‘AZ4’ and Monash Health (Freedom of Information) [2019] VICmr 230 (31 December 2019)

All references to legislation in this document are to the Freedom of Information Act 1982 (Vic) (FOI Act) unless otherwise stated.

Notice of Decision

I have conducted a review under section 49F of the Agency’s fresh decision to refuse access to documents requested by the Applicant under the FOI Act.

My decision on the Applicant’s request differs from the Agency’s original decision in that I have decided to release the document produced by the Agency in accordance with section 19 during the review, also noting the Agency’s agreement to the release of this document to the Applicant.

My reasons for decision follow.

Joanne Kummrow

Public Access Deputy Commissioner

31 December 2019

Reasons for Decision

Background to review

1. The Applicant made a request to the Agency for access to information about who had accessed their medical records, what was accessed and when.
2. In its decision dated [date], the Agency declined to process the Applicant’s request. It advised the Applicant it had attempted to produce the information requested through a computer report, given the information was not available in a discrete form under section 19 of the FOI Act. However, the Agency determined the work involved in collating the information requested represented a substantial and unreasonable diversion of resources under section 25A(1). It also made reference to section 33(1) being a consideration in denying access in full.

Review

3. The Applicant sought review by the Information Commissioner under section 49A(1) of the Agency’s decision to refuse access.
4. The Applicant and the Agency were invited to make a written submission under section 49H(2) in relation to the review.
5. In the course of the review, OVIC staff engaged with the Agency to clarify its decision and determine whether a document could be produced under section 19 which satisfied some, if not all, the Applicant’s request terms.
6. Section 19 provides:

Requests involving use of computers etc.

(1)       Where—

(a)       a request is duly made to an agency;

(b)       it appears from the request that the desire of the applicant is for information that is not available in discrete form in documents of the agency; and

(c)        the agency could produce a written document containing the information in discrete form by—

(i)        the use of a computer or other equipment that is ordinarily available to the agency for retrieving or collating stored information; or

(ii)       the making of a transcript from a sound recording held in the agency— the agency shall deal with the request as if it were a request for access to a written document so produced and containing that information and, for that purpose, this Act applies as if the agency had such a document in its possession.

7. Section 49M(1) permits an agency to make a fresh decision on an FOI request during a review.
8. On [date], the Agency made a fresh decision to again deny access to the document relevant to the Applicant’s request. This was made within the required 28 days under section 49M(2). In its fresh decision the Agency documented its findings of fact as follows:
   1. 1. Monash Health can extract a document which identifies
         1. Whether a medical record accessed
         2. When a medical record was accessed
         3. The employee number of person accessing the medical record
      2. Monash Health cannot produce a document which states the name of the person who accessed the medical
      3. Further, even if the document was able to produce the employee names, the names would be exempt from release under section 33(1). A document is an exempt document if its disclosure under this Act would involve the unreasonable disclosure of information relating to the personal affairs of any person (including a deceased person).
9. The Applicant did not agree with the Agency’s fresh decision and, as required by section 49MA(2),
   I proceeded with my review on the basis of the fresh decision.
10. I have considered all communications and submissions received, including:
11. In undertaking my review, I have had regard to the object of the FOI Act, which is to create a general right of access to information in the possession of the Government or other public bodies, limited only by exceptions and exemptions necessary to protect essential public interests, privacy and business affairs.
12. Following the fresh decision dated [date], OVIC staff consulted with the Agency and expressed the view information, as documented in point 1, was relevant to the terms of the Applicant’s request. As this information could be produced in a discreet document by use of a computer in accordance with section 19, OVIC advised the Agency this document should be produced and released to the Applicant.
13. On [date], the Agency provided OVIC with the result of its preliminary attempts to create a document, being audit reports, relating to the accessing of the Applicant’s medical record. The Agency further submitted details captured regarding who accessed the Applicant’s record in the form of a numerical User ID (being an Agency officer’s employee identification number) constituted personal affairs information under section 33 of the FOI Act and was exempt.
14. On [date], OVIC staff sought further clarification from the Agency regarding the document and asked whether the User IDs could be converted to Agency staff names easily. In response, the Agency submitted this would involve a manual conversion which was outside the scope of producing a document in accordance with section 19.
15. On [date], the Agency was provided with a preliminary view that release of User IDs in the document would not be unreasonable and, therefore, this information would not be exempt under section 33(1).
16. On [date], the Agency provided its consent for the document generated in accordance with section 19 to be released in full to the Applicant including the User IDs.
17. I accept the Agency’s submission that it cannot generate a document in accordance with section 19 that includes the Agency officer names, as requested by the Applicant in their request. Rather, the documents able to be created by the Agency captures User IDs only and the Agency is not required to undertake the manual reconciliation of User IDs to Agency officer names under the FOI Act.
18. On [date] and [date], the Agency provided OVIC with a copy of the document produced in accordance with section 19. It is 125 pages long in .PDF format and comprises tabulated information under the following columns:
    1. Date/Time;
    2. User ID (being the Agency officer’s identification number);
    3. UNRO (being the unit record number which is assigned to a patient on registration); and
    4. Key/Value (which details what was access in the medical record).

Conclusion

19. On the information before me, I am satisfied the Agency can produce a document in accordance with section 19 that contains information relevant to the Applicant’s request terms.
20. While I am of the view the User IDs in the document constitute personal affairs information of third parties, I am not satisfied disclosure of this information would be unreasonable in the circumstances for the purposes of section 33(1).
21. In the circumstances, I have decided to release the document produced by the Agency in accordance with section 19 during the review, also noting the Agency’s agreement to the release of this document in full to the Applicant.
22. As the Agency consents to release of the document, it is not necessary for me to consider the exemption under section 33(1) any further and the document is to be released in full to the Applicant.

Review rights

23. If either party to this review is not satisfied with my decision, they are entitled to apply to the Victorian Civil and Administrative Tribunal (VCAT) for it to be reviewed.^[1]
24. The Applicant may apply to VCAT for a review up to 60 days from the date they are given this Notice of Decision.^[2]
25. While not likely to be relevant in this case, the Agency has a right to apply to VCAT for a review up to 14 days from the date it is given this Notice of Decision.^[3]
26. Information about how to apply to VCAT is available online at www.vcat.vic.gov.au. Alternatively, VCAT may be contacted by email at admin@vcat.vic.gov.au or by telephone on 1300 018 228.
27. The Agency is required to notify the Information Commissioner in writing as soon as practicable if either party applies to VCAT for a review of my decision.^[4]
28. Finally, given the Agency’s consent to disclosure of the document, I do not consider it is practicable or necessary to notify third parties in accordance with section 49P(5).

When this decision takes effect

29. My decision does not take effect until the relevant review period (stated above) expires. If a review application is made to VCAT, my decision will be subject to any VCAT determination.

Annexure 1 – Schedule of Documents

Endnotes

[1] The Applicant in section 50(1)(b) and the Agency in section 50(3D).

[2] Section 52(5).

[3] Section 52(9).

[4] Sections 50(3F) and (3FA).