A Specialist recently contacted MIGA as she had a request from police for a statement detailing medical treatment provided to a patient. The police advised the patient had been charged with a criminal offence, and statements were being sought from all treating healthcare practitioners regarding the patient’s clinical history and mental health status over a period of five years.
The police already had a copy of the patient’s medical records, which had been subpoenaed.
The Specialist contacted MIGA for advice. The key question was whether the police had the appropriate authority to request a statement. Police do not have an automatic right to confidential patient information.
It was recommended that the Specialist specifically check with the police whether the patient had signed an authority consenting to the release of information, or alternatively whether the police were using any legislative powers to compel the Specialist to provide information or whether a warrant had been issued.
The Specialist was also advised there are some situations that would permit a doctor to release information to a third party (including the police) without the patient’s consent.
In this regard, the Privacy Act 1988 (Cth) and the Australian Privacy Principles permit (but not require) disclosure of personal information where there a reasonable belief disclosure is:
— necessary to lessen or prevent a serious threat to an individual’s life, health or safety, or a serious threat to public health or public safety and it is unreasonable or impractical to obtain the consent of the relevant individual (i.e. the patient), or
— reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body – this includes prevention, detection, investigation and prosecution or punishment of criminal offences – a relatively high threshold is required for disclosure under this provision¹, including detailed inquiries of why information is being sought, and a written note of disclosure needs to be made.
In this case, ultimately the police were able to produce a signed consent form from the patient and the Specialist then provided a statement restricted to relevant factual matters about past treatment.
Important points to bear in mind:
- A police officer generally has no more rights than any other third party to obtain information about a patient without consent. Therefore, caution should be exercised at all times before releasing information
- You need to make a careful assessment of the information sought and the reason the information is sought to determine whether it falls within the exceptions of the Australian Privacy Principles or whether you require the patient’s consent
- In considering whether information could be disclosed on the basis of a serious threat, you should explore with police the seriousness of the situation, nature of the threat, and consider risks of disclosure balanced against the implications of non-disclosure, and whether it is reasonable or practical to obtain the patient’s consent
- If refusal to disclose patient information would significantly impede the investigation of a serious criminal offence, disclosure to the police may be justified. The Australian Privacy Principles specifically permit disclosure in these circumstances.
- If you decide to release information to the police without the patient’s specific consent then you should only release sufficient information to respond to the serious threat or
- A note should be included in the patent’s file setting out the request for information and the thought process involved in releasing the information
- If you are in a hospital setting and are contacted by police, you should inform your supervisor and/or the Director of Medical/Clinical Services or medical administration before providing any information.
It is important to proceed with caution where there are privacy concerns. A considered step-by-step approach should be taken. If you are uncertain about a request for information or a statement for the police, or if you would like to learn more about the Australian Privacy Principles, please contact the MIGA Legal Services department.
¹ See EZ and EY  AICmr 23, available at http://www.austlii.edu.au/cgi-bin/viewdoc/au/cases/cth/AICmr/2015/23.html
- OAIC Guide to health privacy – www.oaic.gov.au/privacy/guidance-and-advice/guide-to-health-privacy
- AMA Privacy and Health Record Resource Handbook for Medical Practitioners in the Private Sector