1 Feb 2007, 09:00

Several years ago, a woman authorised a counsellor to request her medical notes from a health agency. The agency couriered these notes to the wrong address.

When the error was discovered, a staff member from the counsellor’s office visited the address the notes had been sent to but was told that no such package had arrived.

Last year, the woman requested and received a copy of her medical file from the health agency. While going through the file she found a reference to the fact that her medical notes had previously been sent to the wrong address.

The woman contacted the health agency directly to complain but was not satisfied with its response. The agency advised her of her right to complain to me.

Rule 5 Health Information Privacy Code

This complaint raised issues under rule 5 of the Health Information Privacy Code 1993.

Rule 5 states that a health agency that holds health information must ensure that the information is protected by such security safeguards as it is reasonable in the circumstances to take, against loss or disclosure.

I investigated the health agency’s procedures when having documents couriered. All courier packs required a mandatory signature as proof of delivery. If no one was available at the address to sign for the package, then the usual procedure was to leave a card advising the individual to contact the courier service to arrange a suitable delivery time. On this occasion the agency found that the courier involved was a relief staff worker who had signed for the package themselves and left it at the address.

The agency acknowledged that it had used the wrong address and that great care is needed to ensure medical notes are kept secure. In fairness to the agency, though, I also recognised that if the agreed delivery process had been followed, the health records would not have been left at the wrong address.

The agency also acknowledged the stress the complainant suffered when she discovered the loss of her information several years after the event. It agreed that, in the circumstances, this had compounded the complainant’s anxiety.

It was not necessary for me to form an opinion, since the agency recognised its error and wanted to settle the complaint.

The agency apologised to the woman. It offered her a small sum of money to recognise its error in sending health information to the incorrect address. It also offered a larger sum to compensate her for the emotional distress she had suffered as a result of her medical information being lost several years previously, and the uncertainty of not knowing where it had gone.

The woman accepted this in full and final settlement of her complaint.

December 2007

Security of health information – health agency – agency sent information to wrong address – additional mistake by courier – settlement – Health Information Privacy Code rule 5