Covid-19 coronavirus patients' details leaked: Privacy Commissioner launches fresh probe

Privacy Commissioner John Edwards is investigating how Covid-19 patient information is distributed.

The Privacy Commissioner has launched an inquiry into how the Ministry of Health distributes Covid-19 patients' information.

The move comes after an investigation into the leak of active patient details to media last month found room for improvements in the ministry's policies.

The leak cost National MP Hamish Walker his political career.

The findings of the inquiry by the State Services Commission and led by Michael Heron, QC, were passed to the Privacy Commission for review.

Privacy Commissioner John Edwards announced today that he would look into how private information was distributed.

However he will not inquire further into the disclosure of information by former party president Michelle Boag or the Auckland Rescue Helicopter Trust (ARHT) unless he's approached by someone's whose details were included in the leak.

Boag accessed the data through her role as acting chief executive of the Auckland Rescue Helicopter Trust and sent the information to National MPs Hamish Walker and Michael Woodhouse.

Walker then leaked the spreadsheet to the Herald and two other media outlets in response to being accused of racism.

Edwards said the terms of his investigation is to inquire whether:

• The Ministry of Health's disclosure of Covid-19 patient information to emergency
services was compliant with the information privacy principles and rules of the Health
Information Privacy Code and that infringes or may infringe individual privacy.

• the police's access to and use of Covid-19 patient data was compliant

"The New Zealand public needs to have confidence that the sensitive health information of Covid-19 patients is not being distributed more widely than it needs to be, and for any necessary dissemination to be done safely.

"I hope the outcome of my inquiry will have implications for the future distribution of Covid-19 patient information, given that the course of the global pandemic has a long way to go yet, and that we will continue to see cases in New Zealand."

Edwards expects to be able to publicly report on his findings and recommendations in early September.

The Heron inquiry found Boag and Walker were solely responsible for the leak but the Health Ministry's systems could have been tighter.

At the time Boag was sent the information, 14 emergency services were sent daily updates of the names, dates of births and locations of active Covid-19 patients.

At the peak of the health crisis it was the ministry's policies to sent the information to those services but the inquiry found that should have been reviewed once community transmission had been stamped out.

Director general of health Ashley Bloomfield welcomed the inquiry and said once the leak was reported, the ministry immediately stopped sending the information to those services.

It was also reviewing how it stored the data, he said.