banner generic


Case Study

Disclosure of Personal Information by a Medical Practitioner to the Police

This case study reviews a complaint made by a patient of a medical practitioner that the practitioner interfered with the patient’s privacy when the practitioner disclosed personal information about the patient to the police.


Mr Z contacted the police to report harassment and property damage as part of an ongoing neighbourhood dispute. A police officer attended Mr Z’s home to investigate his claims and found him to be behaving in a “highly excited and paranoid fashion”. Mr Z admitted to suffering from post-traumatic stress disorder, anxiety disorder and severe back and knee pain.

The officer then attempted to contact Mr Z’s treating doctor, Dr Y, who worked at a medical centre. The officer could not reach Dr Y and was transferred to another doctor at the centre, who noted in Mr Z’s patient records that the officer was concerned that Mr Z was “psychotic and acting strangely”.

Several days later, the officer contacted Dr Y and asked for her opinion as to whether Mr Z was “psychotic”. Dr Y advised: “it was possible but further assessment was needed”. Mr Z became aware of the discussions between the officer and Dr Y through a FOI request.

Claims and defence

In 2011, Mr Z filed a complaint with the Privacy Commissioner in relation to Dr Y’s conduct, seeking an apology and compensation. Mr Z argued that Dr Y had interfered with his privacy by:

  • improperly disclosing his personal information, contained in his medical records, to the sergeant;
  • disclosing inaccurate personal information about him to the sergeant; and
  • failing to have adequate security safeguards to protect his personal information from improper disclosure.

Dr Y argued she had acted in good faith, on the assumption that the officer had the authority to request such information, which formed the basis of a reasonable belief that Mr Z posed a serious and imminent threat to himself or to the public.


The Commissioner held that Dr Y could not have reasonably formed such a belief, given that Mr Z’s medical records contained no indication that following the second phone call from the officer that Dr Y was concerned Mr Z posed a serious or imminent threat to himself or to the public, especially as the second phone call was made several days after the first phone call.

Dr Y admitted in her submissions that she had been unable to recall or suggest any specific threat that Mr Z posed to himself or to the public and did not make any enquiries of the officer (consistent with requirements of the Health Sector Guidelines) as to the nature of the circumstances that had led the officer to contact Dr Y.

Therefore, the Commissioner held that Dr Y’s disclosure was not required by or authorised under law. Dr Y was held to have improperly disclosed Mr Z’s personal information and to have failed to take reasonable steps to protect Mr Z’s personal information. Dr Y did not disclose inaccurate personal information, even though Mr Z did not have a history of psychosis. The Commissioner ordered Dr Y to issue an apology and pay $6,500 compensation to Mr Z.

Key takeaways

Health service providers and medical practitioners should ensure that they are informed about their obligations regarding disclosure of personal information to law enforcement. In particular, providers and practitioners should carefully consider whether there is a serious and imminent threat to an individual’s life, health or safety or to the public.

Providers and practitioners should carefully consider whether disclosures of any personal information is lawful.