Today’s question returns to the issue of paramedics seeking to follow up on their patients and whether that is permissible under current privacy laws – see Giving feedback to paramedics (April 1, 2017) and QAS paramedics accessing patient information via ‘The Viewer’ for ‘follow up’(October 20, 2023).  Today the question comes from a Victorian paramedic who says:

 … I wanted to seek your opinion on the Health Records Act 2001 (Vic). The health privacy principles are listed in Schedule 1 of the Act. Principle 2 relates to Use and Disclosure. I believe, in my unqualified opinion, section 2.2 is relevant to the theme of paramedics seeking feedback.

 There are numerous subpoints and subheadings, and I find that the combination various bullet points and conjunctions may lead me to incorrectly believe this Act provides slightly more supportive language in the theme of paramedics seeking feedback (from hospital staff regarding patients they cared for).

Let me start by saying I understand the value of paramedics getting feedback both to allow them to reflect on their performance and to identify what worked and what did not, and also to give a sense of closure on their work.  Even so whether it is a good idea or not does not determine what the legislation says.

Privacy Principle 2.2 in the Health Records Act 2001 (Vic) is a very complex principle. The clauses that I identify as potentially relevant are 2.2(a) and (f), quoted below:

2.2     An organisation must not use or disclose health information about an individual for a purpose (the secondary purpose) other than the primary purpose for which the information was collected unless at least one of the following paragraphs applies —

(a) both of the following apply—

(i) the secondary purpose is directly related to the primary purpose; and

(ii) the individual would reasonably expect the organisation to use or disclose the information for the secondary purpose; or …

(f)     the use or disclosure is for the purpose of—

(i) funding, management, planning, monitoring, improvement or evaluation of health services; or

(ii) training provided by a health service provider to employees or persons working with the organisation—

and—

(iii) that purpose cannot be served by the use or disclosure of information that does not identify the individual or from which the individual’s identity cannot reasonably be ascertained and it is impracticable for the organisation to seek the individual’s consent to the use or disclosure; or

(iv) reasonable steps are taken to de‑identify the information—

and—

(v) if the information is in a form that could reasonably be expected to identify individuals, the information is not published in a generally available publication; and

(vi) the information is used or disclosed in accordance with guidelines, if any, issued or approved by the Health Complaints Commissioner under section 22 for the purposes of this subparagraph; or…

A health service (in this context a hospital) acquires and records health information including details of observations, treatments, opinions and diagnosis.   The primary purpose of obtaining and recording that information is to provide health care to the patient for the patient’s benefit.  Reporting back to paramedics is not part of that primary purpose it is therefore a secondary purpose.  Reporting information back to paramedics will be permitted if that use is ‘directly related to the primary purpose’ and the patient ‘would reasonably expect’ the hospital to provide that feedback. 

Let us assume for the sake of the argument that an ‘individual would reasonably expect’ a health service like a hospital would share information back to treating paramedics about a patient, their condition to allow those paramedics to reflect on their performance.

Schedule 1 to the Health Records and Information Privacy Act 2002 (NSW) sets out the NSW Health Privacy principles. Principle 11(1)(b) is in the same terms as principle 2.2(a) of the Victorian principles quoted above. A note in the NSW Act says:

For example, if information is collected in order to provide a health service to the individual, the disclosure of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose.

Giving information to the paramedic previously involved in the patient’s care is not making a disclosure to assist in the delivery of further or future health services to that individual.

In ‘QF’ & Others and Spotless Group Limited (Privacy) [2019] AICmr 20 the Australian Information Commissioner and Privacy Commissioner gave consideration to what is meant by ‘directly related’ in an employment context.   Commissioner Falk said (at [49]-[50], and substituting the words ‘health care’ for ‘employment’):

… the act or practice must be directly related to the [health care] … relationship, and not merely an act or practice having an indirect, consequential or remote effect on that relationship.

The Macquarie Online Dictionary defines ‘related’ as “associated; connected”. ‘Directly’ is relevantly defined as “in a direct line, way, or manner…absolutely; exactly; precisely”. The literal interpretation is therefore a strict one, with the term denoting ‘absolutely or exactly having connection’ to the [health care] relationship between the [hospital] … and the individual.

Giving feedback to past practitioners is not directly related to the ongoing delivery of health care.   I note that this opinion is consistent with the view expressed by the Privacy Commissioner and reported in my earlier post see Giving feedback to paramedics (April 1, 2017).  It follows that I don’t see principle 2.2(a) as giving any greater flexibility than the Commonwealth and Queensland laws reported in the earlier cases.

Principle 2.2(f) could be relevant but only at an organisational level.  For example assume Ambulance Victoria (AV) has a process where a paramedic can ‘flag’ a case for review. They think the case will provide useful lessons for others or they want to have their own performance reviewed to reflect on and learn from the event.  In that case AV may have arrangements with the hospital where they can identify the case for review and obtain details of the patient outcome to help feed into the process for the ‘monitoring, improvement or evaluation’ of the services provided by AV and for the ‘training provided by [AV] … to employees or persons working with the organisation’.  As I say that would have to be arranged at an organisational level and is certainly not covered by a paramedic asking a nurse about ‘the patient we brought in earlier…’.

Conclusion

My conclusion after looking at the Commonwealth laws, the Queensland laws and now the Victorian laws is that it is a breach of privacy for hospital staff – nurses and doctors –  to share with paramedics details of a patient’s health condition including observations, diagnosis, treatment, prognosis and further information that may have been obtained.  I say that recognising that there is great value in paramedics being able to close off a case and understand how their actions impacted upon the patient. But just because it’s a good idea does not change the letter of the law. 

Health information is obtained to allow the medical team to provide health care to the person. Sharing that information with people who were, but who are no longer involved in the person’s care is not the primary purpose for which the information was obtained nor is it ‘directly related’ to that purpose.

This blog is made possible with generous financial support from (in alphabetical order) the Australasian College of Paramedicine, the Australian Paramedics Association (NSW), the Australian Paramedics Association (Qld), Natural Hazards Research Australia, NSW Rural Fire Service Association and the NSW SES Volunteers Association. I am responsible for the content in this post including any errors or omissions. Any opinions expressed are mine, and do not necessarily reflect the opinion or understanding of the donors.

This blog is a general discussion of legal principles only.  It is not legal advice. Do not rely on the information here to make decisions regarding your legal position or to make decisions that affect your legal rights or responsibilities. For advice on your particular circumstances always consult an admitted legal practitioner in your state or territory.