The complainant had been in prolonged discussions with a health service over what she perceived to be a medical misdiagnosis recorded on her medical file. The doctor involved subsequently retracted their diagnosis and the complainant requested that all references to the diagnosis be removed. The health service refused the request to preserve the historical integrity of medical records.
The complainant also complained that documents containing the misdiagnosis had also potentially been communicated to persons unnecessarily.
The complainant brought her complaint to OIC.
The complaint raised issues under National Privacy Principles (NPP) 2 (Limits on use or disclosure of personal information) and NPP 9 (Sensitive information).
Under NPP 2, a health agency can disclose an individual’s personal information to a third party without relying on a permitted exception, if the disclosure is for the purpose for which the information was obtained in the first place (i.e. the primary purpose).
For example, if a health agency obtained the information for the purpose of providing the individual with a health service, it can provide that information to someone else if their intended purpose is also to provide that health service.
It is only when the disclosure is for a different purpose altogether (a secondary purpose) that one of the exemptions in NPP 2 needs to be considered.
Sensitive information, such as ‘health information’, is afforded a higher level of privacy protection under the NPPs by placing conditions on the circumstances around how it is collected.
The circumstances in which sensitive information may be collected are set out in NPP 9. One of the exemptions is that ‘the relevant individual has consented’.
During an extended mediation process, OIC negotiated an alternate solution to removing the alleged misdiagnosis on the woman’s medical file, whereby the health service agreed to redact all references to the diagnosis in the working copies of the medical files. The original unredacted documents were also ‘quarantined’ in a secure envelope within the woman’s medical file, with access restricted to limited personnel.
While this solution addressed many of the complainant’s concerns, full agreement did not occur, because the health service did not consider it sound practice to redact certain medical information.