Case Citation:
 

A v Medical Practitioner [2009] PrivCmrA 1
 

Subject Heading:

Collection of personal information and access to personal information

Law:

National Privacy Principles 1.1, 10.1 and 6.1 in Schedule 3 of the Privacy Act 1988 (Cth)

Facts:

The complainant wrote to their medical practitioner requesting a copy of all of the personal information that the practitioner held about them in their medical record.
  A period of thirty days passed and the complainant had not received a response from the medical practitioner.

The complainant made a further request for a copy of their medical record.
 The complainant also requested that an original specialist medical report they had provided to the medical practitioner be returned, stating that the report was only to be seen by the practitioner and not retained as part of their medical record.
  The practitioner provided the complainant with a written response to their request, but did not provide them with copies of their medical records nor the original specialist report.

The complainant claimed that the medical practitioner had interfered with their privacy by failing to provide them with access to their medical record, and by unnecessarily retaining the original specialist report.

Issues:

NPP 1.1 states that an organisation must not collect personal information unless the information is necessary for its functions or activities.

NPP 10.1 provides that an organisation must not collect sensitive information about an individual unless certain circumstances exist, such as where the individual has provided consent.

NPP 6.1 provides that individuals may access personal information that organisations hold about them unless certain exceptions apply.

While NPP 6 does not specify the form of access, it is the Commissioner's view that access should generally be provided in the form requested by the individual.

Outcome:

The Privacy Commissioner investigated the matter under section 40(1) of the Privacy
 Act.
 

The Commissioner found that the medical practitioner had sought advice following the complainant's first request for access.
  The practitioner had not yet responded to the first request when they received the complainant's second request for access.

While the Commissioner acknowledged the delay whilst the medical practitioner sought advice, she did not consider it to be a failure or refusal to provide the complainant with access to their personal information.
  The delay did not constitute an interference with the complainant's privacy.

When the medical practitioner responded to the complainant's requests for access they provided the complainant with written information about how to access their personal information.
  The practitioner offered the complainant the opportunity to view, but not copy, their medical record.
  The practitioner also offered to assist the complainant in understanding the content of the detailed record.

The practitioner also advised the complainant that the original specialist report provided several years prior had been incorporated into the complainant's medical record and would not now be removed.
  The complainant was offered access to the original specialist report as part of their access request.

The complainant did not accept the practitioner's offer to view their medical record.
  They were also dissatisfied that the original specialist report remained on their medical record and would not be returned to them.

While it is the Commissioner's view that, generally, access should be provided in the form requested by an individual, in some cases it is neither possible nor appropriate to do so.
  An organisation is still able to meet the obligations imposed by NPP 6.1 by providing access in another form.

The Commissioner formed the view that in this case, the medical practitioner had met the requirements of NPP 6.1 by offering the complainant the opportunity to view their medical record.

The Commissioner also considered that the specialist report was collected by the practitioner because it was necessary and relevant to their treatment of the complainant.
  Additionally, the Commissioner considered that the specialist report was provided to the medical practitioner with the complainant's consent.
  It was then incorporated into their medical record where it remained until several years later, when the complainant asked for it to be returned.

The Commissioner formed the view that this was neither a breach of NPP 1.1 nor NPP 10.1 as the collection of the report was both necessary and done with the complainant's consent.

The Commissioner closed the complaint under section 41(1)(a) of the Privacy Act on the basis that the medical practitioner had not interfered with the complainant's privacy.

OFFICE OF THE PRIVACY COMMISSIONER

May 2009