ACC Media Release

12 October 2012

ACC makes progress on privacy issues

ACC has developed a privacy index to measure the reduction in privacy breaches and progress against completing the Independent Report on Privacy and Security of Information recommendations, the Chief Executive of ACC, Ralph Stewart, announced today.

Progress against the privacy index will be published on ACC’s website each month.

The August result has seen the index rise from 65 at the end of July to 66 at the end of August. The target is to achieve an index rating of 80 by 2013 and 97.5 by the end of June 2014.

Key movements in the index during the month were:

o Total claims volumes (three month rolling average) were down slightly from 41,169 to 40,906
o Total notified events fell from 104 to 80
o Implementation of the Privacy and Health Information principles is to plan
o Of the 110 recommendations noted in the Independent Report, 23 are on plan to be completed by 31 December.

The improvement for August is a combination of:
o Reduced number of notified events between July and August
o Appointment of new staff to the privacy team to support a higher degree of governance
o Strong progress in establishing the support team to implement the Independent Report recommendations
o Publication of information release and dispatch standards.

“Publishing the index is a practical way of monitoring ACC’s progress towards making significant changes in the way client information is managed.
The index will track the implementation of the recommendations of the Independent Review of ACC Privacy and Security of Information over the next 3 years.

“Successful implementation of the recommendations will see ACC change how personal information is collected stored, accessed and monitored.

“There is a clear ambition to reduce breaches to nil, however in practice in an organisation the size of ACC with over 40 million client documents online this will take time and commitment to achieve. Publishing the index gives the public the opportunity to monitor the progress,” said Mr Stewart.

The Corporation is taking the advice of world experts on privacy to revamp the processes and systems required to keep clients’ personal information.

“The principal author of the Independent Review Report on ACC Privacy, Malcolm Crompton, has agreed to assist ACC in the change management programme relating to privacy matters,” Mr Stewart said.

-Ends-

How the Index works

The Management of Personal Information Index tracks how ACC is progressing against the Privacy Review’s recommendations.

The index is made up of three parts and there are total available points of 120.

Part 1 – Number of privacy breaches (50 points available)

The key factor in the index is the number of privacy breaches that occur. Fewer breaches mean we get a higher score for this part.

The average number of claims that we’re handling also has an impact as more claims means more information being handled. Assessing the number of breaches as a ratio of the number of open claims gives us a way of tracking performance in a relative way. The score will increase if breaches are going down but the number of claims we’re dealing with stays the same, or even increases.

Part 2 – Governance and Staff Capability (22 Points available)

In Parts 2 and 3, we are assessed against questions or principles using a five point scale, ranked from Level 1: Ad hoc/nil in terms of maturity, through to Level 5: Optimised and Public Sector Leading. As we improve the way we work, we should move up the scale to increase our score for these sections.

To measure the management of personal information, we rank our approach to governance, regular audit/assessment and the management and support of staff.

We use the following questions to assess the maturity of how we manage personal information:
• Governance – are the appropriate governance structures in place?
• Internal audit – are the right checks in place?
• Staff training – are staff undergoing appropriate training?
• Privacy champions – are these rolled out throughout the ACC network?

Part 3 – Information Privacy Principles maturity assessment (48 Points available)

How we rank against the 12 Information Privacy Principles is a key measure of how well our systems and processes are designed to support how we collect, store, use and disclose personal information. ACC’s performance against each of the Principles is ranked individually, then added to give a total score in this part.

Information on the privacy index is available on ACC's website at http://www.acc.co.nz/about-acc/overview-of-acc/acc-and-your-personal-information/personal-information-index/index.htm

© Scoop Media