23 June 2023
Sarah Brodrick
[FYI request #22907 email]
Kia ora Sarah
Your Official Information Act request, reference: GOV-025291
Thank you for your requ
est via FYI website of 25 May 2023, asking for information related to privacy at ACC
under the Official Information Act 1982 (the Act).
How we have interpreted your request
Your request asks for ‘all’ official information relating to a range of subjects about privacy at ACC. In our
view, the term ‘all’ is very general, and does not clearly identify the sort of information you are after.
Noting this, we have interpreted your request as seeking documents that are current and provide an
overview of each subject requested. This interpretation, we hope, provides you with information that is
relevant to your enquiries.
The Ombudsman website contains guidance on making official information requests, which you can find at:
www.ombudsman.parliament.nz/resources/making-official-information-requests-guide-requesters. Please note that Staff names have been removed from the documents provided as we have determined
that they are out of scope of your request.
ACC’s access and use of client information
ACC’s Personal Information and Privacy Policy (attached) sets out how ACC collects, stores, uses, discloses,
retains, and protects personal information.
The ACC Code of Conduct sets out that ACC employees are expected to maintain the highest standards of
integrity, discretion and ethical conduct when performing their duties. All staff and contractors are also
required to act in accordance with
the ACC Code of Claimants’ Rights, which covers claimants’ rights to
have their privacy respected.
You can read our privacy notice, framework and disclaimer a
t www.acc.co.nz/privacy/. You can also
understand how your privacy is protected and how to make a complaint about our privacy process.
Collection of medical and other records
To establish your entitlement to compensation, rehabilitation and treatment we may need to collect
medical and other records about you from a third party, such as your General Practitioner, other medical
professional or employer. If there is a clear reason that 2 years is likely to be insufficient, we can collect up
to 5 years if rationale exists that we are reasonably likely to need this.
We need your authority to collect them and only seek records that are or may be relevant to your claim
during the life of your claim. We’ll let you know about the types of records we need to collect, and why we
need to collect them to make these decisions about your claim.
You can either authorise and submit an ACC form or contact us if you'd like to discuss other ways to provide
your authority. These may include, for example, setting the duration of your authority or asking us to
contact you for authority on a case by case basis.
GOV-025291 Page 1 of 3
When ACC collects, uses, stores, and discloses information, we comply with th
e Privacy Act 2020 and the Health Information Privacy Code 2020. We use all information collected to fulfil the requirements of the
Accident Compensation Act 2001 (AC Act).
People who receive assistance from ACC have a legal responsibility
under Section 72 of the AC Act to
provide, or authorise other people to provide, all relevant information and cooperate with ACC in their own
rehabilitation.
Where a client refuses to provide medical information that is relevant to making a decision on their claim, a
decision cannot be made, and therefore the claim must be declined.
We have provided you with the following documents:
-
Obtain Client Authority to Collect Information
-
Request medical or clinical records policy
-
Request clinical records
-
Decline or withdraw client authority to collect information
Please note that there are no legal grounds to support requesting information that is not related to the
relevant claim decision being investigated and reasons for requests for medical information must be
communicated to clients or a client’s advocate/authority to Act. We are therefore refusing this part of your
request as the information does not exist. This decision has been made under section 18(e) of the Act.
Written guidance
To assist in making decisions, ACC’s frontline may request internal specialist guidance from a number of
different areas, such as Clinical Services.
The Clinical Advisor works collaboratively across teams to provide expert consistent, robust and up to date
clinical and rehabilitation advice to ensure sound, consistent, evidence-based decision making. They
provide comprehensive guidance within a written guidance form and stored on ACC’s claims management
system (Eos).
We have provided you with the following documents:
-
Clinical Advisor job description
-
Seek internal guidance
-
Provide internal guidance- written
Pre-existing conditions and casual link
ACC does not cover pre-existing conditions made symptomatic by an accident (or other qualifying
circumstances). However, degenerative changes or pre-existing conditions do not exclude cover if there is a
new injury that is caused by an accident (or other qualifying circumstances), and is not substantially caused
by the pre-existing condition.
ACC has an investigative onus when considering claims (whether for cover or entitlement) and must make
decisions on reasonable grounds. Attached is ACC’s Cover criteria for pre-existing conditions Policy.
For a claim to have cover for a treatment injury there must be a causal link between the treatment and the
injury. See Casual Link policy attached a
nd Section 33 of the AC Act.
GOV-025291 Page 2 of 3
Privacy breaches and the number of settlements
We have interpreted your request for data related to unlawful requests for personal information and
remedies for those unlawful requests as the number of privacy breaches and the number of settlements
made for breaches under the collection related information privacy principles:
• Only collect personal information if it is necessary
• Get the information straight from the individual concerned
• Tell them what you’re going to do with it
• Be considerate when you’re collecting it
Between 1 July 2022 and 31 May 2023 there were nine breaches under these principles recorded. Since
2018 there has been one settlement.
We are unable to provide you with the number of related breaches between 1 July 2018 and 30 June 2022
as it would require substantial collation and research to complete. In order to extract whether a breach by
way of unlawful collection had occurred, would require manual review and investigation of the written
explanation of the privacy incidents across all of weekly breach reporting spreadsheets for that period..
We are therefore refusing this part of your request as the information required to complete your request
requires substantial collation and research. This decision has been made under section 18(f) of the Act.
In making this decision, we considered extending the time limit for responding or applying a charge (as
allowed under the Act). However, neither of these were offered as responding using either option would still
have unreasonably interfered with ACC’s operations.
If you have any questions about this response
You can email me
at [email address]. If you are not happy with this response, you can also contact the Ombudsman via
[email address] or by phoning 0800 802 602. Information about how to make a complaint
is available at
www.ombudsman.parliament.nz. Ngā mihi
Sara Freitag
Acting Manager Official Information Act Services
Government Engagement
GOV-025291 Page 3 of 3
