More job cuts proposed for Kāinga ora, police cost-savings difficulties and what key NZ institutions have fallen in public trust?
A complaint about care at an aged care facility revealed missing medical records, hindering investigation efforts
An audit found several key records could not be found, meaning the health board could not make conclusions on some parts of the complaint
The Privacy Commissioner has publicly rebuked Ultimate Care for a two-year delay in reporting the loss of the records
A complaint about a patient’s treatment at an aged care facility could not be fully investigated after it was discovered key parts of the person’s medical records had gone missing.
The disappearance of the confidential documents was realised after a representative for the patient complained about some of the care they had received while housed at an Ultimate Care Group facility.
When the representative then requested information from the patient’s medical records, Ultimate Care refused to provide it. An audit by the local district health board later revealed the documents were lost.
The Privacy Commissioner has now publicly rebuked Ultimate Care, saying it was “seriously concerning” that it took the business two years to report the loss of the documents, and it was a “significant” issue.
According to the Office of the Privacy Commissioner (OPC), the patient’s representative laid a privacy complaint because their request for information about the resident was withheld.
The patient was housed at an Ultimate Care Group facility when the issues arose. Photo / 123rf
Section 22F of the Health Act states people holding health information must usually provide it to the person the information relates to, or to that person’s representative or service provider where necessary.
“The representative had previously made a complaint to Ultimate Care and the then-Capital and Coast District Health Board about the care provided to the resident while at the facility,” the OPC statement said.
The DHB commissioned a special audit of Ultimate Care over this matter and during a site visit in August 2021, discovered that documents relating to the affected person’s care were missing.
“The audit report noted several key records were not available for the audit team to review.”
The audit noted the missing elements of the file impeded the investigation into the resident’s care and prevented the audit from reaching conclusions on some points of the investigation.
The audit also noted the inability to find parts of the patient’s paper-based clinical records was a potential breach of privacy if the information had not been stored securely.
“Accordingly, the audit report recommended that the health board consider requiring Ultimate Care to ‘locate [the resident’s] missing clinical record or report this as a breach of privacy’. The Health Board advised Ultimate Care of this and other required actions in December 2021,” the OPC said.
There was a follow-up audit in 2022 to assess Ultimate Care’s progress. It did not notify the commissioner at this time.
The patient’s representative then laid a complaint with the Health and Disability Commissioner (HDC). Only in October last year, under direction from the HDC, did Ultimate Care report the privacy breach.
The OPC said Ultimate Care should have reported the privacy breach as soon as it discovered the documents were lost.
“Ultimate Care is a large provider serving a vulnerable group in our population and holds a significant volume of sensitive information about the individuals in its care,” it said.
“A key element of providing care to these individuals is looking after their personal information, and health information in particular. It is disappointing that Ultimate Care did not identify the breach to be notifiable as required under the act and that, despite prompts by the health board, it continued to fail to notify the breach to OPC, until recommended by HDC.”
The two-year delay to report the breach was “seriously concerning”.
Privacy Commissioner Michael Webster chose to name Ultimate Care to make an example of it. Photo / Melissa Waite
Privacy Commissioner Michael Webster named Ultimate Care, saying the business had consistently ignored its notification requirements.
“My recommendation is for agencies to notify us and do it early, even if they’re not 100% sure a privacy breach has occurred, or don’t yet have all the details,” Webster said.
The decision to name Ultimate Care Group was made so it could become an example for others.
Ultimate Care had since taken actions to strengthen privacy policies, increase privacy awareness and improve document management practices, Webster said.
“While these changes are good and have resulted in an improvement in privacy capability in Ultimate Care, I consider the impact of the loss of the clinical file on the resident and the wider systemic issues of poor information management practices at Ultimate Care at that time to be significant.”
The Herald has contacted Ultimate Care and Health NZ Te Whatu Ora for comment.
Ultimate Care owns 19 aged care facilities throughout New Zealand.
Melissa Nightingale is a Wellington-based reporter who covers crime, justice and news in the capital. She joined the Herald in 2016 and has worked as a journalist for 10 years.
