Security of personal health information questioned

A SOUTHLAND man is questioning how secure personal health information is after an unsuccessful complaint to the Privacy Commissioner.

The case is a tangled affair involving a test for sexuallytransmitted infection and a failed romance — the Otago Daily Times has chosen not to name any of the parties.

It resulted in a finding by the Professional Conduct Committee of the Medical Sciences Council that a laboratory staff member inappropriately accessed the Southland man’s health records.

However, the man’s subsequent complaint to the Priv acy Commissioner has failed, as investigators found the laboratory which employed the staff member had not breached the Privacy Act.

‘‘I accept medical information is inherently sensitive, and I acknowledge it would be reasonable to suffer anger and frustration knowing that your health information was inappropriately accessed,’’ commission investigations and dispute resolution manager Riki JamiesonSmyth wrote to the man.

‘‘However, frustration is not sufficient to meet the threshold in section 66.’’

Section 66 of the Privacy Act sets a threestage test for an interference with privacy: someone’s actions need to have caused or could cause, loss, detriment, damage, or injury; have adversely affected or might adversely affect someone’s rights; or have resulted in, or could result in, significant humiliation.

The man said he knew he could come across as someone aggrieved because a decision had gone against him, but he felt a bigger issue was at stake.

‘‘I know how secure my information is now — it’s not secure at all,’’ he said.

The case started with a brief relationship between the man and a laboratory technician, which started in late 2015.

The woman asked that he take an STI test — he agreed to do so, and it found no issues.

The relationship ended soon after, but in 2017 the man became aware other people knew he had had the test after he was asked about his ‘‘issues’’ at a dinner.

In subsequent months the man has complained to the laboratory, the Southern District Health Board, the Health and Disabilities Commission, the Medical Sciences Council and the Privacy Commission, on the grounds his ex had inappropriately accessed his records.

The man also believes some of her colleagues accessed his records, and the evidence he had gathered showed a culture of staff browsing information.

‘‘The Privacy Commission did not even speak to two of the three people who I can prove breached my privacy — there is no interest from their perspective to investigate this matter.’’

The laboratory agreed with the man that his ex had inappropriately accessed his records, but said as she had subsequently left its employment that it could take no further action.

A subsequent internal review demonstrated its staff were

personal mindful of confidentiality and privacy obligations, the lab said.

The conduct committee recommended the woman complete a health privacy course before being eligible to receive an annual practising certificate, and required her to disclose the case of unauthorised access to any future employers where she was required to be a registered health practitioner.

The man has the option of appealing to the Human Rights Review Tribunal, but said his legal advice was the process could take years and might prove unaffordable.

‘‘I don’t know why some of these people looked at my medical records and I will never know.’’