Medical centres in privacy breach

A Wellington man has been sent the medical details of four other patients after asking to see his mother’s records.

John Nelson discovered the four patients’ notes mixed in with his late mother’s file when he collected it from Miramar’s Peninsula Medical Centre last week.

He said he saw an unexpected word on one document. ‘‘I ... then realised it wasn’t my mother’s name on the paper.’’

The notes had been transferred from Miramar Medical Centre, where his mother used to be a patient, to Peninsula Medical Centre, he said.

Both centres have since been in discussions with the Office of the Privacy Commissioner over the incident.

Nelson urged the two centres to apologise to the people whose notes were sent to him.

‘‘They need to seriously review their administration systems. Records shouldn’t be sent out until they’re properly checked.’’

He was also concerned

"As soon as you get someone else's health information, it does not give you a licence to peruse it." Human rights lawyer Michael Bott

his mother’s notes might be included in someone else’s records. ‘‘If this stuff-up could occur, the mind boggles over what else can happen.

‘‘I’m a patient there [Peninsula], and I’m concerned.’’

Neither medical centre would answer questions as to how the breach happened, or whether they would be contacting the patients whose records had been sent out.

Lawyer Sean O’Sullivan, representing both centres, said his clients would not comment.

‘‘Suffice to say there have been discussions with the Office of the Privacy Commissioner and all appropriate steps are now being taken.’’

Human rights lawyer Michael Bott said sending the files of other patients to Nelson was technically a breach of privacy, but an inadvertent one. Before information was released from either medical centre, someone should have read it, to make sure it concerned only Nelson’s mother, he said.

The centres should inform the people whose privacy had been breached, and look at how it happened to avoid it happening again. ‘‘There will be occasions when these sorts of things happen. It’s what you do to minimise harm when it does happen ... it’s the putting it right that counts.’’

It was also important that anyone who received such records should return them as soon as they realised there had been an error, he said.

‘‘As soon as you get someone else’s health information, it does not give you a licence to peruse it ... you should just stop and return it and say ‘this is a mistake’.’’

‘‘This gives the agency the information they need to investigate and address a potential data breach.’’