Covid-19 patients' privacy breach 'not justified or reasonable', inquiry finds

There was no justification for MP Hamish Walker and political operative Michelle Boag to leak confidential Covid-19 patient details, the inquiry into the privacy breach found today. The report also warned of concern at the "routine dissemination" of personal details by the Ministry of Health.

Names, addresses, ages and hotel names of people who tested positive for Covid-19 were  leaked to some media  outlets in early July by Mr Walker, a National MP who had been sent the details by Ms Boag, former National Party president and then-acting chief executive of Auckland Rescue Helicopter Trust. 

The inquiry by Michael Heron found their motivations were political and "not justified or reasonable". 

Deputy State Services Commissioner Helene Quilter has referred Mr Heron's report to the Privacy Commissioner. 

The report found the security around personal information by the Ministry of Health "could have been tighter and the agency should have reviewed this earlier", Ms Quilter said. 

She said the policies around privacy should have been reviewed when there was no longer community transmission in New Zealand - "and it was not". 

"The information should not have been placed in the public arena, the Ministry of Health did not place it there," she said. 

Director-General of Health Dr Ashley Bloomfield said the Ministry of Health is fixing the issues identified in the report. 

The Ministry of Health began notifying emergency services of active cases during the early stages of the Covid-19 outbreak. 

“The policy and process should have been reviewed once there was no longer cases in the community and the dissemination to emergency services of the personal information ought to have stopped,” Mr Heron wrote. 

“In any event, there ought to have been better protection over the personal information.”


Mr Walker told Mr Heron he leaked the information in an effort to hold the Government to account and to respond to an accusation of racism. 

“He explained how one of his constituents had informed him about a likely influx of people to the constituency (Clutha-Southland) from three countries, which was causing concern because of inadequate facilities and preparation”. 

Mr Walker issued a press statement and “it was met with varied reactions, some, including a Government Minister) calling Mr Walker racist”, the report said. 

He went to Ms Boag “in his distress” and she forwarded him the email with the Covid-19 patient information. 

In a statement to the inquiry, Mr Walker wrote, “Ms Boag provided me with this information for me to use in my defence against the accusation of racism”. 

“I could not believe confidential patient information was being sent to a wide range of people from the Government like a school newsletter with no password protection”. 

“I saw this as a major flaw that I could expose at the same time," he said. 

“I accept that my judgement was impaired due to the pressure and distress of being labelled a racist.”


The MoH has suspended its dissemination of patient information. The original email from MoH was sent to Ms Boag’s business email. Its subject line was ‘MEDICAL IN CONFIDENCE – Case notification 02 July 2020’. 

It had a spreadsheet attached with the information and the email had a footer with privacy expectations. 

Mr Heron said the information should have been better protected “from the beginning”. 

On repercussions, Mr Heron said the leak was “committed by motivated individuals knowing they had no entitlements to disclose the information they did, it is doubtful whether an policy (or, potentially security system) could have prevented that. 

The report also found MPs and mayors had been requesting the information about Covid-19 patients but the MoH did not think this was appropriate. 


July 4 - Media outlets reported it had received confidential Covid-19 patient information but did not release the details. 

July 6 - Health Minister Chris Hipkins launches an inquiry into the leak. 

July 7 - National MP Hamish Walker confessed to leaking Covid-19 patient details to the media. Shortly after, Michelle Boag admitted being the original source.

July 8 - Todd Muller said he didn't not want MP Hamish Walker to run as the party's candidate in the Clutha-Southland electorate. Michelle Boag quit her National Party roles. Mr Walker announced he would not stand at the next election.

July 9 - Mr Muller rejected questions that more than one MP had data leaks sent to them, and denied speaking to Michael Woodhouse.

July 10 - Mr Muller said he knew on July 7 that Mr Woodhouse had been sent confidential patient information by Ms Boag. Michelle Boag withdrew all membership from National Party and said she has an "unhealthy relationship with politics".