Health Minister Chris Hipkins has blasted the "disgraceful and grubby" leaking of confidential COVID-19 patient data by National MP Hamish Walker and ex-National Party president Michelle Boag.
In early July, some news media were leaked a confidential list of details concerning 18 active confirmed cases of COVID-19. The list included the names, dates of birth, ages and quarantine locations for each of the patients.
The State Services Commission investigation into the breached data led by Michael Heron QC confirmed on Thursday that Walker and Boag were each responsible for the unauthorised disclosure of the information.
It confirmed that Boag received the information in her capacity as the acting CEO of the Auckland Rescue Helicopter Trust. The email containing the data was sent to 14 email addresses associated with emergency services.
Boag then forward the data to Walker to defend himself, after he was accused of racism over a press release warning thousands from "India, Pakistan and Korea" could be destined for managed isolation facilities in the south without consultation.
Walker told Heron he leaked the confidential data to the press to defend those comments.
"I accept that my judgement was impaired due to the pressure and distress of being labelled a racist," he told Heron. "I accept one of the purposes of sending this information on to the media was to respond, under distress, to accusations of racism."
The Health Minister did not hold back in his criticism of the findings.
"The report is very clear in its findings. It sheets the responsibilities firmly home to Michelle Boag and to Hamish Walker. This was a disgraceful and grubby act carried out by two National Party members for political purposes," Hipkins said on Thursday.
"They gave no thought to the stress and harm they may have caused to the individuals as they hatched their plan to gain political advantage."
Heron said he trusted the explanations that Walker and Boag gave him.
"One has to bear in mind Mr Walker and Ms Boag have made it public; they've certainly expressed sincere regret. I found them candid and sincerely regretful and frankly they have had consequences - pretty severe consequences," he told reporters.
"Had they misled me that might have been a much more serious matter. I certainly had no reason to believe I was being misled - In fact, I had the opposite."
Heron said he did not think a forensic examination of their email accounts was necessary.
"That is something that only goes so far. For example, which accounts, and how far back, and do I search deleted? We can search forever, but much like the systems that prevail, we have to take people at face value sometimes."
Privacy Commissioner John Edwards said he has no ability to issue penalties against individuals or organisations and has no jurisdiction over MPs.
"It remains open to any of the individuals whose information was subject to the Walker/Boag breaches to make complaints to my office."
Hipkins also acknowledged the probe's finding that the Ministry of Health could have protected the confidential information better and that the policy of sending it out should have been reviewed sooner once community transmission had ended.
"The report finds they could have moved more quickly to narrow the distribution list and to be extra safe with that information when community transmission was contained," Hipkins said.
"But I want to be absolutely clear here: the system, like all systems, relied upon the integrity of all of the organisations who received that sensitive information.
"All of those health organisations and professionals acted as New Zealanders would expect - all expect for one. Mr Heron makes it very clear that non system can completely prevent such deliberate acts by malevolently motivated individuals."
Director-General of Health Ashley Bloomfield said he has accepted the findings.
"The immediate action was to stop sending the information that had been being sent on a daily basis to a group of organisations as it had been sent right from early on in the pandemic to support their operational activity," he told reporters.
"Under the circumstances where all our cases are currently in managed isolation and quarantine we don't feel that those organisations need to receive it.
"At the same time, we have reviewed the list of organisations and people who would receive the information should it be required again in the future and to ensure there is a clear reason for them to receive it."
Dr Bloomfield said the Ministry of Health has issued a breach of contract notice to the Auckland Rescue Helicopter Trust in line with its legal obligations under the contract with them.
