Recently I had an ACC claim. I strained some knee ligaments. Old injury, no problem, specialist appointment courtesy of the ACC, and after some appropriate exercise and a follow up appointment, all fixed.
If the file of that treatment got stolen, sent to someone in an email or otherwise treated carelessly, I would be angry. However I can guarantee I wouldn’t feel so ashamed I would want to die, frightened for my personal safety, or worried about being stigmatized by people who found out.
So it is a worrying start to the privacy investigation when the Assistant Privacy Commissioner has issued a letter reported on here saying things like this:
“…information emailed to Bronwyn Pullar was at ‘lower end of breach’…
“The privacy breaches that are being investigated in this instance, while very concerning in an overall information handling context, involve the disclosure of mostly inoffensive information, albeit on a large scale…”
This says to me that the bodies investigating this breach may not fully understand the impact of the recent privacy breaches on sensitive claimants, in that the breach for this group of clients is substantially different to those who have suffered a physical injury.
But of more concern is the fact that the letter can also be read as actively discouraging future whistle blowers by implicating Ms. Pullar:
“Mr Flahive also noted the commission was investigating possible breaches of the Privacy Act by Ms Pullar as well as ACC and he asked the claimant to identify which of those two parties she was complaining against.”
Interestingly someone has pointed out to me that the Privacy act (1983) states:
“In this Act, unless the context otherwise requires, collect does not include receipt of unsolicited information” [Emphasis added.]
It has been clear from the start that Ms. Pullar (see: “Blow your own whistle“) removed names and identifying information from the now infamous spreadsheet before being handed over to the Dominion Post. There is also little doubt the information was “unsolicited” being accidentally sent to Ms. Pullar in an unrelated email.
Privacy is deeply important to those accessing psychological therapy. This importance that is placed on privacy is the reason historically for the existence of the Sensitive Claims Unit, a separate and private specialist unit within ACC. In my opinion Ms. Pullar understands this, and it is in fact this understanding that has motivated her actions. There is also no shortage of people who would like you to think otherwise.
And just when you thought it couldn’t get any worse, I’ve heard a rumour, albeit reliable, that some “long term” sensitive claimants are now being managed at their regional ACC branch office, which is also a clear breach of this understanding.
It was also reported here over the weekend that a psychiatrist contracted to the ACC lost full copies of client files after her unattended suitcase was stolen from a bus, and the ACC’s CEO Ralph Stewart admitting that there will be more privacy breaches…
Sensitive claimants no longer being managed by the sensitive claims unit, client files being left unattended on buses, clients being offered the option of complaining against the whistle blower that bought this all into the light…
Inoffensive information on a large scale. Really? Is it really that hard to understand why confidentiality is so important?
And is it really that hard to keep a secret?