When the police come calling

You’re in the middle of a busy day at the practice when a police officer contacts you. She says she was called to the home of one of your patients and he was “talking incoherently and behaving strangely”. She asks if he has any mental health issues. What do you do?

It is generally not appropriate to breach patient confidentiality, unless you have the patient’s authority or the police produce a court order, e.g., a search warrant or notice to produce.

The police may be able to provide a signed authority, which should be less than six months old. If you still see the patient, you could inform them directly about the request and obtain authority which you can note in your records.

You should record any disclosure in the patient records, including information given by the police and the matters considered when determining whether the information could or should be provided to them. If the request is not urgent, you can ask the police to put it in writing so that you can consider and obtain advice if necessary.

In some circumstances, it may be appropriate to release information to the police where the disclosure is permitted under 6.32 of the Australian Privacy Principles – where it’s stated that you can use or disclose personal information if a “permitted general situation” exists in relation to the use or disclosure. 

Keep in mind that it’s easy to fall foul of the law, and consult MDA National before relying on any of the exceptions – as demonstrated in the decision below in ‘EZ’ and ‘EY’ [2015], a privacy complaint made by a patient against his general practitioner.

Case history

In 2006, Queensland police officers visited Mr Z to investigate his allegations of a neighbour’s harassment and property damage. They noted that he explained his concerns in a “highly excited and at times paranoid fashion”. He told police he suffered from post-traumatic stress disorder, anxiety disorder, and severe back and knee pain.

The police called Mr Z’s treating doctor, Dr Y, but she was unavailable. They spoke to another doctor, who noted the police were concerned that Mr Z was acting strangely. The sergeant spoke to Dr Y a few days later and asked whether she thought Mr Z was psychotic. She advised it was possible, but further assessment was needed.

Mr Z lodged a complaint under the Privacy Act, alleging Dr Y had interfered with his privacy by:

• improperly disclosing personal information contained in his medical records to police (alleged breach of NPP 2.1)*
• disclosing inaccurate personal information about him to police (alleged breach of NPP 3.1)*
• failing to have adequate security safeguards to protect his personal information from improper disclosure (alleged breach of NPP 4.1).*

Dr Y argued that she had made the disclosure in good faith. As the police officer had spoken of a neighbourhood dispute, she felt there was a concern for public safety. She also claimed that because “the police were concerned enough to telephone to ask if Mr Z was psychotic, this suggested it was an urgent matter of public and Mr Z’s safety, and so a response was appropriate and justified”. 

The outcome

The Privacy Commissioner considered the position under the National Privacy Principles* and rejected these arguments.

Given Dr Y’s regular involvement (having treated Mr Z for two years prior to the event) and lack of more detailed questioning of the police about the reasons for the request, he was not satisfied Dr Y could have formed a reasonable belief that Mr Z at the time posed a serious and imminent threat to himself or to public safety, or that he was involved in any unlawful activity. 

Dr Y had not asked the police about the nature of their enquiry or if they suspected him of a serious unlawful activity. There was no court order or direction compelling or authorising the disclosure of the private information to the police.

The Privacy Commissioner concluded that Dr Y had given insufficient consideration to her obligations under the various policies, and the need for rigour in considering when it was permitted to disclose personal health information as articulated in various policies, guidelines and legal requirements.

While Dr Y had made the disclosure “in good faith”, this was not sufficient cause to justify disclosure of private information.

The Privacy Commissioner found that Mr Z suffered injury to his feelings and distress due to the interference with his privacy by Dr Y. He determined that Mr Z’s complaint was proven, and Dr Y had breached the NPPs 2.1 and 4.1 by disclosing his personal information to police.

Dr Y was ordered to apologise to Mr Z in writing and pay him $6,500 in compensation.

Footnote

* The Australian Privacy Principles replaced the National Privacy Principles in March 2014.