Legal Steps After Improper Medical Record Access

Your medical records contain some of the most sensitive and personal information about you. It’s a fundamental right in New Zealand that this information remains private and secure. The idea that someone might access your medical data without proper authorisation – whether it’s a healthcare professional without a legitimate reason, an administrative error, or a malicious act – can be deeply unsettling and a significant breach of trust. If you suspect or discover improper medical record access, knowing your legal steps is crucial. This article, guided by New Zealand’s robust privacy laws, will walk you through what to do, empowering you to protect your health information and assert your rights.

Understanding Improper Medical Record Access in New Zealand

Before diving into legal steps, let’s clarify what constitutes improper access. In New Zealand, your health information is protected by the Privacy Act 2020 and, more specifically, by the Health Information Privacy Code 2020 (HIPC 2020). These laws dictate how health agencies – including hospitals, GPs, specialists, and pharmacies – collect, use, store, and disclose your health information.

What Qualifies as Improper Access?

Improper medical record access occurs when someone views, uses, or shares your health information without a valid legal reason or your express consent (unless a specific exception applies, such as a life-threatening emergency). This could include:

• A healthcare worker checking your records out of curiosity, not related to your care.
• Administrative staff viewing information they don’t need to perform their duties.
• Your records being accidentally disclosed to the wrong person.
• A cyberattack leading to a data breach.
• Someone gaining unauthorised access to a medical system.

Even if no harm was intended, unauthorised access is still a breach of your privacy rights.

Your Rights and the Legal Framework in New Zealand

As a patient in New Zealand, you have significant rights regarding your health information. The Health Information Privacy Code 2020 sets out 13 Health Information Privacy Principles that health agencies must follow. These principles cover various aspects, including how information is collected, stored, and accessed.

• You have the right to know who has accessed your information.
• You have the right to request a copy of your own health records.
• You have the right to request corrections to your health information if it’s inaccurate.
• You have the right to complain if you believe your privacy has been breached.

Breaches of these principles are taken seriously by New Zealand’s regulatory bodies.

Immediate Steps When You Suspect a Breach

Discovering that your medical records may have been improperly accessed can be distressing. Here are the immediate, practical steps you should take:

1. Gather Information and Document Everything

The more details you have, the stronger your case will be. Note down:

• **What happened?** (e.g., “I received a notification about an unusual login,” “My former colleague mentioned details from my record.”)
• **When did it happen?** (Date and approximate time).
• **Who do you suspect?** (If you know or have reason to believe).
• **Any evidence you have.** (Screenshots, emails, text messages, names of witnesses).
• **The specific information you believe was accessed.**

Keep a detailed log of all communications, including dates, names of people you spoke to, and summaries of conversations.

2. Contact the Health Provider or Agency Directly

Your first port of call should be the health agency responsible for your records. Most health organisations have a privacy officer or a designated person to handle privacy concerns. Clearly explain your concerns, provide the details you’ve gathered, and ask them to investigate the matter. They have an obligation to respond and investigate privacy breaches.

This internal complaint process can often resolve issues quickly. They may be able to confirm the access, explain if it was legitimate (e.g., part of a referral process you forgot about), or admit an error and outline steps they’ll take to prevent future incidents.

Escalating Your Concern: The Role of Regulators

If you’re not satisfied with the response from the health provider, or if you believe the breach is serious, New Zealand has independent bodies dedicated to protecting your rights.

The Office of the Privacy Commissioner (OPC)

The Privacy Commissioner is New Zealand’s independent regulator of privacy. If you believe your health information privacy rights have been breached, you can file a complaint with the OPC. They have the power to investigate, mediate disputes, and make formal findings.

• **How to complain:** You can file a complaint directly on the Privacy Commissioner’s website. They will guide you through the process, which typically involves providing details of the breach and the steps you’ve already taken.
• **What they do:** The OPC will assess your complaint, and if appropriate, they will contact the health agency involved to seek their side of the story. They can facilitate a resolution between you and the agency. In serious cases, they can make binding decisions, including ordering an agency to apologise, correct information, or even pay compensation for harm suffered.

It’s important to remember that making a complaint to the Privacy Commissioner is generally free and designed to be accessible.

The Health and Disability Commissioner (HDC)

While the Privacy Commissioner focuses broadly on privacy, the Health and Disability Commissioner specifically deals with consumer rights in health and disability services. Breaches of the HIPC 2020 often overlap with breaches of the Code of Health and Disability Services Consumers’ Rights. For instance, Principle 4 of the Code states you have the right to effective communication and respect for your privacy.

If the improper access also involved a failure of professional conduct or a broader breach of your rights as a health consumer, you might consider making a complaint to the HDC. They investigate complaints about health and disability services and can make recommendations or refer matters to other bodies for further action.

Potential Outcomes and Remedies

Depending on the nature and severity of the improper access, several outcomes are possible:

• **Apology and explanation:** The health agency may provide a formal apology and an explanation of how the breach occurred and what steps they’ve taken to prevent recurrence.
• **Correction of records:** If the breach involved inaccurate information, the agency may be required to correct your records.
• **Systemic changes:** The incident might lead to changes in the agency’s internal policies, procedures, or IT security to prevent future breaches.
• **Compensation:** In cases where you have suffered harm (e.g., emotional distress, financial loss) as a direct result of the privacy breach, the Privacy Commissioner can order compensation.
• **Disciplinary action:** For medical workers who improperly access records, their professional body (e.g., Medical Council of New Zealand, Nursing Council of New Zealand) might take disciplinary action.

Practical Advice and What to Remember

• **Act promptly:** While there aren’t strict time limits for privacy complaints, acting quickly can help preserve evidence and lead to a faster resolution.
• **Be clear and concise:** When making a complaint, stick to the facts and clearly articulate what happened and what outcome you are seeking.
• **Keep copies of everything:** Maintain records of all correspondence, complaint forms, and any evidence you’ve gathered.
• **Seek legal advice if necessary:** For complex or very serious breaches, or if you believe you have suffered significant harm, it might be beneficial to consult a lawyer specialising in privacy law. They can provide tailored advice and represent your interests.
• **Medical workers’ obligations:** If you are a medical worker who has witnessed or discovered improper medical record access, you have a professional and ethical obligation to report it. Whistleblower protections may apply.

Your medical privacy is a cornerstone of effective healthcare. When it’s compromised, it’s vital to know that you have rights and avenues for redress in New Zealand. Taking action not only protects your own information but also contributes to maintaining the integrity and trustworthiness of our healthcare system for everyone. Understanding the legal steps after improper medical record access is your first line of defence.

If you believe your medical records have been improperly accessed and you wish to take action, consider your options and protect your rights. Don’t hesitate to **File a medical privacy complaint** with the appropriate authorities if your concerns are not adequately addressed by the health provider.