Privacy waivers allow patients to pass their confidential health information to the media. So why is Te Whatu Ora declining to honour them?
Liv Redman (Ngāpuhi) didn’t get her vital physiotherapy covered by ACC until she went public. Redman had experienced chronic pelvic pain, clinical depression and post-traumatic stress disorder for five years after being sexually abused. She sought ACC coverage for physiotherapy for seven months and was told she had to see a psychologist for her claim to be accepted, but the waitlist was at least another six months. That was too long to wait in her condition, with her physical symptoms a daily reminder of the traumatic event.
Shortly after, Redman’s physiotherapy appointments were approved by ACC. And while she was glad to have her case resolved, she was dismayed by the lengths she had to go to get there. “I’ve already got disabilities and I’m sure others who have their own disabilities are already compromised enough as it is. Having to advocate for yourself is really hard,” she says. “I don’t think anyone should have to share about their disabilities in order to get an issue solved.”
I reported on Redman’s case at the time and was able to include details of her story through the use of a privacy waiver. “Had I not done anything, I think they would have just let it go,” she says. “Nothing happens unless you scream.”
But not every patient’s screams are able to be heard.
Pita Shelford (Te Rarawa, Ngāpuhi) woke up from a spinal cord surgery in 2022 permanently disabled with reduced mobility and neurological function and regular shaking fits. The surgery was to insert a shunt to drain a cyst that had developed from his neck to his waistline, causing pain.
Five months after the surgery, he found out that the shunt wasn’t in the right position and was pushing into the fibres of his spinal cord, causing nerve damage.
He now has a third of the circulation he should have in his left leg, a risk he says was not communicated to him prior to the operation. Still unable to walk without aid, he is now seeking an amputation.
These days, Shelford wants to stress that he feels failed by the way his complaints were handled, rather than the clinical mistakes or practice themselves. “It’s not so much the medical or the clinical team… it’s those at the top,” he says. “All those guys from the manager level all the way up to the executive level.”
Although he has accepted his disability, Shelford remains frustrated and disillusioned by the way his complaint – which was around the lack of acknowledgement of missed opportunities for treatment post-surgery – was dealt with by the hospital.
It wasn’t something he managed to resolve through the formal complaint system; help from the National Health and Disability Advocacy Service turned into more work for him after his advocate resigned. Eventually, in early 2023, he reached out to me to tell his story.
When Shelford recounted his year-long journey to me, telling me he’d exhausted everything and everyone he knew to fight this battle, I had to verify that what he said matched his clinical records. Most of the time, these records include discussion of a patient’s clinical information which is protected between patient and health agency on the grounds of the Health Information Privacy Code 2020 and the Privacy Act 2020.
A privacy waiver, in this context, can be written by a client or patient to permit a government agency to comment on or disclose personal and health information to the media.
It aligns with Principle 6 of the Privacy Act which states that people have the right to ask for access to their own personal information, either by asking themselves, or giving written permission to another person, including the media, to request on their behalf.
Despite Te Whatu Ora’s media team having had several extensions, my request for comments and clarifications on Shelford’s post-operative experience was eventually met with the following brief response:
We do not provide private patient information to media. We can confirm that all information has been provided directly to the patient and/or designated next of kin.
I called Shelford and he disagreed. He said he didn’t have all of the details about the way his complaint was handled which was the reason he’d reached out to the media in the first place. I pushed again for a response, this time wielding a privacy waiver signed by Shelford.
While putting together a response, the health agency’s media team told me the following (emphasis my own):
All patients, regardless of their circumstances, are entitled to expect that any personal health information they share with their doctor or healthcare professional is treated in strictest confidence. Therefore, discussion of a patient’s private health information publicly would be inappropriate and in breach of that confidential relationship.
Given our professional responsibilities to our patients, in accordance with the HDC Code of Consumer Rights and practitioner standards, Te Whatu Ora will not usually discuss details of patient care through the media even if a waiver is provided by a patient to media.
We have an ongoing duty of care to act in our patient’s best interests, which means we must consider how the potential release of any information might affect their safety and mental wellbeing, as well as impact the privacy of others, not just now, but into the future. This is why we generally do not accept privacy waivers via third parties.
The statement noted that confirming details or sharing information would violate Right 1: The right to be treated with respect, and Right 5: The right to effective communication, in the Health and Disability Commission (HDC) Code of Consumer Rights.
A spokesperson from the Office of the Privacy Commissioner said it appears that Te Whatu Ora is declining waivers not on privacy grounds but on the basis of the HDC Code of Consumer Rights. That’s the poster you see in every clinical waiting room.
Shelford was offended when he heard the reasoning behind Te Whatu Ora’s decision. “It just kind of contradicts how I’ve been treated,” he says. “They’re just trying to protect themselves because they know they’ve let me down in every single way.”
For other public agencies that hold health information about clients, like ACC and the MSD, the use of privacy waivers is established practice. They’re ways to release personal information considered necessary to respond to issues of public accountability or transparency.
However, the provision of a privacy waiver doesn’t guarantee information will be released.
Andy Milne, ACC’s deputy chief executive of strategy, engagement and planning, says the organisation needs to be satisfied that a client authorises them to include personal information in their response to media queries. “We seek a signed privacy waiver form, or other verification, before speaking to anyone other than the client about their claim. The client can choose to set an expiry date for this permission.”
Both ACC and the MSD say they consider each request on a case-by-case basis. In other words, it is ultimately up to the agency to determine whether patients and clients should be allowed access to their information. “If we were not satisfied a person is able to give informed consent, we would not release information to a third party,” says Milne.
For clients who aren’t able or not deemed fit to provide a waiver, such as someone with a severe intellectual disability, agencies may accept a privacy waiver from a representative.
So has Te Whatu Ora been upholding its responsibilities around transparency?
According the privacy commissioner’s office, health agencies such as Te Whatu Ora are obligated not to disclose health information except for the purpose it was collected, unless another exception applies.
“One exception is that the health agency believes on reasonable grounds that the disclosure has been authorised by the individual concerned. This is a voluntary disclosure, and the health agency is not required to disclose information on that basis.”
Section 6, which enables people to access information about themselves through a representative, has only a few restrictions, including “if disclosure would prejudice the requester’s physical or mental health or would be an unwarranted disclosure of someone else’s affairs”.
In Shelford’s case, his physical and mental health fell into a diagnosis of adjustment disorder, major depressive disorder, anxiety, complex post-traumatic stress disorder and functional neurological disorder. He and his psychologist cited the actions and inactions of Te Whatu Ora as the cause of this.
A solution on the horizon?
In mid-2023, I led a complaint on behalf of a handful of health journalists citing poor and inconsistent service provided by Te Whatu Ora’s media team and their refusal of privacy waivers.
Seven months on from the complaint the issue remains unresolved, although a Te Whatu Ora spokesperson maintains that my complaint is “very advanced” and anticipated to be “finished soon”. Dr Nick Baker, the interim chief medical officer, says that prior to the establishment of Te Whatu Ora, district health boards had varying approaches to the way privacy waivers were managed. “As a new organisation, we needed a consistent national approach to privacy waivers that supports transparency while also aligning with relevant obligations, including the Health Information Privacy Code.”
While Te Whatu Ora’s response to my complaint included some ethical concerns around privacy waivers (such as patients changing their mind afterwards or being paid in exchange for their information), the office of the privacy commissioner say they are not aware of any particular issues that have arisen out of the use of privacy waivers in health reporting.
Baker says the process is evolving, but “work on this involves gathering advice and input from those with clinical, legal and privacy expertise”, adding that “in the interests of patients, we must make sure we take the time to get this right”.
Until then, journalists will remain hampered in their ability to fact-check, and patients like Pita Shelford will continue to face bureaucratic hurdles to telling their own stories.