The State Services Commission has found it was “unnecessary” and “not permissible” for the Ministry of Health to send Covid-19 patients’ details to emergency services when there was no longer community transmission of the virus.
The Commission commissioned Michael Heron QC to investigate the matter after it came to light the former National Party president Michelle Boag, in her capacity as the acting CEO of the Auckland Rescue Helicopter Trust, on July 2 sent 18 patients' details to National MP Hamish Walker.
Walker forwarded it to three media organisations in an attempt to back up a claim he made about the races of returning New Zealanders in managed isolation. Boag also sent the information to National’s former health spokesperson, Michael Woodhouse, who deleted it.
Heron said: "Ms Boag and Mr Walker were each responsible for the unauthorised disclosure of this sensitive personal information. Their motivations were political. Their actions were not justified or reasonable...
“The information should not have been placed in the public arena. The Ministry of Health did not place it there.”
However, noting the Auckland Rescue Helicopter Trust was one of 14 emergency services sent the patient details by the Ministry, Heron said: “There was no longer a serious threat justifying non-consensual release of personal information such as this.
“The Ministry was, however, dealing with a dynamic global pandemic and operating under huge pressure on many fronts. Whilst there was opportunity, it is understandable that the policy and its application was not reviewed because the situation was so dynamic…
“In any event, the information should not have been sent in such an insecure and open manner. The distribution of such information by email with unencrypted or unprotected attachments does not appear to be reasonable in the circumstances, particularly where widespread community transmission was not an immediate risk…
“Ultimately any system is vulnerable to the deliberate actions of persons who seek to misuse confidential personal information.
"My comments about the Ministry should not be taken to suggest primary responsibility on its behalf. Ms Boag and Mr Walker have that responsibility and have expressed their sincere regret for their role in causing this incident."
The State Services Commission cannot take further action against Boag, Walker or the Auckland Helicopter Trust, as they don't fall under its jurisdiction.
Deputy State Services Commissioner Helene Quilter said Boag and Walker's actions could've been considered criminal had they been public servants - IE worked for the Ministry of Health.
She has referred the matter to the Privacy Commission, but noted Walker's actions could also fall out of its jurisdiction.
"The Speaker of the House and/or the National Party may have jurisdiction over Mr Walker's conduct, but I do not think the Privacy Commissioner does," Heron said.
He said he took Boag at face value when she told him she didn't send the patients' details to anyone else unauthorised, other than Walker and Woodhouse. But, her email accounts weren't forensically investigated.
Director General of Health Ashley Bloomfield said the Ministry of Health is no longer sending patient details to emergency services and is getting an independent review of its systems done.
The Ministry of Health has issued the Auckland Rescue Helicopter Trust with a breach of contract notice.
Here is a press release from the State Services Commission:
The investigation looked into who or what caused the disclosure of the information, and what might have prevented the information from being disclosed and what, if any, improvements might prevent that happening again in the future.
The deputy commissioner said the investigation, led by Mr Michael Heron, QC, found that sensitive personal information was passed to someone who was not authorised to see it, who then placed it in the public arena.
The breach happened after the then Acting Chief Executive of the Auckland Rescue Helicopter Trust, Ms Michelle Boag, passed on the information, without authorisation, to Mr Hamish Walker, MP. Mr Walker subsequently passed the information on to the media.
The report findings around Ms Boag, the Auckland Rescue Helicopter Trust (ARHT) and Mr Walker have raised privacy issues which are outside the deputy commissioner’s jurisdiction. Ms Quilter has therefore referred the report to the Privacy Commissioner. In particular, she has referred the actions of Ms Boag, the ARHT and Mr Walker for specific attention. Mr Walker’s actions may fall outside the jurisdiction of the Privacy Commissioner but that is for him to determine.
The deputy commissioner has also shared the report with the Speaker of the House of Representatives and the Leader of the National Party, who are referred to in the report and who may have jurisdiction.
In relation to matters under the Commissioner’s jurisdiction, Ms Quilter said the policy around the security of personal information within the Ministry of Health could have been tighter and the agency should have reviewed this earlier.
The Director-General of Health, Dr Ashley Bloomfield, has assured the Commission that the agency is fixing the areas identified in the report for improvement.
“The Ministry’s policy should have been reviewed when the context shifted and it was not,” said Ms Quilter.
“I am not going to criticise the Ministry of Health beyond that when lives have been saved as a result of their actions on the broader COVID-19 front.
“The information should not have been placed in the public arena. The Ministry of Health did not place it there.”
16 Comments
Emails are postcards: able to be read by any hop in the chain from sender to receiver. This has been common knowledge amongst IT professionals for a quarter of a century. But health tends to have a wide continuum of IT competence, from the AI-driven proprietary systems used in some types of diagnoses, to homegrown patient management systems written in COBOL. So not surprising that some postcards went astray. But surely even a cursory check of email addresses could have solved this one? Hire a 10-year-old and set 'em to work.....
But surely even a cursory check of email addresses could have solved this one?
Not really sure what you mean. On the day the government announced an inquiry in the afternoon, Hamish Walker that lunchtime had already confessed to Muller, and then it was made public the next day.
The inquiry never really had a "track down the source of the leaks" phase, it immediately became an "analyse this known leak and what should've been done differently" inquiry.
Too right! Ever since the similar carry-on in the glory days of Dirty Politics it has been the fair right of any politician to violate privacy law and release confidential data on citizens, opponents, whoever really, for political gain!
Storm in a teacup, indeed. Harrumph!
What a limp wristed review...
National taking cues from the Trump electioneering playbook again...
https://www.newshub.co.nz/home/politics/2020/07/national-housing-spokes…
I see that Australia will announce new infections of well over 700 for the last day. I think that it is timely to reflect on all the pressure that the National party and all the others of their ilk put on the government to abandon our hard lock down principals and follow those clever Australians who had managed to achieve such low infection rates without making the sacrifices that we were making. Well this is where that approach got them, and it is only just starting. It will get a hell of a lot worse. So please stand up now and tell us how clever you think they are and what you would reccomend that they do to address the nightmare that they now face. Please also tell us how this would affect your buisnesses and employment? Would you reccoment tacking a completely hands off approach like Trump or Bolesenaro and just let the virus rip?
We welcome your comments below. If you are not already registered, please register to comment.
Remember we welcome robust, respectful and insightful debate. We don't welcome abusive or defamatory comments and will de-register those repeatedly making such comments. Our current comment policy is here.