Hamish Walker has admitted he leaked confidential COVID-19 patient details over "pressure of being labelled a racist" - but an investigation has found the Ministry of Health could have guarded the data better.
Deputy State Services Commissioner Helene Quilter on Thursday released the findings of an investigation into the breach of sensitive personal information - the breach that led to Walker resigning as a National MP.
The findings of the probe confirmed that the breach happened after then-Acting chief executive of the Auckland Rescue Helicopter Trust (ARHT) and ex-National Party president Michelle Boag passed the information, without authorisation, to Walker.
The actions of Boag have been referred to the Privacy Commissioner for a further investigation, but Walker's actions may fall outside of that jurisdiction - but it's yet to be determined.
The week before the data was leaked earlier this month Walker released a statement warning Southlanders that thousands from "India, Pakistan and Korea" could be destined for managed isolation facilities in the south without consultation.
The comments were labelled "racist" by the minister in charge of managed isolation, Megan Woods, and Walker has now admitted that he leaked the confidential data to the press to defend those comments.
"I accept that my judgement was impaired due to the pressure and distress of being labelled a racist," he told the probe. "I accept one of the purposes of sending this information on to the media was to respond, under distress, to accusations of racism."
The investigation has also found the Ministry of Health could have protected the confidential information better and that the policy of sending it out should have been reviewed sooner.
Director-General of Health Dr Ashley Bloomfield has promised the Ministry of Health is fixing areas identified in the investigation that should have been tighter.
But Quilter said she would not criticise the Ministry of Health because, "lives have been saved as a result of their actions on the broader COVID-19 front".
Michael Heron QC, who led the investigation, said it was "not optimal" that the information wasn't password protected, but he acknowledged the pressure it was under.
The probe confirmed that Boag was sent the information in her capacity as ARHT CEO. The email containing the data was sent to 14 email addresses associated with emergency services.
But the probe also stated, "The leak was committed by motivated individuals knowing they had no entitlement to disclose the information they did. It is doubtful whether any policy (or, potentially, security system), could have completely prevented that."
ACT leader David Seymour said the data leak has revealed the "extraordinary incompetence" of the Government's handling of sensitive data.
"The fact that patient data was being stored and distributed on an unlocked spreadsheet is extraordinary. A vaguely competent operation would have the spreadsheet locked."
What happened?
The Government announced in July an investigation would be launched after RNZ revealed it had been sent a document that included the full names, addresses, age and the names of the hotel and one hospital 18 people had been quarantining in.
The documents were seen by several media outlets that chose not to publish it. RNZ made a commitment to Walker before receiving the information, not to name him as the source, it said.
The Government did not know at the time who had leaked the information and Health Minister Chris Hipkins said a "thorough investigation" would look into it, with Michael Heron QC appointed to lead the State Services Commission inquiry.
An "angry" Hipkins apologised to those whose personal details were leaked to the media, and he promised to find those responsible and hold them to account.
The Opposition launched a scathing attack, with National's then-health spokesperson Michael Woodhouse describing the leak as "unconscionable and unacceptable".
The next day, on Tuesday July 7, a bombshell dropped.
Walker sent out a press statement admitting that he leaked the information to the media to "expose the Government's shortcomings" so they would be "rectified".
"Private health information does not have basic safeguards in place and the Government needs to immediately change its protocols and store the information on a secure, safe network that at a minimum requires a password," he said.
"I sincerely apologise for how I have handled this information and to the individuals impacted by this. I will be fully cooperating with the Michael Heron QC inquiry."
Walker was stripped of his portfolios by then-National leader Todd Muller and he will not seek re-election in Southland at the election.
On the same day as Walker's revelation, another bombshell dropped.
Boag confessed that she passed on the data to Walker. She said she was able to access the information as the acting CEO of ARHT.
Boag resigned as the acting CEO of ARHT and has ended her National Party membership.
"This was a massive error of judgement on my part and I apologise to my colleagues at ARHT whom I have let down badly," Boag said. "I very much regret my actions and did not anticipate that Hamish would choose to send it on to some media outlets."
Three days later, on July 10, a third shock came.
Woodhouse said in a press statement that Boag had sent him "four unsolicited emails" containing confidential COVID-19 patient details - different information to what she had sent Walker. He said Boag sent him the information in late June and he deleted it.
He confirmed Boag was not the source of any previous information released to him in relation to the Government's COVID-19 response - such as his unresolved claim of a homeless man spending time in a managed isolation facility.
Woodhouse did not leak the information to the press - but he came under fire for not informing the Government that he had received the confidential data.
Then leader-Muller also came under pressure for not disclosing sooner that Woodhouse had also received information. He was asked during a press conference on July 9 if he had sought assurances that Boag had not passed on data to Woodhouse - but he dodged the question.
The next day Woodhouse confessed that he, too, received similar confidential information, putting pressure on Muller for not coming clean about Woodhouse sooner, because it turned out a press release had been drafted days before.
Muller resigned on July 14, a couple of months into the role, citing "health" reasons.
Muller's deputy leader was Nikki Kaye, who admitted to Newshub earlier this month that Woodhouse's press statement should have gone out sooner.
The day Muller stood down as leader, Judith Collins was elected National Party leader.
Collins stood down Woodhouse from the health portfolio and replaced him with Whangarei MP Dr Shane Reti.
She said she did not seek an assurance from Muller that he didn't prevent Woodhouse from coming clean sooner and said she was awaiting the results of the Heron QC inquiry.
