If you work in a small practice or medical centre, there’s every chance you may not have received many requests for personal information from patients. The starting point is to know that the Privacy Act gives people the right to make a request for information that is about them.

Under the Privacy Act, your practice is legally obligated to respond to that request within 20 working days and to provide the information requested, although the law does allow reasons for withholding the information.

Giving access to information can take several forms. It can mean giving a copy of a document; giving a reasonable opportunity to look at a document, or listen to or view a recording; giving a summary of the information; providing a transcript; or giving the information orally – depending on the requester’s preference.

Pointers for responding to a complaint

But here’s the thing. Failing to respond to a request for personal information can result in a complaint from the requester to the Privacy Commissioner. We hope this never happens to you but in case it does, here are some pointers on how best to engage with us.

1. The first thing to do is talk to us and to tell us what you know about the complaint and the information that’s requested. Our aim is to try and resolve the matter to the satisfaction of both parties – the complainant and the respondent (your practice). Be nice to us because we’re only doing our jobs. We are not advocates for the complainant.
2. The second thing to observe is timeliness. Respond as promptly as you can to our requests for information. No one wins in a protracted complaints dispute. If a complaint drags on, it can become stressful, tiring and expensive for your practice and the complainant. There are many benefits in resolving a complaint to prevent it becoming a case before the Human Rights Review Tribunal. This can be an even longer and more costly process and, in the end, the Tribunal could well decide in favour of the complainant and against your practice.
3. The third point is to remember that our goal is to resolve, not to punish. We’re here to mediate and we do this in a number of ways. One of the techniques we use is to call conferences between both parties, but we’d rather keep things less formal  and resolve them quickly, without a situation escalating.

Tell us in confidence

1. In order for us to review your decision to withhold information from a requester, we will almost always need to see the information.
2. When you send us the information, what we are doing is reviewing it to see if we agree with your reasons for not handing it over to the requester.
3. We are not allowed to disclose the information that is being reviewed and we do not disclose the information.

However, when you give us information to review, it will help us if you can tell us clearly what information is being withheld and the reasons why your practice wants to withhold it.

One example is whether to disclose information about a child to a non-custodial parent. While section 22 of the Health Act permits parents and guardians to request their child’s health information, a health agency, such as a GP, can withhold health information where:

• the child does not want the information to be disclosed;
• it would not be in the child's best interests to disclose the information; or
• one of the other withholding grounds in the Privacy Act applies.

Looking ahead

We have many resources to help medical practices comply with the Privacy Act. Our website has tools such as AskUs – our online privacy FAQs, the Priv-o-matic privacy statement generator, as well as our free online privacy training modules. We have a range of health brochures (in English and Te Reo). All of these are designed to be used to help make privacy easy.

A starting point is to familiarise yourself with our Quick Tour of the Privacy Principles. It may also be a good idea to display it in the administrative area of your practice to help colleagues and employees understand the obligations and responsibilities that come with holding personal information. This way, when you have an encounter with a privacy issue, you’ll know where to start. And if you need to know more, ask us.

Originally published in NZ Doctor (31 January 2018)

Image credit: Blue and silver stethoscope via Pexels

health, Health Information Privacy Code, complaints