pdf (80.26 KB)

Case Citation:

F v Medical Specialist [2009] PrivCmrA 8 

Subject Heading:

Disclosure of sensitive personal information

Law:

National Privacy Principle 2.1 in Schedule 3 of the Privacy Act 1988 (Cth)

Facts:

The complainant was a patient at a medical clinic, and had been treated by several health professionals at the same clinic, including the medical clinic manager.  The complainant approached the clinic and asked to be treated by a specific consultant medical specialist.  The complainant and the consultant had met, though the complainant had never been a patient of the consultant. 

The consultant refused the complainant's request for treatment and subsequently discussed the complainant with the clinic manager.  The complainant claimed that the consultant had unnecessarily disclosed their personal information to the clinic manager. 

Issues:

National Privacy Principle 2.1 provides that an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of collection unless an exception in National Privacy Principle 2.1(a)-(h) applies.  

Outcome:

The Privacy Commissioner investigated the matter under section 40(1) of the Privacy Act. 

The consultant confirmed that the complainant had approached the clinic in this instance specifically seeking treatment from the consultant.  The consultant had refused to treat the complainant citing ethical and therapeutic reasons.  The consultant then advised the clinic manager of the complainant's need for treatment, the consultant's personal refusal to treat the complainant and the reasons for this refusal.

NPP 2.1 (a) permits an organisation to disclose sensitive information for a secondary purpose where that purpose is directly related to the primary purpose of collection, and the individual would reasonably expect the disclosure.

The Commissioner formed the view that in the circumstances described, the disclosure of the complainant's personal information to the clinic manager was both directly related to the purpose for which the information was collected, and was within the complainant's reasonable expectations. 

Additionally, NPP 2.1(g) permits disclosure of personal information if required or authorised by or under law. 

The Commissioner recognised that section 62D(1)(b) of the Health Services Act 1991 (Cth) allows disclosure to a person who has sufficient interest in the health and welfare of a person, such as a general practitioner who has responsibility for the continuing care and treatment of an individual. 

The Commissioner formed the view that in the circumstances described, the clinic manager was such a person.  The clinic manager was one of the complainant's treating health professionals and disclosure by the consultant to the clinic manager was authorised by this section.  

The Commissioner closed the complaint under section 41(1)(a) of the Privacy Act on the grounds that the consultant had not interfered with the complainant's privacy.

OFFICE OF THE PRIVACY COMMISSIONER

August 2009