01/07/2003 4:36am

Rawhiti Trust Hospital Board

Discovery of patient notes in an a former private hospital building: Final report

Background to the inquiry

Following reports to the media in December 2000 that patient files, had been located at the former premises of a private hospital in Auckland (Rawhiti Trust Hospital) I initiated an inquiry into the circumstances in which these files had come to be left on those premises.

I was concerned that the circumstances involved here raised issues relating to heath records and what becomes of them when a hospital ceases business.

Terms of Reference

I sought to establish:

1. Whether records relating to terminations conducted at the Rawhiti Trust Hospital ('the Hospital') had been left on the former premises of the Hospital;

2. If so, what those records comprised, and how they came to have been left after the Hospital sold the premises;

3. Who (which agency) was responsible for ensuring the Hospital's records had been properly secured after it had ceased functioning as a hospital.

Background on the Rawhiti Trust Hospital

The Hospital was formed under a Deed of Trust, dated 18 May 1971, and was registered under the Charitable Trusts Act 1957. The Hospital was under the direction of the Rawhiti Trust Hospital Board of Trustees ('the Board'), which met monthly, and had a General Manager employed (responsible to the Board) for the efficient running of the Hospital. The Board consisted of seven medical practitioners and one lawyer, none of whom received remuneration. The Hospital also had a Director of Nursing, who was responsible for the day to day running of the Hospital, in particular with matters to do with the Hospital's licence.

The Board Secretary, John Hetherington, advised that during its period of operation the Hospital had held three main kinds of records - patient medical records, patient administrative records and staff employment records. During the Hospital's operation, patient medical records were stored at Nurse's stations (in the case of current in/out patient medical records), whilst administrative records (billing etc) were held in the Support Services Manager's Office. Once patients were discharged, their medical and administrative records were combined and kept in the Support Services Manager's Office for twelve months, after which they were taken to a locked storage area in the basement. In addition to these records the Hospital also held the usual records relating to its employees.

The Facts

I was advised in early December 2000 that a member of the public had come across the confidential files of women who had had terminations. The allegation was that those records had been found in an unsecured room attached to the Mt Eden premises of the former Hospital.

The files were alleged to include the names and addresses of women who had had terminations at the Hospital from 1995, termination authorisation forms, as well as general administration papers. Information on a number of terminations carried out each month at the Hospital had also been found.

The premises were subsequently secured by the Police and these files removed to secure storage under the direction of the Ministry of Health. The Hospital had closed approximately three months prior to the discovery.

A spokesman for the Board, John Hetherington, advised that the Board had been unaware that the files had been left at the Hospital's former premises when it had vacated them. Mr Hetherington initially said that he did not know why the files had been left behind. According to a spokesman for the security firm looking after these premises for the new owner the building had been padlocked, but had been broken into.

Privacy Commissioner's Inquiry

As a result of my inquiry I have been able to establish that the Hospital had closed on Friday 19 March 1999, that prior to this the Director of Nursing had contacted the Ministry of Health and the Abortion Supervisory Committee advising of the impending closure and surrending the Hospital's licence and the licence to conduct terminations. A further purpose of that contact was to arrange delivery of the Hospital's records to the Ministry, as required under the Hospitals Act 1957.

It seems that the Ministry advised the Director of Nursing to herself make suitable arrangements for the confidential storage of those records, as it did not have room to receive them. This was done, with arrangements being made for confidential storage with a storage company in Penrose (Recall Total Information Management). The transfer of records was commenced prior to the Hospital's closure, but was not concluded until after the Hospital had closed, at a time when many of the staff who had been responsible for the records were no longer employed.

The Hospital premises were not completely vacated until the end of April/beginning of May 1999, and sale of the premises was not concluded until the end of May 1999. Settlement was completed on 18 July 2000.

The First Issue: Were records left on the premises?

It appears that during the operation of the Hospital some records and files had been transferred from the main storage area to a room under a fire exit stairway, normally used to house redundant equipment. Although the bulk of the records held by the Hospital were successfully relocated to storage with Recall, these records remained on the premises.

The Second Issue: What did these records consist of, and how did they come to be left?

The records, which related to both staff and patients, were contained in six boxes and comprised: a ring binder (containing confidential patient information), files of creditor's invoices, theatre supplies lists, patient bulletins and staff wage lists. They related to the period 1990-1994. The ring binder of patient information contained 198 certificates from certifying consultants for the termination of pregnancies. The wage records consisted of a binder containing the print-outs of the calculations of employee's fortnightly wages.

It appears that the six boxes had been temporarily stored in a room some distance from the main storage area, and in a place not routinely accessed by staff. The room had been locked during the time the Hospital functioned, with the key being kept in the Support Manager's Office. According to the security firm whose responsibility it was to secure the premises after the property had been sold, the room had been padlocked and had remained so until it was broken into. Contrary to some claims in the media, the files had not been abandoned in an unsecured room, nor were the Hospital buildings themselves unsecured: alarms had been installed in the main Hospital buildings after the purchaser had taken possession of it.

It appears that an oversight occurred in the handling and removal of these records, in that the temporary location of the files was not one generally used for the storage of records and therefore was not thought to contain such records. This was compounded by the fact that, by the time of the final closure of the Hospital and the removal of the last records to secure storage with Recall, the staff remaining were unaware that records had been taken from the main storage area to that location. As a result these files were overlooked.

The Board considers that the failure to remove these files from the room was an oversight, which it regrets. In its view, the physical location of the room contributed to that oversight. The Board has drawn my attention to the successful relocation of the bulk of the files held by the Hospital to secure storage.

The Third Issue: Which agency was responsible for these records?

The major issue of concern to me during the course of my inquiry was which agency had been legally responsible for the secure storage of these records upon the closure of the Hospital.

In my view, a strict interpretation of the governing legislation and regulations confers responsibility for ensuring secure storage of patient registers and records of the kind involved here on the Director-General of Health.

Under the Hospital's Act 1957 and the subordinate Hospitals Regulations, health information is divided into registers of patients (specified under section 137 of the Hospitals Act and Regulation 5 of the Hospitals Regulations) and patient charts (provided for under section 138 of the Hospitals Act and Regulation 7(1) of the Hospitals Regulations).

With respect to responsibility for this information, regulation 6(2) of the Hospitals Regulations provides:

If a licence is revoked or otherwise terminated, the licensee shall forthwith forward all registers in his or her hands to the Director/General of Health.

Similarly, Regulation 8(2) of the those Regulations provides that if a licence is revoked or otherwise terminated, the licensee shall forthwith deliver all patient charts in the licensee's hands to the Director-General of Health.

The Hospital's understanding was therefore that upon termination of its licence it was obliged to return all patient charts and registers to the Ministry of Health. Thus when the Director of Nursing for the Hospital approached the Ministry of Health to advise that the licence was terminating, and asking the Ministry to take the patient records and registers, she did so in compliance with the Regulations governing this circumstance.

Advice to my office from the Ministry of Health was that the volume of information that the Ministry could potentially be required to retain and store as a result of compliance by hospitals with these Regulations is such that it is unable to receive the information. Accordingly, the Ministry advises these agencies to make provision for the secure storage of the records they hold.

Upon being advised that it should make alternative arrangements for the secure storage of those registers and records, the Hospital arranged for them to be securely stored with Recall, and for access to those records and registers to be provided to patients and staff through Ascot Hospital. As noted above, some of the records that it had intended to provide for in this manner were left on its former premises and were subsequently located there. They have since been returned to the Ministry, which holds them under the terms of the Hospitals Regulations and the Health (Retention of Health Information) Regulations.

Conclusion

I have reached the conclusion that at the point that its licence to operate as a hospital terminated the Hospital held these records as the Ministry's agent, and that in terms of Rule 5 of the Health Information Privacy Code, the Hospital took reasonable steps to ensure the security of the records and registers which it held. In reaching this view I have noted that the Hospital had attempted to comply with the relevant Regulations, that when directed to do so by the Ministry it had made appropriate arrangements for the secure storage of the files, and had transferred responsibility for their continuing future secure storage (as well as for providing access to them) to Ascot Hospital, its successor in function. That arrangement was agreed to by the Ministry. Unfortunately, as a result of an oversight, the Hospital failed to secure all of the records it held at the time it closed.

Although I consider such an oversight to be serious, I am also of the view that it was a one-off failure on its part, and as such it would not appear to be amenable to further security safeguards being enacted. Moreover, because of its one-off nature I am not persuaded that it constitutes a 'practice' on the part of the Hospital. I therefore do not consider any further action on my part is necessary.

I have written to the Ministry regarding the anomaly that appears to exist with respect to responsibility for the storage and handling of patient registers and records from hospitals whose licences terminate or are revoked. The Ministry advises that it is currently reviewing how record retention can best be managed in the circumstances of hospitals such as Rawhiti. This is in parallel to a review of the issue in relation to record retention in public hospitals where facilities close.

B H Slane
Privacy Commissioner