Consequences of injudicious texting

The use of text messages between healthcare practitioners and with patients is convenient and common, but doctors need to be aware that the content of these texts can be considered part of a patient’s medical record. As this doctor found, this means carefully considering what you write before pressing send.

In this case, a doctor was brought before the Australian Information Commissioner following a privacy complaint from a patient. It was alleged that the doctor breached the Privacy Act by inappropriately disclosing information about his patient in a series of text messages to a third party.

Weekend call for help

The doctor was a treating specialist of a patient with a chronic medical condition.

One weekend, a relative of the patient contacted the doctor asking for assistance. The patient had collapsed at the relative’s home, and they believed urgent treatment was required.

The doctor arranged for the patient to be taken to hospital and throughout the day, liaised with the hospital specialists to ensure appropriate treatment was provided. It was agreed that hospital admission was required so that the patient could receive therapy and support.

After organising with hospital staff to provide transfer to another hospital, the doctor was able to use his connections to arrange for another specialist to admit the patient. Much of his communication to coordinate with the hospital, the patient and the patient’s relative, was via text message. Doing this had taken up most of the doctor’s Saturday.

However, after all the appropriate arrangements had been made, the patient decided she would be better off coming home and unexpectedly self-discharged from hospital.

When the doctor heard this, he sent a series of text messages to a colleague expressing his frustration. This colleague was not a health professional involved in the care of the patient, however she knew the patient’s relative.

Medical record request

The following Monday, the doctor advised the patient’s GP that he could no longer treat the patient. On hearing this, the patient lodged a complaint with Ahpra expressing dissatisfaction with the doctor’s care and treatment. In this complaint, the patient sought a complete copy of her medical records from the doctor.

A range of documentation from the patient’s medical records, including letters, correspondence, pathology, clinical notes and pictures, was provided. However, after receiving this, the patient, who knew the doctor frequently used text messages to communicate, made a further specific request for copies of all texts related to her care.

When copies of the texts were not forthcoming, the patient made a complaint to the Office of the Australian Information Commissioner alleging the doctor had failed to provide access to all personal information held. The patient made a formal request for all correspondence, text messages, notes and other information not provided to date.

The Commissioner wrote to the doctor, asking him to produce all the patient’s personal information including all text messages relating to the patient.

Avant’s advice

In this case, the text messages sent by the doctor were considered to fall within the definition of personal information as defined by the Privacy Act, and no exception relevant to the circumstances applied, so there was no basis to withhold the text messages.

The consent the patient had signed at the start of the therapeutic relationship was also considered. In this, the patient had authorised the specialist to share personal information with other treating specialists for the purposes of treatment.

While most of the text messages sent by the doctor were to other treatment providers and were covered under the consent, the text messages to his colleague who was not a health professional, did not fall within the scope of the patient’s authorised consent.

Privacy breach established

The doctor accepted the texts to his colleague contained personal information about the patient and did not fall within the patient’s authorised consent.

The fact that he had not mentioned the patient’s name in those texts was deemed immaterial as, contextually, the recipient of the text message was able to identify the patient, who was known to the colleague through the patient’s relative.

These text messages then became the basis of a claim for compensation during the regulatory process before the Australian Information Commissioner.

Although the doctor was doing his best to support a patient in need over a weekend, his actions in sending frustrated text messages to a colleague had unfortunate consequences.

Key lessons

The caution with respect to this matter is to be very careful when sending text messages.

• Texts discussing a patient fall within the concept of personal information.
• Text messages related to a patient’s care usually form part of the medical records, and should be saved in their record.
• Depending on the terms of a patient’s consent and the content of the texts, they may or may not fall within the authority granted by the patient.
• A person need not be named but only need to be reasonably identifiable to establish a breach of privacy.
• Even if the opinion or substance of the message is incorrect, it will still be considered personal information.
• Breaches of privacy can lead to regulatory action and/or claims, which can be time consuming and stressful.
• These processes can result in significant consequences, including the payment of compensation and financial penalties.

As such, we return to our regular advice when sending text messages: stop and think before you press send.

Personal information as defined by the Privacy Act

The Privacy Act 1988 contains thirteen Australian Privacy Principles (APPs), with the relevant law extending to this situation under APP 12. This stipulates that an entity must provide access to an individual’s personal information held by the entity upon request, unless an exception exists.

Personal information is defined under the Act to be:

Information or an opinion about an identified individual, or an individual who is reasonably identifiable:

• whether the information or opinion is true or not; and
• whether the information or opinion is recorded in a material form or not.

The term 'personal information' is technologically neutral to ensure sufficient flexibility to encompass changes in information handling over time. This is consistent with international standards and precedent.

The types of information considered to be personal information are unlimited and can vary widely. The definition is not limited to information about an individual’s private or family life, and extends to any information or opinion that is about the individual, from which they are reasonably identifiable. 

This also includes information based on opinion, even if it is incorrect.

More information

Factsheet: Recommendations when using SMS messaging

This article has been updated since it was originally published in Connect magazine issue 22.