ACC form ruling's 'no big privacy breach'

23:08, Apr 14 2014

Revelations that thousands of ACC forms gathering private medical information may be illegal is "not a big privacy breach", Prime Minister John Key says.

Two decisions by the District Court say ACC acted unlawfully when it told two clients it could insist they either signed the consent forms or lose their compensation.

Dunedin lawyer Peter Sara, who was representing the claimants, said all clients were told they must sign the forms, known as ACC 167, which was now deemed to be incompatible with the corporation's own laws.

If claimants didn't sign the forms, their claims were not processed or payments were not made.

The ruling meant information on potentially thousands of people was collected illegally, which some have labelled a massive privacy breach.

But Key said it wasn't.

"I can only act on the advice I've got, but my understanding is the form is not illegal, so therefore it's not a big privacy breach as some people might say, " he said this morning on Firstline.

"What is illegal, according to the judge, is that ACC required you to sign this 167 form that gave access to your medical records and history.

"It's not the form that's illegal - that's totally legal as I'm advised - it's just the fact that they're not paying out or processing a claim if you won't sign that form."

He denied the revelation was another black mark for beleaguered ACC Minister Judith Collins.

"People test their rights in the courts," Key said.

"Operationally, agencies like ACC do actually practically need to see people's medical records, to see whether there's a pre-existing condition.

"On the one side, they're processing your claim as a claimant and deciding whether you're entitled to to payment. On the other side of the coin, they're trying to manage the expense from the taxpayers' point of view and make sure they're complying with the ACC legislation.

"They've got to balance those two things out. If the non-payment of a claim because people don't sign the form is an illegal action then ACC . . . will have to determine what they do next."

The cases were heard by Judge Grant Powell, who upheld both appeals and awarded costs against ACC.

Judge Powell said he realised the decision would have "serious ramifications" for ACC and it was important a new consent form compatible with its own laws was developed as soon as possible.

He said that given ACC's 167 form had gone far beyond its legislated authority to gather private information, it had been reasonable for the appellants to refuse to sign it.

ACC general manager of claims management, Sid Miller, said ACC was was "taking on board" the rulings.

"I think the other piece that's very important here is that we recognise the judge ruled the form was too broad in the way that it is written," he said on Morning Report.

But he denied the information was a "blank cheque".

"I don't think it is a blank cheque, we require information from our clients in terms of supporting them on their rehabilitation."

He rejected that full access to someone's medical history was a way to refuse people their claims.

ACC was now working to put in place a new consent form and had given case managers instructions in dealing with concerned clients.

"We've also got an 0800 number and we'll also be looking through all those clients that could have been affected by this over the 14-year period," he said.

Miller said about 3 per cent of the roughly 50,000 ACC claimants were required to sign a 167 form each year.

"In terms of those impacted, it will be on an annual basis a small percentage of that 50,000, but then in terms of the active and the closed ones going back it could be many more, and that's the work that we have to do," Miller said

He said ACC now had had to work with customers who had signed the form and find out if they were comfortable with ACC having that level of access to their medical files.

If they weren't, then customers could sign the new form ACC was putting in place.

"It is a big situation, as a result of these findings, and we have to address that," he said.

But nothing in the judgement said ACC had been using inappropriately the information it had gathered.

Miller said where clients were not comfortable in the level of information ACC had gathered about them, the corporation would have to dispose of that information.

Labour's ACC spokesman Iain Lees-Galloway said there was "clearly" a privacy breach.

"I think it is a form of privacy breach. What ACC has done is collected information that it had no right to," he said.

"That means that people's private information is available to people that shouldn't have it,that to me is a privacy breach."

Lees-Galloway said ACC needed to think "long and hard" about what it will do with the information.

"It's been gathered inappropriately, and at this point I think it's probably inappropriate to be making statements about holding on to the information, they're going to have to have a bit of a think about that one."

He also slated Collins' involvement in the issue, saying she knew about it for weeks and was now refusing to front.

The minister has so far refused to comment, calling it an "operational matter".

"I think the minister's known about this for a long time, this has clearly been a risk for a long time because ACC has issues with public support around privacy," Lees-Galloway said.

He called on Collins to clarify that people's private information was safe, and look into ways to get rid of information illegally obtained.

He also warned new claimants against signing the old form.

"If I were an ACC claimant today, I would be refusing to sign that form, and I'd be requiring a different consent as is required under the law, not the ACC 167 form that goes way beyond the bounds of the law."