133 Molesworth Street
PO Box 5013
Wellington 6140
New Zealand
T+64 4 496 2000
1 C FEB 2020
Amy S Van Wey Lovatt
By email: [FYI request #12084 email]
Ref:
H202000329
Dear Amy
Response to your request for official information
Thank you for your request under the Official Information Act 1982 (the Act) on 25 January 2020
for information on digital health information standards. A copy of your full request is attached to
this letter.
The Ministry of Health (the Ministry) does not hold the information you have requested and has
no reason to believe this information is held by another agency subject to the Act. For this
reason, I have decided to refuse your request under section 18(g) of the Act.
You may be interested to know that there are health information standards publicly available on
the Ministry website which may be useful to you. These set requirements for safe, secure, and
purposeful use and sharing of health information
: https://health.govt.nz/our-work/digital-
health/digital-health-sector-architecture-standards-and-governance/health-information-
standards-0.
Under section 28(3) of the Act you have the right to ask the Ombudsman to review any
decisions made under this request.
Yours sincerely
Nick Allan
Manager OIA Services
Office of the Director-General
Copy of OIA request
From: "Amy S Van Wey Lovatt" <[FYI request #12084 email]>
To:
"OIA/LGOIMA requests at Ministry of Health" <[Ministry of Health request email]>,
Date: 25/01/2020 06:58 a.m.
Subject:
Official Information request - Digital Health Information Standards
Dear Ministry of Health,
RE: Protection against interception of digital health information
According to the Ministry of Health website, the MoH is responsible for Digital health sector architecture,
standards and governance, which includes the Health information standards. My requests pertain to the
privacy of patient information, and how that information is kept secure, specifically in regards to the
Operation Policy Framework 2019/2020 (OPF), which requires health organisations compliance with the
international standard HISO 10029:2015 Health Information Security Framework (HISF).
Request 1:
According to the Beehive weebsite Minister Clark's email address is d.clark[@]ministers.govt.nz, is
“uniquely identifiable” to Minister Clark, and as you may be aware, may act as an electronic signature for
Minister Clark. Please confirm whether “uniquely identifiable” email accounts are considered “applications
that require authentication” and thus require “a secure logon mechanism” to “ensure individual
responsibility” under section 10.2 of the HISF (pgs 36-37).
To give my following requests context, please consider the following scenario.
Patient X sent personal health information and questions to Dr Zigler’s email address,
Jane.Zigler[@]LocalDHB.govt.nz, with the intent that Dr Zigler would receive the questions and have
answers prepared for an upcoming visit. However, at the appointment both Dr Zigler and Patient X find
out that Dr Zigler never received the email. Investigation revealed that this was because a system
administrator in the IT department had used their “administrator rights” to reroute al of Patient X’s
incoming emails to Richard.Hed[@]LocalDHB.govt.nz, a non-clinical staff member’s individual email
account. Mr Richard Hed had made the request stating he had his (non-clinical) manager’s approval to do
so, but no-one in the IT verified that the patient or medical staff had agreed to the “rerouting” and
“interception” of emails. Again, the rerouting of the email was done without the knowledge of either Dr
Zigler or Patient X. Further, Patient X had never give Mr Richard Hed permission to access Patient X’s
personal health information.
Request 2:
Under section 8.2 of the HISF (p 28) health organizations are required to protect personal health
information exchanged over a network from interception or incorrect routing, within or between agencies
(p 29). Please confirm that under this provision, this includes “interception” of emails which are uniquely
identifiable or “rerouting” of emails intended for one uniquely identifiable account to another and (b) that
the scenario provided is an example of a breach of the HISF standard on protection against “interception
or incorrect routing”.
Request 3:
Section 10.2 (p 36) the HISF requires that systems administrators, who have “privileged user accounts
(administrator rights)” may not use their administrative rights to “over-ride access”. Please confirm that
this means that system administrators may not use their administrator rights to “re-rout” emails from one
“uniquely identifiable account” to another, without the expressed permission of the individual to whom that
email account is “uniquely identifiable” and (b) that the given scenario is an example of a breach of the
HISF standard on protection against misuse of “administrator rights” by a systems administrator.
Request 4:
I respectfully request a list, with specified page or section, of relevant legal, professional and ethical
standards which would be considered by the Digital Health Team to have been breached by the
“rerouting” and “interception” of the private email communications between Patient X and Dr Zigler, as
portrayed in the given scenario.
Page 2 of 3
Request 5:
Please consider including similar such scenarios in the next version of the standards to help physicians,
health organizations, and patients understand what is considered a breach of standards. Please also
consider the inclusion of the legal implications of such breaches to the security and inappropriate access
of private health information, including the interception or rerouting of private email communications.
Thank you for your help and assistance in this matter. I look forward to your response.
Kindest regards,
Amy S Van Wey Lovatt
-------------------------------------------------------------------
This is an Official Information request made via the FYI website.
Please use this email address for all replies to this request:
[FYI request #12084 email]
Is [Ministry of Health request email] the wrong address for Official Information requests to Ministry of Health? If so,
please contact us using this form:
https://scanmail.trustwave.com/?c=15517&d=yLCr3j_zMXVKIJLw7SPnQTmih98Ci0XQ8J1Ug45_Cg&u=h
ttps%3a%2f%2ffyi%2eorg%2enz%2fchange%5frequest%2fnew%3fbody%3dministry%5fof%5fhealth
Disclaimer: This message and any reply that you make will be published on the internet. Our privacy and
copyright policies:
https://scanmail.trustwave.com/?c=15517&d=yLCr3j_zMXVKIJLw7SPnQTmih98Ci0XQ8MRVgop4Xw&u=
https%3a%2f%2ffyi%2eorg%2enz%2fhelp%2fofficers
If you find this service useful as an Official Information officer, please ask your web manager to link to us
from your organisation's OIA or LGOIMA page.
Page 3 of 3
