ACC has cut the number of staff who can look at sensitive claim files by nearly 40 percent amid a raft of changes to beef up privacy measures at the agency.
Following an internal review, the number of employees with access to sensitive claims was reduced from 1414 to 865. Photo: RNZ/Vinay Ranchhod
The way ACC manages sensitive claims, which relate to sexual abuse or assault, has come under scrutiny after RNZ highlighted concerns about the number of staff who have access to them, and revealed a group of call centre staff shared, and laughed at, client details in a private Snapchat group.
This prompted the ACC Board and Treasury to appoint Wellington lawyer Linda Clark to review how the agency handles private and sensitive client information. The review was expected to be completed next month, but changes at the agency were already afoot.
Following an internal review, the number of employees with access to sensitive claims was reduced from 1414 to 865, a reduction of 38 percent since October, according to figures released to RNZ under the Official Information Act.
ACC was also making other changes to further protect against employee browsing.
"We are investigating whether it is possible to tailor the access granted for staff, so they only have access to specific areas of a claim record," ACC said.
"We have work underway to further restrict and control access to our core claims management system, Eos. This work will also enable us to monitor exactly what parts of a claim file are accessed by staff. Regular auditing and reporting of sensitive claims user access will be part of this."
ACC line managers currently received quarterly reports showing which staff had access to sensitive claim files but they had no way of knowing which files were accessed and when. The agency worked on a high-trust model and expected staff to adhere to its code of conduct which states files should only be accessed if it was in the course of their job.
The ACC call centre employee who blew the whistle on the Snapchat group told RNZ that employee browsing of claim files was widespread, as once a caller's identity had been verified they had access to their whole claim, including medical records.
"All we have to do is go into the documents tab and literally everything is sitting in there. And if we wanted to click on every individual one, and just open it up, there's no passwords to get into," they said.
Staff that no longer had routine access to sensitive claims included integrity services (investigations), resolution specialists, claimant support coordinators, examining officers and ministerial writing.
"We have also removed, and continue to remove, access for individuals within a wide range of teams as a result of streamlining sensitive claims-related tasks to specified team members," ACC acting chief operating officer Gabrielle O'Connor said in a statement.
"For example, only a small number of specified people in the payments team now handle payments that involve sensitive claims," O'Conner said.
Victims advocate Ruth Money, who has called for better security and more restrictions on sensitive claims, said the changes would bring relief to sexual abuse survivors worried about their privacy.
"Everybody that I deal with will think this is a really positive move. They're really worried about their confidentiality and their privacy so any kind of proactive moves to trace things, to shut things down where appropriate, can only be seen as a positive."
The ACT Party, which has questioned why so many staff had access to sensitive claims, said the changes were welcomed but were a case of "too little too late".
"The [ACC] minister said people absolutely required access to that information to complete the functions of the role. But ACC now decreasing the number of staff who have access to sensitive claims information shows it was never necessary in the first place," ACT deputy leader Brooke Van Velden said.
"It's a real tragedy that survivors have needed to go public with these stories of their own information being shared in order for this change to happen. There never should have been that many ACC staff who had access to the traumatic details of survivors' stories in the first place.
"It's good that ACC are making these changes, but it's too little too late," Van Velden said.
Money said dealing with frontline staff had become a little easier in recent months as the agency appeared to be taking criticisms of how it managed sensitive claims to heart.
"[In] some of the cases that I'm working on now, I can have a more frank and fearless conversation with the case managers. It's very early days, but you are able to advocate a little stronger. Before you used to just get shut down.
"I genuinely believe that there is intent there in improving the system for everybody, so I think we need to acknowledge that."
