The Sydney Children's Hospital Network v FZP

2026/00124389

ADMIN LAW (other) – the applicant seeks leave to appeal from orders setting aside the finding that the disclosure of FZP's health information was reasonably necessary in accordance with the Health Records and Information Privacy Act 2002 (NSW). FZP complained that Sydney Children's Hospitals unlawfully disclosed health information to the Murdoch Children's Research Institute for a large genomics research project. A Senior Member of NCAT found a breach of the security principle (HPP 5) but held there was no "use" of the information for the purposes of s 10(1)(f) and that any disclosure was permitted by the research exemption in s 11 (1)(f). The NCAT Appeal Panel held that the Tribunal erred in law in its construction and application of both ss 10(1)(f) and 11 (1)(f). The Panel held that the Tribunal had adopted an unduly narrow conception of "use" in s 10(1)(f) by treating the respondent's conduct as involving disclosure only, notwithstanding that conduct facilitating research may constitute a "use" of health information separate from disclosure. The Panel also held that the Tribunal had erred in concluding that the research exemption was satisfied in s 11 (1)(f), without correctly addressing whether the statutory preconditions to that exemption were met. Accordingly, the Appeal Panel set aside the relevant findings and remitted those issues for reconsideration. The Panel rejected the procedural fairness ground of appeal and left undisturbed the remaining findings and orders, including the finding of a breach of HPP 5 and the award of damages. On appeal to this Court, the application for leave only challenges the construction of the research exemption in ss 10(1)(f) and 11(1)(f).

FZP v Sydney Children’s Hospitals Network [2026] NSWCATAP 55