15 Oct 2019, 09:00

Two parents complained to our office after a primary school displayed their child’s Medical Action Plan (MAP) in the school staffroom.

MAPs are developed by schools to inform staff how to respond to children who may require urgent medical attention. The child had high needs and the MAP included sensitive medical information regarding their toileting.

The parents were informed the school would display the MAP in the school’s staff room after their child brought home an unsealed letter and copy of the MAP they had been given. The parents were concerned with the way the school delivered the information, which they believed should have been enclosed in an envelope or marked as confidential. They worried their child’s dignity could have been compromised if the medical information was viewed by their child’s classmates.

They were additionally concerned with the placement of the MAP in the school’s staffroom. They said pupils regularly entered the staffroom and could have easily viewed the MAP, which they said would have caused their child to be bullied. The parents complained to the school and the board of trustees.

The school responded that they did not believe they had breached the child’s privacy but removed the MAP from the staffroom and subsequently reviewed the way children’s medical information was accessed and shared by staff. The school later expressed regret to the parents.

The parents were not satisfied with the way the investigation was conducted and lodged a complaint with us. This complaint raised issues under principles 5 and 11 of the Privacy Act 1993.

Principles 5 and 11

Principle 5 says that agencies should take reasonable steps to ensure that personal information they hold is protected by security safeguards that are reasonable in the circumstances to protect against loss, unauthorised access or use. 

Principle 11 places limits on disclosures of personal information. Agencies must not disclose personal information they hold unless that is one of the purposes for collecting the information, or another of the exceptions applies. 

The school’s response

The school did not believe it had inappropriately displayed the child’s MAP. They argued that not having this information easily accessible could compromise the school’s ability to deal with students with serious health needs. They further argued that the staffroom was a private location, not open to students and the most sensitive information in the document was known to other students, who were extremely kind to the child and sensitive to their problems.

Our view

Our investigation concluded that the school had breached principle 5 of the Privacy Act. Given the extremely sensitive nature of the child’s medical condition, we did not believe the staffroom was the appropriate location to display the MAP. Although the staffroom was predominantly accessed by school staff, it was reasonable to assume that children or other adults may enter it.

We acknowledge the importance of having that information available to staff responsible for the child’s health and safety, but that it was still important to ensure the information was only available to those with a need to know. The display in the staff room meant the info was subject to wider distribution that was necessary.

We recommended the school apologise to the parents and undertake privacy training. As the school removed the MAP from the staffroom and undertook steps to review its processes, we did not think further action from our Office was necessary.