The leak of private Covid-19 patient details has been slammed as a "disgraceful and grubby act" done for political gain, the Health Minister says.
A powerful independent inquiry into how the sensitive information got into the hands of former National party president Michelle Boag and National MP Hamish Walker found they were solely responsible for the leak.
But it's unlikely they'll face any further penalties because their jobs exclude them from the Privacy Act.
The State Services Commission inquiry was ordered by the Government after the Herald reported patient details had been leaked.
Former solicitor general Michael Heron, QC, found the pair's actions were "not justified or reasonable".
Heron was given wide-ranging powers, including seizing computers and questioning people under oath, but the day after he was appointed Boag and Walker confessed.
During his investigation, Heron said he took the pair "at their word" because there was no reason not to believe them. They were not questioned under oath and their email accounts weren't analysed.
Walker told Heron he sent a spreadsheet containing the details of the then 18 active cases to the Herald and two other media outlets to defend himself against accusations of racism.
On July 2, Walker issued a statement saying the returnees had come from "India, Pakistan and Korea" after one of his Southland constituents said there was a "likely influx of people to the constituency" from those countries,
He believed forwarding the information would show that claim was "based on fact and was not racially motivated".
He conceded to Heron the spreadsheet did not prove that as "it gave the names of people and not the places they had departed from".
"I accept that my judgment was impaired due to the pressure and distress of being labelled a racist."
Walker told Heron he also sent the document to hold the Government to account as he believed such sensitive information should have been better protected with encryption or a password.
Walker said it was only after he called Boag in distress after being called a racist that she sent him the spreadsheet to help him prove his point.
"This was the only time that Ms Boag gave me official information that she should not have given me."
Boag was receiving daily updates on the details of the active Covid-19 cases to her private business email address in her role as acting chief executive of the Auckland Rescue Helicopter Trust. She was expected to pass it on to two senior clinical leads.
At the peak of the coronavirus crisis when there was community transmission, the Ministry of Health sent patient details to emergency services so their staff were equipped to treat them if needed.
But this policy wasn't reviewed after the public health threat had subsided and 14 emergency services continued to be sent the information every morning.
"Ultimately, any system is vulnerable to the deliberate actions of persons who seek to misuse confidential personal information," said Heron.
The emails had the subject "MEDICAL IN CONFIDENCE" and contained footers outlining privacy obligations.
Boag sent four spreadsheets of patient information to National's then health spokesman Michael Woodhouse between June 21-25.
Heron said Boag's motivation to do this was also for political gain. Woodhouse told Heron he deleted these emails and because it wasn't central to his inquiry, he didn't pursue it.
"Ideally, he would have counselled Ms Boag not to disclose such information and/or alerted the Ministry or the Minister."
Heron said Boag and Walker had accepted their actions fell below the standard New Zealanders expected but they'd been "candid" and assisted with his inquiry so took them at their word.
But because Boag was sent the information in a professional capacity and Walker is an MP it's unlikely their actions would have breached the Privacy Act, Heron found.
The findings have been referred to the Privacy Commissioner for his attention.
Health Minister Chris Hipkins called it "a disgraceful and grubby act carried out by two National Party members for political purposes".
They "gave no thought to the stress and harm" that may have caused the 18 people on the list, he said.
Hipkins thanked the three media outlets for the responsible way they had handled the highly sensitive information.
Director general of health Dr Ashley Bloomfield said his ministry immediately stopped sending patient data to emergency services after the leak was reported and is reviewing which agencies will be sent the data in the future if there is another Covid-19 health crisis.
The ministry has issued the Auckland Rescue Helicopter Trust with a breach of contract notice and Bloomfield said that was mainly to get assurances the Trust would abide by their privacy commitments.
And all 18 people have been contacted - 17 personally - and apologised to, Bloomfield said.
The 19-year-old disappeared without her wallet or mobile phone.