Bronwyn Puller: ACC abused claimants' rights with consent form

A report from 3 News by Melanie Reid for Third Degree

Bronwyn Puller blew the whistle on ACC in 2012. She was sent nearly 7000 personal files in one of New Zealand’s worst privacy breaches.
Two years later ACC has been found to be involved in another massive privacy scandal. This time it potentially affects three-quarters of a million Kiwis.
"There’s no limitation on it [ACC form 167]," says Ms Puller. "So it’s as wild as your imagination. They could go to your bank and obtain all your banking financial records. They could go to your telecommunications provider and obtain access to your emails. They could go to your gym, look at your gym attendance. They could go to your neighbours, talk to your neighbours. But it’s not just what they can collect; this actually also gives ACC unlimited powers of disclosure."
ACC was forcing clients to sign a consent form that was well beyond ACC’s legal mandate. This gave ACC powers – way beyond what they have under the legislation. This gives them the ability, and the Government, to intrude in every aspect of your life. It gives them the ability to release any information about you to any third party.
Here are just a few examples from our ACC files:

• A male freezing worker's sexual abuse history was shared with his employer.
• A claimant who had suffered mental health issues had her highly sensitive files released to her employer.
• A victim of a brutal assault also had confidential files released to his employer – files about his nightmares, medication and counselling sessions.

"This is the consequence of this form," says Ms Puller. "I don’t think anyone in their right mind would want their employer, or a potential employer, or a headhunting agency, having complete access to their medical records. They are the most highly sensitive private information."
The problem for claimants is if they didn’t sign the 167 consent form allowing ACC wide-ranging collection of their private information, they faced being cut off.
So last week a judge ruled ACC’s use of the consent form unlawful. But there are allegations that for years and years ACC has known this.
Ms Puller had raised the issue of the 167 form with the former minister, the board, the State Services Commission, the Privacy Commissioner, Department of Labour and Ombudsman.
"[Current ACC Minister] Judith Collins was given the list of 45 issues, which I took to the meeting in December, that we asked ACC to address," she says. "The ACC 167 was listed on that as one of the concerns we had about the unlawful approach to the way ACC was operating its business. That list was given to the minister on March 14, 2012.
"I know that she received my list of 45 issues. I also know that she received a copy of the independent report that was commissioned by ACC and the Privacy Commissioner, which raised concerns about ACC’s consent form, because it was the major bugbear that most claimants had with ACC."
So going by the judge's ruling, potentially there are hundreds of thousands of files sitting in an ACC database containing private information that has been obtained in an illegally manner.
"At the end of the day, ACC have created their own administrative nightmare, through the way that they’ve acted. They’ve acted unlawfully. They’ve acted irresponsibly. They’ve acted in a way that basically totally abuses the claimants' rights and the right to informed consent, and to control of their personal information. It’s that simple."
Click here to see the response from ACC.
For anyone with concerns about their claim in relation to their signing the ACC 167 consent form, please call 0800 745 254.

© 2013 MediaWorks TV

http://www.3news.co.nz/Bronwyn-Puller-ACC-abused-claimants-rights-with-consent-form/tabid/1771/articleID/341271/Default.aspx#ixzz2zkDroQnw

Question to Minister

10. KEVIN HAGUE (Green) to the Minister for ACC: Have all of the recommendations of the 2012 Independent Review of ACC’s Privacy and Security of Information been implemented; if not, why not?



Hon JUDITH COLLINS (Minister for ACC): ACC advised that it has implemented 37 of the 44 recommendations. A number have ongoing activity associated with them. Of the remaining seven, two are under active management, which relate to information governance and the implementation of data loss protection software. The other five involve a fundamental review of ACC’s end-to-end claims process activity. Accordingly, ACC advised that it has taken a deliberate decision to complete the end-to-end process review of claims management as part of its work around improving trust and confidence. This is to ensure all processes and information technology changes required under these five recommendations comprehensively meet the intent of the report.
Kevin Hague: Is she confident that the recommendations to ensure that consent forms follow the law and are best practice have been properly implemented, given that the court has just found that the way that ACC was using its ACC167 form was actually illegal?
Hon JUDITH COLLINS: I do not want to argue with the member, but, strictly speaking, the form was not held to be illegal, but the way in which it was used was outside of the statutory requirements. I agree with the member that the form must be changed to comply with the latest decision. I have also been advised by ACC that this form has in the past been approved by the Privacy Commissioner, by the Human Rights Commission, and, I have been told, by six different District Court decisions. So the fact that this latest decision has said that it has been wrongly used is something that ACC is taking very seriously, as am I.
Kevin Hague: How does she reconcile ACC’s illegal use of this form with the privacy review’s findings that stakeholders’ single-biggest concern was the attitude and culture of the organisation in dealing with their personal information, and the report’s finding that a consistent theme was that information not relevant to the claim was held on file?
Hon JUDITH COLLINS: I also recall that the review said that the form itself was able to be used. So I think the problem is that the past decisions of the courts and of other agencies, like the Human Rights Commission, the Privacy Commissioner, and also the review, have not actually said that the form has been misused. But I believe that the member is right that the form should be changed. ACC told me on Monday this week that it was not going to appeal the decision and that it would abide by it. I think that is the right outcome.
Kevin Hague: How do revelations today that ACC has been handing people’s full ACC files—including information on sensitive claims—over to prospective employers stack up against the recommendations of the privacy review?
Hon JUDITH COLLINS: I am sorry, I have not heard that claim, but if the member would like to provide me with the information, I will be happy to take some action. I seek leave to assist the member with the summary—
Mr SPEAKER: You are seeking leave to table a document?
Hon JUDITH COLLINS: It is a document that is the independent review recommendations and summary of actions as at 24 January this year, and I think that might help the member.
Mr SPEAKER: Leave is sought to table that summary of actions. Is there any objection to that being tabled? It can be tabled.
    Document, by leave, laid on the Table of the House.
Kevin Hague: How does the Minister reconcile the responsibility she took as Minister in 2012 and her comment that “I’m not going to sit back and let one of the most important Government entities we have let people down time and time again around things such as privacy. They have to act in the way that I expect them to act.” with her comments over the past several days that the implications of the court decision are an operational matter?
Hon JUDITH COLLINS: Well, strictly speaking, forms are an operational matter, but if the member is going to come to see the progress that has been made and what actions I have taken, I think that I have been very strong on this issue relating to ACC. I can look at the proof of just how successful that has been. In August 2012 there were 80 privacy breaches from ACC. A year later, in August 2013, that was down to 28. In March 2014—the month just past—it was down to 19. There are significant improvements in the ability of ACC to protect people’s privacy, and at the same time, to comply with its obligations under its own Act.

http://www.parliament.nz/en-nz/pb/business/qoa/50HansQ_20140416_00000010/10-accident-compensation-corporation%E2%80%94privacy-and-security

ACC privacy ruling welcomed for sensitive claimants

A press release from the New Zealand Association of Psychotherapists

Yesterday’s District Court ruling, that the standard ACC release of information form the “ACC 167” is illegal, has been welcomed by psychotherapists and clinicians working with sexual abuse survivors.
“The Disley Independent Clincial review of the ACC’s treatment of sensitive claimants, undertaken in 2010, outlined serious concerns about this form and the ACC’s approach to the gathering of health information. This decision is welcomed, but long overdue” says Kyle MacDonald, New Zealand Association of Psychotherapists Public Issues spokesperson.
The Disley review included a legal opinion, which noted concerns about the ACC 167, and explained the limitations that apply to the collection of health information. Those working with all ACC claimants, and specifically in the sexual violence sector, have long expressed these concerns.
“We’ve known for a long time that this form, and its implementation, has caused specific problems for sensitive claimants” says Kyle MacDonald, “it has been common practice for the ACC to request ALL of a claimants GP or Mental health notes, and not accept a health professional acting in accordance with the Privacy act by providing only those parts of the record relevant to the claim. Furthermore the ACC have quite explicitly declined to advance a claim if individuals refuse to sign the waiver due to quite legitimate privacy concerns.”
This has set up a perception that ACC have gone on “fishing expeditions” for reasons to decline claims, rather than sticking to the limits of the Privacy Act, like all other health professionals are required to do.
“Hopefully this decision allows people who have had their claim declined due
to the illegal acquisition of health information to have their claim revisited. It should also allow those who have had their claim declined due to their refusal to sign this form to also re-apply for cover and treatment.”

http://www.scoop.co.nz/stories/PO1404/S00230/acc-privacy-ruling-welcomed-for-sensitive-claimants.htm