Confidentiality Concern NZ: What Happens and How to Respond

When a confidentiality or privacy concern reaches your Council or Board in New Zealand, the authority asks what health information was accessed or disclosed, whether there was a care reason or a lawful basis, how it happened, and what you have done since. Your employer and the Privacy Commissioner can also look at the same event. Your Council or Board decides whether it is a single error that you have put right, a gap in competence, or conduct that goes to trust, and that decision shapes the route. Do three things now. Get advice from your indemnity insurer, your professional association or union, or a lawyer before you write to anyone. Do not contact the person whose information was involved. Then prepare a response that names the breach plainly and shows what has changed.

What a confidentiality or privacy concern is

A confidentiality concern is any question about whether you accessed, used or disclosed a person's health information without a care reason or a lawful basis. The concerns that reach a Council or Board fall into these groups.

Access without a care reason. Opening the record of a person you were not caring for: a family member, a colleague, a neighbour, a person in the news, or a former partner.
Disclosure to family. Telling a relative of a patient, or your own relative, about a patient's care without the patient's authority or a lawful reason.
Disclosure to an employer or a third party. Sending information to an employer, an insurer or an agency beyond what the patient authorised or the law allowed.
Social media. A post, a photo or a message about a patient or a colleague that identifies them, or that people who know them could identify. A post of this kind can also raise a boundary concern with a patient or a colleague.
A lost or unsecured device. A phone, laptop or memory stick holding patient information that was lost, stolen or left open.
A message to the wrong person. A letter, email, text or result sent to the wrong address or the wrong patient.

The law behind it

The Privacy Act 2020 governs personal information in New Zealand, and the Health Information Privacy Code 2020, issued under it, sets the rules for health information. The Code covers why health information is collected, how it is stored and kept secure, who may see it, when it may be used or disclosed, and a person's right to see and ask for correction of their own information. A health agency that has a privacy breach likely to cause serious harm must notify the Privacy Commissioner and the people affected. Where you are employed, your employer is the agency holding the information, and it decides whether to notify.

The Code of Health and Disability Services Consumers' Rights includes the right to have privacy respected, so a patient can complain to the Health and Disability Commissioner as well. A person can also complain to the Privacy Commissioner, who can investigate and, where a complaint is not resolved, refer it on for proceedings. Every Council and Board's code of conduct or standards includes a duty of confidentiality, and that duty is what your authority measures you against.

How your Council or Board sees it

The authority separates three kinds of event. A single error, such as a letter sent to the wrong address, that you reported, helped to contain and have learned from, is the least serious. A gap in practice, such as patient information kept on a personal phone without security, is a question of competence and systems. Access or disclosure that was deliberate, such as opening a record out of curiosity or passing on information about a patient or a colleague, goes to whether the public can trust you with their information, and the authority can refer it to a Professional Conduct Committee.

The authority also looks at what you did when you found out. Reporting the breach to your employer at once, helping to contain it and being open with the person affected where your adviser and your employer agree is right, all read as insight. Concealing it, deleting evidence, or explaining it away reads as the opposite, and can turn a privacy concern into a question of honesty, covered in the guide to an honesty or probity concern.

What happens step by step

The concern is raised. By the patient, your employer after an access audit, the Privacy Commissioner or the Health and Disability Commissioner. The authority writes to you with the concern and a date for your response.
The facts are gathered. The authority can ask your employer for the access log, the messages or the device report, and can ask the person affected for their account.
You respond. With your adviser, you set out what happened, why, what you did when you found out and what you have changed since.
The authority decides the route. It can close the matter, counsel you, order a competence review or refer the matter to a Professional Conduct Committee.
The other processes run. Your employer's process and any Privacy Commissioner or HDC process can run at the same time, and what you say in one can be seen in another.
The outcome is decided. From no further action to a charge before the Health Practitioners Disciplinary Tribunal.

The guide to how an HDC complaint reaches your Council or Board explains the Commissioner's route, and the guide to what happens after a notification sets out every route an authority can take.

What you can do now

Get advice the same day. For doctors the Medical Protection Society, for nurses NZNO, for midwives NZCOM, and for other professions your indemnity insurer or professional association.
Write down what happened while you remember it. Dates, times, what you accessed or sent, to whom, and what you did when you found out. Give it to your adviser, not to anyone else.
Cooperate with your employer's process. With advice, give your employer what it needs to contain the breach and decide whether to notify.
Read the duty that applies. Find the part of your authority's code or standards on confidentiality and privacy, and the rules of the Health Information Privacy Code that the concern touches.
Change what made the breach possible. Remove patient information from personal devices, check how you send results and letters, and keep records you can show the authority.
Complete remediation before the response goes. Dated certificates attached to your response are evidence that you have engaged with the duty.

The guide to writing a response to a notification sets out how to structure what you send.

The outcomes

No further action. Where the breach was a single error, reported and put right, with evidence of change.
Counselling or advice. The authority sets out its expectations and closes the matter.
A competence review or conditions. Where the breach shows a gap in how you handle information, the authority can order a competence review and set conditions or a programme.
Interim suspension or conditions. While a Professional Conduct Committee investigates, section 69 of the Health Practitioners Competence Assurance Act 2003 lets the authority suspend you or set conditions if it considers that necessary to protect the public.
A charge before the Tribunal. Where access or disclosure was deliberate or repeated, a Committee can lay a charge. The guide to a Tribunal hearing explains the penalties, which include censure, a fine, conditions, suspension for up to three years and cancellation of registration.

Where remediation fits

A confidentiality concern asks whether the public can trust you with their information now. The evidence that answers it is what you have changed and what you understand. Confidentiality in Healthcare Practice covers the duty of confidentiality and when information may lawfully be shared. Privacy, Consent and Chaperone in Healthcare Practice covers privacy and consent in the clinical setting. Social Media Professionalism and Boundaries covers what may and may not be posted about a patient or a colleague. The guide to showing insight and building a remediation plan explains how to bring the evidence together.

Each course is NZ$200, takes 2 CPD hours, is self-paced with immediate access, and ends with a dated certificate issued by Healthcare Ethics Courses that you can submit to your Council or Board or put in your remediation plan. The remediation courses for every Council and Board are on the hub page, and the Council and Board investigation process explained shows each stage. Profession guides describe what happens after a notification to the Medical Council about a doctor and a notification to the Nursing Council about a nurse.

Sources and further reading

Office of the Privacy Commissioner: the Health Information Privacy Code 2020, privacy breach notification and how complaints are handled.
New Zealand Legislation: the Privacy Act 2020 and the Health Practitioners Competence Assurance Act 2003.
Health and Disability Commissioner: the Code of Health and Disability Services Consumers' Rights, including the right to have privacy respected.

Frequently asked questions

Can the Privacy Commissioner and my Council or Board both look at the same breach?

Yes. The Privacy Commissioner deals with the breach under the Privacy Act 2020 and the Health Information Privacy Code 2020. Your Council or Board deals with your fitness to practise under the Health Practitioners Competence Assurance Act 2003. Your employer can run its own process too. Each body applies its own rules, and what you say to one can be seen by another, so your adviser should read everything before it is sent.

Is looking at a record without a care reason serious if I did not share what I saw?

Yes. Access without a care reason is a breach in itself, whether or not you passed the information on. Electronic systems log every record opened, by whom and when, and employers audit those logs. An authority looks at why you opened the record, how many times, and whether you were open about it when asked. Access to the record of a family member or a colleague is treated the same way as any other.

Should I tell the patient about the breach myself?

Not without advice. Where you are employed, your employer is the agency that holds the information and decides how the person affected is told, and whether the Privacy Commissioner is notified. A contact you make on your own can be read as an attempt to influence a complaint. Tell your employer and your adviser at once, and let any disclosure to the person happen through the process your employer and adviser agree.

What if the breach was a message sent to the wrong person by mistake?

Report it to your employer straight away and help to contain it, for example by asking the recipient, through your employer, to delete the message. Then look at how it happened and change the step that failed. An authority can close a single error that was reported, contained and followed by a change you can show. The same error left unreported, or repeated, reads as a gap in practice.

What does a Council or Board want to see in my response to a confidentiality concern?

A plain account of what you accessed or disclosed and why. What you did when you found out, including reporting it. The duty in your authority's code that applies, named. What you have changed, such as removing patient information from personal devices. Dated certificates for courses completed. A short reflection on what the breach meant for the person affected. Your adviser should read the draft before it goes.