In the spotlight: The Queenstown Medical Centre’s Isle St branch


Probe into more serious breach inconclusive, staff member resigns

A Queenstown woman has received an apology from the Queenstown Medical Centre after a receptionist breached its policies by looking at her medical records.

However, she remains angry about the incident because the receptionist, who quit last September and left the resort, has refused to admit she told a third party details about the complainant’s visit to the medical centre last March.

The woman, who does not wish to be named, complained to the Office of the Privacy Commissioner (OPC) last July.

It wrapped up its investigation earlier this month, concluding it can’t make a finding because of a lack of evidence.

QMC chief executive Ashley Light says he sympathises with the complainant, but maintains the breach was a ‘‘one-off, rogue event’’, and its processes and staff training are up to scratch.

Mountain Scene is not naming the receptionist, now living in the North Island, for legal reasons.

The complainant says she had a short-lived relationship with the third party, a resort man, which began about two months after he broke off his engagement to the receptionist.

Claim receptionist motivated by jealousy

Last March, he told the complainant his ex-fiancee had called him to say the complainant had visited the medical centre’s Isle Street branch, telling him details about a series of tests the complainant had undergone.

The complainant says the information was ‘‘deeply personal’’ and potentially embarrassing, and the receptionist had been motivated by jealousy.

‘‘She wanted to damage our relationship.’’

When she complained to QMC the following month, Light confirmed the receptionist had breached its policy by viewing her visit record, but said the allegation of a third party breach was ‘‘inconclusive’’.

He’d given the receptionist a final written warning and put her on ‘‘probation’’.

When Light asked if she had evidence of the third party breach, she sent him a copy of an exchange of messages between herself and the third party in which the latter says ‘‘I should have said nothing to be honest, it’s my fault for talk to much [sic]’’ and ‘‘Forgive her she was trying to look out for me and she breached the privacy’’.

The complainant says there’s no other possible explanation for the breach, and she only met the receptionist for the first time months later when Light arranged a meeting between them.

The complainant says the man refused to support her complaint because he didn’t want his ex-fiancee to get in more trouble.

She later received a three-line email from the receptionist, apologising for ‘‘reviewing your medical notes’’.

‘‘It’s like a child saying sorry because their parents told them to.’’

The OPC investigator had told her she’d been unable to make a finding given the lack of evidence.

However, the investigator had carried out a review of QMC’s policies and training.

‘‘I am satisfied the centre has taken reasonable steps to secure the personal information it holds,’’ the investigator wrote.

QMC had demonstrated it had processes in place in case such a breach occurred again.

The OPC has also made recommendations to the medical centre on ‘‘steps they can take to prevent employee browsing’’.

The complainant says the OPC doesn’t have powers to seize phone records, so couldn’t go any further than QMC had, to investigate the breach.

She therefore sees no point in taking her complaint one step higher to the Human Rights Review Tribunal.

She’s pleased, however, that QMC’s systems and training have been independently reviewed.

‘‘I don’t want this to happen to anyone else.’’

Light tells Scene he’s been on leave and hasn’t had a chance to go through the OPC’s report and recommendations.

But once he has, he’ll again review the medical centre’s privacy measures, which include random audits of what patient information staff are viewing.

Asked if the receptionist inappropriately viewed other patients’ medical information, he says: ‘‘No, this is a one-off, rogue event . . . it’s not something we’ve encountered before or since.’’

Light says he ‘‘totally understands’’ why the complainant feels aggrieved about her experience.

‘‘We feel for her, and I wish I could have found the evidence because it would’ve made things a lot quicker.

‘‘We went as far as we could with the Privacy Commissioner to find that evidence, and it wasn’t forthcoming.

‘‘The outcome is that staff member is no longer with us.

‘‘That’s as much as we can do, and then reinforce the training and the policies with the rest of our staff.’’

His message to all QMC patients is ‘‘they can be very confident our processes, procedures and policies are robust’’.

‘‘Unfortunately, we were unable to protect against a one- off, rogue event — a decision by a staff member that was obviously regrettable.

‘‘It’s not ideal because it gets in the way of what we’re trying to do, which is keeping the community safe — not just against Covid but everything else that’s going on.’’