Waikato DHB data breach
Peter Mitchell made this Official Information request to Ministry of Health
This request has an unknown status. We're waiting for Peter Mitchell to read a recent response and update the status.
From: Peter Mitchell
Dear Ministry of Health,
Fyi Ref:
H202206577
Hi.
In a fyi.org.nz response to Scott dated 22 June 2022 your Ministry said:
"The Minister of Health, Hon Andrew Little, has commissioned an independent review which has not been completed. Once the report arising from the review has been submitted to the Minister, the Ministry expects the Minister will decide whether to release it."
Has the independent review now been completed? If so, can you please forward me a copy.
If the review hasn't been completed can you give an estimated date for completion? It's now over 18 months since the data breach occurred
Yours faithfully,
Peter Mitchell
From: OIA Requests
Kia ora Peter,
Thank you for your request for official information. The reference number
for your request is: H2022015672.
As required under the Official Information Act 1982, Manatū Hauora will
endeavour to respond to your request no later than 20 working days after
the day your request was received. If you'd like to calculate the
timeframe, you can use the Ombudsman's online calculator
here: [1]http://www.ombudsman.parliament.nz/
If you have any queries related to this request, please do not hesitate to
get in touch.
Ngā mihi
OIA Services Team
M[2]inistry of Health information releases
U[3]nite against COVID-19
------------------- Original Message -------------------
From: Peter Mitchell <[FOI #20962 email]>;
Received: Thu Oct 27 2022 14:17:57 GMT+1300 (New Zealand Daylight Time)
To: OIA Requests <[email address]>; OIA <[email address]>;
Subject: Official Information request - Waikato DHB data breach
Dear Ministry of Health,
Fyi Ref:
H202206577
Hi.
In a
[4]http://scanmail.trustwave.com/?c=15517&a...
response to Scott dated 22 June 2022 your Ministry said:
"The Minister of Health, Hon Andrew Little, has commissioned an
independent review which has not been completed. Once the report arising
from the review has been submitted to the Minister, the Ministry expects
the Minister will decide whether to release it."
Has the independent review now been completed? If so, can you please
forward me a copy.
If the review hasn't been completed can you give an estimated date for
completion? It's now over 18 months since the data breach occurred
Yours faithfully,
Peter Mitchell
-------------------------------------------------------------------
This is an Official Information request made via the FYI website.
Please use this email address for all replies to this request:
[FOI #20962 email]
Is [Ministry of Health request email] the wrong address for Official Information requests
to Ministry of Health? If so, please contact us using this form:
[5]https://scanmail.trustwave.com/?c=15517&...
Disclaimer: This message and any reply that you make will be published on
the internet. Our privacy and copyright policies:
[6]https://scanmail.trustwave.com/?c=15517&...
If you find this service useful as an Official Information officer, please
ask your web manager to link to us from your organisation's OIA or LGOIMA
page.
-------------------------------------------------------------------
****************************************************************************
Statement of confidentiality: This e-mail message and any accompanying
attachments may contain information that is IN-CONFIDENCE and subject to
legal privilege.
If you are not the intended recipient, do not read, use, disseminate,
distribute or copy this message or attachments.
If you have received this message in error, please notify the sender
immediately and delete this message.
****************************************************************************
--------------------------------------------------------------------------
This e-mail message has been scanned for Viruses and Content and cleared
by the Ministry of Health's Content and Virus Filtering Gateway
--------------------------------------------------------------------------
References
Visible links
1. http://www.ombudsman.parliament.nz/
2. https://www.health.govt.nz/about-ministr...
3. https://covid19.govt.nz/
4. http://scanmail.trustwave.com/?c=15517&a...
5. https://scanmail.trustwave.com/?c=15517&...
6. https://scanmail.trustwave.com/?c=15517&...
hide quoted sections
From: OIA Requests
Kia ora Peter
Please find attached a letter regarding the transfer of your request for
information
Ngā mihi
OIA Services Team
Manatū Hauora | Ministry of Health
M[1]inistry of Health information releases
U[2]nite against COVID-19
****************************************************************************
Statement of confidentiality: This e-mail message and any accompanying
attachments may contain information that is IN-CONFIDENCE and subject to
legal privilege.
If you are not the intended recipient, do not read, use, disseminate,
distribute or copy this message or attachments.
If you have received this message in error, please notify the sender
immediately and delete this message.
****************************************************************************
--------------------------------------------------------------------------
This e-mail message has been scanned for Viruses and Content and cleared
by the Ministry of Health's Content and Virus Filtering Gateway
--------------------------------------------------------------------------
References
Visible links
1. https://www.health.govt.nz/about-ministr...
2. https://covid19.govt.nz/
hide quoted sections
From: hnzOIA
Tēnā koe,
Thank you for contacting Te Whatu Ora, Health NZ. This is an automatic
reply to confirm that we have received your email. Depending on the
nature of your request you may not receive a response for up to 20 working
days. We will try to respond to your query as quickly as possible.
s information that is identified to be of general public interest, the
response may also be published on our website. If we e response to your
OIA request, all personal information, including your name and contact
details will be removed.
Ngā mihi
Te Whatu Ora, Health NZ.
****************************************************************************
Statement of confidentiality: This e-mail message and any accompanying
attachments may contain information that is IN-CONFIDENCE and subject to
legal privilege.
If you are not the intended recipient, do not read, use, disseminate,
distribute or copy this message or attachments.
If you have received this message in error, please notify the sender
immediately and delete this message.
****************************************************************************
--------------------------------------------------------------------------
This e-mail message has been scanned for Viruses and Content and cleared
by the Ministry of Health's Content and Virus Filtering Gateway
--------------------------------------------------------------------------
hide quoted sections
From: hnzOIA
Kia ora Peter,
Thank you for your request for information about an Independant paper
review on 10 November 2022. Please find attached our response to your
request.
If you have any questions, please get in touch at
[1][email address].
If you are not happy with this response, you have the right to make a
complaint to the Ombudsman. Information about how to do this is available
at www.ombudsman.parliament.nz or by phoning 0800 802 602.
Ngâ mihi
Te Whatu Ora – Health New Zealand
TeWhatuOra.govt.nz
****************************************************************************
Statement of confidentiality: This e-mail message and any accompanying
attachments may contain information that is IN-CONFIDENCE and subject to
legal privilege.
If you are not the intended recipient, do not read, use, disseminate,
distribute or copy this message or attachments.
If you have received this message in error, please notify the sender
immediately and delete this message.
****************************************************************************
--------------------------------------------------------------------------
This e-mail message has been scanned for Viruses and Content and cleared
by the Ministry of Health's Content and Virus Filtering Gateway
--------------------------------------------------------------------------
References
Visible links
1. mailto:[email address]
hide quoted sections
From: Peter Mitchell
Dear hnzOIA,
Gaynor,
I see there are media reports that a report was released on 7 December. I'm surprised you didn't send me a copy of the report. Can you please do so.
Yours sincerely,
Peter Mitchell
From: Peter Mitchell
Dear hnzOIA,
I have now been given a copy of the InPhySec Security report. I see it has been released with a number of redactions made under the Official Information Act.
In terms of those redactions can Health NZ please provide, under s. 19(a)(ii) of the OIA, the grounds of support of each of those redactions.
I note for the record Health NZ has not advised me of my right to make a complaint to the Office of the Ombudsman to seek an investigation and review of Health NZ's refusal to provide all the information in the InPhySec Security report.
I also note that Health NZ has not referred to any public interest reasons to release the redacted information referred to in s. 9(1) of the OIA. Can you please send me that s. 9(1) consideration.
Yours sincerely,
Peter Mitchell
From: hnzOIA
Hi Peter,
Thank you for emailing us. I’m happy to respond to the questions to have
regarding the InPhySec Security report in relation to its redactions.
“In terms of those redactions can Health NZ please provide, under s.
19(a)(ii) of the OIA, the grounds of support of each of those redactions.”
There were two different grounds used for the redactions made in the
report, they were 9(2)(c) and Harassment 9(2)(k).
9(2)(c) applies if the withholding of the information is necessary to
avoid prejudice to measures protecting the health or safety of members of
the public.
9(2)(k) is used to prevent the disclosure or use of official information
for improper gain or improper advantage.
We considered the public interest in transparency and accountability, but
did not consider that it outweighed the harm.
It was also mentioned in our decision letter to you that you could
complain to the ombudsman. We have attached that response letter to this
email.
If you have any further questions about this please do not hesitate to ask
them by replying to this email.
Regards,
Ministerial Services
Te Whatu Ora – Health New Zealand
TeWhatuOra.govt.nz
-----Original Message-----
From: Peter Mitchell <[1][FYI request #20962 email]>
Sent: Thursday, 8 December 2022 11:35 am
To: hnzOIA <[2][email address]>
Subject: Re: Response to your request for information HNZ ref HNZ00006562
CRM:0310007
Dear hnzOIA,
I have now been given a copy of the InPhySec Security report. I see it has
been released with a number of redactions made under the Official
Information Act.
In terms of those redactions can Health NZ please provide, under s.
19(a)(ii) of the OIA, the grounds of support of each of those redactions.
I note for the record Health NZ has not advised me of my right to make a
complaint to the Office of the Ombudsman to seek an investigation and
review of Health NZ's refusal to provide all the information in the
InPhySec Security report.
I also note that Health NZ has not referred to any public interest reasons
to release the redacted information referred to in s. 9(1) of the OIA. Can
you please send me that s. 9(1) consideration.
Yours sincerely,
Peter Mitchell
-----Original Message-----
Kia ora Peter,
Thank you for your request for information about an Independant paper
review on 10 November 2022. Please find attached our response to your
request.
If you have any questions, please get in touch at [1][email address].
If you are not happy with this response, you have the right to make a
complaint to the Ombudsman. Information about how to do this is available
at [3]www.ombudsman.parliament.nz or by phoning 0800 802 602.
Ngâ mihi
Te Whatu Ora – Health New Zealand
[4]http://scanmail.trustwave.com/?c=15517&a...
References
Visible links
1. [5]mailto:[email address]
-------------------------------------------------------------------
Please use this email address for all replies to this request:
[6][FYI request #20962 email]
Disclaimer: This message and any reply that you make will be published on
the internet. Our privacy and copyright policies:
[7]https://scanmail.trustwave.com/?c=15517&...
If you find this service useful as an Official Information officer, please
ask your web manager to link to us from your organisation's OIA or LGOIMA
page.
-------------------------------------------------------------------
****************************************************************************
Statement of confidentiality: This e-mail message and any accompanying
attachments may contain information that is IN-CONFIDENCE and subject to
legal privilege.
If you are not the intended recipient, do not read, use, disseminate,
distribute or copy this message or attachments.
If you have received this message in error, please notify the sender
immediately and delete this message.
****************************************************************************
--------------------------------------------------------------------------
This e-mail message has been scanned for Viruses and Content and cleared
by the Ministry of Health's Content and Virus Filtering Gateway
--------------------------------------------------------------------------
References
Visible links
1. mailto:[FYI request #20962 email]
2. mailto:[email address]
3. http://www.ombudsman.parliament.nz/
4. http://scanmail.trustwave.com/?c=15517&a...
5. mailto:[email
6. mailto:[FYI request #20962 email]
7. https://scanmail.trustwave.com/?c=15517&...
hide quoted sections
From: Peter Mitchell
Dear hnzOIA,
I refer to your response of 21 December 2022.
You refer to ss. 9(2)(c) and 9(2)(k).
Grounds in Support
Regarding my request for the s.19 OIA grounds in support of that reason to withhold you have not given me those grounds in support.
S. 19(a)(i) provides you must give the applicant who made the request the “reason for its refusal.” You have done that by referring to s. 9(2)(c) and 9(2)(k).
As you will be aware s. 19(a)(ii) provides, in part:
“if the applicant so requests, the grounds in support of that reason, unless the giving of those grounds would itself prejudice the interests protected by …. section 9 and (in the case of the interests protected by section 9) there is no countervailing public interest;”
In my 8 December 2022 email I had asked for those s.19(a)(ii) “grounds in support” of Health NZ’s decision to use s. 9(2)(c) and 9(2)(k).
In his September 2022 report “OIA compliance and practice in Ministry of Health” the Chief Ombudsman commented (at p. 30):
“Staff in the Communications and Data Services teams should also have an adequate level of knowledge about the OIA to allow them to identify OIA requests and to be aware of the obligations they must adhere to when responding to them. In particular, these staff need to be aware of OIA timeliness obligations and, where any aspect of the request is refused, they must be aware of the Ministry’s obligations under section 19 of the OIA to give the requester the reason for its refusal … “
And at p.46:
“There are a number of reasons I suggest the Ministry embed good record keeping practices for OIA requests:
it will assist the agency in responding to requesters if they seek the grounds for withholding information, under section 19 of the OIA;”
Again I request you to provide me with the grounds in support of Health NZ‘s decision to use s. 9(2)(c) and 9(2)(k).
Public Interest
In your 21 December 2022 response when I asked about Health NZ’s section 9(1) (public interest) considerations you simply said:
“We considered the public interest in transparency and accountability, but did not consider that it outweighed the harm.”
To assist agencies in considering how to properly apply section 9(1) and the public interest the Ombudsman in 2019 prepared “Public interest: A guide to the public interest test.” In its Introduction this Guide said:
"This is a guide to how the public interest test works in practice. It contains discussion and case studies to illustrate:
the kinds of public interest considerations that can favour disclosure of official information;
some factors that can affect the weight of the public interest in disclosure; and
alternative ways that agencies can seek to strike the right balance between the need to withhold information and the public interest in release.
In the Guide (p. 4) it states:
The public interest is broadly equivalent to the concept of the public good. It can cover a wide range of values and principles relating to the public good, or what is in the best interests of society.
The Guide goes on to give examples of public interest considerations favouring disclosure. These considerations include:
Transparency
Participation
Accountabilty
Administration of justice
Health, safety and environment
The Guide says (p.5):
In practice, this means that agencies must:
Identify the …. interest(s) in favour of withholding the information
Identify the public interest considerations in favour of disclosing the information
Assess the relative weight of these competing interests, and decide whether the public interest in disclosure outweighs the need to withhold.
The Guide, at pp. 8 – 22 gives practical examples of identifying public interest considerations favouring disclosure.
Recording and giving reasons
On p. 27 the Guide says:
The official information legislation doesn’t say that agencies have to record or give their reasons for concluding that the public interest in release does not outweigh the need to withhold information when refusing a request. However, it is good practice for agencies to adequately document their decision making process, including their application of the public interest test. Doing so helps in the event that a requester seeks the grounds in support of the reasons for withholding, or an agency has to justify to the Ombudsman its decision to refuse a request.
It is also good practice for agencies to explain their application of the public interest test to requesters, even if the requester does not seek the grounds in support of the reasons for withholding. This should include the public interest considerations they have taken into account, and their reasons for concluding that those considerations did not outweigh the need to withhold. Doing so promotes transparency and helps to instil trust and confidence that the agency has taken a robust approach to the application of the withholding grounds."
In his September 2022 report “OIA compliance and practice in Ministry of Health” the Chief Ombudsman commented (at p. 47)”
“... I suggested in my provisional opinion that the Ministry may wish to consider adding a prompt to staff in its template OIA response letters to include details for the requester about the public interest considerations specific to their request. This should not simply be a rote sentence stating that countervailing public interest considerations do not outweigh the decision to withhold information. It should promote genuine consideration of the public interest and be informative for requesters. The Ministry has advised that it has amended its template in accordance with my suggestion and I look forward to following up on its implementation over the coming months.”
Given your Ministry has advised it has amended its public interest template you have still given me in your response of 22 December 2023 what the Chief Ombudsman refers to as a “ …a rote sentence stating that countervailing public interest considerations do not outweigh the decision to withhold information.”
Can you provide what the Public Interest Guide referred to above says:
"This should include the public interest considerations they have taken into account, and their reasons for concluding that those considerations did not outweigh the need to withhold."
I await your response on both of these matters.
Yours sincerely,
Peter Mitchell
Things to do with this request
- Add an annotation (to help the requester or others)
- Download a zip file of all correspondence
Offensive? Unsuitable?
Requests for personal information and vexatious requests are not considered valid requests for Official Information (read more).
If you believe this request is not suitable, you can report it for attention by the site administrators
Report this request
Scott left an annotation ()
The report is online here: https://www.tewhatuora.govt.nz/about-us/...
Link to this