Taranaki District Health Board Data Breach (2015)

Plunket have launched an investigation after medical records were found in a house at the Taranaki Building Removers' yard. The records were uncovered at the weekend and handed to the Taranaki District Health Board (TDHB). TDHB quality and risk manager Anne Kemp said the records were kept secure over the weekend and handed back to Plunket - a separate organisation, independent of the DHB - yesterday. Plunket general manager operations, central and southern region, Brenda Hynes confirmed the records were the organisation's and date "from around 20 years ago." "We have launched a full investigation and as part of this, we have informed our privacy officer, the Ministry of Health and the privacy commissioner," Hynes said. She said client privacy was "of the utmost importance" and Plunket had systems in place to ensure information given to staff in confidence remained private and confidential. "We will investigate this highly unusual incident fully to determine how it occurred. We'd like to apologise for any concern felt by Plunket families from this incident." Hynes said the quick thinking of the people who handed the records to the TDHB was to be commended. The privacy commissioner's website states anyone who finds someone's information was legally responsible for it. A spokesman for Taranaki Building Removers said he had no idea the records had been found on the yard. Part of an old Plunket building was on site, he said, but it's not known if they were found there. "I didn't think there was anything in it." Ministry of Health chief legal advisor Phil Knipe said it was important all New Zealand organisations, both private and public, ensured they had adequate safeguards to protect the information of consumers. "The ministry notes that Plunket is taking the issue very seriously and, as appropriate, is conducting its own investigation," he said. Privacy commissioner communications adviser Charles Mabbett said he too had been notified of the breach and told of the investigation. "Health information is very sensitive personal information. The people who discovered these personal health records did the right thing in handing the documents over to a responsible authority and we commend them for it." Mabbett said that Plunket was following the commissioner's data breach guidelines which advised it "to contain the breach and make a first assessment, evaluate the risks, notify affected people if necessary and prevent a repeat".