An Invercargill woman is concerned about her privacy after ACC gave her someone else’s sensitive medical records.
It came one month after more than a dozen employees of Accident Compensation Corporation (ACC) staff in Hamilton allegedly shared private client information over social media and weeks after two Dunedin staff were suspended for allegedly inappropriately sharing client information.
Invercargill woman Reba Pottinger said when she sat down with a cup of coffee to go over her documents she discovered another set on top of hers.
She had requested a copy of her own records and picked them up from the Invercargill ACC office.
Inside the envelope was an extra set, which belonged to a woman in Hamilton.
The files contained a lot of sensitive information, including a full medical record, address and a phone number.
The information also included mention of anorexia, anxiety and suicide attempts.
The error was "really inappropriate" and she felt terrible for the woman who had her private information exposed, she said.
"You can’t just do that to someone."
The mistake made her feel very anxious and she started to wonder if her information could have been accidentally given out as well.
"Why aren’t things like that checked?" she said.
She considered going to ACC about the issue, but was scared that the woman in Hamilton would find out her privacy had been breached.
"It might be really detrimental to her mental health," Ms Pottinger said.
She contacted the Office of the Privacy Commissioner but was referred back to ACC.
She was unsure what to do with the papers and did not know whether she should destroy them or send them to the rightful owner, she said.
An ACC spokeswoman said ACC was investigating the alleged breach.
It had a dedicated team for client information requests which collated and checked files before releasing them to a client.
"It is likely that this was a case of human error and in no way a deliberate breach," she said.
ACC was undertaking an independent review into how it managed client information, which would show whether any changes needed to be made to how it handled client claims and information.
The review was expected to take no longer than six months.
