A mother's world has been "turned upside down" after a nurse accidentally sent details of her child's sexual abuse to an unrelated party.
The Dunedin woman, who spoke on condition of anonymity, was told by the Southern District Health Board in December last year of a privacy breach involving "sensitive information".
But the horrifying details were only revealed in a letter she received last Monday.
Attached to an apology from the SDHB were the contents of the file that was accidentally attached to an email to a Porse teacher on an unrelated matter.
In it was the outline of a conversation the woman had had with a nurse in 2017, outlining sexual abuse her child had suffered.
It featured names of the woman's children and schools they attended.
She had no idea the discussion had even been transcribed.
"I would never have disclosed information if they had said it was being recorded," she said.
When the sexual allegations arose, she said her "whole world was destroyed".
Her family had just begun to heal when she was rocked by notification of the privacy bungle.
"It's mind-blowing. I can't describe it. I haven't slept in five days," the woman told the Otago Daily Times last week.
She has instructed legal counsel and made a complaint to the office of the Privacy Commissioner.
From there, she would consider taking the case to the Human Rights Review Tribunal.
She sat down for a meeting with SDHB's primary care and population health general manager Mary Cleary-Lyons on Wednesday.
The official explained the file containing the private information had been saved on a computer desktop beside a blank referral form.
Critically, the SDHB could give no assurances to the woman that it had only been sent once.
"At the meeting they admitted it had been sitting on the desktop for 16 months and they had no idea how many times it had been sent out," she said.
Ms Cleary-Lyons said the private file had since been removed from the desktop and stored correctly, "so we do not anticipate this happening again".
The staff member involved and the wider team had been spoken to, to avoid such an error happening again.
"We are continuing to review the full chain of events and I anticipate we may make further changes to our procedures and systems to improve data security and ensure we adequately protect patient privacy," Ms Cleary-Lyons said in a letter.
They told the woman she would receive a copy of any report generated but could give no estimate of how long the process would take.
SDHB acting chief executive Lisa Gestro apologised "unreservedly, for the distress that has been caused by this situation".
The ODT's questions about other privacy breaches and specific protocols regarding information storage went unanswered.
University of Otago law professor Paul Roth said the Privacy Commissioner's role was to make findings and then assist parties in settling the issue.
Matters normally concluded at that juncture but a complainant could then progress the case to the Human Rights Review Tribunal.
Damages could only be awarded if someone could prove they had suffered harm or loss as a direct result of the privacy breach, Prof Roth said.
The Dunedin mother said the consequences of the breach could be catastrophic.
One of her children had repeatedly harmed herself and the mother worried if there was any hint personal information had been inadvertently leaked, there could be a tragic outcome.
"I feel like I've failed my children," she said.
"I'll never trust [the DHB] again."
