The State Services Commission has found it was “unnecessary” and “not permissible” for the Ministry of Health to send Covid-19 patients’ details to emergency services when there was no longer community transmission of the virus.
The Commission commissioned Michael Heron QC to investigate the matter after it came to light the former National Party president Michelle Boag, in her capacity as the acting CEO of the Auckland Rescue Helicopter Trust, on July 2 sent 18 patients' details to National MP Hamish Walker.
Walker forwarded it to three media organisations in an attempt to back up a claim he made about the races of returning New Zealanders in managed isolation. Boag also sent the information to National’s former health spokesperson, Michael Woodhouse, who deleted it.
Heron said: "Ms Boag and Mr Walker were each responsible for the unauthorised disclosure of this sensitive personal information. Their motivations were political. Their actions were not justified or reasonable...
“The information should not have been placed in the public arena. The Ministry of Health did not place it there.”
However, noting the Auckland Rescue Helicopter Trust was one of 14 emergency services sent the patient details by the Ministry, Heron said: “There was no longer a serious threat justifying non-consensual release of personal information such as this.
“The Ministry was, however, dealing with a dynamic global pandemic and operating under huge pressure on many fronts. Whilst there was opportunity, it is understandable that the policy and its application was not reviewed because the situation was so dynamic…
“In any event, the information should not have been sent in such an insecure and open manner. The distribution of such information by email with unencrypted or unprotected attachments does not appear to be reasonable in the circumstances, particularly where widespread community transmission was not an immediate risk…
“Ultimately any system is vulnerable to the deliberate actions of persons who seek to misuse confidential personal information.
"My comments about the Ministry should not be taken to suggest primary responsibility on its behalf. Ms Boag and Mr Walker have that responsibility and have expressed their sincere regret for their role in causing this incident."
The State Services Commission cannot take further action against Boag, Walker or the Auckland Helicopter Trust, as they don't fall under its jurisdiction.
Deputy State Services Commissioner Helene Quilter said Boag and Walker's actions could've been considered criminal had they been public servants - IE worked for the Ministry of Health.
She has referred the matter to the Privacy Commission, but noted Walker's actions could also fall out of its jurisdiction.
"The Speaker of the House and/or the National Party may have jurisdiction over Mr Walker's conduct, but I do not think the Privacy Commissioner does," Heron said.
He said he took Boag at face value when she told him she didn't send the patients' details to anyone else unauthorised, other than Walker and Woodhouse. But, her email accounts weren't forensically investigated.
Director General of Health Ashley Bloomfield said the Ministry of Health is no longer sending patient details to emergency services and is getting an independent review of its systems done.
The Ministry of Health has issued the Auckland Rescue Helicopter Trust with a breach of contract notice.
Here is a press release from the State Services Commission:
The investigation looked into who or what caused the disclosure of the information, and what might have prevented the information from being disclosed and what, if any, improvements might prevent that happening again in the future.
The deputy commissioner said the investigation, led by Mr Michael Heron, QC, found that sensitive personal information was passed to someone who was not authorised to see it, who then placed it in the public arena.
The breach happened after the then Acting Chief Executive of the Auckland Rescue Helicopter Trust, Ms Michelle Boag, passed on the information, without authorisation, to Mr Hamish Walker, MP. Mr Walker subsequently passed the information on to the media.
The report findings around Ms Boag, the Auckland Rescue Helicopter Trust (ARHT) and Mr Walker have raised privacy issues which are outside the deputy commissioner’s jurisdiction. Ms Quilter has therefore referred the report to the Privacy Commissioner. In particular, she has referred the actions of Ms Boag, the ARHT and Mr Walker for specific attention. Mr Walker’s actions may fall outside the jurisdiction of the Privacy Commissioner but that is for him to determine.
The deputy commissioner has also shared the report with the Speaker of the House of Representatives and the Leader of the National Party, who are referred to in the report and who may have jurisdiction.
In relation to matters under the Commissioner’s jurisdiction, Ms Quilter said the policy around the security of personal information within the Ministry of Health could have been tighter and the agency should have reviewed this earlier.
The Director-General of Health, Dr Ashley Bloomfield, has assured the Commission that the agency is fixing the areas identified in the report for improvement.
“The Ministry’s policy should have been reviewed when the context shifted and it was not,” said Ms Quilter.
“I am not going to criticise the Ministry of Health beyond that when lives have been saved as a result of their actions on the broader COVID-19 front.
“The information should not have been placed in the public arena. The Ministry of Health did not place it there.”
We welcome your comments below. If you are not already registered, please register to comment
Remember we welcome robust, respectful and insightful debate. We don't welcome abusive or defamatory comments and will de-register those repeatedly making such comments. Our current comment policy is here.