Request for assessment

After the Otago Daily Times reported that patient files regarding West Coast DHB patients had been discovered in a Christchurch suburb, Archives New Zealand began an assessment of the DHB’s IM procedures and systems.

The assessment involved both the Canterbury DHB and the West Coast DHB because they have a shared service agreement, and a shared Executive Sponsor.

The issue

A member of the public found the files, which included 300 patients’ names and health numbers, and the private health information of at least 15 patients, including clinical notes. Some of the misplaced information remains missing.

The West Coast DHB had investigated the discovery as a serious employment issue. It issued a media statement, a formal apology to patients, and alerted the Office of the Privacy Commissioner about the breach.

While the loss of files led to a breach of privacy, Archives New Zealand’s remit allows the assessment of the IM practices that led to the files being misplaced and lost. Under the requirements of the mandatory Information and records management standard issued under section 27 of the PRA:

  • 3.4 “Information and records must be protected from unauthorised or unlawful access, alteration, loss, deletion and/or destruction.”
  • 3.5 “Access to, use of and sharing of information and records must be managed appropriately in line with legal and business requirements.”

With confidential patient information being left in a public place and lost, clearly the West Coast DHB was in breach of both requirements under the standard, so we instigated an assessment.

Assessment and recommendation

Focusing on the information mismanagement factor, the Chief Archivist directed the DHB to report under section 31 of the PRA. This direction sought information about the changes the DHB will make to its IM systems and policies, business rules and procedures to ensure the security and protection of information and records, as well as how the DHB intends to monitor and enforce these changes. We were satisfied with the actions the DHB had taken. The Chief Archivist also notified the Privacy Commissioner that he had reminded the West Coast DHB of its responsibilities under the PRA.

Back to: Regulating Government Information