Requests for patient information can be made for a variety of reasons, but you don’t automatically have to open the files.
Providing patient information to police can be fraught with pitfalls – especially if the request is not made with a clear-cut search warrant, a court order or the patient’s written permission.
Anthony Mennillo, MIGA’s Head of Claims and Legal Services, said the issue was a common reason for members to contact the MDO.
“It’s understandable that it causes a lot of stress, especially when the police come into a practice asking for access to information or records,” he said.
“Most doctors are well prepared – and that is the key – but they still misunderstand their obligations from time to time.
“The reality is that the police are no more entitled to information about a patient than anyone else, with a few exceptions.”
Mr Mennillo said the very first action a practitioner should take when approached by a police officer was to check their credentials. If the contact is made over the telephone, it is reasonable to request an email to verify the credentials of the police officer making the request, which should be added to the patient’s records.
“I would be very circumspect about how much information is released over the telephone without first establishing the police officer’s identity and credentials,” he said.
“When engaging with police, they should be able to provide a case number which is attached to the case in question, and this should be recorded.”
The first question that should be asked by doctors is whether the patient has consented in writing to the release of information. If the patient has not provided consent, information should only be released if the police can produce a warrant, subpoena or court order.
“It is good practice to request and retain a copy of the patient consent, warrant, subpoena or court order ,” said Mr Mennillo.
“The document should be carefully read and only the information specified should be produced.”
The information provided should be in line with the request. For example, some warrants or subpoenas may specify records for a particular time period. Records should not be provided outside this period as this could be deemed a breach of confidentiality.
“It’s important to stick to the scope of the search warrant or subpoena and provide nothing else outside that,” said Mr Mennillo.
He said there were rare situations where police could justify requesting information in the absence of consent, a warrant, a subpoena or a court order. These include where there is a serious threat to the life, health or safety of an individual or to public health or safety; and where they have a good reason to suspect unlawful activity or serious misconduct.
“While it is important to be cooperative, it is equally important to stay within the scope of the request for information,” he said.
“If a decision is made to disclose information, only information that is directly relevant to the issue of concern should be released. I would also exercise caution about offering opinions or observations outside what is actually documented about that patient.”
An example of where things did go wrong was detailed in a 2015 determination by the Australian Privacy Commissioner Timothy Pilgrim, in which a doctor was ordered to apologise to a patient in writing and pay him $6500 in compensation for breaching his privacy.
It related to a 2006 matter arising from a visit Queensland police officers made to the general practitioner (referred to as Dr Y) by a man known as Mr Z.
The police officers were investigating Mr Z’s allegations of a neighbour’s harassment and property damage. According to the determination, the police noted that Mr Z spoke in a “highly excited and at times paranoid fashion”. He told police he suffered from post-traumatic stress disorder, anxiety disorder, and severe back and knee pain.
The police later called Mr Z’s treating doctor, Dr Y, but she was unavailable, so they spoke to another doctor who made a note about the call in the patient’s notes, Mr Pilgrim wrote in his determination.
“Several days later, Sergeant X called Dr Y,” he wrote. “It appears from the documents provided by QPS [Queensland Police Service] and Dr Y that Sergeant X asked her whether, in her opinion, Mr Z ‘was psychotic’.
“Dr Y advised Sergeant X that ‘it was possible but further assessment was needed’.”
Five years after the initial contact, Mr Z lodged a complaint under the Privacy Act, alleging Dr Y had interfered with his privacy by improperly disclosing personal information contained in his medical records to police; disclosing inaccurate personal information about him to police; and failing to have adequate security safeguards to protect his personal information from improper disclosure.
Mr Mennillo said practitioners who were not sure about what to disclose or how to disclose it should reach out to their MDO for advice.
“Any communications with police should also be documented in the patient’s records,” he said.
“It’s important not to rush the response, especially if the police are also asking for a statement in addition to the records. Getting legal advice can help avoid any issues arising with the statement down the track.
All practices should have a policy about the handling of police requests for patient information, and this should be regularly updated and communicated with staff. Administration staff – especially those who are the first port of call for visitors to the practice – should be informed about the policy and have easy access to it for reference.
“It is naturally stressful when police officers come asking for access to patient information and it is easy to feel intimidated,” said Mr Mennillo.
“But it’s important to stay calm and remember that they don’t have to provide confidential information to police without patient consent, a warrant, subpoena or court order.
“If there are extenuating circumstances and you are not sure, I would suggest getting advice before releasing anything.”
