Due to a global Microsoft outage, we are experiencing technical difficulties that may make it hard to reach us.

Back of police member showing the blue reflective police writing on the reflective stab vest

GP breached patient privacy by disclosing information to police without a warrant

Thursday, 20 June 2024

Key messages from the case

When approached by police for information about a patient, doctors need to consider their privacy obligations and determine whether they are obliged or permitted to disclose the information without the patient’s consent. Disclosing information without a warrant or subpoena may constitute a privacy breach, as this case involving a GP illustrates.

Details of the decision

Breaching patient's privacy to disclose information to police

Police visited Mr Z at home after a neighbourhood complaint. They considered him ‘highly excited and at times paranoid’. He told them he suffered from post-traumatic stress disorder, anxiety disorder and severe pain.

A police officer approached Dr Y, Mr Z’s treating doctor, and asked whether she thought Mr Z was psychotic. Dr Y responded that it was possible but further assessment was required.

Three years later Mr Z obtained documents under a freedom of information request that disclosed this conversation. He made a complaint against Dr Y under the Privacy Act 1988 (Cth).

Dr Y conceded she had disclosed personal information without Mr Z’s permission, but claimed this was permitted on the grounds that:

  • there was an urgent threat to the safety of Mr Z and/or the public as she had been contacted by the police
  • there was a reason to suspect that unlawful activity had occurred since police had contacted the practice twice
  • disclosure was required or authorised by law
  • she reasonably believed disclosure was necessary for the prevention or investigation of a crime

Outcome

The Privacy Commissioner rejected Dr Y’s arguments. There was no evidence that Dr Y had formed the necessary beliefs that would have justified disclosure. She had not asked the police about the nature of their inquiry. There was no warrant, subpoena or legislation requiring disclosure.

The Commissioner accepted Dr Y made the disclosure in good faith, but this was not sufficient justification to breach the patient’s privacy. She needed to have considered the privacy obligations she owed to her patient and whether disclosure was necessary before disclosing Mr Z’s personal information.

Mr Z had suffered injury to his feelings and distress.

Dr Y was ordered to apologise in writing and pay $6500 compensation.

Key lessons

You are not obligated to provide patient information to the police unless you have the patient’s consent, or the police have a warrant, subpoena or other legal order requiring the information.

If you are contacted by police, you can say that they need to get the patient’s consent or a warrant, or other court order before you provide information.

You may be legally permitted to disclose a patient’s personal information without their consent in some circumstances, including where you reasonably believe:

  • disclosing the information would lessen or prevent a serious threat to the life, health or safety of the patient, another individual, or the public and it is unreasonable or impracticable to obtain consent, or
  • unlawful misconduct or a crime is being or may be committed and disclosure is necessary to take appropriate action.

You will need to ask questions of the police to understand the nature of their enquiry and consider whether you believe disclosure is necessary.

Even in these situations, there may be other factors to consider, such as state or territory privacy legislation or any policies from your organisation. Disclosing information without consent can be complex so seek advice before breaching a patient’s privacy.

If you do decide you need to disclose the information, only disclose information that is necessary to address the serious threat. Check the patient’s records to make sure any information you provide is accurate.

Document any details of your communication with police and the information you disclosed.

References and further reading

Avant factsheet – Privacy: the essentials

Avant factsheet – Providing medical records to a third party

Office of the Australian Information Commissioner - Chapter 3: Using or disclosing health information

More information

For medico-legal advice, please contact us on nca@avant.org.au or call 1800 128 268, 24/7 in emergencies.

Disclaimers

The case discussed in this publication is based on a real case. Certain information has been de-identified to preserve privacy and confidentiality. The information in this article does not constitute legal advice or other professional advice and should not be relied upon as such. It is intended only to provide a summary and general overview on matters of interest and it is not intended to be comprehensive. You should seek legal or other professional advice before acting or relying on any of its content. 

Our CPD courses for Avant members

Tick off some CPD hours and learn more with our in-depth eLearning courses, free for Avant members. Our courses include education activities, reviewing performance and measuring outcomes. 

Learn now

Need support?

Dealing with a medico-legal issue can be stressful. Find out how Avant and other organisations can help.

To Top