A district health board (DHB) received a request from a social service agency asking the DHB to disclose the names of patients who had tested positive for Covid-19. The DHB contacted us for advice – should it share this information? The DHB was concerned this could be a privacy breach.

Carrying out vital social services in a state of emergency

There is a strong public interest in ensuring that social service agencies can perform their functions. This is heightened during a lockdown period if there are risks to safety, particularly the safety of children.

The social service agency properly wanted to protect its staff if required to make urgent house calls. As a safety precaution, the agency wanted to know ahead of time if an address it was attending was associated with any patients known to have Covid-19. The information would help protect the staff who were to visit the address from infection.

Is there a basis for disclosure?

There are several possible legal authorities for DHB disclosures.

Section 22C of the Health Act provides a broad authority for health agencies like DHBs to disclose to relevant government social service agencies as necessary for those agencies to carry out their statutory functions.

Rule 11 of the Health Information Privacy Code also provides a basis for disclosure to protect against serious threats to an individual’s health or public health more generally (if it is not practicable in the circumstance to seek the individual’s authorisation).

The Civil Defence National Emergencies (Information Sharing) Code 2013 (issued by the Privacy Commissioner under the Privacy Act) permits the sharing of information for purposes directly related to responding to or managing an epidemic, including assisting affected individuals to access medical or other treatment, health services and other assistance.

In some circumstances, the DHB could be compelled to provide the information. For example, the Oranga Tamariki Act 1989 empowers Oranga Tamariki, the Ministry of Children, to require information to determine whether a child or young person is in need of care and protection or for proceedings such as a family group conference (section 66). If such a demand is made, the DHB should verify that what they are being compelled to provide is consistent with the statutory power being used and doesn't exceed it. 

Even if there is an available basis to disclose or compel a DHB to provide the health status of patients, agencies need to carefully consider whether it would be necessary or useful to do so.

Is the disclosure necessary?

At this stage of the coronavirus epidemic, all agencies that interact with members of the public need to take strict precautions, regardless of whether they know the health status of the individual.

During the national Covid-19 lockdown, our starting point is that the social service agency should be working under the assumption that individuals at an address could potentially be Covid-19 positive and so it should already be taking the necessary steps to keep its staff safe – like practising social distancing and frequent handwashing.

Relying primarily on information about who has been positively diagnosed could be risky. It can take some time for individuals to display symptoms, be tested and then diagnosed. It therefore makes sense for all agencies to take a consistent approach and treat everyone as potentially infectious, regardless of whether they can request or compel disclosure of an individual’s health status.

If there is a justified case for disclosing the status of patients, it will not usually be necessary to disclose its full list of Covid-19 patients. A better solution would be for the DHB to disclose personal information about individual patients on a targeted case-by-case basis.

How might this work in practice?

If the DHB knew that a patient who tested positive for Covid-19 engaged with a particular social service agency, it could communicate this information to the relevant agency or agencies.

By contrast, disclosing a full list of all Covid-19 patients’ personal details to an agency is likely to disclose more information than is necessary for the purpose.

Image credit: ICU hospital beds via Aadil Hospital