Covid privacy breach report places blame on Nats
An inquiry into the leak of Covid-19 patient data has found room for improvement in Ministry of Health policies, but concludes the breach may have been beyond prevention
A privacy breach involving the personal information of Covid-19 patients was committed by "motivated individuals" within the National Party who knew they had no right to share the information they did, an official investigation has concluded.
However, the State Services Commission report, led by Michael Heron QC, has also found that Ministry of Health policies around information sharing could have been tightened after community transmission of the virus ceased.
Clutha-Southland MP Hamish Walker, who shared the patient information with media, and former National Party president Michelle Boag, who provided the data to him, were fingered as the prime wrongdoers by Heron.
"The leak was committed by motivated individuals knowing they had no entitlement to disclose the information they did," Heron said.
"It is doubtful whether any policy (or, potentially, security system) could have completely prevented that."
Walker and Boag's actions were politically motivated and not justified or reasonable, he said.
The information had been sent on July 2 to 14 email addresses associated with emergency services, with a subject line stating it was "MEDICAL IN CONFIDENCE".
Boag had provided her business email to receive the data rather than an address for the Auckland Rescue Helicopter Trust, of which she was serving as the acting chief executive, but all had agreed that was the capacity in which she had received the information.
The Ministry of Health had drafted a policy for sharing information with emergency services in April, while the country was in lockdown and there was still community transmission of Covid-19.
Heron described the policy as a "considered response to the pressures arising during the early stages of the crisis". However, it had not reviewed the guidelines after forming the view on May 1 there was no longer community transmission, despite the likelihood it was unnecessary and not permissible to share the personal information of patients at that point.
The distribution of such information by email and with unencrypted or unprotected attachments did not appear to be reasonable in the circumstances, he said.
Deputy State Services Commissioner Helene Quilter said the commission had been assured by Director-General of Health Ashley Bloomfield that his ministry was addressing the shortcomings outlined in the report.
"The ministry's policy should have been reviewed when the context shifted and it was not," Quilter said.
"I am not going to criticise the Ministry of Health beyond that when lives have been saved as a result of their actions on the broader Covid-19 front."
Quilter said the report had been referred to the Privacy Commissioner, as well as Speaker Trevor Mallard and National leader Judith Collins, as there were issues which were in their jurisdiction rather than that of the SSC.
Heron's investigation was commissioned after the NZ Herald and other media outlets reported they had been given sensitive medical information of patients who had tested positive for the virus.
Several days after the initial media reports, Walker confessed to being the source of the leak in an apparent bid to clear his name, following accusations of racism regarding a press release he issued about people from India, Korea and Pakistan potentially heading to the south for managed isolation or quarantine.
The Clutha-Southland MP withdrew his candidacy for the upcoming election after then-National leader Todd Muller wrote to the party's board recommending it take action against Walker.
Separately, Boag admitted she had sent the patient data to Walker, after receiving it in relation to her job as acting chief executive of the Auckland Rescue Helicopter Trust.
Boag resigned from that role, as well as positions on Auckland Central MP Nikki Kaye's electorate and campaign committees, describing her actions as "a massive error of judgment".
She later resigned as a National Party member altogether when she admitted that she had also sent Covid-19 data to National's health spokesman Michael Woodhouse.
Woodhouse told media he did not do anything with the information provided by Boag as he recognised its sensitivity, but he was stripped of the health portfolio and demoted by new National leader Judith Collins, who said he should have informed authorities when he was sent the emails.
Can you help our journalists uncover the facts?
Newsroom is committed to giving our journalists the time they need to uncover, investigate, and fact-check tough stories. Reader donations are critical to buying our team the time they need to produce high-quality independent journalism.
If you can help us, please donate today.