Disgraced National MP Hamish Walker sent private Covid-19 details because his judgement was impaired after being called racist, an inquiry has found.
And former National party president Michelle Boag sent the highly sensitive information to Walker in an attempt to help clear his name.
The powerful inquiry by the State Services Commission was critical of the pair and found the Ministry of Health could have kept patient details more secure.
Deputy Services Commissioner State Helene Quilter was very critical of Boag and Walker:
"Ms Boag and Mr Walker were each responsible for the unauthorised disclosure of this sensitive information. Their motivations were political. Their actions were not justified or reasonable. Each acknowledged their error publicly and cooperated with this inquiry."
The investigation, headed by former solicitor general Michael Heron, QC, was tasked with getting to the bottom of the leak and investigate whether patient data could have been kept more secure.
Heron found Boag was sent the patient details through her role of acting chief executive of Auckland Rescue Helicopter Trust.
During the peak of the crisis, emergency services were sent the details of active cases.
Quilter said this should have been reviewed.
"The Ministry's policy should have been reviewed when the context shifted and it was not," said Quilter.
"I am not going to criticise the Ministry of Health beyond that when lives have been saved as a result of their actions on the broader Covid-19 front.
"The information should not have been placed in the public arena. The Ministry of Health did not place it there."
Boag then sent Walker the information after he'd been accused of being racist for saying the active cases came from "India, Pakistan and Korea".
She believed the information would help clear his name.
Walker then forwarded the information to media.
"The three countries are places in the news as having significant outbreaks of Covid-19. I was aware that at least many of the people would be New Zealand citizens or permanent residents and it was not my intention to highlight the race of the people, but simply their country of departure."
Walker said he found accusations of racism "very upsetting" and impaired his judgement.
Walker said he was also concerned at how freely the patient information was available and was sent around without password protection and he wanted to hold the Government to account.
"I saw this as a major Government flaw that I could expose at the time."
The findings of the inquiry have been passed to the Privacy Commissioner as they sit outside the jurisdiction of the State Services Commission.
The investigation found the security around the security of personal information within the Ministry of Health "could have been tighter and the agency should have reviewed this earlier".
Director general of health Ashley Bloomfield has given the State Services Commission assurances his ministry is fixing the areas identified in the report for improvement.
