For example there was an outbreak in Matamata, and any emergency services there at the time would have been understandably cautious, she said.
"It was for that reason that the emergency services were told."
The spreadsheet information was not password protected, while in comparison patient information held at a district health board is, Boag said.
"Initially, it was like here's 20 people, then it was here's 40 people and then it was here's a hundred people and then it was here's several hundred people ..."
While she was an acting CEO for ARHT, she said, she had "no idea" why health officials chose to use her personal email address.
Boag reiterated the privacy of patient data held by ARHT had not been breached.
"I even as CEO never had access to that data because I didn't need to. Only clinicians need to have access to that data."
Last night she said she'd made a "massive error of judgment" sending the details to Walker, and apologised for doing so.
"The information was made available to me in my position as then acting CEO of the Auckland Rescue Helicopter Trust (ARHT), although it was sent to my private email address.
"This was a massive error of judgment on my part and I apologise to my colleagues at ARHT whom I have let down badly.
"I very much regret my actions and did not anticipate that Hamish would choose to send it on to some media outlets but I am grateful that the media involved have chosen not to publish the 18 names that were contained within it."
Walker "sincerely apologised" for how he handled the information, and was sorry for the impact on the affected individuals, who are all infected with Covid-19.
He said he released the information to media to justify his previous comments about Kiwis flying in from India, Pakistan and Korea, which the Government had described as racist.
"I made serious allegations against the Government's Covid-19 response and passed on this information to prove those allegations," he said in a statement today.
"I did this to expose the Government's shortcomings so they would be rectified. It was never intended that the personal details would be made public, and they have not been, either by me or the persons I forwarded them to.
"The information that I received was not password-protected by the Government. It was not stored on a secure system where authorised people needed to log on. There was no redaction to protect patient details, and no confidentiality statement on the document.
"By exposing a significant privacy issue I hope the Government will improve its protocols and get its safeguards right."
