Covid-19 patient leak: Inquiry launched with Minister determined to uncover 'exactly who' is responsible and why

An urgent Government inquiry has been launched to uncover "exactly who" did it and why Covid-19 patient details were leaked.

State Services Minister Chris Hipkins has appointed former solicitor general Mike Heron, QC, to lead the probe into the massive Covid-19 privacy breach.

The Herald revealed on Saturday that the personal details of 18 active cases had been leaked in a spreadsheet, including their names and dates of births. Two other media outlets have also reported seeing the document.

Hipkins expected the urgent inquiry to report back by the end of the month. It will also examine how the information was stored and whether that could be improved.

"My message to all involved though is simple and clear: New Zealanders have an absolute right to expect that their personal information will be held and handled in the strictest of confidence.

"The public release of this information is wrong. I'm determined to find out why it happened, how it happened and ensure that systems are in place to prevent it from happening in the future."

READ MORE:
• Covid 19 coronavirus patients' details leaked: Investigation launched as agencies scramble
• Covid 19 privacy breach: Criminal charges 'on the table' if malicious motive behind leak of personal details
• Workers evacuated after ammonia leak at Fonterra Te Rapa
• Coronavirus: Ministers told to 'dismiss' interviews on Covid-19 documents - leaked memo

Heron will use the State Service Commissioner's powers under the State Sector Act and the powerful Inquiries Act which allow him to:

• Require documents to be produced

• Summons witnesses

• Question parties under oath

Hipkins said the approach wasn't heavy-handed given how serious the privacy breach was and the importance of getting to the bottom of how it happened and why.

"This is a very serious matter. New Zealanders should all know that their health information held by the Government is being handled with the strictest of confidence.

"And if there has been any malicious activity here, then we want to know exactly who is responsible."

Hipkins said there were a number of theories about how the sensitive information came to be released but he didn't think it was human error.

"I don't think that information tends to accidentally be sent to multiple media outlets at the same time."

Hipkins acknowledged there were legislative powers for journalists to protect their sources in an investigation and a "high threshold" had to be met for them to give evidence.

Under the Evidence Act, a journalist is not compellable to disclose their source in a criminal or civil case, or produce any document that would identify them unless a High Court judge rules it's in the public interest.

Hipkins thanked media for being "very responsible" with the people's details through not contacting them and keeping it secure.

A number of different agencies, including health and ones involved with border facilities, have access to the information.

With so many possible points of access, Hipkins conceded they might not be able to establish exactly who it was but believed they were likely to "get close if we can't get an absolute definitive answer on who did exactly what".

"That will be disappointing but we'll certainly get as close as we can to knowing exactly what's happened and who's involved."

Prime Minister Jacinda Ardern said people needed to be sure their health information was properly looked after.

What information was leaked?

The personal details of the 18 people who were active cases of Covid-19 was leaked, ranging from a 30-year-old woman in Auckland to a 70-year-old man in Canterbury.

It includes the personal details of the man in his 30s receiving care in Auckland City Hospital.

The contains their names, dates of birth, which border facility the Covid-positive people were staying in when they tested positive and where they were moved for quarantine.