An article from the Dominion Post by Shane Cowlishaw
ACC'S privacy practices have again been exposed after it sent information about an elderly client to the wrong person, and then took six weeks to tell her about it.
The corporation also failed to inform ACC Minister Judith Collins about the breach. She was unaware of it until told on Friday by The Dominion Post.
Mrs Collins has weekly meetings with the organisation and has demanded a zero-tolerance approach to privacy violations. She said the latest breach was "totally unacceptable" and called for a full explanation from outgoing chief executive Ralph Stewart.
The information, which included details about Auckland resident Diane Hawke's injury, compensation and complaints about ACC, was sent to a client in the corporation's sensitive claims unit in a bundle of documents at the end of March - just weeks after the privacy breach involving whistleblower Bronwyn Pullar was revealed.
All correspondence with sensitive claims unit clients is supposed to go through more thorough security checks.
The mistake was not discovered until July, when the recipient, who has had her own privacy breached by ACC several times, finally found time to look at all the information she was sent. Incensed, she emailed and called ACC several times. She was shocked to discover six weeks later that Mrs Hawke had still not been told of the breach.
Both Mrs Hawke and the sensitive claims unit client were among the 7000 people whose details were inadvertently sent to Ms Pullar.
The fallout from Ms Pullar's revelations claimed the scalps of Cabinet minister Nick Smith, ACC chairman John Judge and several board members.
Last week a damning independent report into the breach vindicated Ms Pullar and highlighted a poor privacy culture at ACC.
The sensitive claimant said she was "mortified" at receiving Mrs Hawke's details, but her shock quickly turned to anger when she learnt how ACC had handled it.
"Look, I was just shattered that their strategy in the media is ‘We take it seriously'. This took them six weeks to get serious about. It's a bad, sick joke, and it's simply not good enough."
The breach raised several issues, including how historical information from a standard ACC claimant had been mixed up in current documents prepared for one handled by the sensitive claims unit, she said.
Mrs Hawke, who has been sent another person's details in the past, said she was angry to learn about the delay in informing her. "I thought ... here we go again, because I have no confidence in their privacy or anything else."
Ms Collins said Mr Stewart would report on how the breach happened and what was done to ensure it never happens again.
ACC spokeswoman Stephanie Melville said the six-week delay was too long, and ACC apologised. An inquiry was under way and no decision had been made on possible compensation. The findings of the privacy commissioner's report had been accepted and all recommendations would be implemented in full, she said.
TIMELINE
March 29: ACC sends the sensitive claimant a bundle of documents relating to her case.
July 11: Claimant, who regularly receives large volumes of documents from ACC, notices the March package contains nine pages of Diane Hawke's information, dated 2008.
July 11: Sensitive claimant emails her case manager over breach.
July 12, 16: Claimant rings ACC complaints office and customer support service manager Kerry Dow over breach.
July 18-22: She and Mr Dow exchange emails about breach and whether the documents have been destroyed.
August 15: After speaking to Mrs Hawke, sensitive claimant learns ACC has yet to tell her of the breach. She calls ACC again.
August 16: Mr Dow calls Mrs Hawke to tell her of the breach and emails sensitive claimant, informing her he has done so.
http://www.stuff.co.nz/national/7597898/Minister-fumes-as-ACC-fails-yet-again© 2012 Fairfax NZ News
