pdf (146.39 KB)

Case Citation:

H v Health Service Provider [2010] PrivCmrA 9

Subject Heading:

Collection of sensitive information

Law:

National Privacy Principles 1.3, 1.5 and 10.2 in Schedule 3 of the Privacy Act 1988 (Cth)

The following case was decided by the Privacy Commissioner prior to 1 November 2010. On 1 November 2010 all the powers of the Privacy Commissioner under the Privacy Act were conferred on the Australian Information Commissioner. A reference to a thing done by the Privacy Commissioner before this date should be taken to have been done by the Information Commissioner.

Facts:

The complainant was a patient at a health clinic that was sold to another health service provider.  The complainant alleged that the purchasing health service provider did not have their authority to collect their sensitive information and also failed to provide them with notice of collection at the time it acquired the health clinic. 

Issues:

NPP 1.3 states that at or before the time (or if that is not practicable, as soon as practicable after) an organisation collects an individual's personal information, it must take reasonable steps to ensure the individual is aware of a number of factors, including the purposes for which the information is collected.

NPP 1.5 states that an organisation collecting personal information about an individual from someone else, take reasonable steps to ensure that the individual is, or has been made aware, of the matters listed in NPP 1.3. 

NPP 10.2 provides that an organisation may collect sensitive information without an individual's consent where the collection is necessary to provide a health service to the individual and the collection is in accordance with the rules of a competent governing health or medical body.

Outcome:

The Commissioner investigated the matter under section 40(1) of the Privacy Act.

The Commissioner found that the original health clinic had placed a notice on behalf of the purchaser at the clinic outlining details of the sale of the business, the identity of the purchaser, how it could be contacted and notified individuals that they were able to gain access to their health information.  The complainant was also personally informed about these issues prior to the sale.  Therefore, the Commissioner formed the view that the health service provider had met the notice requirements of NPP 1.3 and NPP 1.5.

The Commissioner then considered the different elements required to collect sensitive information under NPP 10.2(a). 

First, the Commissioner was satisfied that the health service provider was a provider of health services and collected the complainant's information to provide them with a health service. 

Second, the Commissioner considered whether the collection was necessary to provide a health service, given the complainant may not have attended the new service.  The Commissioner took the view that the collection was necessary for the continuation of the health service to the individual.  If the collection did not occur the health information would be lost as no organisation would be responsible for it. 

Third, the purchasing organisation advised that it was a member of a competent medical body whose code of practice requires its members to maintain the confidentiality of client information and to comply with current privacy legislation.  Therefore, the Commissioner was satisfied that the collection was in accordance with rules established by a competent medical body.

The Commissioner was satisfied that the health service provider met all the requirements of NPP 10.2 when collecting the complainant's personal information.

The Commissioner closed the complaint under section 41(1)(a) of the Privacy Act on the grounds that the health service provider had not interfered with the complainant's privacy.

Office of the Australian Information Commissioner
December 2010