Names have been removed to protect privacy. Identifying letters are assigned in alphabetical order and bear no relationship to the person’s actual name.                                                                                           

Introduction. 

How matter arose. 

Opinion.

Changes made since events. 

Recommendations. 

Follow-up actions. 

Appendix A: Messages transcript — Ms D and Mrs B. 

Appendix B: Messages transcript — Ms F and ‘mutual friend’ 

Introduction

1. This report is the opinion of Dr Vanessa Caldwell, Deputy Health and Disability Commissioner, and is made in accordance with the power delegated to her by the Commissioner.
   
   
2. The report discusses the conduct of Ms D, a healthcare assistant of Health New Zealand|Te Whatu Ora (Health NZ). Ms D took a photograph of Mr A without consent whilst he was a patient in ICU and shared this with a third party, along with details of Mr A’s health status.
   
   
3. The following issues were identified for investigation:

• • Whether Ms D provided Mr A with an appropriate standard of care, including whether she treated him with respect and dignity in May and June 202X.

• • Whether Health NZ provided Mr A with an appropriate standard of care, including whether it treated him with respect and dignity in May and June 202X.

4. The parties directly involved in the investigation were:

Mr A                                                          Consumer

Mr B                                                          Consumer’s son

Ms D                                                          Healthcare assistant

Health NZ                                                  Group provider

5. Further information was received from Mr A’s son, Mr C.

How matter arose

6. On 21 June 202X, the Health and Disability Commissioner received a complaint from Mr A about the conduct of Ms D, a healthcare assistant, while he was an inpatient at a hospital.
   
   
7. Mr A raised concerns that during his stay in hospital, Ms D took photographs of him whilst he was in an induced coma and shared these with her family members, and that she interfered with his next-of-kin information and prevented his next of kin from receiving information on his health status.
   
   
8. Mr A was admitted to the hospital Intensive Care Unit (ICU) following an accident that caused a severe traumatic brain injury (TBI) and facial fractures. Mr A’s son and next of kin, Mr C, was contacted and arrived at the hospital shortly after Mr A’s admission.
   
   
9. Mr A has another son, Mr B. Mr B is married to Mrs B, whose mother is Ms D.
   
   
10. Ms D advised that Mr B told her that Mr A was on the way to the hospital and requested that she keep him updated on Mr A’s health status.

Sharing of photograph and health information

11. When Mr A arrived at the hospital, Ms D took a photograph of Mr A whilst he was in an induced coma, and sent this to her daughter, Mrs B, along with details of Mr A’s condition. A transcript of Ms D and Mrs B’s conversation is provided as Appendix A to this report.
    
    
12. During the conversation, Ms D advised Mrs B that Mr A had ‘a head injury and facial fractures and a[n] uncleared spine but they will check on that’. Ms D went into further detail about Mr A’s condition, saying: ‘[He] has an icp bolt[1] in for pressure on the brain face is very swollen [Mr C] staying the night in waiting room do you [want] me to see if I can get a picture.’
    
    
13. The following day, Ms D again messaged her daughter, Mrs B, with other clinical information about Mr A, advising: ‘[H]e is ok going sometime today for ct drs stitching his lip I think.’
    
    
14. As a healthcare assistant, Ms D was working under the direction and delegation of a registered nurse in the ICU at the hospital. At the time of taking the photograph of Mr A, RN E was Mr A’s duty nurse. Ms D told HDC that before she took the photograph of Mr A, she asked RN E if she could take the photo, and RN E gave her permission to share the photo with Mr B.
    
    
15. However, Health NZ told HDC that RN E does not remember this conversation, and subsequently Ms D advised HDC that due to the passage of time, she now cannot be certain it was RN E.
    
    
16. Ms D explained to HDC that she sent the photo to prepare Mr B for what his father looked like to ease his anxiety around hospitals.
    
    
17. Ms D told HDC:

‘I acknowledge that I blurred the boundaries between trying to be helpful as a family member with the fact that I was in a role working in the hospital at the time as a [healthcare assistant] when I passed the information on.’

18. Ms D also acknowledged that it was inappropriate for her to send the photo and information on Mr A’s status without Mr A’s next of kin’s consent, and she apologised for this.
    
    
19. Screenshots of Ms D’s messages with her daughter, Mrs B, were shared with others. Mr A provided HDC with screenshots of messages between Ms D’s other daughter, Ms F, and a mutual friend of Ms F and Mr C. Ms F shared screenshots of Ms D’s messages with Mrs B with the mutual friend and discussed the matter with the friend. A transcript of Ms F and the mutual friend’s conversation is provided as Appendix B to this report.

Ms D’s interference with the next-of-kin process

20. Beyond Ms D sharing private information and photographs without consent, Mr A also raised concerns that Ms D interfered with the next-of-kin process. 
    
    
21. Mr A and Mr C stated that Ms D asked the ICU doctors not to share information with Mr C until Mr B was present, and this caused a delay of approximately four hours in Mr C, as next of kin, receiving information.
    
    
22. Mr C said that when he arrived at the hospital at approximately 9am, Ms D told him that she had asked the doctor to wait until Mr B had arrived before providing an update on Mr A’s condition. Mr B arrived at approximately 11.30am and they spoke to the doctor at approximately 1pm.
    
    
23. In contrast, Ms D told HDC that she had no direct conversation with the medical team in relation to Mr A’s care, although she confirmed that she was present as part of the team settling Mr A into the ward when the medical team was undertaking a handover.
    
    
24. However, in her text communication, the day after Mr A was admitted, Ms D advised Mrs B and Mr B: ‘The [doctor] said when the family is here he will give them an update on what’s happening.’ Ms D also confirmed: ‘[I have not] seen [Mr C] this morning so if [Mr B] comes with him the [doctor] will talk with them.’
    
    
25. Mr A also raised concern that Ms D added Mr B as a next of kin on his record.
    
    
26. Mr C told HDC that on the fourth day after Mr A was admitted, one of the nurses in the ICU, now known to be RN G, came up to him with a clipboard in front of her to confirm Mr A’s next-of-kin information. Mr C explained that RN G had him listed as the next of kin on the sheet on the clipboard, but there was a sticky note on top with Mr B’s contact information. Mr C said that RN G explained that she was seeking his permission to add Mr B’s contact information on the system, as it had ‘been left on there’.
    
    
27. The clinical records provided to HDC confirm that on this date, RN G noted that Mr C was the only next of kin, and that there was a stressful dynamic between the family and Mr B’s wife, Mrs B.

Complaint management

28. Health NZ advised HDC that the initial complaint was made to Associate Charge Nurse Manager RN H by Mr C the day after Mr A was admitted. Health NZ confirmed that at that time an apology was provided to Mr C, and RN H ‘ensured that [Ms D] was working at the other end of the unit’.
    
    
29. Health NZ told HDC that once aware of a privacy breach, their expectations were that ‘the line manager notify the Privacy Officer so a risk assessment [could] be completed’. Health NZ confirmed that this was not done at the time, but their Privacy Officer was notified subsequently.
    
    
30. The clinical notes provided by Health NZ show that on the fourth day after Mr A was admitted, Mr C spoke with RN H about the issue, and RN H assured him that it would not happen again, and that processes would be put in place to ensure that Ms D could not take any more photographs of Mr A.
    
    
31. Mr A woke up from the induced coma approximately a week after admission and over the following week was told by his family that Ms D had shared a photo of him with others via the internet. Mr A stated that he asked to speak to someone about what had happened and to lodge a complaint.
    
    
32. Health NZ told HDC that Nurse Manager RN I was informed of the matter and met with Ms D approximately ten days after admission and ‘reiterated the seriousness of the complaint, and confirmed the photograph was deleted’. Health NZ said that RN I did not follow policy and failed to document these conversations or report the breach in the reportable event system and escalate to the Privacy Officer.
    
    
33. The clinical notes state that two weeks after admission, Mr A expressed his concerns and desire to make a complaint regarding the matter to his attending nurse, who passed this on to the Charge Nurse.
    
    
34. Health NZ confirmed that RN I met with Mr A and Mr C on two occasions and again with Mr C, with the permission of Mr A, on a third occasion. Health NZ stated that RN I apologised to Mr A and Mr C on these three occasions and provided information on how to submit a formal complaint if they were not satisfied with the response. However, Health NZ stated that again, RN I failed to record these conversations in the clinical notes and said: ‘This lack of documentation is not routine and these conversations should have been recorded.’
    
    
35. Mr A said that RN I ‘tried to apologise on [Ms D’s] behalf and then left it at that’, and RN I advised them[2] to focus on his recovery and forget about what had happened. Mr A was told that Ms D was aware that what she had done was wrong and would come to apologise to him, but she never did. Mr A said he felt as though the hospital was ‘trying to cover up [Ms D’s] illegal activity’.
    
    
36. Health NZ told HDC that Ms D reported her connection with Mr A to the Nurse Co-ordinator at the time of admission. This information was also not documented at the time.
    
    
37. Ms D told HDC that she told the nurse on duty that her ‘son-in-law’s father was in surgery and was going to be transferred to ICU’. Ms D stated: ‘[The nurse on duty] was therefore aware prior to [Mr A] arriving in ICU that there was a close family connection with me.’
    
    
38. Health NZ also told HDC that the day after Mr A was admitted, Ms D requested to be moved to the other end of the unit, as per standard practice, as she felt there was a conflict of interest. Health NZ also advised that Ms D communicated the conflict of interest at a handover meeting with the Acting Charge Nurse Manager. Health NZ confirmed that this information was also not documented at the time.
    
    
39. Ms D stated that she had no further involvement in Mr A’s care after she was moved.
    
    
40. In relation to Mr A’s and Mr C’s concerns regarding the next-of-kin information being changed, Health NZ confirmed that it investigated its ICT[3] system thoroughly and found no records indicating that Mr A’s next-of-kin information had been changed by ICU staff.
    
    
41. Health NZ noted that at the time of admission, Mr A had two NHI numbers, one of which had Mr B listed as the next of kin. The two NHI numbers were merged during Mr A’s stay, which Health NZ stated was standard process, and there was ‘a possibility that this change was automated through this process’.
    
    
42. The clinical records provided by Health NZ show Mr C as the next of kin throughout. On some occasions, Mr A’s daughter is recorded as a secondary next of kin.  Mr B is not referred to in the clinical records as next of kin.

Further information

43. Mr A told HDC that he is very appreciative of what the ICU team did for him and feels that they saved his life.

Relevant management standards, policies, and procedures

44. The Health NZ region concerned had policies, management standards, and standard operating procedures in place at the time of the events, which are discussed below.
    
    
45. The Health NZ region has three internal documents relevant to maintaining the confidentiality of patients’ health information.
    
    
46. The first is the ‘Confidentiality Policy’,[4] which states that all employees must hold records in strict confidence, and that all patients have a right to be treated with dignity and respect, which includes respecting their right to confidentiality and privacy.
    
    
47. The second is the ‘Security Access Agreement’,[5] which requires employees to agree to ‘only access and use information that is necessary for the performance of [their] duties’ and ‘not remove, copy or disclose any information except when necessary for the performance of [their] duties and in accordance with relevant statutory and policy obligations’. Further, employees are to agree that when using mobile devices, they will act in accordance with confidentiality requirements and other Health NZ policies. HDC has not been provided with evidence that Ms D signed this agreement.
    
    
48. The third is the ‘Use and Disclosure of Personal Information’ procedure’,[6] which is a guide for staff on ‘when to use and disclose personal information collected about an individual’. The procedure directs that ‘health information collected about an individual must not be disclosed unless the patient has provided consent, or where it is permitted by law’.
    
    
49. Health NZ confirmed that ‘[Ms D] was not familiar with [the Health NZ region’s] privacy policy’ at the time. Health NZ acknowledged that ‘as a unit … at the time of this event there was a general lack of familiarity as to the specifics of sharing photos with family members and this has been recognised as a gap’.
    
    
50. The Health NZ region has a four-step procedure for staff to follow when there is a breach of privacy, titled ‘Dealing with a Privacy Breach’.[7] Step one requires notifying the line manager of a potential breach; the line manager is then responsible for investigating and notifying the Privacy Officer. Step two requires assessing the risks. At step three, when appropriate, the Office of the Privacy Commissioner is notified. If the Office of the Privacy Commissioner is not notified, the reasons for this must be documented. Step four requires action to prevent further breaches, including staff training. The procedure states that an example of a privacy breach is ‘employees accessing or disclosing personal information outside their authorisation’.
    
    
51. The Health NZ region provided HDC with a policy regarding recording devices, titled ‘Use of Recording Devices in Clinical Encounters’.[8] The purpose of this policy is to clarify the Health NZ region’s position regarding recordings by a patient or their friends and whānau and to protect the privacy and confidentiality of both consumers and health professionals. Central to the policy is addressing the issue of covert recording, which is done without knowledge and agreement. The policy does not clarify the Health NZ region’s position on an employee taking covert recordings.
    
    
52. In terms of the Health NZ region’s policy on recording information in the medical record, the Health NZ region has the ‘Medical Records (Electronic and Hard Copy) Content and Documentation Policy’.[9] This policy ‘outlines the expected standard and management of the content of medical records’ and directs employees on what must be recorded on the medical record. The policy defines medical records as information describing every aspect of the health care provided to a patient, and includes information, in any format, relating to the health and welfare of an individual. The policy lists specific examples, including emails, X-rays, and notes of meetings. The policy notes that ‘no complaints information/documentation should be kept in the [patient] medical record’. The Health NZ region did not provide HDC with a copy of a policy relevant to where complaint information should be recorded.
    
    
53. The Privacy Act 2020 states that where an organisation has a privacy breach that has caused, or is likely to cause, serious harm to someone, the organisation will need to notify the Privacy Commissioner as soon as possible.[10] The Privacy Commissioner’s ‘Privacy Breach Guidelines’ also state that where a breach is notifiable, organisations ‘must inform the Office of the Privacy Commissioner as well as affected people’, and its expectation is that this will be done within 72 hours.[11]

Responses to provisional opinion

Mr A

54. Mr A was given an opportunity to respond to the ‘How matter arose’ and ‘Changes made since events’ sections of the provisional opinion. Mr A reiterated that Ms D has never apologised to him or any member of his family and never asked if she could take a photo of him to share with his son, Mr B. Mr A also stated that the text messages clearly show that Ms D offered to take the photo and share it, not only with Mr B, but with other members of her family, together with his private medical information, which was wrong.
    
    
55. Mr A also stated that he was ‘disappointed with [RN I’s] handling of this whole matter’ and said that ‘not only did [RN I not] follow procedure, but [RN I] tried to make light of it [and] sweep it under the carpet’. Mr A was concerned that RN I had not recognised any shortcomings in dealing with this complaint.
    
    
56. Mr A stressed that the impact of this incident has affected not only himself, but his whole family, and he is ‘hurting’ and ‘heartbroken’ because of the implications for him and his family.

Ms D

57. Ms D was given an opportunity to respond to the provisional opinion. She had no submissions or comments.

Health NZ

58. The Health NZ region was provided with the opportunity to respond to the provisional opinion but made no comment. However, in response to the final opinion the Health NZ region stated:

‘We would like to again express how sorry we are that this privacy breach occurred. It must have been extremely distressing for [Mr A] and his whānau during an already stressful time.’

59. The Health NZ region said that its existing policy for complaints management states that ‘the responder will maintain documentation of all activity in regards to the complaint, including records of phone calls, minutes of meetings and staff interviews’. The Health NZ region confirmed that its review process will ‘ensure this point is reiterated, and more information on where this should be documented will be made available’.

Opinion

Introduction

60. I acknowledge that this would have been a difficult time for Mr A and his family, given the seriousness of his injuries and situation. It is evident that Mr A had to deal with the issues raised in this complaint whilst recovering from a traumatic injury, and I recognise that this would have been distressing for him and his immediate family.

Ms D — breach

61. I have assessed the information gathered as part of Mr A’s complaint and have found Ms D in breach of Rights 1(1), 1(2), and 3 of the Code of Health and Disability Services Consumers’ Rights (the Code). The reasons for my decision are set out below.

Sharing photograph and health information

62. As a healthcare assistant, Ms D was required to provide services in accordance with the Code. In particular, she was required to treat consumers with respect, protect their privacy, and provide services in a manner that respected their dignity.
    
    
63. In addition, Ms D was subject to the Health NZ region’s policies on maintaining patient confidentiality. Under the Confidentiality Policy, Ms D was required to hold records in strict confidence and treat patients with dignity and respect. Further, the Use and Disclosure of Personal Information Procedure guided staff not to disclose information collected about an individual without patient consent.
    
    
64. Ms D acknowledged that she took a photograph of Mr A whilst he was in an induced coma and shared this with her daughter, Mrs B, along with details of Mr A’s private health information. Ms D did this without the consent of Mr A or Mr A’s next of kin.
    
    
65. Ms D stated that she asked permission to take the photograph from the duty nurse at the time, RN E, although I note that RN E does not remember having this conversation, and Ms D is now uncertain whether it was RN E. I am unable to conclude whether this conversation took place, or with whom. In any event, I am critical that Ms D considered it appropriate to make the request, given Mr A’s situation of being unable to provide consent.
    
    
66. Ms D has submitted that her intention in sharing the photograph was to comfort Mr B and prepare him for the condition of his father. However, the act of taking the photograph and sending it to a third party was inappropriate and did not demonstrate respect for Mr A’s dignity. The transcript of the conversation between Ms D and Mrs B makes no reference to this intention, and I consider that Ms D took the photograph for an unnecessary and personal purpose, and I am critical of this.
    
    
67. Although Ms D was not involved in the further sharing of Mr A’s private clinical information and had no part in the subsequent sharing of the photograph with her other daughter, Ms F, and the mutual friend concerned, Ms D enabled Mrs B to forward the information to Ms F by sharing it inappropriately in the first place. I am critical that Ms D stored private medical information and the photograph of Mr A on her personal mobile device, and that she shared this information without consent. This was contrary to the Health NZ region’s policies on confidentiality.

Conclusion

68. Taking a non-consented photograph of Mr A and sharing his clinical information with a third party was wholly unacceptable behaviour from a healthcare worker, and in doing so Ms D failed to respect Mr A and his privacy. Accordingly, I find that Ms D breached Rights 1(1)[12] and 1(2)[13] of the Code. In addition, I consider that the services provided were not performed in a manner that respected Mr A’s dignity, and therefore Ms D also breached Right 3[14] of the Code.

Ms D’s interference with next-of-kin process — adverse comment

69. Regarding the concerns raised about interference with the next of kin recorded on Mr A’s clinical file and efforts to prevent information being shared with Mr A’s next of kin, I am satisfied that Mr C was recorded correctly as the next of kin throughout the clinical record.
    
    
70. I note that Mr C said that he was advised by Ms D that she had asked the doctor to wait until Mr B arrived before providing information, and there are concerns about a delay in information reaching Mr C as next of kin.
    
    
71. However, whilst Ms D told HDC that she had no direct conversation with the medical team in relation to Mr A’s care other than being present when he was settled into the ward the day he was admitted, she updated her daughter, Mrs B, by text the following day advising what the doctor had said about providing an update to the family. In my view, it is likely that Ms D had a discussion with the doctor who was overseeing Mr A’s care on the morning of the day after admission, when she knew that it was inappropriate to do so, having already asked to be moved to the other end of the unit due to the conflict of interest. I am critical that Ms D discussed Mr A’s care with the doctor and shared an update on this with her daughter.
    
    
72. I note that the junior doctor did not provide clinical information to Mr C and Mr B until an hour and a half after Mr B arrived the day after Mr A was admitted, so it is difficult to say whether this information would have been available any sooner, and I am satisfied that the information was provided in a timely manner.

Health NZ — breach

Complaint management

73. As a healthcare provider, Health NZ is responsible for providing services in accordance with the Code. At the time of the events, overall the Health NZ region concerned had comprehensive policies and procedures for protecting privacy and managing privacy breaches. However, I consider that there has been a clear failure to train staff adequately in these policies and procedures. The Health NZ region’s policies clearly establish that staff must hold records in strict confidence and treat patients with dignity and respect, and the Health NZ region requires staff to sign a security access agreement that supports these policies.
    
    
74. Mr A and Mr C complained about Ms D’s privacy breach on numerous occasions, including to Associate Charge Nurse Manager RN H and Nurse Manager RN I.
    
    
75. Health NZ acknowledged that there was a failure to notify its Privacy Officer of the breach at the time, in line with its expectations. Therefore, the breach was not escalated appropriately and according to the Health NZ’s region’s procedures for ‘Dealing with a Privacy Breach’. Health NZ also stated that there is no documented evidence that the Privacy Commissioner was notified within 72 hours of the breach, in accordance with the requirements of the Privacy Act 2020 for a serious privacy breach.
    
    
76. I am critical that on numerous occasions members of staff, including those in managerial positions, were informed of the privacy breach but failed to follow the procedure or the Privacy Act 2020 for managing privacy breaches. Health NZ acknowledged that Ms D and others in her unit were not familiar with the Health NZ region’s privacy policies and requirements. This indicates that the Health NZ region failed to train its staff adequately on its policies and procedures that protect a patient’s privacy and dignity. This goes against Right 4(2) of the Code, which states that a consumer has the right to have services provided that comply with legal, professional, ethical, and other relevant standards.
    
    
77. Right 10(6) of the Code establishes the minimum standards with which a provider’s complaints procedure must comply. In particular, under Right 10(6)(1)(c) a complaints procedure must ensure that the complaint and actions regarding the complaint are documented.
    
    
78. I am concerned that the actions taken further to the complaints were not recorded adequately. From the information provided to HDC, it appears that the Health NZ region concerned does not have a policy or procedure to provide guidance to staff to ensure that complaints, and actions regarding a complaint, are documented, and I am critical of this.
    
    
79. I am also concerned that the Health NZ region does not appear to have a policy that addresses covert recording by staff. Health NZ should have a policy that clearly establishes its position that staff shall not use personal recording devices in clinical encounters, and what should happen should a breach occur in those circumstances.  

Conclusion

80. By not training staff adequately on its policies and procedures, and not having adequate policies on the use of recording devices, the Health NZ region failed to provide services to Mr A that complied with legal, professional, ethical, and other relevant standards. Accordingly, I find that Health NZ breached Right 4(2)[15] of the Code. In addition, I consider that by failing to have a procedure that ensured that Mr A’s complaint and actions regarding the complaint were documented, Health NZ breached Right 10(6)(c)[16] of the Code.

Changes made since events

81. The Health NZ region confirmed to HDC that it has taken actions to address the issues raised by Mr A’s complaint, namely:

1. 1. As a requirement, privacy training will form part of its induction/orientation for new members to the team in ICU.
   2. By providing refresher training to the ICU team in relation to reporting responsibilities related to privacy breaches, and an overview of the importance of documentation and record-keeping.
   3. Breach and Privacy Expectations were covered with all senior team members at a team meeting and will be revisited at scheduled intervals throughout the year.
   4. The ICU team have committed to training, including specific privacy education by using this complaint as a case study and learning opportunity.
   5. Education was provided to staff around use of cell phones in ICU, including education to the senior team around photos and reminders of privacy requirements.
   6. Privacy and HR training was provided for the senior team, and the educators of ICU have booked further privacy training for other members of the team.
   7. Steps have been taken to ensure that documentation of complaints and associated conversations are recorded as per Health NZ’s policies on documentation.
   8. Health NZ informed its Privacy Officer of this matter.

82. Ms D has completed online courses on privacy of personal and health information and carefully reviewed the Health NZ region’s own privacy policy on the matter. Ms D confirmed that in future she would not pass on a patient’s health information without adequate consent.

Recommendations

83. I recommend that Ms D:

1. 1. Provide a formal written apology to Mr A for the failings identified in this report. The apology is to be provided to HDC, for forwarding to Mr A, within three weeks of the date of this report.
   2. Provide HDC with evidence of the online privacy courses and review of Health NZ’s policies, management standards, and operating procedures she completed further to this complaint. This evidence is to be provided to HDC within three months of the date of this report.

1. I recommend that the Health NZ region:

1. 1. Provide a formal written apology to Mr A for the failings identified in this report. The apology is to be provided to HDC, for forwarding to Mr A, within three weeks of the date of this report.
   2. Review the current policy on complaints management procedure and implement changes to ensure that complaints and actions regarding complaints are documented. Evidence confirming the review and implementation of any changes to the existing policy or introduction of a new policy is to be provided to HDC within six months of the date of this report.

Follow-up actions

85. A copy of this report with details identifying the parties removed, except Health NZ, will be sent to Health NZ|Te Whatu Ora, the Health Quality & Safety Commission, and the Office of the Privacy Commissioner and placed on the Health and Disability Commissioner website, www.hdc.org.nz, for educational purposes.