Report into Covid privacy breach

The Heron report into the Covid privacy breach has been released.

Media release:

Findings of investigation into COVID-19 active cases privacy breach

Deputy State Services Commissioner Helene Quilter has today announced the findings of an investigation into a breach of privacy regarding sensitive personal information.

The investigation looked into who or what caused the disclosure of the information, and what might have prevented the information from being disclosed and what, if any, improvements might prevent that happening again in the future.

The deputy commissioner said the investigation, led by Mr Michael Heron, QC, found that sensitive personal information was passed to someone who was not authorised to see it, who then placed it in the public arena.

The breach happened after the then Acting Chief Executive of the Auckland Rescue Helicopter Trust, Ms Michelle Boag, passed on the information, without authorisation, to Mr Hamish Walker, MP. Mr Walker subsequently passed the information on to the media.The report findings around Ms Boag, the Auckland Rescue Helicopter Trust (ARHT) and Mr Walker have raised privacy issues which are outside the deputy commissioner’s jurisdiction. Ms Quilter has therefore referred the report to the Privacy Commissioner. In particular, she has referred the actions of Ms Boag, the ARHT and Mr Walker for specific attention. Mr Walker’s actions may fall outside the jurisdiction of the Privacy Commissioner but that is for him to determine.

The deputy commissioner has also shared the report with the Speaker of the House of Representatives and the Leader of the National Party, who are referred to in the report and who may have jurisdiction.

In relation to matters under the Commissioner’s jurisdiction, Ms Quilter said the policy around the security of personal information within the Ministry of Health could have been tighter and the agency should have reviewed this earlier.

The Director-General of Health, Dr Ashley Bloomfield, has assured the Commission that the agency is fixing the areas identified in the report for improvement.“The Ministry’s policy should have been reviewed when the context shifted and it was not,” said Ms Quilter.

“I am not going to criticise the Ministry of Health beyond that when lives have been saved as a result of their actions on the broader COVID-19 front.

“The information should not have been placed in the public arena. The Ministry of Health did not place it there.”

Report Executive Summary:

Ms Boag and Mr Walker were each responsible for the unauthorised disclosure of this sensitive personal information. Their motivations were political. Their actions were not justified or reasonable. Each acknowledged their error publicly and cooperated fully with this inquiry.

The Ministry of Health policy and process in notifying emergency services of active cases was a considered response to the pressures arising during the early stages of the crisis. Whether the policy was appropriate in the circumstances applicable in April 2020 will be the subject of further review by the Privacy Commissioner. The policy and process should have been reviewed once there were no longer cases in the community and the dissemination to emergency services of the personal information ought to have stopped. In any event, there ought to have been better protection over the personal information.

On Boag and Walker:

The statements of Ms Boag and Mr Walker indicate that the cause of the leak was, first and foremost, deliberate and politically motivated. Both have expressed their sincere regret at their poor judgement in distributing this sensitive personal information to others. I was contacted by a COVID-19 patient to convey their shock and dismay that such information would be passed around in this manner. The Ministry was aware of the risks of unauthorised disclosure of such information and the harm that could be caused. Given its sensitivity, disclosure of such personal information requires clear legal authority and careful judgement.

The Privacy Act is unlikely to apply to Mr Walker in these circumstances. Section 2 of the Act states that an “agency… does not include… a member of Parliament in his or her official capacity.” Mr Walker considers he received and disseminated the information in his capacity as an MP. He says and I accept that he sought to hold the Government to account with respect to the countries from which new cases were originating and with respect to the lack of security around personal information. Mr Walker accepted that the spreadsheet did not assist to prove the first point. In my view, however, Mr Walker was acting in his official capacity.

Ms Boag’s actions in disseminating the personal information would not have been compliant with ARHT policy.

The State Services Commissioner could consider a formal referral of Ms Boag and the ARHT to the Privacy Commissioner, who is the appropriate statutory body in their case. The Privacy Commissioner is, however, already reviewing the question of whether the Ministry policy was appropriate and can investigate this matter with or without a referral or complaint.

On Michael Woodhouse:

Ms Boag had earlier provided similar personal information (but different spreadsheets) to Michael Woodhouse, MP. I received information relating to those other occasions from Ms Boag and proactively from Mr Woodhouse. Mr Woodhouse advised he did not forward such information on and has now deleted it. I considered whether I should pursue the deletion further with Mr Woodhouse, but ultimately because the information was similar in nature and it was not central to my inquiry, I determined it was not necessary to pursue it. I accept Mr Woodhouse deleted the information. Ideally, he would have counselled Ms Boag not to disclose such information and/or alerted the Ministry or Minister.

Full report:

Evolving Boag story on Covid privacy leak

Michele Boag now says that she was sent daily emails by the Ministry of Health to her private email, and this is how she got the personal details of Covid cases.

After Hamish Walker admitted sending personal health details to media on Tuesday, Boag followed up with a statement claiming:

Today I am announcing that I am the person who passed on details of current Covid19 cases to Clutha Southland MP Hamish Walker, who then passed on that information to a number of media outlets.

The information was made available to me in my position as then Acting CEO of the Auckland Rescue Helicopter Trust, although it was sent to my private email address.

This was a massive error of judgement on my part and I apologise to my colleagues at ARHT whom I have let down badly.

I take full responsibility for my actions and have resigned as Acting CEO of ARHT…

At midday yesterday Walker announced that he wouldn’t stand for re-election in Clutha-Southland (now Southland).

Meanwhile Boag didn’t respond to media requests for further information, but it was announced by National deputy leader Nikki Kaye that Boag was stepping down from Party roles. RNZ: Michelle Boag stands down from roles with National deputy leader Nikki Kaye

High-profile former National Party president Michelle Boag has resigned from her campaign and electorate roles for Auckland Central MP and National deputy leader Nikki Kaye.

Kaye said Walker had “displayed a number of very significant errors of judgement and I think his position is pretty difficult in the future.”

Kaye has known Boag for many years and said she was ” absolutely gutted” and “hugely disappointed” that she was behind the leak to the MP.

Then last night Covid-19 privacy breach info came from Health Ministry, Michelle Boag says

Former National Party president Michelle Boag says the Ministry of Health sent her the private details of people infected with Covid-19.

Boag told RNZ the Ministry of Health had sent daily emails to her private email, which included the sensitive details of the country’s Covid-19 cases.

Boag couldn’t explain why it was sent to her private email, but suspected it was because she was only temporarily in the role of chief executive.

The government has already confirmed emergency services were regularly sent the details of the country’s active cases, so they could take the proper precautions if responding to a call-out where someone with Covid-19 was present.

The Ministry of Health and the Health Minister both declined to comment when contacted by RNZ this evening.

This morning Ministry of Health silent on Michelle Boag’s Covid-19 patient detail source claims

The Ministry of Health is refusing to confirm if it supplied the former National Party President Michelle Boag with a daily list of people infected with Covid-19 and their private information.

“I was sent it [the private patient information] legitimately by the Ministry of Health,” Boag said.

She received a daily list of Covid-19 patients, and their personal details, as the acting chief executive of the Auckland Rescue Helicopter Trust (ARHT), Boag said, but added it was sent to her personal email.

Boag said she would then forward the list to “people in the organisation who needed that to do their work”.

Boag couldn’t explain why it was sent to her personal email, but suspected it was because she was only temporarily in the role of chief executive.

Despite receiving sensitive emails daily, Boag said she only ever shared one with Mr Walker.

Boag refused to explain why she did when asked by RNZ.

“Well I’m not going to go into that, but that is the subject obviously of the investigation,” she said.

The Ministry of Health and government ministers declined to comment when contacted by RNZ last night.

But the minister in charge of managed isolation Megan Woods has already confirmed emergency services have been supplied the names of people infected with Covid-19 since the start of the government’s response.

“That is an operational procedure that is standard and that’s because if emergency services need to come into contact with someone who has tested Covid positive for whatever reason, be that an airlift or whatever, that they have that information and make sure their staff is protected,” Woods said.

The Auckland Rescue Helicopter Trust made a statement yesterday:

In the wake of Michelle Boag’s revelation concerning the leak of Covid-19 patient information, Auckland Rescue Helicopter Trust Chair Simon Tompkins says Ms Boag’s resignation as Acting CEO and Trustee has been accepted.

“The breach which has been admitted by Ms Boag was of an email that was sent to her personal account. As an administrative resource, Ms Boag has never had access to any clinical or patient data held by ARHT.

“ARHT is an integral part of the health system and we are entrusted with information about our patients which is properly protected by protocols which only enable access to those who need this data to care for the patient. We have reviewed these protocols and are confident that none of this patient information has been subject to any privacy breach.

“Nevertheless we take our responsibility for patient confidentiality very seriously and continuously seek to improve our protocols and procedures,” Tompkins says.

“We want to reassure the New Zealand public and, most importantly, our patients and their families that patient care remains our top priority. Any information we hold on patients is private with access on a restricted basis and has not been breached.”

This seems to conflict with what Boag has claimed.

Unless Boag or ARHT  or the Ministry of Health give furhter details we may have to wait until the outcome of the Mike Herron investigation to learn what actually happened.

RNZ: Inquiry still going ahead

The minister for state services, Chris Hipkins, said the ongoing state services inquiry would look at how many people received the sensitive information from the Ministry of Health and whether or not it was appropriate they did.

“We do want to get to the bottom of exactly what happened here and I don’t think the government should rely on what comments people make to the media to draw a line under it, we actually want a proper thorough investigation so that all of the facts can be put on the table so that everyone can be clear what happened,” Hipkins said.

Before Boag and Walker publicly confessed, the inquiry led by Mike Heron QC was expected report back with answers by the end of July.

But the past 48 hours is likely to have make his job a lot easier – and faster.

It is still likely to take a week or two.

Boag says she only passed one email on to Walker – but that doesn’t minimise her actions, that email happened to contain all the details of current Covid cases including personal details.