21 Sep 2020, 09:00

Privacy Commissioner recommends Ministry of Health and Police review their use and disclosure of Covid-19 patient information

Privacy Commissioner John Edwards has released the results of an inquiry into the Ministry of Health’s disclosure of Covid-19 patient information to emergency services.

The Inquiry recommends government agencies review the way they handle and share Covid-19 patient health information, particularly given its highly sensitive nature.

“The Ministry of Health has acted appropriately and responsibly with Covid-19 patient information. Emergency services, including Police, received it for legitimate reasons. However, Police use and disclosure of Covid-19 patient information as part of its vetting function, although only for a short time, was inappropriate,” Mr Edwards said.

State Services Commissioner, Peter Hughes, referred Michael Heron QC’s report to the Privacy Commissioner on 29 July. That report had investigated the disclosure of Covid-19 patient information by former acting chief executive of Auckland Rescue Helicopter Trust, Michelle Boag, and National Party MP, Hamish Walker.

Based on matters raised in the Heron report and complaints the Office had received from the public, the Privacy Commissioner launched an independent Inquiry to investigate two distinct issues:

• Whether the Ministry of Health’s disclosure of Covid-19 patient information to emergency services was compliant with the information privacy principles and rules of the Health Information Privacy Code.
• Whether Police’s disclosure of Covid-19 patient information was compliant with the information privacy principles.

The Inquiry also examined whether either of these disclosures infringed or may have infringed on individual privacy.

Findings

The Inquiry found that the Ministry of Health had a “clear and measured rationale” for its decisions to provide patient information to emergency service in April 2020 when the decision was made. The Ministry should, however, have revisited its decision as New Zealand moved down alert levels in May 2020.

The Inquiry found that Police had legitimate reasons to collect Covid-19 patient information from the Ministry to assist front-line Police staff with performing their pandemic management and general policing duties.

Police should have reviewed its need for patient information as the number of Covid-19 cases in New Zealand reduced. It was inappropriate for Police to disclose patients’ Covid-19 statuses to patients’ potential employers as part of their vetting function.

Recommendations for the Ministry

The Commissioner recommended that the Ministry:

• Ensure it appropriately assesses rule 11 of the Health Information Privacy Code. In particular, the Ministry should give due consideration to whether it is practicable or desirable to obtain a person’s consent before disclosing their health information to prevent or lessen a serious threat to public health or safety.
• Implement appropriate data minimisation and disclosure practices so that only information that is necessary for the public health response is disclosed to the emergency services.
• Assist health agencies administering Covid-19 tests to ensure people taking tests are told of the purposes for which their information will be used, and the intended recipients, as required by rule 3.
• Develop a plan regarding the sharing of such information, ensuring all recipients are aware of the risks of releasing information that may lead to an individual being identified and how to mitigate those risks.
• Implement immediate measures ensuring the security of health information when disclosing identifiable details to third parties.
• Develop memoranda of understanding between the Ministry and emergency services establishing clear expectations about the use of patient information by the recipients.

Recommendations for Police

The Commissioner recommended that Police:

• Consistently review and revise its need for Covid-19 patient information in order to respond to changing risk levels.
• Develop internal policies on staff access to and use of Covid-19 patient information.
• Develop a memorandum of understanding with the Ministry in line with its own need for patient information and internal policy.

“Police should never have disclosed patients’ Covid-19 statuses to prospective employers as part of their vetting process. To Police’s credit, as soon as we raised concerns about this practice, they immediately stopped,” Mr Edwards said.

You can read and download a copy of the report here. 

For more information: Feilidh Dwyer 021 959 050