I initiated an investigation into the way an access request was dealt with by a Hospital and Health Service (HHS). The request had been made by the father of a man who had formerly been a patient of the HHS. The father had a power of attorney to act on the man's behalf. The father made a request as agent and also made a separate request for personal information about himself. The information at issue was a report commissioned by the HHS into the man's care while he was a patient of the HHS. The report contained information about the man's condition, treatment, upbringing and parents.

The HHS said there were circumstances in the case which made it want to be absolutely sure that the man understood the consequences of the report being released to his father. The HHS was not convinced that the man wanted the information released to his father or that he would have any control over the report once it was released. As the father had made public statements about the man's treatment by the HHS, the HHS considered the father was likely to make the report public for his own purposes, which might not be in the man's best interests.

Although the father held a general power of attorney in respect of the man, the HHS did not accept this as evidence that the man had authorised the report to be released. and asked him to verify that he wanted the information released. The man gave the HHS written authorisation to disclose all health information about him to his father.

Before releasing the report the HHS also wanted the man to sign an indemnity form waiving any privacy rights and indemnifying the HHS against future claims arising from the release of the report. The man's lawyer did so on his behalf, and the report was released to the father.

I had to consider two issues. The first was whether the HHS should have accepted the father's power of attorney at face value. I formed the opinion that it should. The second was whether the requirement to sign an indemnity before the report would be released amounted to a refusal to release it under the Health Information Privacy Code. I formed the opinion that it did.

Power of Attorney

Rule 6 of the Health Information Privacy Code gives individuals a right to have access to personal information about themselves that is held by agencies.

Section 45 of the Privacy Act requires agencies to observe certain safeguards to satisfy themselves that information requested under rule 6 is provided to the appropriate person. It provides:

Where an information privacy request is made ... the agency - (c) Shall ensure that, where the request is made by an agent of the individual, the agent has the written authority of that individual to obtain the information or is otherwise properly authorised by that individual to obtain the information.

In this case, the HHS had copies of a power of attorney as well as a written authorisation stating that the information could be released to the father. In my view the HHS could have accepted either document as written authority for the father to obtain the information on the man's behalf.

Indemnity

The second issue was whether the requirement by the HHS for the man's lawyer to sign an indemnity on his behalf before the report would be released was a 'refusal' to release the information. The indemnity provided:

_The man hereby agrees to waive any privacy interests he may have in relation to the release of the report and to indemnify the HHS from any action or claim that may arise as a result of the HHS's release to him of the report._

_The man further indemnifies the HHS in relation to the publication of any material about him or his family that might otherwise be defamatory, that is contained in the report._

It appeared that the HHS was prepared to release the report to the man (through his father) only if he agreed to waive any privacy interests in the report and to indemnify the HHS from any future action or claim that may have arisen from the release. It was clear that the report would not be released unless the indemnity was signed.

The HHS said it wanted to ensure the man understood the possible consequences of releasing the report to his father. I considered that the HHS had the opportunity, through its contact with his lawyer, to inform him of the media attention concerning the report and its belief that his father would release the report to the media. In this way, the HHS could have satisfied any concerns that the man was unaware of the full circumstances surrounding the request. It had to be remembered that the HHS was not proposing to release the report to the public: it was dealing with an access request made under rule 6.

However, rather than simply informing the man of the situation, the HHS was seeking legal protection in case he made a claim against it after the report was released. The HHS had said early in the investigation that the indemnity was to ensure that, if the father did 'abuse' the information given to him, the man would have no recourse against the HHS.

I formed the opinion that the requirement imposed by the HHS - that the man sign an indemnity - amounted to a refusal to make the information available in response to a request. The information would not be given to him until he signed the indemnity. In responding to a request under rule 6, the HHS was not entitled to impose the condition that a waiver be signed before the information would be released.

Interference with privacy

Section 66(2)(a)(i) and (b) of the Privacy Act provides that an action is an interference with the privacy of an individual if, in relation to an information privacy request:
(a) the action consists of a decision in relation to the request, including a refusal to make information available in response to a request; and
(b) there is no proper basis for that decision.

I considered that there had been a refusal in this case and that that there was no proper basis for it. Therefore, the refusal amounted to an interference with the man's privacy.

Where I am of the opinion that a complaint has substance I may seek a satisfactory assurance against the repetition of the action which was the subject matter of the investigation or the doing of further actions of a similar kind (section 77(1)(a)). In the circumstances I considered it would be appropriate to seek an assurance from the HHS that:
1. In future, when considering whether to provide information in response to an access request, it would consider only the Privacy Act withholding grounds and other relevant statutory provisions; and
2. It accepted that the imposition of a condition requiring an indemnity prior to granting access amounted to a refusal to make the information available.

The HHS gave these assurances and I closed my file.

Indexing terms: Access to personal information - Hospital & Health Service - Refusal - Request by father on behalf of son - Power of attorney not accepted as evidence of authorisation to make request - HHS required son to sign indemnity before information released to father - Requirement to sign indemnity deemed to be a refusal of access - Commissioner initiated investigation - Assurance against repetition of action obtained - Privacy Act 1993, ss 45(c), 66(2)(a)(i) & (b), 77(1)(a) - Health Information Privacy Code 1994, rule 6

May 1999