Suppose a local health district (LHD) has used a patient's electronic medical record (eMR) for training purposes. Upon learning that they have done this, the patient is displeased and tells them so. The LHD responds, "we had implied consent", and the patient begrudgingly accepts.

However, let us now suppose that the patient realises, "hey, express refusals always override claims of implied consent." So he prepares an express refusal to consent to the use of his health records for training purposes and delivers it to the LHD.

The express refusal notice is lawful. However, let us suppose that the patient learns that the LHD has continued to use his medical records for training purposes, meaning they have failed to honour the patient's stated wishes.

Now, to avoid ambiguity about what has happened:

  1. The express refusal notice is accepted as valid and lawful by the LHD
  2. The reason why the LHD is unable to stop using the is due to technical limitations of the eMR system
  3. This is the first time any patient has ever withdrawn consent -- it has to do with a particular type of training use that the patient knows is occurring but the public at large is unaware of it.
  4. The LHD could have cancelled training if they wanted to. Or bused people to another LHD for training. Or designed a system that did not have this limitation. Or designed a system that did not require the use of patient records.

Am I correct in arguing that the LHD never really had implied consent to begin with? In other words, does the failure to honour the express refusal inform us about the legitimacy of prior claims of implied consent?

I believe that it does. This is my argumentation:

The LHD never had implied consent, because it never had any intention of honouring any expression of autonomy that was orthogonal to its own self-interest. In effect, when the LHD started using the patient's health records for eMR training, it did so hoping that nobody would ever work out that they could exercise their autonomy and refuse to consent to such uses.

The inability of the LHD to honour the express refusal invalidates any claim that it ever had implied consent to begin with. What it has done is no different to someone taking a book from my bookshelf without asking, then claiming it was borrowed and not stolen, but then failing to return it when I ask for it back.

The LHD never had implied consent to use the patient's health records for eMR training, nor did it ever have implied consent to use the records of any other person for training.


1 Answer 1


Am I correct in arguing that the LHD never really had implied consent to begin with? In other words, does the failure to honour the express refusal inform us about the legitimacy of prior claims of implied consent?


They had implied consent and had not intent at the outset to dishonor it. They have violated the patient's privacy right when consent was expressly withdrawn, and they discovered that they cannot easily comply and therefore did not comply.

The fact that they have made it expensive for themselves to comply with their legal obligations going forward does not imply that they lacked implied consent at the outset, so they should have no liability for the time period from when the training materials started to be used until the time when implied consent ended. They are only responsible going forward for their failure to honor the patient's wishes.

It is not at all exceptional for a legal obligation to turn out to be more difficult to comply with when it arises than was anticipated when the systems that make the legal obligation difficult to comply with were implemented.

Health care companies aren't expected to be prophets who can foresee the complex confluence of factors that has painted them in a corner, particularly when a situation has never come up before the current one. It is likely that no one person was ever even simultaneously aware of all the facts necessary to know that this could happen. Someone in the IT department will often not be intimately familiar with what is going on in the training part of the operation and what the privacy rules that apply are and even if someone was, that someone may have been in no position to do anything about it at the time.

Health care providers aren't supposed to be evaluated with 20-20 hindsight. Given that they almost surely did not and could not easily have known that they had made a future express withdrawal of consent very difficult to effectuate, scienter can't be attributed to it. And, honestly, they are in more than enough trouble simply trying to deal with the problem post-express withdrawal of consent when they did start to violate privacy laws.

  • TY for the detailed answer. would any of the following make a difference? 1) They initially thought the patient had no right to opt out -- until the patient went though the legislation w/ them step by step 2) They deliberately ignored repeated attempts by the patient to confirm that they were not using records anymore 3) They tried to deceive the patient into re-consenting 4) "Very difficult to effectuate" is not correct. Quite literally, it is impossible. I think it is akin to me saying that someone is free to leave my home anytime they want, but having built no doors through which to exit.
    – faustus
    Mar 24, 2018 at 2:58
  • 2
    @faustus I don't think that (1), (2) or (3) change the result. And, as to (4), your question sets forth more than one way this could be accomplished.
    – ohwilleke
    Mar 24, 2018 at 5:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .