Under section 69(2) Privacy Act, I initiated an investigation into certain disclosures of health information about a patient contained in a letter written by a nurse and sent to an opposition MP. The disclosures concerned health information about a patient released into the community under the mental health legislation.

Relevant Facts

The nurse wrote to the Minister of Health expressing certain concerns about release of a particular and identified patient from the secure unit of a psychiatric hospital. This letter contained information about the patient, including allegations concerning earlier behaviour, some comments on the patient's psychiatric situation and state of mind, references to the patient's ability to cope with the outside world and comments on the risk of release into the community. The nurse also sent a copy of this letter to the Minister of Police and the National Director of Mental Health.

The Associate Minister of Health responded to this letter. She noted, inter alia, that she had asked the Director of Mental Health to consider the issues raised in the letter and to ensure that the issues were monitored very closely.

Some months later the nurse sent to an Opposition MP a copy of the earlier letter to the Minister of Health. It is this latter action which I decided to investigate.

Health Information Privacy Code 1993 (Temporary)

The Health Information Privacy Code 1993 (Temporary) ("the Code") is the code of practice issued under the Privacy Act that was in force at the relevant time. The code provided legally enforceable rules governing the disclosure of health information by health agencies.

By subclause 4(1)(a) of the Code a "registered health professional" is a "health agency". A "registered health professional" is defined, in clause 4(2)(g) to include a registered nurse. The nurse in this case came within the definition of a health agency.

"Health information" is defined in clause 3. The information contained in the letter included "health information" as defined in the Code.

The subject of this investigation was whether the disclosure by the nurse, as a health agency, of health information about a patient to the MP constituted an interference with privacy under the Health Information Privacy Code 1993 (Temporary).

Rule 11 of the Code sets limits on disclosure of health information. The relevant part of subrule (1) provides that:

(1) A health agency that holds health information shall not disclose the information unless the agency believes, on reasonable grounds, -

(d) That it is not desirable or practicable to obtain authorisation in accordance with subclause (1)

(b) of this rule and the disclosure is in accordance with subclause (2) of this rule.

The relevant part of the subrule (2) of rule 11 provides that:

(2) A health agency that holds personal information shall not disclose the information to a person or body or agency unless the agency believes, on reasonable grounds -

(b) That the disclosure of the information is necessary to prevent or lessen a serious and imminent threat to (i) Public health or public safety; or (ii) The life or health of the individual concerned or another individual;

Subrule (3) of rule 11 provides that:

(3) Disclosure pursuant to subclause (2) of this rule is permitted only to the extent necessary for the particular purpose or to satisfy the particular request for information.

The relevant parts of subrules are underlined for emphasis.

Rule 11 - Circumstances in which disclosure of health information is permissible

Rule 11(1)(d) provides that disclosure in the circumstances described in subrule 11(2) will be permissible where it is not desirable or practicable to obtain authorisation from the individual concerned or his or her representatives.

In outline there were three key issues I considered in determining whether a disclosure was permissible under subrule 11(2) namely:

(1) whether or not it was desirable or practicable to obtain authorisation from the individual concerned or his or her representative;

(2) whether one of the exceptions listed in rule 11(2)(a) to (l) applied; and

(3) whether or not disclosure was only to the extent necessary for the particular purpose.

1. Authorisation of the individual concerned

Disclosure in the circumstances described in rule 11(2) will only be permissible where the agency believes, on reasonable grounds, that it is not desirable or practicable to obtain authorisation from the individual concerned or his or her representative (rule 11(1)(d).

My investigations revealed that the nurse did not speak to the patient after discharge from the unit. In fact there was no personal contact by the nurse with the former patient subsequent to the discharge. However, there was contact between the nurse and the community nurse, who supported the patient, to discuss the patient's progress. Two weeks before sending the letter to the Opposition MP, the nurse spoke to the community nurse about the former patient's progress.

There was nothing in the evidence presented to me to indicate that the nurse considered whether or not the patient's authorisation should have been sought before disclosing the health information to the MP. In my opinion it was not inconceivable that with appropriate counselling and encouragement the patient would have been amenable to limited disclosures for limited purposes. An appropriate course of action, in my opinion, may have been for the nurse to have discussed the issue with the community nurse and to canvass the possibility of that nurse bringing the issue up with the patient with the aim of seeking the patient's views.

It is central to the right of privacy that the individual concerned be put in the "middle of the picture" and that her or his views be the first reference point whenever that is practicable. However, I did not consider, in this case, that the facts justified my finding that the disclosure was not permissible solely on the basis that the nurse did not discuss the patient's authorisation first. I believe that, had the nurse considered these matters, there may well have been, in the circumstances, objective grounds for believing that the obtaining of authorisation was either not practicable or not desirable.

2. Application of exceptions found in Rule 11(2)

In assessing whether or not the disclosure of health information in this case fell within one of the exceptions in rule 11(2) I focused on:

- the purpose for which the disclosure was made, and whether the nurse had reasonable grounds for believing that this disclosure was necessary to effect that purpose?

The purpose of disclosure

The disclosure of health information did not take place in a vacuum. The background circumstances had been the subject of considerable news media comment and speculation. I read background documentation and legal opinions which contained references to the reasons for the disclosure. My investigating staff and I conducted interviews with and received correspondence from the nurse. I also examined the nurse on oath.
The original letter noting the nurse's concerns had been sent by the nurse to the Minister of Health (with copies to the Minister of Police and the National Director of Mental Health) following a clinical meeting in which the nurse was involved. During this meeting there was a discussion regarding concerns about the operation of the (relatively new) Mental Health (Compulsory Assessment and Treatment) Act 1992 ("the Mental Health Act").

The clinical meeting was, in turn, preceded by the first six monthly review (Certification Hearings) of patients subject to an In-patient Order under this Act. Following the first sixth monthly review, the patient was discharged. This particular case was then used during the clinical meeting in the context of discussion about how staff may address their concerns regarding the process adopted under the Mental Health Act.

Discussion of the patient's case during the meeting was illustrative of a concern as opposed to being a particular concern. Seven days after that meeting the nurse wrote to the Minister of Health. A number of health professionals, and specifically the Unit Manager, were aware of and indicated support for the nurse's action in sending that letter to the Minister of Health.

Eight months later there was wide-ranging publicity about issues of public safety arising from the release of patients from psychiatric institutions under the new Mental Health Act. The stimulus for the publicity appeared to be the case of a man who was released from a mental health unit under the same legislation as the patient in this investigation and for similar reasons. Subsequent to his release he sexually violated an infant.

During this time the Opposition MP called for an inquiry into that case and the wider issue of release of other patients pursuant to the Mental Health Act. However, soon after the call for an inquiry the Minister of Crown Health Enterprises and the Minister of Health each rejected the need for an inquiry. In the media the Minister of Health contended that the case was a single case which stood on its own facts.

It was shortly thereafter that the nurse sent to the MP a copy of the letter originally sent to the Minister of Health. To me, the nurse noted that concerns expressed in the original letter to the Minister of Health had not been addressed prior to its later disclosure to the MP. The nurse had a strong concern that the patient would re-offend in a similar way to before and that it would be a tragedy. The nurse also noted that it was becoming an increasing concern that dangerous people were being released. The nurse stated that the action was motivated by conscience and the concern that staff were waiting for the patient to commit another offence.

The nurse told me that the letter had been sent to the MP for two reasons:

• the nurse believed the patient represented a serious and imminent threat to the public safety at this point in time;

and more importantly, according to the nurse:

• the nurse believed that the patient represented a clear example of a group of particular psychiatric patients who were being released into the community through a loophole or error in the writing and functioning of the then new Mental Health Act.

It appeared from the information provided to my office that the purpose of the disclosure was two-fold:

• to prevent or lessen the threat the nurse considered the patient posed to the health and safety of members of the public; and

• to provide support and momentum for initiatives to change the Mental Health Act which the nurse considered demonstrably inadequate.

The nature of the concerns support a conclusion that the purpose of disclosure was at least in part, "to prevent or lessen a serious and imminent threat to public health or public safety" in terms of rule 11(2)(b)(i).

The identity of the person to whom the disclosure is made can support or detract from any proposition that the person disclosing might put forward as being the purpose of the disclosure. It would be more difficult to accept that the disclosure was made for some particular purpose if the person to whom the disclosure was made would not be in a position to effect that purpose.

The MP had called publicly for an inquiry into the alleged inadequacies of the new mental health legislation. The Minister for Crown Health Enterprises had rejected the need for an inquiry on the basis, inter alia, that that incident attracting publicity at the time stood alone. However, the MP made it publicly known that he was dissatisfied with that response. It was at this stage that the nurse disclosed to the MP the letter, originally sent to the Minister of Health. The nurse made it quite clear to me that the letter was provided to support the call for an inquiry by showing that there was another specific case which posed a similar threat.

If this letter had been successful in persuading the MP to convince the Minister of Health that an inquiry was necessary, it was reasonable to suppose that the patient's case would have been considered as evidence in that inquiry. One effect of this may have been that the circumstances of the patient's discharge would be re-examined. This step, in turn, raised the possibility that the patient would be removed from a position where he was able to continue to pose a threat.

On balance I accepted that disclosure to the MP was consistent with a finding that the purpose of the disclosure was to prevent or lessen the serious and imminent threat to public health or public safety. However the exception in rule 11(2)(b)(i) can only be relied on if the health agency believes on reasonable grounds that the disclosure of the information is necessary to prevent or lessen the serious and imminent threat. Given the nurse's earlier lack of success in raising the issues with the Ministers of Health and Police and the National Director of Mental Health and given the Minister of Health's response to MP's call for an inquiry, I accepted that the nurse considered the disclosure was necessary to effect this purpose.

Did the nurse have reasonable grounds for believing that this disclosure was necessary to effect that purpose?

Having established the nurse's purpose in disclosing the health information to the MP the next step was to establish whether or not the belief that the disclosure was necessary to effect that purpose was based on reasonable grounds.

The nurse's case can be summarised as follows. The nurse had been the patient's case manager and primary contact prior to 1992. Subsequently the nurse became a charge nurse. In this position the nurse was expected to have an understanding of the other patients of which there were about 30.

The nurse noted that some forensic psychiatrists concurred with the view that the patient was a high risk and would need intensive and long term therapy and care specifically directed at the condition. The nurse said that the patient had never received that specialised therapy.

After the patient left the hospital the nurse had no personal contact with the patient. However, when the nurse contacted the community nurse who was supporting the patient, he was told that she was visiting the patient almost daily and that the patient was often non-compliant about medication. She also told the nurse that the patient could barely handle many day to day tasks.

The nurse informed me of several events which were relevant in maintaining an awareness of the patient's position and progress. This information was gleaned either from conversations with, or comments made by, other staff members and not by access to the patient's file.

I had to form an opinion on whether there were reasonable grounds on which the nurse could believe that disclosure of health information to the MP, without the patient's authorisation, was necessary to prevent or lessen a serious and imminent threat to public safety. I had to consider whether, objectively, there were reasonable grounds for such a belief, not whether the nurse subjectively held the belief.

I broke this into two parts:

I. Whether or not there were reasonable grounds to believe that the patient posed a serious and imminent threat to public safety, and

II. Whether or not there were reasonable grounds to believe that disclosure of health information about the patient to the MP was necessary to prevent or lessen this threat.

I. I noted that there was no personal contact by the nurse with the patient subsequent to his discharge from the hospital. On the other hand the nurse was aware of the patient's activities since leaving the hospital and had a less than reassuring conversation with the community nurse two weeks before the disclosure. On balance and considering the nurse's long (albeit somewhat peripheral) involvement in this patient's care and the nurse's expertise and experience in the field, I was satisfied that the nurse had reasonable grounds for believing that the patient posed a serious and imminent threat at the time of the disclosure to the MP.

II. The nurse considered the disclosure to the MP was necessary to prevent the threat the nurse believed the patient posed because the Ministers and the National Director of Mental Health had not responded in any substantive way to the earlier letter. The Minister of Health called the other case a one-off incident and declined the MP's call for an inquiry. The MP had continued calling for an inquiry despite the Ministers' views. The nurse considered the MP's call for an inquiry would be strengthened if he had a particular case to cite to the Minister of Health. As noted earlier it is conceivable that the letter could have been successfully used by the MP to persuade the Minister to conduct an inquiry. The patient's case may have been examined during the course of an inquiry and as a result the patient's position may have been altered to prevent or lessen the threat posed. While it is conceivable that sending the earlier letter to the MP may have had these effects, the link between the disclosure and the desired result is tenuous, especially when it is difficult to see how the desired result could be achieved without a legislative change.

The nurse confirmed that the MP had been approached as "a legislator". It seems to me that the MP was not an obvious person to be in a position to prevent or lessen the serious and imminent threat posed by a particular case. For there to be reasonable grounds to believe that disclosure was necessary for that particular purpose, there must be reasonable grounds to believe that the person to whom the information was disclosed could effect that purpose. There was little reason to believe the MP would have the power to alter the patient's position in the community. To address an imminent threat the recipient of a disclosure would need the power to act urgently, to achieve a tangible result in a particular case. In real terms, the MP was so removed from the decision-making processes in respect of individual patients in the mental health system as to be powerless. The fact that the MP used the letter to add fire to the public debate about an inquiry supports the view that the MP was not a person in the position to do something about a particular individual posing an imminent threat as he would have been if he had held appropriate executive office.

Disclosure of health information held in confidence by professionals to prevent or lessen the serious and imminent threat will only be permissible where the disclosure is necessary to effect that purpose. The concept of a disclosure being "necessary" to prevent or lessen a threat also involves the notion that the threat could not be prevented or lessened in some other way not involving a breach of confidence.

The facts that I was able to establish did not support the argument that the nurse took any steps at that time to see if the perceived threat to safety could be prevented or lessened in some way not involving a breach of patient confidentiality. In particular, the nurse did not provide any satisfactory reason why it was necessary to include information that would identify the patient in the letter to the MP, given that the disclosure to the MP was intended to avert the threat the patient posed by the indirect means of opening up or adding fuel to the MPs call for an inquiry. It is even more difficult to see how it could be considered necessary to include all the other detailed information about the patient set out in the letter.

The concept of "necessary" also involves disclosure to the particular recipient being necessary. If the disclosure the subject of this investigation (i.e. a disclosure to an Opposition MP) were to be accepted as being "necessary" to prevent or lessen a serious and imminent threat then it may seem logical that disclosure of sensitive health information to any other MP (or perhaps to other officials such as Mayors and councillors, and to candidates for such offices) would be justifiable, if they could raise the matter in public debate. It is difficult to see how such disclosures could be considered appropriate from a public policy point of view when there are people with special functions to receive and act on such disclosures who have the expertise and power to act effectively to lessen the risk. The Courts have referred to such people as being the "appropriate authority" or the "responsible authority". A good illustration of the point can be found in the Duncan case.

The headnote to the court case gives a succinct summary of the facts:

Duncan was a ... registered medical practitioner in ... a small rural community. Henry, one of his patients, was a bus driver by occupation and had ... operated a passenger service business ... for 30 years. In 1982 Henry suffered two heart attacks, and was attended by Duncan as his general practitioner. In December 1982 Henry ... underwent a triple coronary artery bypass operation. After the successful operation, Henry obtained a medical certificate from the surgeon which enable him to obtain a licence to drive passenger service vehicles. On 27 April 1983 Henry intended to take his bus to Auckland on a charter trip. On the day before the trip, Duncan spoke to a woman who was to be a passenger on the chartered bus and told her that Henry was not fit to drive and could have a heart attack a any time. Duncan also spoke to Henry and on discovering that he had a licence to drive a passenger service vehicle sought assistance from the local police constable to have Henry's licence revoked. Later Duncan asked a patient at his surgery to help him organise a petition to have Henry barred from driving passenger service vehicles; the patient refused. Henry complained to the Medical Practitioners Disciplinary Committee that he was being unjustly victimised by Duncan and that there had been a breach of patient confidentiality. Duncan v Medical Disciplinary Committee ¹⁹⁸⁶ 1 NZLR 513.

The Disciplinary Committee found Duncan guilty of professional misconduct for breach of professional confidence and censured him. Duncan did not appeal against the decision but made statements to the national news media about Henry's heart condition and fitness to drive. As a result, Henry made a further complaint to the Medical Council which Duncan unsuccessfully sought to have reviewed by the High Court and later the Court of Appeal. Having considered the evidence, the Council adjudged Dr Duncan to be guilty of professional misconduct by disclosing confidential information to the national news media in breach of his professional responsibilities, and in respect of certain other charges, and ordered that his name be removed from the medical register.

The Disciplinary Committee decision included the following reasons for censuring Duncan:

The Committee accepts that Dr Duncan was motivated by concern for the welfare of his community but considers that his actions and intervention were both unwise and unwarranted and amounted to professional misconduct ... he breached professional confidence in informing lay people of his patient's personal medical history. The Committee takes the view that professional confidence can only be breached in most exceptional circumstances and then only if the public interest is paramount. In such a case ... communication should be made only to the responsible authority ... His breach of confidentiality on the 26th of April was serious; however the Committee took a even more serious view of his breach of confidentiality one month after the first instance to an individual who, in no circumstances, could have been a responsible authority. (my underlining) page 518.

Rule 11 of the Code draws upon the tradition of the ethical standards discussed in the Duncan case. The Duncan case focuses on the purpose of a particular disclosure and the need to disclose to an appropriate authority.

My concern was that the nurse's disclosure identifying and including extremely sensitive details about a patient to a Member of Parliament was not "necessary" in terms of rule 11(2)(d) and was inconsistent with the emphasis on "responsible authorities" in the Duncan case. The disclosure to the Police was not the subject of the complaint in the Duncan case, nor was it criticised by the Medical Council or the Courts. It was disclosure to other people that was criticised. The emphasis on disclosing to a "responsible authority" recognises that professional confidence should only be breached in the most exceptional circumstances and then only if the public interest is paramount. This is because it is the "responsible authority" which will have the powers to do something about the matter to protect the public interest. Disclosure to persons who do not have such power merely provides an in-road into medical confidence and privacy which does not carry any corresponding assurance of benefit to the public interest.

In my opinion the nurse did not have reasonable grounds for believing that disclosure of the patient's health information to the MP was necessary to prevent or lessen the serious and imminent threat to public health or public safety by the patient.

As the MP did not need to know the identity of the individual who was the subject of the concerns (or all the other detailed health information), the type of disclosure to the Member of Parliament was not necessary to prevent or lessen the threat posed by the patient. The MP was not in a position to have any influence on the patient's then-current position and while the MP might have been able to use the letter to agitate successfully for an inquiry, he did not need the patient's identity to do so. A reference to the previous letter for instance would have been quite adequate to have drawn the attention of the Minister of Health and the Director of Mental Health and the Police to the situation described in the original letter.

3. Extent of Disclosure

Even if the nurse had reasonable grounds to believe that disclosure fell within rule 11(2)(b) the disclosure would still have had to satisfy rule 11(3) which provides that:

Disclosure under subrule (2) is permitted only to the extent necessary for the particular purpose.”

For the purposes of addressing the issues I will put aside the question of whether or not some disclosure to the MP was necessary. On the facts of this case the central issue under rule 11(3) is whether or not it was necessary for the nurse to disclose all the information to the MP.

On the basis of the foregoing discussion and the likelihood of action effecting that purpose, there is no doubt that additional and unnecessary details were disclosed to the MP.

Final Opinion

I concluded that the nurse disclosed the patient's health information to the MP because the nurse considered it was necessary to do so to prevent or lessen a serious and imminent threat to public safety. My opinion was that, while having reasonable grounds to believe that the patient posed a serious and imminent threat to public safety, the nurse did not have reasonable grounds to believe that it was necessary to disclose this information to the Opposition MP to lessen or prevent this threat. The MP was not the appropriate recipient of the information. Even if there were reasonable grounds for belief that it was necessary to disclose this information to the MP, the nurse disclosed more health information than was necessary for the purpose. In my opinion there was a breach of rule 11 of the Code.

The action would be an interference with the privacy of an individual only if, in relation to that individual, the action breached rule 11 of the code of practice and, in the opinion of the Commissioner or the Tribunal:

(i) Has caused or may cause loss, detriment, damage or injury to that individual; or

(ii) Had adversely affected or may adversely affect the rights, benefits, privileges, obligations or interests of that individual; or

(iii) Has resulted in or may result in significant humiliation, significant loss of dignity or significant injury to the feelings of that individual.

I was satisfied that the patient had been significantly humiliated by this disclosure of health information. The patient felt unnecessarily hurt and let down as a patient. To an extent such a humiliation will be the inevitable consequence of any disclosure of highly sensitive information of this type but, in this case, the comments provided to me by the aggrieved individual and those who had subsequently supported the patient established beyond doubt that the patient suffered significant humiliation and loss of dignity.

In my opinion there had been an interference with the privacy of the patient.

As the nurse disagreed with my opinion, I was unable to settle the matter. However, in the circumstances, I did not think it appropriate to recommend proceedings before the Complaints Review Tribunal. In arriving at that position I took into account:

• the investigation was initiated by me not because of a complaint;

• there was no evidence that the nurse intended the MP to make the detailed health information public;

• the nurse had already been subject to considerable stress as a result of the disclosures by the MP;

• the nurse now has a better understanding of the legal requirements relating to privacy of health information under the Act and the Health Information Privacy Code and is, in my opinion, likely to take care not to breach the rules of the Code in the future.

Note:

1. Members of Parliament acting in their official capacity are not “agencies” as defined by the Privacy Act and therefore the information privacy principles and the Health Information Privacy Code rules do not apply to them.
2. I found no grounds to make any separate investigation into the responsibility of the hospital.
3. The Health Information Privacy Code 1993 (Temporary) was replaced by the Health Information Privacy Code 1994 which is similar in most respects.

December 1996

Indexing terms: Disclosure of personal information - 'Registered health professional' - Disclosure of 'health information' about a psychiatric patient to an Opposition Member of Parliament - Whether disclosure made in a belief 'on reasonable grounds' that the disclosure was 'necessary to prevent or lessen a serious and imminent threat to ... public safety' - Whether disclosure went beyond the extent necessary for the particular purpose - Whether the breach of the disclosure rule was accompanied by significant humiliation or significant loss of dignity to constitute an 'interference with the privacy of an individual' - Health Information Privacy Code 1993 (Temporary), clauses 3, 4(1)(a), 4(2)(g) and rules 11(1)(d), 11(2) and 11(3)