In healthcare settings, patients have a strong interest in knowing their privacy will be protected. Given that health information is often highly sensitive, in what circumstances is it reasonable for a health agency to disclose that information to others?

In certain situations, health agencies may need to share health information with appropriate parties, such as Police, in order to mitigate any risk of harm to a patient. The health practitioner should obtain an individual’s consent unless it is not practicable or desirable to do so.

We recently received a complaint from a person who was experiencing suicidal thoughts. An emergency service considered the man to be a high risk to himself and others due to their escalating interactions with him. In order to best meet safety requirements for him, the emergency service shared with Police a safety plan to prevent and lessen the serious threat to his life. Following the disclosure, the man complained to us about the emergency service disclosing his health information to Police without his consent.

Is there a serious threat?

Rule 11 of the Health Information Privacy Code (HIPC) says when a health agency discloses information, it needs to be able to rely on an exception or another piece of legislation to do so. Authorisation of the disclosure is only one of the possible exceptions under rule 11.

Another exception is rule 11(2)(d). This allows a health agency to disclose personal information if it has reasonable grounds to believe the disclosure is necessary to prevent or lessen a serious threat to the life or health of an individual and it is not practicable or desirable to obtain the individual’s consent first.

In this case, the disclosure was to the responsible authority (Police) who had been continuing to respond to the man when in distress. The disclosure was limited to information directly relevant for the purpose of ensuring the man’s safety when he presented to Police and did not include any information about his diagnosis. Authorisation from him was neither practicable nor desirable because the agencies needed to move quickly to ensure they could keep him safe, particularly given the nature of the threat.

The Health Act 1956

In addition to the exception under rule 11(2)(d) of the HIPC, section 22C of the Health Act 1956 could apply to the disclosure made to Police. Section 22C of the Health Act is an override to the Privacy Act and the HIPC which allows an agency to disclose health information in certain circumstances.

Section 22C says (in summary):

Any agency may disclose health information, if that information is required by a constable, for the purposes of exercising or performing any of that person’s powers, duties or functions. 

Disclosure to a relative

We received another complaint from a person who had raised concerns when a hospital informed their mother of their health condition when they had attended the emergency department. 

Under rule 11(2) of the HIPC, a health agency can disclose health information about the individual concerned to a near relative. In this case, the hospital would have reasonable grounds to believe it could rely on rule 11(2)(b) when informing the person’s mother about their presentation at the emergency department. The disclosure had not been contrary to the express request of the patient and it also appeared to be in accordance with recognised professional practice.

It is important to note that rule 11(3) says that “the disclosure under subrule (2) is permitted only to the extent necessary for the particular purpose”. In other words, only provide enough information necessary to avoid the threat, and give it to someone who is in a position to do something about the threat.

Where someone’s life is in danger, disclosure of necessary information takes precedence over consent; safety comes first.

Recommendations

We recommend health agencies ensure their staff undertake privacy training and regular refresher courses. We have two e-learning modules specifically for health agencies about health information and the HIPC which are freely available on our website. They are Health ABC and Health 101.

We also recommend health agencies regularly review their policies and ensure they are kept up to date. It is important staff are aware of their obligations under the HIPC and staff are both aware of their obligations under the HIPC and act in line with those obligations.

If you are a health agency and you have any enquiries about the above, please feel free to give us a ring on 0800 803 909 (Monday to Friday, 10:00am to 3:00pm) or email us at enquiries@privacy.org.nz

We cannot provide legal advice, but we can provide general guidance that may be of assistance.

Image credit: Safety first via PIXY#ORG

Health Information Privacy Code, health