Police vetting revealed to six people's prospective employers that they had Covid-19, a report by the Privacy Commissioner has shown.
Photo: Richard Tindiller
The report by the Privacy Commissioner examined how the Ministry of Health disclosed Covid-19 patient information to emergency services, including police.
In a statement, a police spokesperson said they had accepted the findings and apologised to the six people whose information had been shared.
"We are sorry for the release of information and we acknowledge that this should not have happened," assistant commissioner service Jevon McSkimming said.
"We have apologised to those people whose Covid-19 status we shared when we shouldn't have. We note the recommendations of the Privacy Commissioner and we have issued guidance to staff to ensure this doesn't happen again."
McSkimming told Morning Report the decision was made by an individual manager.
"I think this was an evolving period and police were really trying to do the best thing in terms of keeping people safe and Covid information I think was viewed by that manager as keeping people safe - albeit wrongly."
He said a close eye is kept on who accesses information inside the police system.
'One of our vetting managers made the decision wrongly' - Jevon McSkimming
Privacy Commissioner John Edwards released his report today, having investigated after the police vetting issue came to light.
"A couple of people raised concerns with my office about police releasing their Covid status to prospective employers as part of their vetting service ... it's not really their function."
He was part way into the investigation when the leaking of Covid-19 patient information by National MP Hamish Walker and former party president Michelle Boag to media organisations came to light. None of the media organisations reported the information.
That leak prompted a separate report for the State Services Commission by Solicitor-General Mike Heron QC, which found the leak by Boag and Walker had been deliberate and politically motivated, but it also found some fault with the Ministry of Health.
Walker said he would retire from politics at the election, while Boag resigned from her roles with the Auckland Rescue Helicopter Trust, and her campaign and electorate roles for the National Party.
Edwards said this expanded the scope of his own investigation to include the Ministry's sharing of Covid-19 patients' information all emergency services, including police.
He found that although the Ministry of Health had a "measured a clear rationale" for sharing the information, it did not take proper legal processes in deciding to disclose the information and there was no evidence the ministry had considered seeking the consent of the patients.
"We didn't see any evidence that the ministry or DHBs or others were notifying people who were getting tests that this was one of the consequences of a positive result, that their information would be distributed to these emergency services. And that is certainly something which should have occurred."
Once available to police, the information was also uploaded to a master spreadsheet and was also duplicated into the police communications centre assisted dispatch system.
"That's quite a lot of people having access to that information ... it was available to all [police] staff," Edwards said.
He found that although police had a legitimate reason for seeking the information from the ministry - protecting its frontline officers from people who may have the virus - disclosing it for vetting was inappropriate.
"Police vetting staff are effectively making a judgment on the relevance of clinical information without clinical input. It should not be up to Police vetting staff to make this decision where that information is being relied on by the agency to make decisions such as determining a person's suitability for employment," the report said.
Edwards told Morning Report he was made aware that the police were sharing the Covid-19 status of jobseekers in April.
He said police should draw a line under any medical information they may hold "because they're not qualified to be making clinical judgements about the relevance of a given medical condition for a prospective employer".
Unless it's clearly associated with offending, medical information should not be shared, he said.
Photo: Supplied / Office of the Privacy Commissioner
'They're not qualified to be making clinical judgements' - John Edwards
Edwards noted that police had immediately stopped doing this after he raised concerns, but said police and the ministry should have reviewed their information-sharing about Covid-19 patients' details after 1 May, when there was no longer any community transmission of the virus, a conclusion it shared with the Heron report.
He recommended that:
Police
- Consistently review and revise the need for Covid-19 patient information
- Develop an internal policy on staff access to this information
- Develop a memorandum of understanding with the ministry of health in line with the above
Ministry of Health
- Implement data minimisation so only information necessary to the public health responsee
- Develop a plan to ensure people who receive this information understand the risks of releasing it
- Ensure people taking Covid-19 tests are aware of the purpose their information may be used and the intended recipients
- Implement immediate measures to ensure security of health information relating to third parties
- Develop a memorandum of understanding with emergency services to set clear expectations
- Ensure that disclosing health information to prevent a serious threat to public health is assessed appropriately
The Ministry of Health also welcomed the Commissioner's report and said that after the two reports it recognised that a move down to different alert levels was an appropriate time to review the sharing of patient data with emergency services".
"By the time of the release of the earlier Heron report, the ministry had reviewed its protocols and security around the sharing of data, and had ceased the sharing of patient information," the ministry said.
"The ministry has reviewed the recommendations made in the Privacy Commissioner's report and will ensure the sharing of any patient data is treated with the utmost care and respect of the patient's privacy first and foremost. We will also continue working with emergency services to establish clear protocols about the use of patient information by the recipients."
Edwards said people who had similar concerns should make a complaint to his office.
"They can't go to court directly for that kind of thing, they have to come through my office, so we'll work with the affected parties and we'll continue to work with police to resolve those."
Read more about the 2020 election: