Privacy Issues

If you have a complaint about the treatment you or a friend or family member are receiving from your local mental health and/or addiction services, please refer to our complaints section for information on what to do.

The Privacy Act provides for the development of codes of practice. The Health Information Privacy Code 1994 (the Code) applies to everyone working in the health sector that handles health information. Detailed information on the code and how it can be used is contained in the Mental Health Professionals and Patient Information Guidance Notes for Agencies in the Mental Health Sector prepared for the Mental Health Commission by the Privacy Commissioner.

Every District Health Board (DHB) provider should have a written policy on privacy issues and, if the service is citing privacy issues or the Privacy Act as a reason for refusing to provide or receive information, a request to be provided with a copy of the service's Privacy Policy should be made as a first step to determining whether the service is correct in their application of privacy legislation.

The Ministry of Health has a National Statement and Checklist for all staff in mental health services.

Q. If you are being voluntarily treated by mental health services, will the service provide information to your family about the treatment you are receiving?

Sometimes a service user may not want their family, or specific individuals, to be given information about their illness or treatment, or their presence in hospital. Rule 11 of the Health Information Privacy Code 1994 limits the instances in which health information may be disclosed. If the withholding of the information would not affect the service user's treatment, or if disclosure of the information would adversely affect their treatment, then the service has the right not to disclose the information to the individual(s) concerned.

Furthermore, even if the service user has not vetoed disclosure, if an agency considers disclosure is not in the service user's best interests, perhaps because of family dynamics or because of potential harm to the therapeutic relationship, the family may be advised that a decision not to disclose has been made on clinical grounds. This may apply even when the service user is a child and the person requesting the information is their parent or legal guardian, as parents and/or guardians do not have an automatic right of access to their children's medical records. In the case of the very young there would seldom be reason to withhold the information from a parent or legal guardian, but circumstances, such as suspicion of abuse, may arise that render it necessary.

Q. Can mental health services accept information from your family, whānau or caregiver that may be relevant to your condition or treatment?

There is nothing in the Privacy Act to prohibit family members, whānau, caregivers or members of other agencies providing information to mental health services regarding a family member or person to whom they are providing services.

Furthermore, there is nothing to prevent mental health services accepting that information and/or taking action based on it. The Health Information Privacy Code 1994 applies to the active collection of information; it does not apply to unsolicited information that may be offered. However, the service does have to take reasonable steps to ensure that the information is accurate, current, complete, relevant and not misleading. If appropriate, the service may verify any information offered with the service user.

Q. If you are being compulsorily treated by mental health services under the Mental Health (Compulsory Assessment and Treatment) Act, what are your rights the rights of your family with regard to the sharing of information about your treatment?

There is provision in the Mental Health (Compulsory Assessment and Treatment) Amendment Act 1999 for families to be consulted about the care of family members with mental health concerns (section 7).

Q. If you have vetoed the provision of information to a certain individual or agency, but the service had disclosed the information anyway, is this a violation of your rights?

There are some circumstances where disclosure of information is justified, for example, to pass on necessary information about care of the person to others who should be aware of certain aspects of care, such as medication requirements.

Q. If you have requested access to your personal health records held by the service but the service is being slow, or refusing, to respond what can you do?

Response to such requests must be made as soon as practicable and no later than 20 working days after receipt of the request. People may ask for their requests to be treated with urgency, but should give an explanation of the need for urgency.

Access to records may be granted in a variety of ways, including inspection of or provision of a copy of the documents or a summary of the information, hearing or viewing audio or video tapes, supplying transcripts or a summary of the information. 

The only reasons for refusing a such a request are contained in ss27 to 29 of the Privacy Act and may include:

• Release being likely to prejudice the maintenace of the law
• Disclosure would be likely to endanger the safety of any individual
• Disclosure would involve the unwarranted disclosure of the affairs of another individual or of a deceased person. This requires a balance to be struck between the privacy interests of the requester and the other person/people involved
• Disclosure would be likely to prejudice the physical or mental health of the requester
• The information is not readily retrievable, does not exist or cannot be found.

Q. If you want a correction to your records, but the service is reluctant or is refusing to comply, what should you do?

People have a right to request a correction to their health information and services have a requirement to take the initiative in ensuring that information recorded is correct. If an agency is not willing to change the information it holds, it must, if requested, take reasonable steps to attach a statement of the correction sought. For example, where a patient disagrees with a diagnosis and requests its removal, the service may be reluctant to remove it as it may provide an explanation of a subsequent course of treatment. In this case, the service may wish to attach a statement of correction and, if appropriate, note the later, correct diagnosis at that place in the record.

If correction is made, or a statement of correction is attached to the record, the agency must take reasonable steps to inform everyone who has previously received the information of the changes made. This is covered in rule 7, section 4 of the Health Information Privacy Code 1994.

Q. Are services allowed to release information to the media or in the public interest?

The Health Information Privacy Code 1994 allows a limited release of information to the media, such as information in general terms concerning the presence, identity, location, condition and progress of a person in hospital on the day on which the information is disclosed. However, such disclosure cannot be contrary to the patient's (or their representative's) express request.
There may be a compelling interest in disclosure, perhaps to avert a suicide or to warn that a patient in the community poses a risk (either generally or to a particular person). The Code permits disclosure if a threat is both serious and imminent, although there are a number of issues that should be considered prior to disclosure (there is more information on this in the Commission's publication on patient information).