Names have been removed to protect privacy. Identifying letters are assigned in alphabetical order and bear no relationship to the person’s actual name.

 

A Decision by the Deputy Health and Disability Commissioner

 

Introduction

How matter arose

Opinion: Ms A — breach

Opinion: Disability service — no breach

Changes made since events

Recommendations

Follow-up actions

 

Introduction

1. This report is the opinion of Rose Wall, Deputy Health and Disability Commissioner, and is made in accordance with the power delegated to her by the Commissioner.
2. The report discusses the conduct of Ms A, a community support worker at a disability service. Ms A took non-consensual photographs and video recordings of multiple consumers of disability support services, which were stored on her personal mobile device and accessed by a third party.
3. The following issues were identified for investigation:

• Whether Ms A provided multiple consumers with an appropriate standard of care from September 2019 to March 2023 (inclusive), including whether she treated them with respect and dignity from September 2019 to March 2023 (inclusive).
• Whether the disability service provided multiple consumers with an appropriate standard of care from September 2019 to March 2023 (inclusive), including whether it treated them with respect and dignity from September 2019 to March 2023 (inclusive).

4. The parties directly involved in the investigation were:

Ms A                                                                     Community support worker

Mr B                                                                      Complainant

Disability service                                               Group provider

5. Community support worker Mr C is also mentioned in this report.

How matter arose

Relationship between Ms A and Mr B

6. The Health and Disability Commissioner received a complaint from Mr B about the conduct of Ms A. Mr B raised concerns that Ms A had taken photographs and video recordings of multiple consumers, and that she did not treat them with respect and dignity. Mr B told HDC:

‘From the past few years [Ms A] has been sending me pictures and videos of [the disability service’s] clients and has also mentioned things that are private and confidential. I have warned her several times to stop doing the same but her continued behaviour is forcing me to send this email to inform the authorities about the breach of confidentiality and privacy of the clients. I believe [the] clients are vulnerable people and should be treated with care, empathy and should be given the privacy like we all deserve.’

7. Mr B and Ms A presented differing accounts as to how Mr B had obtained access to the photographs and video recordings of the consumers.
8. Mr B said that Ms A had shared the photographs and video recordings of the consumers with him.
9. Ms A accepts that she took the photographs and video recordings of the consumers but denies that she shared these with Mr B. Ms A said that Mr B is her estranged husband, and he gained access to the images on her personal mobile device without her consent. Ms A stated:

‘[Mr B’s] complaint is a result of a bitter, disgruntled, and vengeful ex-partner that has embarked on a crusade to ruin my life. His ultimate aim was for me to lose my job and go back to him because I would not survive financially … on my own … [Mr B] was a possessive and jealous partner who would constantly and forcibly check my phone. There were many times when I was not in the room while [Mr B] went to my phone. The only way that he would have got the photos and videos was by forwarding these to his own phone. At this point in our relationship, I had already advised [Mr B] that I want a separation. My guess is that he knew then how he would use this information against me.’

10. Mr B denies that he accessed the images on Ms A’s personal device without her consent and maintains that Ms A shared the images with him. Mr B confirmed that he and Ms A are in the process of separation but said that he has ‘zero interest’ in ruining Ms A’s professional career, and that he did not intend to cause Ms A or her reputation any harm by making the complaint.

Ms A

11. Ms A was employed by the disability service as a community support worker in November 2018. As outlined in the employment agreement between Ms A and the disability service, a community support worker works as part of a team providing support to a group of people with disabilities living in, or supported by, one of their community homes or services.
12. Ms A said that the care she provides to the consumers includes supporting them with their personal cares, medication, shopping, budgeting, and general administration.

Photographs and video recordings

13. Ms A accepts that she took non-consensual photographs and video recordings of the consumers but said that she was unable to recall the exact dates and times when these were taken.

Photographs

14. Ms A photographed five consumers who are supported by the disability service, namely Mr V, Mr W, Mr X, Mr Y, and Ms Z. A total of 13 photographs were provided to HDC.
15. Mr V features in most of the photographs. There is one photograph of Mr V asleep on a couch, and two photographs of Mr V sitting on a chair while covering his face. Other photographs show Mr V reading a newspaper, Mr V sitting on a couch, Mr V sitting on a beach, and Mr V having an alcoholic beverage in a restaurant or bar.
16. There are also photographs showing all five of the consumers in traditional dress.

Video recordings

17. Ms A used a photograph that she had taken previously to create an animated video of Mr V dressed in a costume resembling a rabbit and dancing to music.
18. Ms A also took a video recording of Mr V and another consumer in which they appear to be upset over what appears to have been a verbal disagreement. Mr V is sitting outside, while the other consumer is sitting inside the community home. Another community support worker can be heard saying, ‘Cool down, I’m going to talk to him,’ to the other consumer. Ms A can be heard saying, ‘It’s okay,’ and, ‘Cool down okay, I’ll talk to [Mr V], it’s all good,’ to the other consumer.

Video recordings of Ms Z

19. Ms A took video recordings of Ms Z verbally interacting with another community support worker, Mr C, who is not shown in any of the video recordings.
20. In one of the video recordings, Ms A can be heard telling Ms Z to go to her room. The video recording shows Ms Z punching herself in the face.
21. In another video recording, Ms A can be heard saying, ‘You’re stinking,’ to Ms Z, and Mr C can be heard saying, ‘You smell like a dead rat,’ to Ms Z. The video recording shows Ms Z spitting at Mr C. Mr C cannot be seen in the video but he can be heard spitting at Ms Z in response. Mr C can be heard saying, ‘If you spit, I’ll spit,’ and, ‘You look like a devil,’ to Ms Z.
22. Ms A said that she took the photographs and video recordings ‘as evidence of the [clients’] erratic and violent behaviour’. Ms A said:

‘I wanted this evidence to protect myself and my job in case the clients falsely accused me of treating them badly. These are moments where I could not access the house camera in time to record this erratic behaviour from clients … These photos and videos were solely for my protection. It was not shared with anyone including [Mr B] …’

23. There is nothing in the video recordings to show that Ms A took any steps in response to Mr C’s behaviour towards Ms Z. Ms A did not report the interaction between Ms Z and Mr C to the Service Coordinator.

Disability service investigation

24. Following the events, the disability service conducted an investigation of Ms A’s conduct.
25. The disability service accepts that Ms A did not share the information with Mr B and that Mr B could have accessed the information without Ms A’s consent. The disability service said that prior to the complaint, Ms A had advised that she required support ‘because she was experiencing major relationship issues with her husband’. The disability service said:

‘[The disability service] is unable to definitively confirm the method by which the complainant gained access to the images but accepts that the complainant is [Ms A’s] husband and that, in the circumstances, [Ms A’s] contention that they were accessed without her consent is a credible explanation.’

26. The disability service concluded that Ms A had collected personal information, that collecting the images and video recordings was inappropriate, and that she had failed to keep the information secure. The disability service stated: ‘We have formally advised [Ms A] that she has breached the rights of the people she is employed to support and that her conduct is unacceptable.’
27. Following disciplinary action by the disability service, Ms A received a formal written warning.
28. The disability service said that it advised all but one of the consumer’s whānau of the events. The disability service stated that Mr Y is no longer supported by the disability service, and although attempts were made to contact his whānau, these were unsuccessful.

Education and training

29. Ms A holds a certificate in Health and Wellbeing (Level 4).
30. The disability service said that upon commencing employment, all employees are provided with induction training over a five-day period. The induction training includes a briefing on key policies and practices, including its policies on privacy and incident reporting.
31. Ms A confirmed that she had received training on the disability service’s policies and practices.
32. Ms A completed the induction training in November 2018. She also completed workplace[1] training and emergency first aid training in November 2018, and positive behaviour support training in July 2019. In 2021, Ms A completed refresher workplace and emergency first aid training, and she also received a briefing on diabetes.

Management and supervision

33. Ms A reported to the House Leader and the Service Coordinator. The disability service said that the House Leader was present in the community home regularly, and the Service Coordinator visited frequently.
34. The disability service stated that prior to these events there had been no concerns about Ms A’s conduct or performance.

Relevant management standards, policies, and procedures

35. The disability service had comprehensive policies, management standards, and standard operating procedures in place at the time of the events, which are discussed below.

Code of Conduct

36. The disability service’s Code of Conduct[2] states that behaviour and conduct are critical aspects of providing safe and appropriate care for a person being supported. The Code of Conduct contains minimum requirements that must be observed by all staff members of the disability service. It states that any breach of the Code of Conduct may result in disciplinary action, and cases of serious breach of the Code of Conduct may result in instant dismissal.
37. The Code of Conduct states that staff members are required to ensure that they are aware of, understand, and comply with, the disability service’s policies and procedures.
38. In relation to reporting and documenting incidents (such as the incidents witnessed by Ms A in the video recordings discussed above), the Code of Conduct states that the correct and thorough completion of documentation is ‘a crucial performance requirement’ at the disability service, as is prompt and full reporting. These requirements cover matters such as writing in a person’s progress notes, and ‘reporting both a staff or a person’s incident or accident’.
39. The Code of Conduct states that staff members must comply with the Privacy Act and that they must treat personal information about a person, supplier, or another staff member with confidentiality and not access, pass on, or hold any such personal information without authorisation.

Code of Ethics

40. The Code of Ethics for Support Staff[3] (Code of Ethics) states that its purpose is to provide principles to underpin support work, professional and management practice, and decision-making. It states that staff members are responsible for understanding and following this management standard and related procedures.
41. The Code of Ethics states:

‘Support staff acknowledge that the way they behave directly influences the quality of life of a person they support and the reputation of the disability service. They are committed to conducting themselves in ways that demonstrate respect for every disabled person and those with whom they work. Behaviours in respect of these are person-centred and innovative. All actions are within appropriate personal and professional boundaries …’

42. The Code of Ethics states that support staff acknowledge and respect the trust placed in them by a disabled person, their family, other professional organisations, and the disability service.

Personal information (privacy) — management standard

43. The management standard on Personal Information (Privacy)[4] (Privacy Standard) provides guidance on the management of personal information to ensure that security and privacy is maintained.
44. The Privacy Standard states that personal information can include photographs, video recordings, and audio recordings. The Privacy Standard states that there must be good reason to collect personal information, which is related to the functions performed by the disability service, and that the personal information held by the disability service must be safeguarded from unauthorised disclosure.
45. The Privacy Standard states that disability service staff and any parties responsible for the collection of personal information, as well as those holding or accessing personal information, must ensure that there are safeguards in place that are reasonable in the circumstances to prevent loss, misuse, or disclosure of personal information. It states that this requirement is relevant to the behaviour of people and to the design and operation of systems that are utilised to collect, store, or disseminate personal information.
46. The Privacy Standard states that systems utilised for the collection, storage, and dissemination of information as well as individual staff must also take reasonable steps to prevent inadvertent loss or disclosure of personal information. This requirement applies to both physical and digital systems. The Privacy Standard states that the steps include, but are not limited to, locking information away to prevent unwarranted access, which may be accidental or deliberate.

Personal information (privacy) — standard operating procedure

47. The standard operating procedure on Personal Information (Privacy)[5] (Privacy Procedure) outlines the expectations for collecting and managing a person’s personal information. It states that personal information must be collected and managed in accordance with the Privacy Act and the person’s rights.

Privacy Policy

48. The policy on Privacy (Privacy Policy)[6] states that its purpose is to set out the principles and behaviours that the disability service expects to ensure that it meets its privacy obligations with regard to consumers, tenants, donors, and staff members. The policy applies to trustees, directors, employees, contractors (where applicable), volunteers, interns, the disability service and independent living support.
49. The Privacy Policy defines personal information as ‘any information about an identifiable individual, including documents, correspondence, images and audio or visual recordings’.
50. The Privacy Policy states that the disability service is committed to ensuring that personal information is managed with care and respect, and in a way that protects the privacy and dignity of consumers, tenants, donors, and staff members. The Privacy Policy refers to the privacy principles and states that only the information needed for lawful purposes is to be collected, and the information is to be kept safe and secure, and protected from accidental disclosure.
51. The Privacy Policy states that there is a designated Privacy Officer to assist staff to comply with the law and the Privacy Policy. The Privacy Policy states that it is the responsibility of all staff members to understand and act in accordance with the Privacy Policy and the organisation’s personal and health information standards, and to promptly report any privacy breaches, risks, or complaints to their manager and/or the Privacy Officer.

Adverse event reporting — management standard

52. The management standard on adverse event reporting[7] (Reporting Standard) states that its purpose is to ensure that the disability service has robust adverse event reporting. It states that reporting incidents is essential because ‘it raises awareness about the things that can go wrong so that corrective and preventative actions can be taken promptly’.
53. The Reporting Standard states that employees are responsible for understanding and following this management standard and related procedures.
54. The Reporting Standard states that adverse events, or ‘client incidents’, include behaviours of concern and if the person was harmed.
55. The Reporting Standard states that for triaging purposes, all incidents are categorised into reportable incidents, serious incidents, and critical incidents. It states that reportable incidents need to be reported to the Service Coordinator within the day of it occurring, serious incidents may need Service Manager oversight and need to be reported within the hour, and critical incidents need to be reported immediately to the Service Coordinator, who will then notify the Service Manager, who will inform the Chief Operating Officer.

Adverse event reporting — standard operating procedure

56. The standard operating procedure on Adverse Event (Incident) Reporting[8] (Reporting Procedure) outlines the expectations for reporting an adverse event or ‘client incident’. A client incident is defined as an event that results in harm, or potential harm, by or to any person being supported. The Reporting Procedure states that all staff members must follow the Reporting Procedure.
57. The Reporting Procedure states that the disability service has six types of client incidents, including ‘harmed or victim e.g. assaulted by another person’ and ‘behaviour of the person e.g. physical aggression against others’.
58. The Reporting Procedure states that based on the degree of harm and the impact, an incident is either reportable, serious, or critical. The Reporting Procedure states that a reportable incident must be reported within 24 hours of it occurring, and serious incidents and critical incidents must be reported by phone to the Service Manager within one hour of it occurring, as well as via a software platform. For critical incidents, the Service Manager must notify the Chief Operating Officer, who will report it to the funder within 24 hours.
59. The Reporting Procedure states that a ‘person incident’ must be reported to the Service Coordinator (or the on-call Service Coordinator if after hours) as per the time frames outlined above. It states that if there is any doubt, the Service Coordinator should be contacted to seek advice or support.

Whaikaha|Ministry of Disabled People

60. Whaikaha confirmed that the disability service is a ‘large provider of services for Whaikaha’ and that it has been in regular contact with the disability service. Whaikaha told HDC:

‘We have specifically reviewed the information we have on file related to this address. I can confirm that the last audit completed for this address was in 2021. At the time, no concerns were raised about service provision. Further to this, we have received no critical incidents for this property. Whaikaha have followed up with [the disability service] management around the concerns raised in this complaint and have been advised that an appropriate [human resources] process has occurred with the staff member involved.’

Further information

61. Ms A told HDC:

‘I have learnt that under no circumstance am I to record or take photos of any workplace related activity. Any incident involving people we support must be reported to the [Service Coordinator] (or on-call coordinator) and reported in the systems provided.’

Responses to provisional opinion

Mr B

62. Mr B was given an opportunity to respond to the ‘Introduction’, ‘How matter arose’, and ‘Changes made since events’ sections of my provisional opinion.[9]  
63. Mr B’s comments have been incorporated into this opinion where relevant and appropriate.

Ms A

64. Ms A was given an opportunity to respond to the sections of the provisional opinion that relate to her.
65. Ms A has accepted the findings of the provisional opinion.

Disability service

66. The disability service was given an opportunity to respond to the provisional opinion.
67. The disability service’s comments have been incorporated into this opinion where relevant.

Opinion: Ms A — breach

Taking photographs and video recordings of consumers

68. Ms A took photographs and video recordings of five consumers of disability support services and stored these on her personal mobile device. The consumers are vulnerable people with disabilities.
69. As a community support worker, Ms A was required to provide services in accordance with the Code of Health and Disability Services Consumers’ Rights (the Code). In particular, she was required to treat the consumers with respect, and to provide services in a manner that respected their dignity.
70. The Code of Ethics requires its staff members to conduct themselves in ways that demonstrate respect for every disabled person.
71. The act of taking these photographs and video recordings was inappropriate and did not demonstrate respect for the consumers. In my view, Ms A took these photographs and video recordings for an unnecessary and personal purpose.
72. I strongly reject Ms A’s submissions that she took the photographs and video recordings as evidence of ‘erratic and violent behaviour’, and that she did so in an attempt to protect herself. Most of the photographs show the consumers, and in particular Mr V, appearing outwardly calm (sitting on the beach or on a couch, and covering his face), and in a defenceless position (sleeping on the couch). Ms A also created an animated video of Mr V dancing, dressed in a rabbit suit.
73. Ms A’s actions in taking these photographs and video recordings of the consumers meant that not only did she have no regard for their privacy in the most vulnerable of circumstances, but she did so in a demeaning way, and it seems for no other reason than her own personal gratification and entertainment.
74. In my view, Ms A did not respect the trust placed in her by the disabled consumers, their whānau, or the disability service, as required by the Code of Ethics.
75. The Code of Conduct states that staff members must treat personal information (which includes photographs and video and audio recordings) about a person with confidentiality and must not access, pass on, or hold any such personal information without authorisation.
76. The Privacy Policy states that only the information needed for lawful purposes is to be collected, and the information is to be kept safe and secure, and protected from accidental disclosure.
77. Similarly, the Privacy Standard states that there must be good reason to collect personal information, which is related to the functions performed by the disability service, and that the personal information must be safeguarded from unauthorised disclosure.
78. The Privacy Standard also states that disability service staff and any parties responsible for the collection of personal information, as well as those holding or accessing personal information, must ensure that there are safeguards in place to prevent loss, misuse, or disclosure of personal information. It also requires staff to take reasonable steps to prevent inadvertent loss or disclosure of personal information, which includes locking information away to prevent unwarranted access, which may be accidental or deliberate.
79. While I am unable to determine with certainty how Mr B obtained access to the photographs and video recordings, I am critical that Ms A stored personal information of the consumers on her personal mobile device, and that she failed to keep this information secure. This was contrary to the disability service’s Code of Conduct, Mobile Device Standard, Privacy Policy, and Privacy Standard.

Conclusion

80. By taking non-consensual photographs and video recordings of the consumers, storing them on her personal mobile device, and failing to keep them secure, Ms A failed to treat multiple consumers of disability support services with respect, in breach of Right 1(1) of the Code. In addition, I consider that the services provided were not performed in a manner that respected the dignity of the consumers, and therefore Ms A also breached Right 3 of the Code.

Care provided and incident reporting

81. Ms A took a video recording of Ms Z while she was verbally interacting with another community support worker, Mr C. On the video recording, Mr C can be heard saying, ‘You smell like a dead rat,’ and, ‘You look like a devil,’ to Ms Z. Mr C can be heard spitting and saying, ‘If you spit, I’ll spit,’ to Ms Z.
82. Mr C’s behaviour towards Ms Z was concerning and verbally abusive. Ms Z is a vulnerable consumer who is reliant on others to protect her and to keep her safe.
83. I am critical that Ms A witnessed this concerning behaviour and did not take any steps to keep Ms Z safe. This was inappropriate care. Ms A should have advocated for Ms Z and should have taken immediate action to ensure that Ms Z was protected and kept safe.
84. In one of the video recordings, Ms A can be heard telling Ms Z to go to her room. The video recording shows Ms Z punching herself in the face.
85. I am also critical that Ms A failed to report the incident involving Mr C to the Service Coordinator. In addition, I am critical that Ms A witnessed Ms Z’s self-harm (punching herself in the face) and that she failed to report this to the Service Coordinator.
86. The Reporting Procedure and Reporting Standard states that a client incident, which includes behaviours of concern, must be reported to the Service Coordinator (or the on-call Service Coordinator if the incident occurs after hours).
87. I find that by failing to take action to keep Ms Z safe, and by failing to report the incident involving Mr C and the incident of self-harming to the Service Coordinator, Ms A failed to provide services to Ms Z with reasonable care and skill, in breach of Right 4(1) of the Code.

Opinion: Disability service — no breach

88. As a healthcare provider, the disability service is responsible for providing services in accordance with the Code. At the time of the events, the disability service had comprehensive policies, management standards, and standard operating procedures in place. The disability service’s expectations of staff behaviour were clearly set out in these documents.
89. As part of their induction training, staff are provided with training on the disability service’s policies, management standards, and operating procedures. Ms A acknowledged that she had received this training.
90. I note that there have been no previous incidents or concerns in relation to Ms A. In this case, I consider that the failures were individual failures in judgement on the part of Ms A, rather than deficient guidance or training, and therefore not indicative of broader systems or organisational issues at the disability service. Accordingly, I do not find that the disability service breached the Code.
91. I have recommended that the disability service use this case as a basis for developing education/training on the use of personal mobile devices, using mobile devices for taking photographs and video and audio recordings, and incident reporting for staff members.

Changes made since events

92. The disability service said that it is considering making improvements to its induction training to specifically address the use of mobile devices for recording photographs and video recordings.

Recommendations

93. As recommended in the provisional opinion, Ms A has provided formal written apologies to each of the consumers and their whānau for the failings identified in this report.
94. I recommend that Ms A review and familiarise herself with the disability service’s policies, management standards, and operating procedures. Evidence of this is to be provided to HDC within three months of the date of this report.
95. I recommend that the disability service:
96. Implement a system to ensure that any substantive changes to policy and procedure are advised to employees and, where appropriate, this is supported by education or training.  Evidence that such a system has been implemented is to be provided to HDC within six months of the date of this report.
97. Use this case as a basis for developing education/training on the use of personal mobile devices, using mobile devices for taking photographs and video and audio recordings, and incident reporting for staff members. Evidence confirming the content of the education/training and the attendance records is to be provided to HDC within six months of the date of this report.

Follow-up actions

96. A copy of this report with details identifying the parties removed will be sent to Whaikaha|Ministry of Disabled People and placed on the Health and Disability Commissioner website, hdc.org.nz, for educational purposes.

 

[1] Assists organisations to reduce the risk of behaviours of concern and workplace violence through the provision of engaging, outcome-focused training programmes.

[2] Approved on 1 April 2021.

[3] Approved on 1 April 2021 and last amended on 3 August 2022.

[4] Approved on 11 November 2020.

[5] Approved on 6 December 2021.

[6] Approved on 13 February 2023.

[7] Approved on 5 March 2021.

[8] Approved on 5 March 2021.

[9] The identities of the consumers were redacted to ensure that their privacy is protected.