The Accident Compensation Corporation says it is sorry it accidentally released the personal details of thousands of clients.
It has confirmed details of more than 9000 ACC claims, covering about 6000 people, were accidentally emailed to one of its clients last August.
Chief executive Ralph Stewart has apologised for what he calls a regretful and shocking accident, saying clearly the corporation's processes were not strong enough to avoid the mistake and must be reviewed.
He told Checkpoint the names of 137 people making sensitive claims were released. ACC's sensitive claims unit deals with sexual abuse and rape victims.
Mr Stewart says an Auckland staff member accidentally emailed a spreadsheet containing the personal information to a client. He says she is distraught but at this stage her job is not at stake.
The corporation says it is notifying all the claimants affected.
Listen to Ralph Stewart
Chair only just told
The client who received the emails told the manager in December but ACC board chairman John Judge told Checkpoint he was not made aware of the breach until Tuesday morning.
Mr Judge says there will be a meeting on Wednesday about why it took three months for the details to emerge.
He says the board will expect a full report from the chief executive.
He says if Privacy Commissioner Marie Shroff decides on an independent inquiry into the breach, he will fully co-operate with it.
Ms Shroff says she has already sent a letter to ACC asking it to explain the breach and what systems it has in place.
Ms Shroff says she will decide whether to launch an inquiry after considering ACC's response.
Listen to John Judge
News to Minister
A spokesperson for ACC Minister Judith Collins says she has asked Mr Stewart for a report on the matter.
Her office says she did not know about the information leak until Tuesday.
Opposition parties say some ACC claimants could be entitled to compensation over the breach.
The Labour and Green Parties say it is a serious breach, and ACC should have acted faster.
Labour's ACC spokesperson Andrew Little says those with sensitive claims could get compensation.
He says he is stunned by claims that senior management at the corporation knew about the possible privacy breach, and did nothing about it.
Greens ACC spokesperson Kevin Hague says an internal inquiry will not be enough to restore public confidence in the corporation. He says an independent inquiry is needed to establish what happened, and who knew about it.
Repeated breaches - lawyer
A specialist accident compensation lawyer in Dunedin, Peter Sara, says ACC sends him confidential information about people who are not his clients half a dozen times a year.
Mr Sara is also a member of the Law Society's Accident Compensation Committee.
He told Checkpoint this mistake has been happening for the last six to seven years and he has always sent it back to ACC.
Mr Sara says ACC needs to seriously look at its internal processes because it is just carelessness and any breach of private medical information is a serious matter.
Listen to Peter Sara