1 Feb 2010, 09:00

A woman complained that a District Health Board had provided her anonymised health information to the Ministry of Health as part of statistical information concerning serious and sentinel events within the DHB.

The information was published by the Ministry of Health and resulted in the woman's anonymised health information being published in a local newspaper. The woman considered that the information released by the DHB enabled her to be identified.

Rule 11

Rule 11 of the Health Information Privacy Code places limits on the disclosure of information. A health agency may disclose health information where it believes on reasonable grounds that one of the exceptions set out in rule 11(1) applies. Disclosure is also allowed under rule 11(2) in a number of other circumstances, but only where it is not desirable or practicable to obtain authorisation from the individual.

The DHB advised us that as part of the annual reporting requirements placed on DHBs it released anonymised information to the Ministry of Health. This information concerned the serious and sentinel events that occurred within the DHB over a 12 month period.

As a result, the DHB sought to rely on rule 11(2)(c)(i) and (ii) of the Health Information Privacy Code.

Rule 11(2) provides:
(2) Compliance with paragraph (1)(b) is not necessary if the health agency believes on reasonable grounds that it is either not desirable or not practicable to obtain authorisation from the individual concerned and that:
(c) the information:

(i) is to be used in a form in which the
individual concerned is not identified; or
(ii) is to be used for statistical purposes and will not be published in a form that could reasonably be expected to identify the individual concerned.

Rule 11(1)(b) generally provides that information must not be disclosed unless the individual concerned authorises the disclosure.

The health information disclosed included a brief diagnosis and the reason why the case was included in the report. On the day the report was released the DHB contacted the woman's husband and advised him that the report was being released. This was the only communication with the woman or her husband with regard to the release of the woman's health information.

There was no evidence that it was not desirable or not practicable to obtain the woman's authorisation to release the information.

However, section 22H of the Health Act, which allows disclosure of health information but does not allow the identification of the person to whom it relates, provided the DHB with a statutory basis to release the information to the Ministry.

As the information did not identify the woman, section 22H of the Health Act overrode the provisions of the Health Information Privacy Code, by the effect of section 7(1) of the Privacy Act.

We conveyed our view to the DHB that it could not rely on rule 11(2)(c)(i) and (ii) as there was no evidence that it was not practicable or not desirable to obtain the woman's authorisation to the release of the information. However, we also acknowledged that section 22H of the Health Act applied.

The DHB acknowledged that more consultation with the woman would have been desirable in the circumstances, and apologised for any distress caused by the disclosure.

On this basis we closed our investigation.


March 2010

Health information - disclosure - District Health Board - Ministry of Health - identifiable individual - authorisation to disclose - consultation with the individual - Health Information Privacy Code, rule 11 - Privacy Act; section 7 - Health Act; section 22H