Psychologist fined $5000 for failing to give patient access to their clinical records

Healthcare providers must generally give patients access to their clinical records within a reasonable time frame, or provide reasons why they cannot. While there are some limited exceptions, a patient’s intentions to complain is not a valid reason to refuse.  

Under the Privacy Act 1988 (Cth), Australian Privacy Principle 12 (APP 12) gives individuals the right to access personal information held about them, unless a specific exception applies.

SF was a patient of SG, who was then practising as a psychologist. SF also held an administrative role at SG’s practice for a period of time.

SF complained to the healthcare regulator about SG’s treatment. SF also requested a copy of their clinical notes but received no response. SF then complained to the Office of the Information Commissioner (OAIC).

The OAIC also attempted to contact the psychologist at least 10 times using different methods. Eventually the psychologist responded. They claimed at various points:

1. They did not intend to provide the records because of ongoing legal proceedings.
2. They did not have the records, suggesting that SF had stolen the file while working at the rooms.
3. The request was frivolous or vexatious because SF already had their records (APP 12.2(c))
4. Providing the records would have an unreasonable impact on the privacy of others (APP 12.3(b)). They claimed that in the context of a regulatory investigation, the records would reveal details about SF’s employment and relationships which would impact the privacy and public standing of others.
5. The information related to legal proceedings and would not be discoverable in those proceedings (APP 12.2(d))
6. Giving access would be likely to prejudice appropriate action relating to unlawful activity or misconduct (APP 12.2(h))

The commissioner found the psychologist’s evidence inconsistent and unpersuasive. They preferred SF’s evidence that they had not taken their own records. The commissioner was satisfied the psychologist was required to give SF access to their personal information and had failed to do so.

The request was therefore not vexatious. The commissioner was not persuaded that any of the exceptions applied. It was unclear how the contents of records would impact any others’ privacy, even if disclosed during the course of a regulatory investigation. Nor was there any reason to believe the records would not be discoverable, or that providing access would prevent action against any misconduct.

Privacy breach

The commissioner found that SG had interfered with SF’s privacy by:

1. failing to provide access to their personal information (APP 12.1) , and
2. failing to provide reasons for refusal and the options to complain about the refusal (APP 12.9).

The commissioner made a declaration that SG must not repeat or continue this interference and must provide SF with access to their clinical records, or complete a statutory declaration setting out why they were unable to provide access including details of when they became aware of the loss and steps taken to locate the records.

Compensation

SF claimed $70,000 compensation for ‘financial abuse’ plus compensation for psychological injury and distress.

The commissioner was not persuaded the privacy breach caused SF to suffer any economic loss. The commissioner did find the privacy breach had contributed to some of the distress SF had suffered, although much of the harm could be attributed to other factors. The commissioner found that SG’s manner had been insulting and unjustified and demonstrated a disregard for SF’s privacy rights, therefore an amount of aggravated damage was appropriate.

The commissioner ordered an amount of $3000 compensation plus $2000 aggravated damages.

Patients have a right to access personal information you or your practice/organisation hold about them. This includes access to their clinical records.

You cannot refuse access simply because you believe a patient may make a complaint against you.

You need to respond to a patient’s request for access within a reasonable time. Usually 30 calendar days is considered reasonable but time periods vary between jurisdictions (See Responding to a request to access medical records for more information.)

It is important to determine who owns the medical records (you, the practice, hospital etc) and who is responsible to action a request.

If you refuse access, you need to give the patient reasons for refusing.

Seek advice if you believe one of the exemptions may apply, for example:

• you reasonably believe that giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety, or
• giving access would have an unreasonable impact on the privacy of other individuals.

Avant collection - Privacy in Practice: what you need to know

Avant factsheet – Privacy: the essentials

Avant eLearning – Medical records: Part 2 – Managment of the record

Office of the Australian Information Commissioner – Guide to health privacy

Office of the Australia Information Commissioner – Chapter 4: Giving access to health information

For medico-legal advice, please contact us here, or call 1800 128 268, 24/7 in emergencies.