A patient, Mr Q, made a request to a health organisation for the personal health information they held about him. Four days later, the organisation made two documents available to him. Mr Q then contacted the organisation again, advising that the information did not match his expectations of what he would receive, and he reiterated his request.
Just under a month later, Mr Q contacted the organisation again, complaining that he had still not received all the information he had requested. He was advised during this call that the organisation had more information regarding his healthcare, but they were withholding this information from him.
Mr Q again requested all the information regarding his healthcare including, but not limited to, copies of emails between the organisation and ACC, and alerted the organisation to the fact that he had also requested from ACC a summary of the voice conversations with ACC relating to his claim. Mr Q further requested that the organisation provide him with all his information, including documents that related to his injury claim.
Two days later the organisation wrote to Mr Q advising that:
1. It was not their practice to collect information on every voice conversation that may occur in the course of delivering a clinical service, particularly where collection of that information did not add further to the record of health status, or document the care or treatment provided.
2. They did not have provision for an ‘IT sweep’ but would ask staff to search their email systems for any held emails related to the service provided, which had not already been uploaded into the clinical record.
3. They would provide him with a copy of all information collected in the course of the management of his referral to the organisation, with the exception of the neuropsychology test materials used and a copy of the raw data. It was explained that these were not health or personal information and that the test material was protected by copyright. It was pointed out that:
“…psychologists are required to protect the physical security and integrity of assessment instruments and ensure that they are not used inappropriately. Maintaining test security is critical because if the tests were known beyond those performing neuropsychology, the results would be severely diminished, and result in inappropriate usage of the same.”
Three months later, Mr Q complained to the Office of the Privacy Commissioner and asked them to review the organisation’s response to his request.
Medical Protection assisted with the organisation’s response to the Office of the Privacy Commissioner. The organisation explained that they had given the patient all the information that they held, with the exception of the raw test data and test materials, which had been withheld as:
“…raw data can undermine the integrity and security of neuropsychological testing instruments, and raw test data are vulnerable to misinterpretation. In particular, the practice of neuropsychological assessment assumes the client is naïve to the test material, and has not had the opportunity to learn or be schooled in the required responses. Without this, neuropsychological data are likely to be invalid as an accurate representation of the client’s actual ability and the practice of neuropsychological [testing] is of limited clinical utility. To this end, most tests used, and their scoring and interpretation manuals, can only be purchased by appropriately qualified psychologists, and are copyrighted. Most tests are published after extensive peer-reviewed assessment to establish appropriate norms, and cannot be quickly replaced if the material becomes widely distributed.”
The organisation argued that they had the right to withhold this information under section 28 of the Privacy Act 1993 – Trade Secrets. They referenced a prior decision of the Privacy Commissioner, which had elucidated the following principles from judicial decisions:
• Matters of public knowledge or of general knowledge in an industry cannot be considered to be true trade secrets.
• The element of secrecy derives from the information only being known in the particular business in which it is used. However, mere assertion that something is a trade secret does not automatically make it so.
• Whether information is or is not a trade secret has to be determined objectively on the facts and circumstances of each case.
They surmised that it was their understanding that section 28 of the Privacy Act related to the ability of professions and commercial businesses to protect trade secrets. The way in which neuropsychologists used the tests that were the subject of this request, and their ethical obligations in preserving the security of this testing, would in their view mean that the use of the tests fall within the definition of trade secrets. They also noted that in the past, the Commissioner had withheld information such as examination scripts on the basis that the questions themselves were not information about the candidate. Similarly, they did not believe that the requested information fell within the definition of personal information.
Outcome
The Office of the Privacy Commissioner formed the preliminary view that the evaluative material (raw test data and test materials) could be considered and withheld under section 28 (trade secrets), but advised that they wanted to confirm the steps the organisation had taken to locate the correspondence relating to the patient.
The Office of the Privacy Commissioner later came back to the organisation and advised that while they were satisfied that the organisation had taken appropriate steps to locate the other requested information, in order to withhold the test information it would be necessary for the organisation to prove that release of that information would likely prejudice its commercial position. They acknowledged that they were aware that the test answers were recorded within questions and therefore the copyrighted information would be hard to redact. In light of the organisation’s concern that this information would be used or could be disseminated without their knowledge and/or interpreted incorrectly, the suggestion was made that Mr Q could view the information at the organisation, rather than receiving a copy of the information.
Mr Q did not take up this opportunity, instead being more concerned about the correspondence with ACC.
Learning points
- What is “health information” is broader than just the clinical notes. This complaint demonstrates the extent to which some patients will go to request their health information; particularly in cases where a third party has made a disadvantageous decision concerning them.
- Access to health information is seen as a fundamental right under the Health Information Privacy Code. Health agencies must provide access to requested information unless they have a reason for withholding that information under the Privacy Act. You should contact Medical Protection for advice, if you are considering withholding information.
- Many psychologists feel they have ethical and professional obligations not to disclose test materials. While these obligations do not appear to outweigh patients’ rights to access their health information, the Privacy Commissioner is prepared to place constraints on how patients access their information in order to protect, to some extent, the integrity of the assessment instruments.