18 April 2014

Govt questioned over ACC policy

A news report from Radio New Zealand News
Opposition parties are questioning how long the ACC Minister has known about a privacy waiver used by the corporation that has now been ruled by a court as too broad.
ACC Minister Judith Collins, questioned in Parliament, said she was told about the court decision on Friday and was not aware of the significance of the issue.
But Labour and the Greens say Ms Collins has known about the issue for years, as it was raised in a report about a privacy breach 18 months ago.
Green MP Kevin Hague said after serious privacy breaches by ACC in the past, Ms Collins made public confidence in the corporation a ministerial concern.
Labour's ACC spokesperson Iain Lees-Galloway said it was implausible Ms Collins heard of the issue only last week.
"It was in the review of the Bronwyn Pullar case that issues with this form were first identified. In fact, there were media articles about this late last year as well. It's implausible the minister only heard of this issue last week."
In August 2011, details of more than 6000 ACC clients were mistakenly sent to Auckland claimant Bronwyn Pullar, resulting in the resignations of ACC minister Nick Smith, ACC chair John Judge, two directors and chief executive Ralph Stewart.
Outside the House on Wednesday, Judith Collins said ACC should not be handing over people's sensitive claim information to prospective employers and she hadn't heard about the sensitive claims complaint until Wednesday.
"I am actually very concerned about that and I want to find out what are the facts behind it. Is this correct? I understand that there has been some complaints filed with the Human Rights Commission. If that is true, I look forward to seeing what has occurred and when it has occurred."
Ms Collins says she wants to make sure that people's privacy is protected.
http://www.radionz.co.nz/news/national/241780/claims-acc-sent-sensitive-files

© Radio New Zealand 2014

17 April 2014

Claims ACC sent sensitive files

A news report from Radio New Zealand
The Human Rights Commission has received five complaints in the past two years about Accident Compensation Corporation files sent to prospective employers.
The commission on Wednesday said in at least one case, the file included sensitive claim information such as sexual abuse.
ACC's policy of forcing clients to sign a wide-ranging privacy waiver has been found in breach of the law.
The Dunedin District Court ruled on Monday that the controversial ACC 167 form was beyond the law and the corporation had no right to decline entitlements because a client would not sign it. The corporation had cut compensation to an unknown number of claimants for refusing to sign the waiver.
Christchurch Justice of the Peace and community board member Karolin Potter said she had been approached by two people at legal forums who told her they had had sensitive claim information sent to their employer by ACC.
"In response to employer's request for their ACC information, the ACC had sent out the entire file including sensitive claim material for sexual abuse in their past."
Ms Potter told Radio New Zealand's Nine to Noon programme on Wednesday both complainants said ACC told them it had no discretion to filter the information they provided to prospective employers.
ACC has issued a statement saying it does not send information about claims older than 10 years, mental injuries, declined claims, treatment injury claims or sensitive issue claims, without the client's express permission.
The corporation said it will disclose information only if it is required to help get a client into work, which is the purpose for which it was collected.
Council of Trade Unions' president Helen Kelly says people signing employment privacy waivers are in no position to negotiate its conditions.
http://www.radionz.co.nz/news/national/241780/claims-acc-sent-sensitive-files

© Radio New Zealand 2014

16 April 2014

Question to Minister

10. KEVIN HAGUE (Green) to the Minister for ACC: Have all of the recommendations of the 2012 Independent Review of ACC’s Privacy and Security of Information been implemented; if not, why not?



Hon JUDITH COLLINS (Minister for ACC): ACC advised that it has implemented 37 of the 44 recommendations. A number have ongoing activity associated with them. Of the remaining seven, two are under active management, which relate to information governance and the implementation of data loss protection software. The other five involve a fundamental review of ACC’s end-to-end claims process activity. Accordingly, ACC advised that it has taken a deliberate decision to complete the end-to-end process review of claims management as part of its work around improving trust and confidence. This is to ensure all processes and information technology changes required under these five recommendations comprehensively meet the intent of the report.
Kevin Hague: Is she confident that the recommendations to ensure that consent forms follow the law and are best practice have been properly implemented, given that the court has just found that the way that ACC was using its ACC167 form was actually illegal?
Hon JUDITH COLLINS: I do not want to argue with the member, but, strictly speaking, the form was not held to be illegal, but the way in which it was used was outside of the statutory requirements. I agree with the member that the form must be changed to comply with the latest decision. I have also been advised by ACC that this form has in the past been approved by the Privacy Commissioner, by the Human Rights Commission, and, I have been told, by six different District Court decisions. So the fact that this latest decision has said that it has been wrongly used is something that ACC is taking very seriously, as am I.
Kevin Hague: How does she reconcile ACC’s illegal use of this form with the privacy review’s findings that stakeholders’ single-biggest concern was the attitude and culture of the organisation in dealing with their personal information, and the report’s finding that a consistent theme was that information not relevant to the claim was held on file?
Hon JUDITH COLLINS: I also recall that the review said that the form itself was able to be used. So I think the problem is that the past decisions of the courts and of other agencies, like the Human Rights Commission, the Privacy Commissioner, and also the review, have not actually said that the form has been misused. But I believe that the member is right that the form should be changed. ACC told me on Monday this week that it was not going to appeal the decision and that it would abide by it. I think that is the right outcome.
Kevin Hague: How do revelations today that ACC has been handing people’s full ACC files—including information on sensitive claims—over to prospective employers stack up against the recommendations of the privacy review?
Hon JUDITH COLLINS: I am sorry, I have not heard that claim, but if the member would like to provide me with the information, I will be happy to take some action. I seek leave to assist the member with the summary—
Mr SPEAKER: You are seeking leave to table a document?
Hon JUDITH COLLINS: It is a document that is the independent review recommendations and summary of actions as at 24 January this year, and I think that might help the member.
Mr SPEAKER: Leave is sought to table that summary of actions. Is there any objection to that being tabled? It can be tabled.
    Document, by leave, laid on the Table of the House.
Kevin Hague: How does the Minister reconcile the responsibility she took as Minister in 2012 and her comment that “I’m not going to sit back and let one of the most important Government entities we have let people down time and time again around things such as privacy. They have to act in the way that I expect them to act.” with her comments over the past several days that the implications of the court decision are an operational matter?
Hon JUDITH COLLINS: Well, strictly speaking, forms are an operational matter, but if the member is going to come to see the progress that has been made and what actions I have taken, I think that I have been very strong on this issue relating to ACC. I can look at the proof of just how successful that has been. In August 2012 there were 80 privacy breaches from ACC. A year later, in August 2013, that was down to 28. In March 2014—the month just past—it was down to 19. There are significant improvements in the ability of ACC to protect people’s privacy, and at the same time, to comply with its obligations under its own Act.

http://www.parliament.nz/en-nz/pb/business/qoa/50HansQ_20140416_00000010/10-accident-compensation-corporation%E2%80%94privacy-and-security

15 April 2014

ACC privacy ruling welcomed for sensitive claimants

A press release from the New Zealand Association of Psychotherapists
Yesterday’s District Court ruling, that the standard ACC release of information form the “ACC 167” is illegal, has been welcomed by psychotherapists and clinicians working with sexual abuse survivors.
“The Disley Independent Clincial review of the ACC’s treatment of sensitive claimants, undertaken in 2010, outlined serious concerns about this form and the ACC’s approach to the gathering of health information. This decision is welcomed, but long overdue” says Kyle MacDonald, New Zealand Association of Psychotherapists Public Issues spokesperson.
The Disley review included a legal opinion, which noted concerns about the ACC 167, and explained the limitations that apply to the collection of health information. Those working with all ACC claimants, and specifically in the sexual violence sector, have long expressed these concerns.
“We’ve known for a long time that this form, and its implementation, has caused specific problems for sensitive claimants” says Kyle MacDonald, “it has been common practice for the ACC to request ALL of a claimants GP or Mental health notes, and not accept a health professional acting in accordance with the Privacy act by providing only those parts of the record relevant to the claim. Furthermore the ACC have quite explicitly declined to advance a claim if individuals refuse to sign the waiver due to quite legitimate privacy concerns.”
This has set up a perception that ACC have gone on “fishing expeditions” for reasons to decline claims, rather than sticking to the limits of the Privacy Act, like all other health professionals are required to do.
“Hopefully this decision allows people who have had their claim declined due
to the illegal acquisition of health information to have their claim revisited. It should also allow those who have had their claim declined due to their refusal to sign this form to also re-apply for cover and treatment.”
http://www.scoop.co.nz/stories/PO1404/S00230/acc-privacy-ruling-welcomed-for-sensitive-claimants.htm

ACC compo policy 'wrong in law'

An article from the New Zealand Herald by Martin Johnston
Form requesting signature to consent to information with threat of compensation cut is deemed unlawful.
A judge has overturned ACC's policy of cutting off accident claimants' compensation if they refuse to approve widespread gathering of information about themselves. The Accident Compensation Corporation's actions were "without basis and wrong in law", District Court Judge Grant Powell says in two just-released verdicts. The decisions come 2 years after ACC's mass privacy breach.
ACC, asked yesterday if it was following the judge's advice to rewrite the ACC167 form, said the form was "not illegal". ACC was "amending the relevant processes to address the matters raised by the court". ACC argued before the court cases that the blanket consent form provided "administrative efficiency".
Claimants Denise Powell, a part-time university lecturer who had a back injury, and "K", a sexual abuse victim and brain injury claimant, appealed against ACC cutting off their entitlements after they repeatedly refused to sign the ACC167 form. Their entitlements were reinstated after they eventually signed but they said they only signed because they were put under duress. Both claimants previously had arrangements with ACC to give it consent to obtain specific information relating to their claims case-by-case. This system ran for several years until 2009 and 2010 when case managers indicated the corporation could no longer accept those arrangements and they would have to sign the form or lose their entitlements.
But Judge Powell said the ACC167 form was much broader in its consent to gather information than the requirement in the Accident Compensation Act that claimants approve the release of "medical and other records that may be relevant to the claim". ACC was justified to seek a wide range of information and could request consent for this from claimants. But it could use section 117/3 of the act to cut off entitlements for refusing consent only for the "medical and other records" specified in the act, and not for the wider information search that ACC167 enabled.
The judge cites, as an example of the kind of wider information sought, Dr Powell's ACC case manager asking her GP if the medical certificates he wrote accurately reflected the amount of work she was capable of doing. "It would appear," the case manager wrote, "that the hours both paid and unpaid combined could almost exceed a full week's work. If you do not agree will you please provide your reasons."
Dr Powell, an ACC claimants' support group spokeswoman, said the case manager's letter was inappropriate and after a complaint she was assigned to a different case manager. "K" told the corporation he was concerned about its use or possible misuse of private information including details about his sensitive claim with ACC.
Warren Forster, the advocate for both claimants, said there had been a long line of failed appeals against having ACC payments stopped because of refusing to sign the ACC167 form, but there had not been full legal argument on the issue before the K and Powell cases. ACC is setting up a dedicated phone line for clients with historical consent concerns.

• ACC consent concern line 0800 745 254.

Form filling
• ACC167 form asked claimants to sign: "I give my consent for information about me to be collected, used and disclosed..."
• The Accident Compensation Act says: "A claimant who receives any entitlement must, when reasonably required to do so by the corporation...authorise the corporation to obtain medical and other records that may be relevant to the claim."
• What the judge said: "In my view, even a casual glance at the ACC167 form...shows that the authorisation is considerably more extensive than provided by section 72, 1, c [of the act]."
© 2014 APN New Zealand Ltd

http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=11238207