal information. 

The complainant advised the Commissioner that not all the personal information which was sought had been provided by the health service provider but that they did not wish to pursue the matter further.  Consequently, the Commissioner closed the complaint in accordance with section 41(2)(a) of the Privacy Act on the grounds that the health service provider had adequately dealt with the complaint.  

OFFICE OF THE PRIVACY COMMISSIONER June 2006