GP breached patient privacy by disclosing information to police without a warrant

When approached by police for information about a patient, doctors need to consider their privacy obligations and determine whether they are obliged or permitted to disclose the information without the patient’s consent. Disclosing information without a warrant or subpoena may constitute a privacy breach, as this case involving a GP illustrates.

Breaching patient's privacy to disclose information to police

Police visited Mr Z at home after a neighbourhood complaint. They considered him ‘highly excited and at times paranoid’. He told them he suffered from post-traumatic stress disorder, anxiety disorder and severe pain.

A police officer approached Dr Y, Mr Z’s treating doctor, and asked whether she thought Mr Z was psychotic. Dr Y responded that it was possible but further assessment was required.

Three years later Mr Z obtained documents under a freedom of information request that disclosed this conversation. He made a complaint against Dr Y under the Privacy Act 1988 (Cth).

Dr Y conceded she had disclosed personal information without Mr Z’s permission, but claimed this was permitted on the grounds that:

• there was an urgent threat to the safety of Mr Z and/or the public as she had been contacted by the police
• there was a reason to suspect that unlawful activity had occurred since police had contacted the practice twice
• disclosure was required or authorised by law
• she reasonably believed disclosure was necessary for the prevention or investigation of a crime

The Privacy Commissioner rejected Dr Y’s arguments. There was no evidence that Dr Y had formed the necessary beliefs that would have justified disclosure. She had not asked the police about the nature of their inquiry. There was no warrant, subpoena or legislation requiring disclosure.

The Commissioner accepted Dr Y made the disclosure in good faith, but this was not sufficient justification to breach the patient’s privacy. She needed to have considered the privacy obligations she owed to her patient and whether disclosure was necessary before disclosing Mr Z’s personal information.

Mr Z had suffered injury to his feelings and distress.

Dr Y was ordered to apologise in writing and pay $6500 compensation.

You are not obligated to provide patient information to the police unless you have the patient’s consent, or the police have a warrant, subpoena or other legal order requiring the information.

If you are contacted by police, you can say that they need to get the patient’s consent or a warrant, or other court order before you provide information.

You may be legally permitted to disclose a patient’s personal information without their consent in some circumstances, including where you reasonably believe:

• disclosing the information would lessen or prevent a serious threat to the life, health or safety of the patient, another individual, or the public and it is unreasonable or impracticable to obtain consent, or
• unlawful misconduct or a crime is being or may be committed and disclosure is necessary to take appropriate action.

You will need to ask questions of the police to understand the nature of their enquiry and consider whether you believe disclosure is necessary.

Even in these situations, there may be other factors to consider, such as state or territory privacy legislation or any policies from your organisation. Disclosing information without consent can be complex so seek advice before breaching a patient’s privacy.

If you do decide you need to disclose the information, only disclose information that is necessary to address the serious threat. Check the patient’s records to make sure any information you provide is accurate.

Document any details of your communication with police and the information you disclosed.

Avant factsheet – Privacy: the essentials

Avant factsheet – Providing medical records to a third party

Office of the Australian Information Commissioner - Chapter 3: Using or disclosing health information

For medico-legal advice, please contact us here, or call 1800 128 268, 24/7 in emergencies.