Patient details: fresh privacy probe launched

WELLINGTON: The Privacy Commissioner has launched an inquiry into how the Ministry of Health distributes Covid19 patient information.

It comes after an investigation into the leak of active patient details to media last month found room for improvements in the ministry’s policies.

The findings of the inquiry by the State Services Commission, led by Michael Heron QC, were passed to the Privacy Commission for review.

Privacy Commissioner John Edwards yesterday announced he would look into how private information was distributed.

He would not inquire further into the disclosure of information by former party president Michelle Boag or the Auckland Rescue Helicopter Trust (ARHT) unless he was approached by someone whose details were included in the leak.

Ms Boag accessed the data through her role as acting chief executive of the ARHT and sent the information to National MPs Hamish Walker and Michael Woodhouse.

Mr Walker then leaked the spreadsheet to media outlets in response to being accused of racism.

Mr Edwards said the terms of his investigation were to inquire whether:

The Ministry of Health’s disclosure of Covid19 patient information to emergency services was compliant with the information privacy principles and rules of the Health Information Privacy Code and that infringes or may infringe individual privacy.

The police’s access to and use of Covid19 patient data was compliant.

‘‘The New Zealand public needs to have confidence that the sensitive health information of Covid19 patients is not being distributed more widely than it needs to be, and for any necessary dissemination to be done safely.

‘‘I hope the outcome of my inquiry will have implications for the future distribution of Covid19 patient information, given that the course of the global pandemic has a long way to go yet, and that we will continue to see cases in New Zealand.’’

He expected to be able to publicly report on his findings and recommendations in early September.

The Heron inquiry found Ms Boag and Mr Walker were solely responsible for the leak but the Health Ministry’s systems could have been tighter.

At the time Ms Boag was sent the information, 14 emergency services were sent daily updates of the names, dates of births and locations of active Covid19 patients.

At the peak of the health crisis it was the ministry’s policy to send the information to those services, but the inquiry found that should have been reviewed once community transmission had been stamped out.

Directorgeneral of health Ashley Bloomfield welcomed the inquiry and said once the leak was reported, the ministry immediately stopped sending the information to those services.

It was also reviewing how it stored the data, he said. — The New Zealand Herald