privacy australia medical health consent
Does the failure to honour an express refusal invalidate prior claims of having implied consent?
<p>Suppose a local health district (LHD) has used a patient's electronic medical record (eMR) for training purposes. Upon learning that they have done this, the patient is displeased and tells them so. The LHD responds, "we had implied consent", and the patient begrudgingly accepts. </p>

<p>However, let us now suppose that the patient realises, "hey, express refusals always override claims of implied consent." So he prepares an express refusal to consent to the use of his health records for training purposes and delivers it to the LHD. </p>

<p>The express refusal notice is lawful. However, let us suppose that the patient learns that the LHD has continued to use his medical records for training purposes, meaning they have failed to honour the patient's stated wishes. </p>

<p>Now, to avoid ambiguity about what has happened:</p>

<ol>
<li>The express refusal notice is accepted as valid and lawful by the LHD</li>
<li>The reason why the LHD is unable to stop using the is due to technical limitations of the eMR system</li>
<li>This is the first time any patient has ever withdrawn consent -- it has to do with a particular type of training use that the patient knows is occurring but the public at large is unaware of it. </li>
<li>The LHD could have cancelled training if they wanted to. Or bused people to another LHD for training. Or designed a system that did not have this limitation. Or designed a system that did not require the use of patient records.</li>
</ol>

<p><strong>Am I correct in arguing that the LHD never really had implied consent to begin with?</strong> In other words, does the failure to honour the express refusal inform us about the legitimacy of prior claims of implied consent?</p>

<p>I believe that it does. This is my argumentation:</p>

<blockquote>
  <p>The LHD never had implied consent, because it never had any
  intention of honouring any expression of autonomy that was orthogonal
  to its own self-interest. In effect, when the LHD started using the
  patient's health records for eMR training, it did so hoping that
  nobody would ever work out that they could exercise their autonomy and
  refuse to consent to such uses. </p>
  
  <p>The inability of the LHD to honour the express refusal
  invalidates any claim that it ever had implied consent to begin with.
  What it has done is no different to someone taking a book from my
  bookshelf without asking, then claiming it was borrowed and not
  stolen, but then failing to return it when I ask for it back. </p>
  
  <p>The
  LHD never had implied consent to use the patient's health records
  for eMR training, nor did it ever have implied consent to use the
  records of any other person for training.</p>
</blockquote>

<p>Thoughts?</p>

<blockquote>
  <p>Am I correct in arguing that the LHD never really had implied consent
  to begin with? In other words, does the failure to honour the express
  refusal inform us about the legitimacy of prior claims of implied
  consent?</p>
</blockquote>

<p>No. </p>

<p>They had implied consent and had not intent at the outset to dishonor it. They have violated the patient's privacy right when consent was expressly withdrawn, and they discovered that they cannot easily comply and therefore did not comply.</p>

<p>The fact that they have made it expensive for themselves to comply with their legal obligations going forward does not imply that they lacked implied consent at the outset, so they should have no liability for the time period from when the training materials started to be used until the time when implied consent ended. They are only responsible going forward for their failure to honor the patient's wishes.</p>

<p>It is not at all exceptional for a legal obligation to turn out to be more difficult to comply with when it arises than was anticipated when the systems that make the legal obligation difficult to comply with were implemented. </p>

<p>Health care companies aren't expected to be prophets who can foresee the complex confluence of factors that has painted them in a corner, particularly when a situation has never come up before the current one. It is likely that no one person was ever even simultaneously aware of all the facts necessary to know that this could happen. Someone in the IT department will often not be intimately familiar with what is going on in the training part of the operation and what the privacy rules that apply are and even if someone was, that someone may have been in no position to do anything about it at the time.</p>

<p>Health care providers aren't supposed to be evaluated with 20-20 hindsight. Given that they almost surely did not and could not easily have known that they had made a future express withdrawal of consent very difficult to effectuate, scienter can't be attributed to it. And, honestly, they are in more than enough trouble simply trying to deal with the problem post-express withdrawal of consent when they did start to violate privacy laws.</p>
