Report into Covid privacy breach

The Heron report into the Covid privacy breach has been released.

Media release:

Findings of investigation into COVID-19 active cases privacy breach

Deputy State Services Commissioner Helene Quilter has today announced the findings of an investigation into a breach of privacy regarding sensitive personal information.

The investigation looked into who or what caused the disclosure of the information, and what might have prevented the information from being disclosed and what, if any, improvements might prevent that happening again in the future.

The deputy commissioner said the investigation, led by Mr Michael Heron, QC, found that sensitive personal information was passed to someone who was not authorised to see it, who then placed it in the public arena.

The breach happened after the then Acting Chief Executive of the Auckland Rescue Helicopter Trust, Ms Michelle Boag, passed on the information, without authorisation, to Mr Hamish Walker, MP. Mr Walker subsequently passed the information on to the media.The report findings around Ms Boag, the Auckland Rescue Helicopter Trust (ARHT) and Mr Walker have raised privacy issues which are outside the deputy commissioner’s jurisdiction. Ms Quilter has therefore referred the report to the Privacy Commissioner. In particular, she has referred the actions of Ms Boag, the ARHT and Mr Walker for specific attention. Mr Walker’s actions may fall outside the jurisdiction of the Privacy Commissioner but that is for him to determine.

The deputy commissioner has also shared the report with the Speaker of the House of Representatives and the Leader of the National Party, who are referred to in the report and who may have jurisdiction.

In relation to matters under the Commissioner’s jurisdiction, Ms Quilter said the policy around the security of personal information within the Ministry of Health could have been tighter and the agency should have reviewed this earlier.

The Director-General of Health, Dr Ashley Bloomfield, has assured the Commission that the agency is fixing the areas identified in the report for improvement.“The Ministry’s policy should have been reviewed when the context shifted and it was not,” said Ms Quilter.

“I am not going to criticise the Ministry of Health beyond that when lives have been saved as a result of their actions on the broader COVID-19 front.

“The information should not have been placed in the public arena. The Ministry of Health did not place it there.”

Report Executive Summary:

Ms Boag and Mr Walker were each responsible for the unauthorised disclosure of this sensitive personal information. Their motivations were political. Their actions were not justified or reasonable. Each acknowledged their error publicly and cooperated fully with this inquiry.

The Ministry of Health policy and process in notifying emergency services of active cases was a considered response to the pressures arising during the early stages of the crisis. Whether the policy was appropriate in the circumstances applicable in April 2020 will be the subject of further review by the Privacy Commissioner. The policy and process should have been reviewed once there were no longer cases in the community and the dissemination to emergency services of the personal information ought to have stopped. In any event, there ought to have been better protection over the personal information.

On Boag and Walker:

The statements of Ms Boag and Mr Walker indicate that the cause of the leak was, first and foremost, deliberate and politically motivated. Both have expressed their sincere regret at their poor judgement in distributing this sensitive personal information to others. I was contacted by a COVID-19 patient to convey their shock and dismay that such information would be passed around in this manner. The Ministry was aware of the risks of unauthorised disclosure of such information and the harm that could be caused. Given its sensitivity, disclosure of such personal information requires clear legal authority and careful judgement.

The Privacy Act is unlikely to apply to Mr Walker in these circumstances. Section 2 of the Act states that an “agency… does not include… a member of Parliament in his or her official capacity.” Mr Walker considers he received and disseminated the information in his capacity as an MP. He says and I accept that he sought to hold the Government to account with respect to the countries from which new cases were originating and with respect to the lack of security around personal information. Mr Walker accepted that the spreadsheet did not assist to prove the first point. In my view, however, Mr Walker was acting in his official capacity.

Ms Boag’s actions in disseminating the personal information would not have been compliant with ARHT policy.

The State Services Commissioner could consider a formal referral of Ms Boag and the ARHT to the Privacy Commissioner, who is the appropriate statutory body in their case. The Privacy Commissioner is, however, already reviewing the question of whether the Ministry policy was appropriate and can investigate this matter with or without a referral or complaint.

On Michael Woodhouse:

Ms Boag had earlier provided similar personal information (but different spreadsheets) to Michael Woodhouse, MP. I received information relating to those other occasions from Ms Boag and proactively from Mr Woodhouse. Mr Woodhouse advised he did not forward such information on and has now deleted it. I considered whether I should pursue the deletion further with Mr Woodhouse, but ultimately because the information was similar in nature and it was not central to my inquiry, I determined it was not necessary to pursue it. I accept Mr Woodhouse deleted the information. Ideally, he would have counselled Ms Boag not to disclose such information and/or alerted the Ministry or Minister.

Full report:

Walker stepping down, Muller steps up, but National down and out of contention

After admitting sending personal details of Covid cases to several media outlets National MP Hamish Walker took the only course open to him – yesterday he pre-empted a Party board meeting considering a request to dump him from the party by announcing he wouldn’t stand in the Clutha Southland (now Southland) electorate in September’s election.

Personal Statement From Hamish Walker

Today I am announcing that I will not be standing for re-election for the Southland electorate at the upcoming 2020 election.

I wish to thank the people of Clutha-Southland who I have loved meeting, assisting and representing over the past two and a half years.

I sincerely apologise for my actions.

I will be making no further comment.

Todd Muller Accepts Hamish Walker’s Decision Not To Stand In 2020

National Party Leader Todd Muller has today accepted Hamish Walker’s decision to withdraw his candidacy for the seat of Southland and not stand at the upcoming election.

“Rachel Bird, the National Party’s Southern Regional Chair, has received a letter from Hamish confirming he will withdraw as the National Party candidate for Southland.

“There was a clear breach of trust, which goes against the values National holds as a party.

“The National Party Board will still meet today to discuss the selection of a new candidate.”

Statement From Peter Goodfellow, National Party President

Yesterday evening I received a letter from Leader Todd Muller, asking the National Party Board of Directors to urgently meet and consider some very serious, publicly reported, issues concerning Clutha-Southland MP Hamish Walker.

The Board met at midday today (Wednesday 8 July) via videoconference and was advised that Mr Walker has now formally resigned his candidacy for the National Party in the Southland Electorate for the 2020 General Election.

A selection process will therefore begin almost immediately to find a new candidate for the Southland Electorate, and we look forward to a robust and democratic process.

On behalf of the National Party Board of Directors, I would like to apologise for any distress caused to the individuals concerned as a result of the actions of one of our Members of Parliament.

RNZ: Hamish Walker’s exit from politics ‘was the only option’ – Todd Muller

In an announcement on transport this afternoon, Muller said the board will be looking at installing a new National Party candidate for Southland in the coming days.

“This was the only option because as we have well traversed the events of the last few days have not reflected from my perspective the appropriate National Party behaviour and values.

“He has worked very hard for his community over the last three years, and ultimately it was an error of judgement, a serious error of judgement that has cost him his career.

“It’s the right decision and I acknowledge that and now of course we seek to move on.”

He said he would not talk through the advice Walker had received, which was in a letter between himself and Walker.

Muller said Walker’s judgement was “fundamentally flawed”.

“And I’m on record a number of times now confirming that, and he’s paid the ultimate price of doing that.

“This is an isolated incident and we’ve got to see it through that lens, and I have acted very swiftly and we’ve got the right outcome.”

He said his MPs were clear around the expectations of them and they reflected a party with a “fine tradition of values, of achievement for this country and every one of us knows that we are there because at the last election well over a million people supported our cause and our view that the government is stronger when we’re in control”.

“Hamish Walker went behind my back and made his own judgement, and I’m sure that he is ruing it today.

“We have had one MP who made a serious error and has paid the ultimate price in terms of his political career. I think that talks to a party that does have high standards and when people breach them there is consequences.

“It was totally inappropriate for that personal information to be leaked to the media, because they are New Zealanders who are suffering because they have Covid and are in a constrained environment.”

But he said National would continue to critique the government’s “every day glitches” in the managed isolation programme.

“The government continues to demonstrate by the day actually that their border management is still not at the expectations that New Zealanders have of keeping us safe.”

What Michelle Boag and Hamish walker did reflects very poorly on the National Party. Walker is a first MP but especially after his Clutha Southland predecessor Todd Barclay crashed and burned his political career Walker should have been well aware of the dangers of stuffing up.

Walker should have also been well aware that personal information given to MPs has special privacy requirements.

Boag has shown that her long history of political involvement is a risk to any other work she does, as she has put political dirt first. She is likely to be shunned by National from now but she knows a lot of people in the party and it will be hard for her to be separated from it.

Leader Todd Muller has had a disaster to deal with, and I think he has dealt with it about as well as he could have. He made it clear he was totally opposed to what happened, and he made it clear that he had lost confidence in Walker and that Walker should resign, which he did.

In an adverse situation Muller looked reasonably principled and decisive, considering he had to allow Walker and the party to make decisions, and had to deal with legal issues.

But despite looking more sort of like leader material Muller has to now deal with his party in a dire situation. National’s chances of succeeding this election looked a long shot before this happened, but it now looks like they are virtually out of contention.

Unless Jacinda Ardern resigns or does something terrible, or someone in Labour does something as bad as Walker and it is handled poorly by Ardern and the party, or Covid turns to custard in New Zealand, then it looks likely now Ardern and Labour should cruise back into power.

Labour are sort of vulnerable on the economic risks, but that looks well covered with wage subsidies running through to September, and large amounts of money are being dished out around the country to try to keep the economy from crashing. It would take a major turn for the worse in the next two months for this to risk labour’s re-election.

So Muller and National are left to try to rescue as much support as possible to prevent their caucus from being decimated. It is too early to tell how bad the Boag/Walker effect will be, but National will struggle to get over 40% this election, and could easily crash to under 30%.

Evolving Boag story on Covid privacy leak

Michele Boag now says that she was sent daily emails by the Ministry of Health to her private email, and this is how she got the personal details of Covid cases.

After Hamish Walker admitted sending personal health details to media on Tuesday, Boag followed up with a statement claiming:

Today I am announcing that I am the person who passed on details of current Covid19 cases to Clutha Southland MP Hamish Walker, who then passed on that information to a number of media outlets.

The information was made available to me in my position as then Acting CEO of the Auckland Rescue Helicopter Trust, although it was sent to my private email address.

This was a massive error of judgement on my part and I apologise to my colleagues at ARHT whom I have let down badly.

I take full responsibility for my actions and have resigned as Acting CEO of ARHT…

At midday yesterday Walker announced that he wouldn’t stand for re-election in Clutha-Southland (now Southland).

Meanwhile Boag didn’t respond to media requests for further information, but it was announced by National deputy leader Nikki Kaye that Boag was stepping down from Party roles. RNZ: Michelle Boag stands down from roles with National deputy leader Nikki Kaye

High-profile former National Party president Michelle Boag has resigned from her campaign and electorate roles for Auckland Central MP and National deputy leader Nikki Kaye.

Kaye said Walker had “displayed a number of very significant errors of judgement and I think his position is pretty difficult in the future.”

Kaye has known Boag for many years and said she was ” absolutely gutted” and “hugely disappointed” that she was behind the leak to the MP.

Then last night Covid-19 privacy breach info came from Health Ministry, Michelle Boag says

Former National Party president Michelle Boag says the Ministry of Health sent her the private details of people infected with Covid-19.

Boag told RNZ the Ministry of Health had sent daily emails to her private email, which included the sensitive details of the country’s Covid-19 cases.

Boag couldn’t explain why it was sent to her private email, but suspected it was because she was only temporarily in the role of chief executive.

The government has already confirmed emergency services were regularly sent the details of the country’s active cases, so they could take the proper precautions if responding to a call-out where someone with Covid-19 was present.

The Ministry of Health and the Health Minister both declined to comment when contacted by RNZ this evening.

This morning Ministry of Health silent on Michelle Boag’s Covid-19 patient detail source claims

The Ministry of Health is refusing to confirm if it supplied the former National Party President Michelle Boag with a daily list of people infected with Covid-19 and their private information.

“I was sent it [the private patient information] legitimately by the Ministry of Health,” Boag said.

She received a daily list of Covid-19 patients, and their personal details, as the acting chief executive of the Auckland Rescue Helicopter Trust (ARHT), Boag said, but added it was sent to her personal email.

Boag said she would then forward the list to “people in the organisation who needed that to do their work”.

Boag couldn’t explain why it was sent to her personal email, but suspected it was because she was only temporarily in the role of chief executive.

Despite receiving sensitive emails daily, Boag said she only ever shared one with Mr Walker.

Boag refused to explain why she did when asked by RNZ.

“Well I’m not going to go into that, but that is the subject obviously of the investigation,” she said.

The Ministry of Health and government ministers declined to comment when contacted by RNZ last night.

But the minister in charge of managed isolation Megan Woods has already confirmed emergency services have been supplied the names of people infected with Covid-19 since the start of the government’s response.

“That is an operational procedure that is standard and that’s because if emergency services need to come into contact with someone who has tested Covid positive for whatever reason, be that an airlift or whatever, that they have that information and make sure their staff is protected,” Woods said.

The Auckland Rescue Helicopter Trust made a statement yesterday:

In the wake of Michelle Boag’s revelation concerning the leak of Covid-19 patient information, Auckland Rescue Helicopter Trust Chair Simon Tompkins says Ms Boag’s resignation as Acting CEO and Trustee has been accepted.

“The breach which has been admitted by Ms Boag was of an email that was sent to her personal account. As an administrative resource, Ms Boag has never had access to any clinical or patient data held by ARHT.

“ARHT is an integral part of the health system and we are entrusted with information about our patients which is properly protected by protocols which only enable access to those who need this data to care for the patient. We have reviewed these protocols and are confident that none of this patient information has been subject to any privacy breach.

“Nevertheless we take our responsibility for patient confidentiality very seriously and continuously seek to improve our protocols and procedures,” Tompkins says.

“We want to reassure the New Zealand public and, most importantly, our patients and their families that patient care remains our top priority. Any information we hold on patients is private with access on a restricted basis and has not been breached.”

This seems to conflict with what Boag has claimed.

Unless Boag or ARHT  or the Ministry of Health give furhter details we may have to wait until the outcome of the Mike Herron investigation to learn what actually happened.

RNZ: Inquiry still going ahead

The minister for state services, Chris Hipkins, said the ongoing state services inquiry would look at how many people received the sensitive information from the Ministry of Health and whether or not it was appropriate they did.

“We do want to get to the bottom of exactly what happened here and I don’t think the government should rely on what comments people make to the media to draw a line under it, we actually want a proper thorough investigation so that all of the facts can be put on the table so that everyone can be clear what happened,” Hipkins said.

Before Boag and Walker publicly confessed, the inquiry led by Mike Heron QC was expected report back with answers by the end of July.

But the past 48 hours is likely to have make his job a lot easier – and faster.

It is still likely to take a week or two.

Boag says she only passed one email on to Walker – but that doesn’t minimise her actions, that email happened to contain all the details of current Covid cases including personal details.

Muller asks National board to remove Walker from party

There has been widespread calls for Clutha Southland MP Hamish Walker to be dumped. While the party leader doesn’t have the power to sack an electorate MP, Todd Muller says that the leaking of health information showed ‘serious lapses of judgment’, and ‘appalling lack of judgement’, and was ‘completely unacceptable’, and has written to the National Party board asking that Walker is removed from the party.

Muller says he us very angry about what happened.

RNZ:  Todd Muller on Hamish Walker – ‘There needs to be consequences’

The National Party leader says he has written to the party’s board asking them to remove MP Hamish Walker from the party after it was revealed he leaked private health information to media.

Prior to that revelation, National Party leader Todd Muller described the leak as “loose, shabby and a reminder these guys can’t manage important things well”.

“The problem is when you’ve allowed a culture of sloppiness and clumsiness to take over and become pervasive, you know, really history suggests you need a new broom to be able to sort and set the tone from the top,” he said on Monday.

Walker, who admitted the leak late yesterday afternoon, has already been stripped of his portfolios and is now subject to an independent State Services inquiry.

Muller told Morning Report there needed to be consequences and he has written to the party’s board asking it to remove Walker from the party.

Muller has given a lengthy interview to RNZ, they say they will post more details. Walker and Boag would not do interviews. They will be subject to the inquiry set up to investigate the leak.

The board will meet to discuss the matter today.

Muller said he learn on Monday at lunchtime about who leaked the information when Walker contacted him to inform him. He is not aware of any other National MPs being aware of who was responsible for the leak.

Muller also said the consequences will be significant for Michelle Boag, who obtained the information in her role as Acting CEO of the Auckland Rescue Helicopter Trust.

Muller says that Boag did not assist him with his leadership takeover, and he’s not aware of her helping Walker on other matters.

I think that Walker should jump before he is pushed from the party, or al least announce he won’t stand for re-election in  September.

This is hugely damaging for National as it is, but if Walker doesn’t resign or withdraw the damage to the party will increase.

Muller is saying and doing about all he can in the circumstances. It must have removed any hope of success for him or national this election.

UPDATE:

He had little choice but to do this, and jumping before being pushed reduces the substantial damage he has done to his party.

Todd Muller accepts Hamish Walker’s decision not to stand in 2020

National Party Leader Todd Muller has today accepted Hamish Walker’s decision to withdraw his candidacy for the seat of Southland and not stand at the upcoming election.

“Rachel Bird, the National Party’s Southern Regional Chair, has received a letter from Hamish confirming he will withdraw as the National Party candidate for Southland.

“There was a clear breach of trust, which goes against the values National holds as a party.

“The National Party Board will still meet today to discuss the selection of a new candidate.”

Hamish Walker – admission and apology over leak

National MP Hamish Walker:

A Personal Statement And An Apology

I have spoken to National Party Leader Todd Muller and informed him that I passed to members of the media, by email, information containing Covid-19 patient details that was given to me by a source.

I did this to expose the Government’s shortcomings so they would be rectified. It was never intended that the personal details would be made public, and they have not been, either by me or the persons I forwarded them to.

I have received legal advice that I have not committed any criminal offence.

The information that I received was not password protected by the Government. It was not stored on a secure system where authorised people needed to log on. There was no redaction to protect patient details, and no confidentiality statement on the document.

By exposing a significant privacy issue I hope the Government will improve its protocols and get its safeguards right.

I made serious allegations against the Government’s Covid-19 response and passed on this information to prove those allegations.

Private health information does not have basic safeguards in place and the Government needs to immediately change its protocols and store the information on a secure, safe network that at a minimum requires a password.

I sincerely apologise for how I have handled this information and to the individuals impacted by this. I will be fully cooperating with the Michael Heron QC inquiry.

National leader Todd Muller:

Statement On Hamish Walker

Hamish Walker has informed me that he received and then disclosed health information regarding active Covid-19 cases to members of the media.

I have asked Hamish to acknowledge this to Michael Heron QC and cooperate fully with his inquiry into how the information made it into the public domain.

I have expressed to Hamish my view that forwarding on this information was an error of judgement.

While I wait for the result of the inquiry I have transferred his Forestry, Land Information and Associate Tourism portfolio responsibilities to Ian McKelvie.

Given this matter is the subject of an inquiry I will not be making any further public comment.


UPDATE: Michelle Boag has admitted passing the information on to Walker.

From RNZ: National MP Hamish Walker admits leaking Covid-19 patient details

In a statement, Boag said that handing on the patient details to Walker was “a massive error of judgement on my part and I apologise to my colleagues at ARHT (Auckland Rescue Helicopter Trust) whom I have let down badly”.

“I very much regret my actions and did not anticipate that Hamish would choose to send it on to some media outlets but I am grateful that the media involved have chosen not to publish the 18 names that were contained within it.

She said she had resigned from her role at the Auckland Rescue Helicopter Trust.

“I take full responsibility for my actions and have resigned as acting CEO of ARHT.”

Boag was the National Party’s president in 2001 and 2002.

Boag was also linked to the leadership coup when Muller replaced Simon Bridges.

From  memory she was also involved in the management of Todd Barclay before he exited the same Clutha-Southland electorate taken over by Walker.

This is very damaging for National regardless of how it pans out from here.


Press Statement From Michelle Boag

Today I am announcing that I am the person who passed on details of current Covid19 cases to Clutha Southland MP Hamish Walker, who then passed on that information to a number of media outlets.

The information was made available to me in my position as then Acting CEO of the Auckland Rescue Helicopter Trust, although it was sent to my private email address.

This was a massive error of judgement on my part and I apologise to my colleagues at ARHT whom I have let down badly.

I very much regret my actions and did not anticipate that Hamish would choose to send it on to some media outlets  but I am grateful that the media involved have chosen not to publish the 18 names that were contained within it.

I take full responsibility for my actions and have resigned as Acting CEO of ARHT, which is in very good hands as the result of a recent restructure and the appointment of a new CEO for the Trust’s operations and the appointment of a General Manager to oversee the Trusts’s marketing and fundraising operations.

I sincerely hope that the communities of the Auckland region will continue to support the Rescue Helicopter at this time of very important need.  My actions were mine alone and should not reflect at all on the professionalism, integrity and outstanding reputation of the Rescue Helicopter staff.    They are an amazing bunch of dedicated community servants and I know they will be very disappointed in me.

Any requests for comment should be directed to me personally as ARHT bears no responsibility at all for my misjudgement.

Electorate MP helps Sri Lankan family get residency

Electorate MPs do a lot of work with and for constituents that usually goes unreported and largely unnoticed, but here is a story of a success by rookie Clutha-Southland MP Hamish Walker (he took over the seat long held by Bill English and short held by Todd Barclay).

This also shows how MPs from different parties work together – in this case Associate Minister of Immigration Kris Faafoi.

Stuff: Sri Lankan family get residency after eight-year battle

A year after they pleaded to avoid deportation to Sri Lanka, a Queenstown family have been granted residency and are giving back to the community that supported them.

“I am so happy,” an emotional Dinesha Wijerathne said, while working in her new chef job at the community project Let’s Eat.

Husband Sam Wijerathne, a taxi driver, said they had struggled for eight years to reach a point of certainty for the family.

As they went through the residency application process, Dinesha Wijerathne, the primary visa holder, was diagnosed with multiple sclerosis (MS) and was unable to work.

Their working visa applications were declined and the future looked grim.

Local MP Hamish Walker stepped in too.

He assisted them to appeal to the Immigration and Protection Tribunal, buying time for the family, before requesting the Immigration Minister to intervene.

Walker, a first term National Party MP, lobbied Associate Minister of Immigration Kris Faafoi.

“Really I must thank him for allowing thIs family to stay in New Zealand,” Walker said.

Good work by Walker, and a good response from Faafoi.

 

Hamish Walker selected for Clutha-Southland

The National Party in Clutha-Southland has gone for someone quite a bit older to replace Todd Barclay as their MP – 32 year old Hamish Walker has been selected to be their next MP. Walker appeared to be the front runner.

It has to be expected he will easily win what is a very safe National seat, so the hardest part has been done. Many MPs are selected more by parties than by electorates.

Walker stood for National in Dunedin South last election. He lost to Labour’s Clare Curran by 3,858 votes, not bad for what has historically been a Labour stronghold.

Better for his party, National got 15,003 party votes to Labour’s 12,518. National had also come out in front in the 2011 election but by less, so Walker and his campaign team must have been doing something well.

Walker was 65th on National’s list in 2014, a few places outside the cut. It doesn’t matter where he ends up on their list this year, he should romp in in Clutha Southland, Barclay won with 21,561 votes there in 2014, with the Labour candidate second on 6,675.

I think he moved to Dunedin from up north prior to the last election.