The SMH reports that the St Vincent's Hospital group has "banned unauthorised photography on its campuses in a bid to protect the privacy of its patients". A spokeswoman for NSW Health is reported as stating that there are no plans to ban photography in public hospitals.
At St Vincent's
Patients and their visitors will now have to seek permission from staff members before taking photographs in all wards except for the maternity ward at the Mater Hospital on the north shore ....
The policy follows several episodes where patient privacy has been compromised, including two occasions in which the victims of high-profile assaults were filmed – once by a member of the public – and broadcast on television.
In a separate incident, a psychiatric patient published information about other patients and staff on social media.St Vincent's has indicated that
"We don't want to turn into some draconian campus." "We understand and appreciate that from time to time people really do want to take photographs for all the right reasons and so we just want to have that happen in a controlled environment."It will accordingly post signs on windows near high-traffic areas warning visitors not to take photographs without authorisation, contingent for example on a nurse drawing a curtain between beds.
The SMH notes that
Psychiatric wards have long been concerned about information posted to the internet by disinhibited or delusional patients.
Psychiatrist Sarah Michael said the scenario arose every few months that patients used the internet to broadcast information about themselves or others without considering the implications. "The 'no photographs' is a good first step, but it still doesn't cover things like what if they tweet things that are inappropriate or put something on Facebook," Dr Michael said. "Once you've put something up there, it's up there."
Hospitals expose themselves to litigation under the NSW Privacy Act should they fail to protect patient privacy. The paparazzi photograph of Mick Jagger's girlfriend Marianne Faithfull lying comatose in St Vincent's Hospital, published in Sydney's Daily Mirror during the 1969 Rolling Stones tour, is the nightmare scenario.Legal historians might recall Kaye v Robertson [1991] FSR 62.
Meanwhile in Canada we await the results of litigation following Hopkins v. Kay 2015 ONCA 112, in which the Ontario Court of Appeal has held that Hopkins as representative in a class action against data breach involving Peterborough Regional Heath Centre - is able to bring a common law claim for intrusion upon seclusion.
Such a claim was recognised in Jones v. Tsige 2012 ONCA 32, discussed here and in an article in Privacy Law Bulletin.
Peterborough argued that a claim was precluded by the Ontario Personal Health Information Protection Act, with health privacy violations being solely the domain of the province's Information & Privacy Commissioner.
In this instance the Court dismissed Peterborough’s appeal, meaning that patients will be able to sue hospitals and other health information custodian. A health privacy breach will accordingly be addressable in both a civil court case and as the subject of investigation by the privacy commissioner. Peterborough bears the C$24,000 costs of the appeal.
It is alleged that the medical records of 280 patients, including Erkenraadje Wensvoort (representative in class action against Peterborough), were wrongfully accessed between 2011 and 2012. Wensvoort alleges she left an abusive relationship after 51 years of marriage (including hospitalisation at Peterborough) and went into hiding with an unlisted phone number and address. On admission to Peterborough her identity was supposed to be safeguarded, with information only being provided to the staff treating her.
She claims that she suffered psychiatric harm when the hospital revealed that her medical records had been improperly accessed; she worried that her husband had paid a hospital employee in an attempt to find her. (That fear is consistent with coverage of separate litigation by 14,450 patients of the Rouge Valley Health System following allegations that employees sold patient records).
Health sector in peril? Under PHIPA there is a requirement for evidence of 'actual harm', with damages for mental anguish limited to C$10,000. (Compare the quantum with the recent Hammond award in New Zealand.) Damages under common law in Ontario without proof of actual harm, following Jones, are not spectacular. Further, the Court noted that the test from Jones is difficult to satisfy. Under s. 72(5) of the PHIPA the province's Attorney General may commence a prosecution regarding wilful contravention of the Act, punishable by a C$50,000 fine re individuals and C$250,000 for institutions.
In the current judgment the Court emphasised that PHIPA centres on systemic issues that should be addressed through systemic improvements. It noted
the broad discretion conferred on the Commissioner by PHIPA means that complainants would face an expensive and uphill fight on any judicial review challenging a decision not to review or proceed with an individual complaint.The Ontario Information & Privacy Commissioner supported the position of the respondent, with the Court clearly noting comments by the Commissioner.
