public board meeting...1.8.1 communications memo 31 1.8.2 health matters wairarapa newsletter...

Public Board Meeting

Meeting Date: Monday 16th December 2019

Meeting Time: 12:00pm

Venue: Board RoomCSSB BuildingWairarapa DHB

2019 12 16 Wairarapa Board Meeting PUBLIC - Agenda

1

Wairarapa District Health Board

Well Wairarapa : Better health for all

Government Priorities 2019/20“Improving the wellbeing of New Zealanders and their families“

Improving child wellbeing Improving mental wellbeing

Improving wellbeing through preventionBetter population health outcomes

supported by a strong and equitable public health and disability system

Strong fiscal management Better population health outcomes supported by primary health care


2

AGENDAHeld on Monday 16th December 2019

Lecture Room, CSSB Building, Wairarapa DHB, MastertonCommencing at 12:00pm – 01:10pm

BOARD PUBLIC SESSIONItem Action Lead Minute Allocation PG

1. Procedural Business

1.1 Karakia

25 12:00pm

5

1.2 Apologies Accept

Chair

1.3 Interest/Conflict register Accept Confirm 6

1.4 Minutes November 2019 Meeting Accept Confirm 8

1.5 Actions November 2019 Accept Confirm 15

1.6 Draft 2019 Board Work Plan Accept 16

1.7 Chairperson Report Verbal

1.8 Chief Executive Report Note D Oliff 17

2. Patient Story Verbal C Stewart 15 12:25pm

3. Decision

3.1 Wairarapa DHB 2019/20 Tobacco Control PlanApproveDecline

S Williams 15 12:40pm 20

3.2 Board Endorsement to use Cloud ICT ServicesApproveDecline

T Voice 15 12:55pm 23

4. Other

4.1 General Business5 01:10pm 27

4.2 Resolution to Exclude the Public Agree5. Committee Minutes

5.1 Community & Public Health Advisory Committee October 2019 Receive 28

Date of next meeting: To be confirmed


3

Appendices# Item PG

1.3 Wairarapa DHB Conflict of Interest Register 5

1.4 November 2019 Board Minutes 6

1.5 November 2019 Board Actions 8

1.6 Wairarapa DHB Workplan December 2019 16

1.8 Chief Executive Officer Report December 2019 17

1.8.1 Communications Memo 31

1.8.2 Health Matters Wairarapa Newsletter November 2019 36

3.1 Wairarapa DHB 2019/20 Tobacco Control Plan 20

3.1.1 2019/20 Tapu Te Hā, Tobacco Control Plan [Wairarapa DHB] 2019/20 45

3.1.2 Tapu Te Hā, Project Plan [kapahaka] 59

3.2 Endorsement to use Cloud ICT Services 23

3.2.1 A3 Cloud Paper Summary 61

3.2.2 3DHB ICT Cloud Computing - Risk Document v03 62

4.2 Resolution to Exclude the Public 27

5.1 Community & Public Health Advisory Committee October 2019 28


4

Wairarapa District Hutt Board

Karakia

Tuia ki runga,

Tuia ki raro

Tuia ki roto,

Tuia ki waho

Ka rongo te ao,

Ka rongo te pō

Haumi e, Hui e

Taiki e

---------------Unite aboveUnite below

Unite withoutUnite within

Listen to the nightListen to the world

Now we come togetherAs one.

2019 12 16 Wairarapa Board Meeting PUBLIC - Procedual Business

5

Updated: 2019-12-08 1

Wairarapa Board INTEREST REGISTER

Name Interest

Sir Paul CollinsChair

∑ Director of: Active Equity Holdings Limited (Chair)Hurricanes GP LimitedIdes LimitedShott Beverages LimitedTechnical Advisory Services Limited

∑ Director and shareholder of: AEL Managers LimitedBeverage Holdings LimitedCohiba Traders LimitedEcopoint LimitedTofino Trustee Limited

∑ Member of shareholders Review Group for New Zealand Health Partnerships Limited

Dr Tony BeckerDeputy Chair

∑

Mrs Leanne SoutheyMember

∑ Chair, Wairarapa District Health Board, Finance Risk & Audit Committee∑ Deputy Chair, Wairarapa District Health Board∑ Chair of Lands Trust Masterton (15 February 2016)∑ Director, Southey Sayer Limited∑ Chartered Accountant to Health Professionals including Selina Sutherland Hospital and Selina

Sutherland Trust∑ Trustee, Wairarapa Community Health Trust∑ Shareholder of Mangan Graphics Ltd∑ Member of UCOL Council

Mr Ronald KaraitianaMember

∑ Member, Wairarapa District Health Board∑ Member, Wairarapa Te Iwi Kainga Committee∑ Member, Wairarapa District Health Board, Finance Risk & Audit Committee∑ Akura Lands Trust Chairman∑ Extended family members work in varying roles at DHB∑ Chair of WrDHB Hospital Advisory Committee∑ CE Te Hauora Runanga o Wairarapa∑ RK Consulting Ltd, Business owner∑ Whanau ora Collective Member Te Hauora and Whaiora via Te Pou Matakana

Helen PocknallMember

∑ Contractor with Ministry of Health

Ryan SorianoMember

∑ Community Coordinator for FOCUS, Disability Support Services at Wairarapa DHB∑ Member, Board Trustee for Saint Patrick School Board, Masterton∑ Wife Employed as Senior Caregiver at Lansdowne Park Aged Care Facility

Joy CooperMember

∑

Norman GrayMember

∑ Association of Salaried Medical Specialists (ASMS) Branch Representative for Wairarapa∑ Emergency Consultant and Clinical Lead, Wairarapa DHB


6

Updated: 2019-12-08 2

Wairarapa Board INTEREST REGISTER

Name Interest

Jill StringerMember

Yvette GraceMember

∑

Jill PettisMember

∑


7

Wairarapa DHB November 2019 Board Meeting Page 1 of 5

Minutes: Kadeen Williams , Board Secretary Held on 25th November 2019 Lecture Room, CSSB Building, Wairarapa Hospital, Masterton

Board Meeting Public

Board Members Present Sir Paul Collins Board Chair Leanne Southey Deputy Chair Adrienne Staples Member Nick Crozier Member Liz Falkner Member Jane Hopkirk Member Derek Milne Member Rick Long Member Ron Karaitiana Member Alan Shirley Member Fiona Samuels Member Executive Leadership Team Present Dale Oliff CEO WrDHB Chris Stewart Executive leader Quality, Risk & Innovation Susan Flavin Acting Executive Financial Officer Kieran McCann Executive Leader, Operations Sandra Williams Acting Executive Leader, Planning & Performance Michele Halford Director Nursing Anna Cardno Communication Manager Visitors Eli Hill Wairarapa Times Age Jill Stringer 2020 Elected Board Member

1. Procedural Business

1.2 Apologies As noted above

1.3 Minutes from previous meeting: October 2019

The Board RESOLVED to approve the minutes of the Members’ (Excluded) meeting held in September 2019 as a true and accurate record of the meeting.

Addition to have Cultural supervision of the Māori Nursing staff in Maternity

Māori diabetes target – Questions around how patients have not been through the service

Moved J.Hopkirk Seconded R. Karaitiana Carried

1.4 Action Items Register

All actions completed and updated

Check spelling with names


8


1.5 Interest/Conflict Register

The Board NOTED that no changes to the interest register were declared in the meeting

The Board CONFIRMED that two matters (including matters reported to, and decisions made, by the Board at this meeting) that require disclosure and that there would be an opportunity to declare any conflicts prior to discussion on each item of the agenda.

J.Hopkirk advised a conflict of interest with role at Takiri Mai Te Ata, Kokiri Hauora

R. Karaitiana advised a conflict of interest with role as CEO Te Hauora Runanga o Wairarapa

1.6 Chairperson reports

a. No update

1.7 Chief Executive Reports

The report was taken as READ

NOTES this paper and discusses as appropriate

The Board:

NOTED Code Red article has been a successful proactive response to cancellation of services which have affected patient care

NOTED The first edition of the General Practitioners (GP) newsletter released will provide clear and open information for a connected health service offering in Wairarapa

NOTED Accreditation visit during October 2019 was successful. Report will be shared when available

NOTED Ministry of Health (MoH) Forum focussed on Equity and Well Being. Well attended with no unknown factors. Improvements within management and systems for end on end to improvements for the Health of New Zealanders

NOTED Central Region DHBs Trauma project is a priority for 2020/21. Trauma work is roadside to bedside and having the right service at the right time

NOTED Chief Executive (CE) is meeting with community services and making connections

NOTED Acknowledgment for A.Shirley for exceptional services for the community

NOTED Nursing activity x-ray request project and triage nurses are undertaking further education to order imaging requests which will save time for patients

2 Patient Story

The Board received a VERBAL update from C.Stewart for the Patient Survey

NOTED will be a regular agenda item that are relevant and purposeful for the Board and current environments

3 Decision

Wairarapa DHB 2019/20 Tobacco Control Plan



The Board:

NOTED CPHAC actions have been prioritised

NOTED MoH are pushing for this work to be done. There are six key actions to completed


9


NOTED Wairarapa has a higher percentage of older people which may affect the data. The first point of action is to prevent and data will be collected throughout the project for monitoring

NOTED Mental Health and Addictions services could help support this project. The Tabacco plan would be across all services

ACTION Tabaco plan updates to be more inclusive of Māori equity actions and how to address this

Tabaco plan to include wording to show this will be across all services

Moved R. Karaitiana Seconded A.Staples Carried

Community & Public Health Advisory Committee (CPHAC) Updates



The Board:

NOTED CPHAC to provide high level overviews and transparency with provider contracts for the Board

NOTED CPHAC have the ability to co-opt people to assist with work and projects as required

AGREE ToR agreed with the updates as requested to review and expand the contractors section

AGREE Membership agreed and D.Sotiri

ACTION ToR to be updated and include more detail with reporting, monitoring and relationships with stakeholder, contractors and other committees.

Moved Sir P Collins Seconded J.Hopkirk Carried

3DHB Sub Regional Pacific Health & Wellbeing Strategic Plan 2020/25

The report was taken as READ and Notes this paper and discusses as appropriate

The Board:

NOTED With community feedback we have been able to ensure a great service and support for our Pacifica patients

NOTED WrDHB are top of the country for Bowel Cancer, and great results for the Pacifica community. Health Education has been a large part of the plan over the last five years

NOTED Consumer Council, CPHAC are all noted to have Pacifica involvement

NOTED Next five years plan encompasses the life time of the patients and also the social determents

NOTED Thinking outside the box and getting the health services out to the patients who need it

NOTED Budget information to be refined and will be brought forward at a later date

ACTION February – March 2020 to be rolled out for Boards as a final plan

Moved D.Milne Seconded F.Samuel Carried

4. Information

Financial Report

The report was taken as READ and NOTES this paper and discusses as appropriate

The Board:

NOTED Favourable budget and forecasting to breakeven on budget. Watching Higher IDF costs and recruitment


10


NOTED System Level Measure funding for PHOs at irregular times and are performance based

NOTED PHO enrolment update to be 46,400 table to start with Wairarapa residents then residents funded elsewhere

Hospital and Community Services Report


The Board:

NOTED Recruitment remains a focus with a number of opportunities

NOTED Emergency Department (ED) addressing missed target

NOTED Analysis of orthopaedics with surgeries and options for patients. Radiology rescheduling due to strike actions

NOTED Theatre utilisation has had a number of updates to better suit patients and timeframes

NOTED National Theatre Utilisation generally sits at 85% however this is dependent on internal processors

NOTED Health Advisory Committee (HAC) has been ambulated with the Board. There are a number of DHBs which include the HAC as part of the Board to ensure all risks are known by members.

ACTION: F.Samuels would like further information on how the Board are fulfilling their responsibilities for the ACT on the Health Advisory Committee

Planning & Performance Report


The Board:

NOTED Annual plan signed off (11th November 2019) and all paper copies have been distributed

NOTED Strategic planning underway for transformational changes with town hall sessions happening. Collation from these collaborative sessions will be presented during a strategic session with the Board

ACTION: Update aged Care all facilities beds

Wairarapa DHB Quality, Risk & Innovation Quarterly Report


The Board:

NOTED Last Quarter has seen all the corrective actions signed off. Training for Quality team is underway for 20202

NOTED Increased visibility with processing and reporting of incidents for improvements

NOTED Violence intervention project part of the Health and Wellbeing plan going forwards

NOTED Displaced patients with no fixed abode are being discussed and assistance through the Clinical Review group

ACTION: D.Oliff TAS audits will be brought forward to the Board, Clinical Board and/or CPHAC

D.Oliff Follow up regarding the requirements for contract management

5. Other

General Business

Formal thanks to Management and retiring Board Members for time spent with the Wairarapa District Health Board and services to the Community

Resolution to Exclude the Public

SUBJECT REASON REFERENCE


11


Public Excluded Minutes For the reasons set out in the public Board agenda

Chief Executive’s report

Information contained in the paper may be subject to change as the information has not yet been reviewed by the FRAC Paper contains information and advice that is likely to prejudice or disadvantage negotiations

Section 9(2)(f)(iv) Section 9(2)(j)

Provision of Regional Oral & Maxillo Facial Services

Discussions about creation of/employment into roles where individuals in those roles may be identifiable, and therefore revealing details such as remuneration details

Section 9(2)(a)

Tū Ora Company Cyber Security Breach

Revealing gaps in security, knowledge of which someone could take advantage of to cause harm

Section 9(2)(c)

Educational and Support for staff at Wairarapa District Health Board

Information that may compromise the privacy of staff Section 29(1)(a)

Response to Board questions with communications in Primary Health Care in Wairarapa

Commercially sensitive information Section 9(2)(i)

Wairarapa DHB 2018/19 Final Annual Report

Info/discussion on restructuring/change processes that may enable affected individuals to be identified, therefore revealing details of individuals’ possible redundancies or redeployment

Section 29(1)(a)

MHAIDS Integration project Staff sensitive information ahead of a staff consultation launch

Section 9(2)(a)

FRAC minutes October 2019

Sub Committee Excluded Minutes Section 9(2)(j)

Correspondence Commercially sensitive information Section9(2)(i)

Moved Sir P.Collins Seconded R. Karaitiana Carried

Meeting Closed: 2:10pm CONFIRMED that these minutes constitute a true and accurate record Dated this day of 2019.

Sir Paul Collins Chair, Wairarapa District Health Board


12

PUBLIC WrDHB MEETING ACTION

Wairarapa DHB Public Action Register# Lead Action How Dealt with Completed Date

1. D.Oliff Dental Bus updates. Logistics for planning and opportunity to have a Regional Dental Bus

Update provided in CE Report for December report December 2019

2. D.Oliff Immunisations statistics update from PHO Update provided in CE Report for December report December 2019

3. S. WilliamsTabacco Plan to be updated to be more inclusive of Māori equity actions and how to address these. View of entire service offerings for all services

Updates made to plan and included with Board papers at December meeting December 2019

4. S.Williams

Terms of Reference for Community & Public Health Advisory Committee (CPHAC) to be updated to include further details on reporting, monitoring and relationships with stakeholders and relevant parties

Updates to be made through CPHAC meeting February 2020


13

Wairarapa DHB Work Plan 2019

January February March April May June July August September October November December

Dec

isio

n

Wairarapa DHB Board and Statuary

Committees’

Draft 2019/20 Annual Plan

Final Annual Plan 2019/20

DSAC meeting Report

Final Financial Plan 2019/20

Dis

cuss

ion

4th QTR DAP Report

People & Capability update

5 Priorities DAP update

Palliative care implementation

paper

MHAIDs update Vision, Values, Voice update

Health & Safety Report

1st QTR DAP report

OSH, Incidents, adverse events,

HDC, Risk register, Patient

experienceHQSC markers

Review 48hour Readmission Screening report MHAIDs Report

3DHB MHA Strategy “Living

Life Well”Regional Māori Health Report

(MoH)

Pres

enta

tion

Planning & Funding Clinical Board

Iwi KaingaConsumer

CouncilPacifica Health

Clinical Board

Visi

tsRegular monthly items: Strategy, Planning and Outcomes updates to includePublic Chair report CEO report Resolution to exclude the public ALT update Palliative care update Obesity preventionPublic Excluded Chair report CEO report FRAC report back FRAC minutes Primary care update Child & Youth health Smoking cessation


14

PUBLIC

Wairarapa District Health Board Page 1 of 3

BOARD INFORMATION PAPER

Date: December 2019

Author Dale Oliff, Chief Executive Wairarapa District Health Board

Subject Chief Executive Public Report to the Board

RECOMMENDATION It is recommended that the Board:a. NOTES this paper and discusses as appropriate

APPENDICIES1. Communications update November 20192. Health Matters Newsletter November 2019

1 PURPOSE

The purpose of this paper is to provide the Board with updates from across the hospital and wider Wairarapa Health Community. It highlights work that is occurring at the DHB.

2 WELCOME TO OUR NEW BOARD MEMBERS

Warm welcome to the incoming Board. The Executive Team and I are looking forward to working with you to provide a comprehensive and high quality and responsive service to our populations and communities.

3 TU ORA COMPASS ANNUAL GENERAL MEETING (AGM)

I attended the Tu Ora AGM on the 21st November 2019 in Wellington. It was pleasing to see the ongoing activities that the Primary Health Organisation (PHO) have undertaken over the past 12months. Wairarapa District Health Board (WrDHB) and Tu Ora are planning a joint workshop early in the New Year to look at how the two entities working collaboratively can support patients to receive the appropriate care in the most suitable setting. The focus will be on the Triage four and five patents.

4 SENIOR LEADERSHIP GROUP COMMUNICATION SESSION (SLG)

The second SLG half-day session was held 28th November. The purpose of the meeting is to bring all the Senior Managers and Senior Clinical Staff together to communicate activities that are underway around the organisation and for the central region. Representative from the Central Region Technical Advisory Services Limited (TAS) spoke about the Regional Clinical Services plan as it relates to the Wairarapa and Teresa Wall presented the Central Regions Equity Framework that has been signed off by the Regional Chief Executives.

5 TRANSFORMATIVE VISION AND STRATEGY DEVELOPMENT

Significant activity across the Wairarapa Health Board and system is underway lead by our Executive Leader Planning and Performance with support by the Saphere Group. Sessions have been held with Clinical groups and General Practices. It is planned to draw the work together for discussion with the DHB Board in late January 2020 for a workshop to give the future strategy for the Health Services.


15

PUBLIC


6 EXECUTIVE LEADER APPOINTMENTS

I am pleased to welcome Frank Van Ham to the District Health Board and I am looking forward to working with Frank who brings a strong strategic financial experience to the Executive Team.

I wish to most sincerely acknowledge all the work completed by Susan Flavin. Susan’s Leadership and commitments for getting the Oracle project implemented along with having the CostPro businessunderway as it is important for the financial sustainability work underway.

The Executive Team will be further strengthened with the appointment of a permanent Executive Leader for Planning, Funding and Performance which is in the process of being confirmed.

7 MENTAL HEALTH, ADDICTIONS AND INTELLECTUAL DISABILITY SERVICE CONSULTATION DOCUMENT

The MHAIDs lead DHB Management and Clinical Governance consultation document has been released to the three DHB’s for staff consultation. This consultation period is open until 5:00pm Wednesday 15th January 2020. Staff have been provided support options if they are required.

8 REGIONAL DENTAL BUS UPDATE

Good oral Health and hygiene are an important part of general health for all. Two units with two-chairs are positional to sites all over the Wairarapa, bringing on-site screening, examination and treatment. Each is staffed by two therapists and an assistant. The units have been designed for the comfort of both children and the staff. We have an Adolescent Dental Care Programme which works with every dental practice throughout the Wairarapa with this programme so patients can register with dentists to meet their own needs.

9 WAIRARAPA IMMUNISATION UPDATE

The latest data from our Primary Health Organisation (PHO) for Quarter two (2) (period 01/07/2019 to 30/09/2019) have been listed below for your information.

Milestone Age:

Total: NZE: Maori: Pacific: Declined:

No. Eligible

Fully Imms

for age

%No.

Eligible

Fully Imms

for age

%No.

Eligible

Fully Imms

for age

%No.

Eligible

Fully Imms

for age

% Total %

6 month 122 99 81% 58 52 90% 44 32 73% 5 5 100% 2 1.6%8 month 132 122 92% 67 60 90% 48 47 98% 3 3 100% 7 5.3%12 month 132 124 94% 64 62 97% 48 44 92% 2 2 100% 6 4.5%24 month 140 132 94% 80 75 94% 44 43 98% 4 3 75% 6 4.3%5 year 152 136 89% 86 78 91% 48 42 88% 1 1 100% 12 7.9%

The first 1,000 days is an equity priority for the Wairarapa DHB and there are action where immunisations may become part of the project. While there are still families who do choose not to immunise the overall statistics for the Wairarapa are very favourable. The PHO are aware of the families who have not been immunised and are working towards getting further information.


16

PUBLIC


10 COMMUNICATION UPDATES AND LOCAL EVENTS

We have provided a brief outline of the media coverage of interest through appendix 1.

2019 Patient Safety Week

This year’s Patient Safety Week | Wiki Haumaru Tūroro 3rd to 9th November was about understanding implicit bias in health care. Wairarapa was able to join in with a session held at Hutt Valley DHB where Anton Blank hosted a presentation alongside Dr Carla Houkamau on Wednesday 6th November 2019. The session provided staff with tools for identifying and addressing implicit bias for both individuals and organisations.

Wairarapa Ambulance Service pop-up

Wellington Free Ambulance (WFA) completed their pop-up sessions on Friday 15th November 2019 where they had two main focuses. The first was about fleshing out the ideas and opportunities that have come to the surface, understanding what they look like. The second area we worked on was creating and testing prototypes for our ideas, which include;

∑ Creation of a mobile health hub

∑ A Wairarapa Leadership Model that will support our work better

∑ Integrating social isolation and loneliness check lists in to our work

∑ Staff wellbeing initiatives

∑ Partnering with Local Medical Centres to provide an Extended Care Paramedic model of service that would focus more on treating patients and leaving them at home

∑ Better collaboration with community groups and organisations to make sure everyone can access the emergency medical care they need.

We look forward to finding out further details on how the sessions worked and what the outcomes will be from WFA in the near future.

Health Matters Wairarapa Newsletter

Attached as appendix 2 is the first joint newsletter with Wairarapa DHB and Tu Ora Compass Health. The intent as previously described is to enhance communications between the DHB, Primary Health and the wider health community.


17

PUBLIC


DECISION PAPER

Date: 16 December 2019

Presented By Sandra Williams, Executive Leader Planning and Performance

Author Daniel Kawana, Service Development Manager Planning and Performance

Endorsed By Dale Oliff, Chief Executive

Subject Wairarapa DHB 2019/20 Tobacco Control Plan

RECOMMENDATION

It is recommended that the Board:

a. Notes the DHB receives funding from the Ministry of Health for the planning and coordination of activities designed to reduce the uptake of smoking and support current smokers to quit.

b. Notes in 2019/20 the DHB intends to consolidate its health promotion activities and provide increased support for Māori, specifically whānau with babies.

c. Notes the 2019/20 Tobacco Control Plan was designed in partnership with Māori health, Tu Ora Compass Health, Whaiora Whānui, Takiri Mai te Ata & Regional Public Health.

d. Agrees to the key focus areas of kainga & hapūtanga, Māori health promotion and equity.

e. Endorse the 2019/20 Tobacco Control Plan.

APPENDICES:

1. 2019/20 Tapu Te Hā, Tobacco Control Plan [Wairarapa DHB] 2019/20

2. Tapu Te Hā, Project Plan [kapahaka]

1 PURPOSE

This paper presents the 2019/20 Tobacco Control Plan (TCP) for reducing the incidence and impact of smoking in Wairarapa to “the Board” for its consideration and endorsement. This plan also incorporates feedback from the recent Community Public Health Advisory Committee (CPHAC) and Board meetings.

2 SUMMARY

The headline actions for the 2019/20 Plan include -1. Refocusing existing health promotion and cessation work to prioritise key population groups in

particular whānau Māori, kainga Māori & wahine Māori with babies.2. Also working in known settings such as: Ngā Kanohi Marae o Wairarapa, Cameron House,

Wairarapa Teen Parent Unit and King Street Art, settings that have a high percentage of Māori participants.

3. Trialling new initiatives, including increasing antenatal and post-partum support for Māori women with complex needs.

4. Strengthening smoking cessation support across the board in primary, secondary, maternity, mental health and community settings.

2019 12 16 Wairarapa Board Meeting PUBLIC - Decision

18

PUBLIC


5. Continuing to support health care practitioners to provide Smokefree ABC (Ask, Brief Advice, offer Cessation support).

6. Increasing the number of referrals to the stop smoking services.7. Increasing access and reducing inequities to smoking cessation medications in particular

Varenicline Pfizer.8. Collaborating with key stakeholders (both health and non-health stakeholders) to inform service

planning and implementation.

3 BACKGROUND

The 2019/20 TCP was revised using the feedback of CPHAC and the Board to bring more of an explicit focus on Māori, equity and for the plan to sit across all services.

In New Zealand, around 16.3% of adults aged over 15 years smoke daily. Māori and Pacific people are more likely to smoke (38.6% and 25.5% respectively). Māori, Pacific and pregnant women are priority groups for all tobacco control work, due to the higher prevalence and higher impact of smoking. Smoking during pregnancy is a major concern in the Wairarapa. Nationally 32% Māori women who are pregnant smoke - in the Wairarapa, it is 37%.

There has been a significant decrease in the proportion of Wairarapa Māori aged 15–17 years who smoke regularly, but no change in smoking rates among Māori aged 20–24 years. . Among non-Māori youth, smoking rates decreased in each age group, and the gaps between Māori and non-Māori smoking rates widened and remained twice as high for Māori (38%) as for non-Māori (19%). Data from the Ministry of Health indicates that in June 2017, 21% of the PHO enrolled population in the Wairarapa were recorded as a current smoker.

For a number of years the Ministry of Health has provided funding, through an annual side contract, for coordination of tobacco control activities in a DHB area. The Ministry also separately funds national health promotion activities, through the Health Promotion Agency and Hāpai Te Hauora. Quit smoking services (SSS) through the national Quitline, and local quit services. In Wairarapa, this service is provided by Whaiora Whānui Limited, who are sub-contracted by the sub-regional provider Tākiri Mai Te Ata located regionally with Hutt Valley & Capital & Coast DHB’s.

For several years, the Wairarapa DHB contracted Regional Public Health to provide the coordination service, and funded Tū Ora Compass Health for activities to support the primary care smoking target. In 2018/19, following the re-establishment of the Planning and performance Team, the decision was made to bring the planning and coordination of the plan back in-house.

This was in recognition of the need to accelerate our efforts towards the 2025 Smokefree Aotearoa goal, to provide increased management and governance support for local activities, and to better integrate activities across providers. The contract was eventually re-tendered and now sits with Tu Ora Compass Health who will lead the Māori health promotion activities alongside Whaiora Whānui and Regional Public Health.

4 CONCLUSION

The 2019/20 Plan builds on activities to date, but increases our efforts to coordinate health promotion activity, increase referrals to stop smoking services, and provide better support for Māori smokers and pregnant women.To complement the headline actions the 2019/20 Plan will also -1. Work directly alongside local kapahaka groups and their whānau to increase quit attempts. 2. Implement a Pepē Ora Navigator /coach to provide wrap around support for high-needs hapū

māmā and their whānau (including delivery of smoking cessation)


19

PUBLIC


3. Maintain the 90% primary care health target and report quarterly to the Alliance (Tihei) and the Wairarapa District Health Board.

4. Encourage referrals from primary care and promote the SSS to medical practises. 5. Continue to offer ABC training to secondary, primary and pharmacies and extend the training to

include dentists. Support and incentivise the Pharmacy Project and include dentists on completion of the ABC training. “Vape to Quit” training will also be offered on request.

6. Support other agencies as appropriate. For example supporting smokefree environments through the support of the Fresh Air project for smokefree outdoor dining.

7. Ensure PIKI counsellors are aware of support pathways should the individual they are counselling indicate they wish to stop smoking.

8. Ensure that any new kaupapa Māori ante-natal service (e.g. Hapū Wānanga) incorporates smokefree messages and support.

9. Investigate funded visits for initial GP visit for Varenicline Pfizer. Investigate current Varenicline Pfizer usage and identify opportunities for increasing uptake.


20

PUBLIC

Hutt Valley District Health Board and Capital & Coast District Health Board Page 1 November 2019

Date: 6 November 2019 BOARD DECISION

Author Rupert Applin, 3DHB ICT Team Lead, Business Analysis

Endorsed by Tracy Voice, 3DHB Chief Digital Officer

Subject Board Endorsement to use Cloud ICT Services

RECOMMENDATIONS It is recommended that the Board:

a. NOTE that 3DHB ICT wish to pursue a cloud first approach to procuring ICT services and resources.

b. NOTE that risks do exist with regard to cloud computing, however these risks can be mitigated through good due diligence, procedures and practices.

c. NOTE that DIA has undertaken risk assessment and security certification audits on both Microsoft Azure, Office 365 and Amazon Web Services (AWS), and has issued security certificates for their use up to In-Confidence level, which the DHBs can utilise as part of their own cloud procurement and certification and assurance processes.

d. NOTE This paper has been ENDORSED by Wairarapa Executive Leadership Team

e. APPROVE the use of cloud computing subject to the right security and privacy assessments which will require Digital and Data Intelligence Governance Group signoff.

APPENDICES

1. A3 Cloud Paper Summary

2. 3DHB ICT Cloud Computing - Risk Document v03

1. PURPOSE

The purpose of this paper is seeking approval to adopt a cloud first approach (onshore and offshore) given that it is low risk on the basis we will conduct the right security and privacy assessments which will require Digital and Data Intelligence Governance Group signoff (being representatives from across the 3DHBs with Chief Executive Officers (CEO) chairing).

2. BACKGROUND

The delivery of computing services—including servers, storage, databases, networking, software, analytics, and intelligence—over the Internet (“the cloud”) can offer faster innovation, flexible resources, and economies of scale.

The Government Chief Digital Officer (GCDO) has indicated that New Zealand government agencies are required to use public cloud services in preference to traditional IT systems.

They are required to adopt these services on a case by case basis, following risk assessments. Public cloud services are ICT services used by multiple organisations from different industries, including public and private sectors.

Public cloud services are a mainstream technology choice for organisations that are digitally transforming themselves.


21

PUBLIC


Many emerging technologies — such as block chain, internet of things, artificial intelligence and data analytics — are now delivered as public cloud services.

New Zealand government requires agencies to accelerate their adoption of public cloud services in a balanced way so they can drive digital transformation. This includes:

∑ enhancing customer experiences

∑ streamlining operations

∑ creating new delivery models

The move to accelerate adoption was endorsed by Cabinet in 2016 and this is expected to be re-endorsed in late 2019.

3DHB Vision

The move to cloud is intended to enhance the DHB’s strategic vision by providing technologies and service models that enable the vision to be realised, in particular enabling a digitally-enabled care network that finds technological solutions to:

∑ provide fast and easy access to information and resources to allow people to make informed health care choices

∑ Support people to manage more of their health needs at home through access to professional advice and self-monitoring, using remote diagnostics

∑ provide an electronic health record that is secure and supports health care professionals and social service providers to share accurate and reliable information while retaining appropriate confidentiality

∑ deliver specialist health care that will be more responsive and enabling CHNs to co-ordinate complex care simply and safely – resulting in improved health outcomes


22

PUBLIC


3. DISCUSSION

Risks

Whilst these services offer significant advantages to the DHB, there are risks and legislative implications that must be addressed prior to the DHB adopting cloud services.

These risks are outlined in detailed within the Cloud Risk document, attached as appendix 1.

In summary these risks are as follows, however it must be realised that many of these risks exist today with on premise ICT infrastructure which also apply to cloud based ICT.

∑ Consumers have reduced visibility and control of their assets and data.

∑ On-demand self-service simplifies unauthorized use, malicious actors could instantiate resources without organisational consent.

∑ Internet-Accessible Management application programming interfaces can be compromised allowing access to data.

∑ Separation among multiple tenants (customers) on the same cloud system fails allowing data to leak between customers

∑ Data deletion is incomplete so when data is deleted some may remain on the cloud systems

Risk Mitigation

There are four important practices, and specific actions, that the DHB would use to feel secure in the cloud.

Perform due diligence

The DHB must fully understand their networks and applications to determine how to provide functionality, resilience, and security for cloud-deployed applications and systems.

Due diligence must be performed across the lifecycle of applications and systems being deployed to the cloud, including planning, development and deployment, operations, and decommissioning.

Managing access

Access management generally requires three capabilities: the ability to identify and authenticate users, the ability to assign users access rights, and the ability to create and enforce access control policies for resources.

Protect data

Beyond access control, data protection involves three separate challenges: protecting data from unauthorized access, ensuring continued access to critical data in the event of errors and failures, and preventing the accidental disclosure of data that was supposedly deleted.

Monitor and defend

The cloud service provider is responsible for monitoring the infrastructure and services provided to the DHB, but is not responsible for monitoring the systems and application the DHB create using the provided services.

The DHB should rely on the cloud service providers monitoring information as the first line of monitoring to detect unauthorized access to, or use of, systems and applications, as well as unexpected behaviour or usage of the systems and applications or their users.

The DHB must therefore learn how to use the new data to defend the DHB’s cloud-based resources.


23

PUBLIC


Summary

It is important to remember that cloud service providers use a shared responsibility model for security. The cloud service provider accepts responsibility for some aspects of security. Other aspects of security are shared between the cloud service provider and the DHB.

Overseas Legislation

In addition to the risks above, two pieces of legislation by overseas government may impact the DHB with regard to patient data privacy.

Australian Telecommunications and Other Legislation Amendment (Assistance and Access) Act (2018)

US Clarifying Lawful Overseas Use of Data Act or CLOUD Act (H.R. 4943)

Both these acts give the respective governments the right to request access to data stored on cloud infrastructure (based in their country or owned by an organisation domiciled within that country)

However permission access to data must be authorised by the countries respective justice systems, additionally neither countries legislation can force cloud providers to give carte blanche access or to build backdoors into these systems.

Internal Affairs Assurance

The DIA has undertaken risk assessment and security certification audits on both Microsoft Azure, O365 and Amazon Web Services (AWS) and has issue security certificates for their use up to In-Confidence level, that government agencies can utilise as part of their own cloud procurement and Certification and Assurance processes.

It’s also important to note that the DIA certificate covers use of Microsoft Azure anywhere in the world, not just Australia and the NZ Health Information Security Framework states that New Zealanders’ medical information is to be classified at no-higher than “Medical – In Confidence” level.

This means the DHBs can utilise the DIA issued certificates for its certification and auditing purposes. They can obtain these certificates directly from DIA.

The DIA is itself consuming Microsoft cloud services delivered from Australia, including for the purposes of storing and processing New Zealanders’ personal information.

4. NEXT STEPS

To begin considering the use of cloud computing when procuring, upgrading or replacing clinical and corporate systems subject to right security and privacy assessments which will require Digital and Data Intelligence governance group signoff.


24


BOARD DECISION PAPER

Date: December 2019

Author Sir Paul Collins, Wairarapa District Health Board Chair

Subject Resolution to Exclude the Public

RECOMMENDATION It is recommended that the Board

a. AGREES that Public be excluded from the following parts of the of the Meeting of the Board in accordance with the NZ Public Health and Disability Act 2000 (“the Act”) where the Board is considering subject matter in the following table.

b. NOTES The grounds for the resolution is the Board, relying on Clause 32(a) of Schedule 3 of the Act believes the public conduct of the meeting would be likely to result in the disclosure of information for which good reason exists under the Official Information Act 1982 (OIA) to withhold, in particular:

SUBJECT REASON REFERENCE

Public Excluded Minutes For the reasons set out in the public Board agenda

Chief Executive’s report

Information contained in the paper may be subject to change as the information has not yet been reviewed by the FRACPaper contains information and advice that is likely to prejudice or disadvantage negotiations

Section9(2)(f)(iv)Section 9(2)(j)

CostPro Upgrade ProjectAny department or organisation holding the information to carry out, without prejudice or disadvantage, commercial activities

Section 9(2)(i)DRAFT 2020 Schedule

DRAFT 2020 Workplan

Wairarapa Executive Introductions

Protect the privacy of natural persons, including that of deceased natural persons

Section 9(2)(a

CPHAC Minutes 2019 Sub Committee Excluded Minutes Section 9(2)(j)

Correspondence Commercially sensitive information Section9(2)(i)

2019 12 16 Wairarapa Board Meeting PUBLIC - Other

25

2019 12 16 Wairarapa Board Meeting PUBLIC - Committee Minutes

26


27


28

Internal Memorandum

To: Wairarapa Board Members

From: Dale Oliff, Chief Executive Officer

Date: 5th December 2019

Subject: Media of Interest for November 2019

'Service failure': Man's leg catches fire during surgery

From Newshub Published 17:12 04/11/2019 Also from MSNHealth and Disability Commissioner Anthony Hill released a report on Monday, finding the orthopaedic surgeon and the Wairarapa District Health Board failed to care for the man. RNZ National 4pm - Item 4

From Radio New Zealand Published 16:46 04/11/2019 The Wairarapa District Health Board and an orthopedic surgeon have been found in breach of their duties for setting fire to a patient's leg during knee surgery. Man's leg catches fire during knee operation, surgeon and DHB in breach

From New Zealand Herald Published 15:46 04/11/2019 Also from New Zealand Herald, Newstalk ZBWairarapa District Health Board (DHB) and an orthopaedic surgeon have been found in breach for failing to provide adequate care to the man during knee surgery. Man's knee catches fire during surgery at Wairarapa Hospital

From Dominion Post Published 15:29 04/11/2019 Health and Disability Commissioner Anthony Hill found Wairarapa DHB and an orthopaedic surgeon in breach of its code for failures in the care of a man during the procedure in September 2017. HDC case: Burns sustained during surgery

From Health and Disability Commissioner Published 14:01 04/11/2019 Also from Voxy, TVNZ, NZ DoctorHealth and Disability Commissioner Anthony Hill today released a report finding Wairarapa District Health Board(DHB) and an orthopaedic surgeon in breach of the Code of Health and Disability Services Consumers’ Rights (the Code) for failures in the care provided to a man during knee surgery. Wairarapa surgeon accidentally sets patient's leg on fire during botched knee surgery

From TVNZ Published 14:55 04/11/2019 Also from Health and Disability Commissioner, Voxy, Health and Disability Commissioner, NZ DoctorA Wairarapa District Health Board orthopaedic surgeon has been told to apologise to a patient and undergo further training after accidentally setting his leg on fire during knee surgery. Newstalk ZB 4pm - Item 4

From Newstalk ZB Published 16:26 04/11/2019 Health and Disability Commissioner, Anthony Hill says the surgeon failed to follow DHB guidelines and provide services with reasonable care and skill.

2019 12 16 Wairarapa Board Meeting PUBLIC - Appendices

29

https://www.newshub.co.nz/home/new-zealand/2019/11/kiwi-surgeon-found-in-breach-after-man-s-leg-catches-fire-during-operation.html

https://www.msn.com/en-nz/news/national/service-failure-mans-leg-catches-fire-during-surgery/ar-AAJNITA

https://news.fuseworksmedia.com/1f397e81-151c-4a58-a7c8-85a2e4553d0d

https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12282273

https://www.nzherald.co.nz/health/news/article.cfm?c_id=204&objectid=12282273

https://www.newstalkzb.co.nz/news/health/mans-leg-catches-fire-during-knee-operation-surgeon-and-dhb-in-breach/

https://www.stuff.co.nz/national/health/117150599/mans-knee-catches-fire-during-surgery-at-wairarapa-hospital

https://news.fuseworksmedia.com/0ad17093-0ff0-40eb-bd92-d65fba211e8e

http://www.voxy.co.nz/health/5/351542

https://www.tvnz.co.nz/one-news/new-zealand/wairarapa-surgeon-accidentally-sets-patients-leg-fire-during-botched-knee-surgery

https://www.nzdoctor.co.nz/article/undoctored/burns-sustained-during-surgery

https://www.tvnz.co.nz/one-news/new-zealand/wairarapa-surgeon-accidentally-sets-patients-leg-fire-during-botched-knee-surgery

https://news.fuseworksmedia.com/0ad17093-0ff0-40eb-bd92-d65fba211e8e


https://news.fuseworksmedia.com/6df238db-fd15-478b-8e29-c2e087611a2f

https://www.nzdoctor.co.nz/article/undoctored/burns-sustained-during-surgery

https://news.fuseworksmedia.com/0a2eff0d-cea0-4425-a004-a44a8a765a55

Calls for new Rural Health Commissioner to address rural healthcare failings

From The Country Published 05:02 05/11/2019 Also from NZ Herald National, New Zealand HeraldThe Rural Health Alliance Aotearoa NZ, which represents about 30 rural health, business and agricultural organisations, is expected to ask Health Minister David Clark to follow in Australia's footsteps and appoint a rural health commissioner along with what it deems as four other critical actions when it meets him and other MPs on Thursday. Crisis in the provinces: Time for a NZ Rural Health Commissioner?

From Lorelei Mason Published 05:00 05/11/2019 Also from VoxyThe Rural Health Alliance Aotearoa New Zealand (RHAANZ) meets in Wellington tomorrow for the organisation’s 4th RuralFest, an annual day-long event to discuss and formalise a formal policy ‘wish-list’ to take to parliament the following day (Thursday) for a series of unique, high-access meetings with the Health Minister and MP’s from other political parties. ... "Last year, for the first time, the Health Minister’s Letter of Expectation to all twenty of the country’s District Health Boards urged them to make the needs of their rural patients a priority as part of the new Rural Proofing policy" says Dr Henry. ... Health Minister David Clark has also announced a scoping project to establish Rural Health Training Hubs.

District Health Board complaints: Is yours the most complained about in the country?

From Stuff.co.nz Published 12:19 10/11/2019 In the past six months, the Health and Disability Commissioner received more complaints about Auckland District Health Board than any other DHB in the country. ... The Health and Disability Commissioner this week issued a report analysing complaints about District Health Boards in the six months to June 30.

NZ needs a more nuanced discussion about suicide

From Newsroom Published 06:29 11/11/2019 Also from MSNThe new head of the Ministry of Health’s Suicide Prevention Office has her work cut out for her, as she tries to bring the public along on a more nuanced conversation about suicide ... While the Government accepted the majority of the inquiry’s recommendations, Health Minister David Clark flatly refused to set a suicide reduction target.

Rural health services labelled 'completely unacceptable'

From Newstalk ZB Published 16:30 08/11/2019 At its meeting on Wednesday, Health Minister David Clark indicated he'd explore the idea.

Violence, self-harm, abuse - this is real life in our classrooms

From New Zealand Herald [PAYWALL] Published 06:11 13/11/2019 He was however shocked to find some of the comments principals made about Te Roopu Kimiora, Northland DHB's child and adolescent mental health service. The Health Minister's defending emergency funding for District Health Boards

From NZ City Published 17:28 12/11/2019 The Health Minister's defending emergency funding for District Health Boards ... The Health Minister's defending emergency funding for District Health Boards ... An Equity support report has revealed the Government made a 142 million dollar payment to seven DHBs before June 30 this year.

The total District Health Board deficit $170m higher than Govt had previously admitted

From New Zealand Herald Published 17:00 12/11/2019 Also from NZ Herald Politics


30

https://www.nzherald.co.nz/the-country/news/article.cfm?c_id=16&objectid=12282316

https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12282316

https://www.nzherald.co.nz/health/news/article.cfm?c_id=204&objectid=12282316

https://news.fuseworksmedia.com/a96b42b4-7525-4108-bef6-8b1b5674d15f


https://urldefense.com/v3/__https:/www.stuff.co.nz/national/health/117225188/district-health-board-complaints-is-yours-the-most-complained-about-in-the-country__;!ySm_boIZAJI!EMr88i72MJ0MesADNqxc9i3x2-rIfG5UfNpufvwvAh_QQQmvUt6PvJA62BOht3q3b2TKI96AqQ$

https://urldefense.com/v3/__https:/www.newsroom.co.nz/2019/11/11/901843/nz-needs-a-more-nuanced-discussion-about-suicide__;!ySm_boIZAJI!EMr88i72MJ0MesADNqxc9i3x2-rIfG5UfNpufvwvAh_QQQmvUt6PvJA62BOht3q3b2TH0WtU1A$

https://urldefense.com/v3/__https:/www.msn.com/en-nz/news/national/nz-needs-a-more-nuanced-discussion-about-suicide/ar-BBWy985__;!ySm_boIZAJI!EMr88i72MJ0MesADNqxc9i3x2-rIfG5UfNpufvwvAh_QQQmvUt6PvJA62BOht3q3b2TF6fZ7RA$

https://urldefense.com/v3/__https:/www.newstalkzb.co.nz/on-air/early-edition/audio/dr-chris-henry-govt-expresses-interest-in-nz-rural-health-commissioner-role/__;!ySm_boIZAJI!EMr88i72MJ0MesADNqxc9i3x2-rIfG5UfNpufvwvAh_QQQmvUt6PvJA62BOht3q3b2RINoL4Jg$

https://urldefense.com/v3/__https:/www.nzherald.co.nz/premium/news/article.cfm?c_id=1504669&objectid=12284568__;!ySm_boIZAJI!Bx3ObMOXGR_I2K_R1zl-znBmYbCelJjSsdvNBeR7esyxjV2SwIrLC7MRId5QMbd65rTWl8CJkQ$

https://urldefense.com/v3/__https:/home.nzcity.co.nz/news/article.aspx?id=301059__;!ySm_boIZAJI!Bx3ObMOXGR_I2K_R1zl-znBmYbCelJjSsdvNBeR7esyxjV2SwIrLC7MRId5QMbd65rSsQvyeQw$

https://urldefense.com/v3/__https:/www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12284637__;!ySm_boIZAJI!Bx3ObMOXGR_I2K_R1zl-znBmYbCelJjSsdvNBeR7esyxjV2SwIrLC7MRId5QMbd65rTtJ8xDkw$

https://urldefense.com/v3/__https:/www.nzherald.co.nz/politics/news/article.cfm?c_id=280&objectid=12284637__;!ySm_boIZAJI!Bx3ObMOXGR_I2K_R1zl-znBmYbCelJjSsdvNBeR7esyxjV2SwIrLC7MRId5QMbd65rRV3Z6tIg$

Health Minister David Clark has told the House the overall District Health Board deficit is actually almost $170 million higher than the Government had previously admitted. ... In the Treasury's Crown account figures, released last month, the total District Health Board ( DHB) deficit was reported to be more than $1 billion - $700 million higher than the Budget's expectations. ... During Question Time today, Clark again blamed the previous National government for the DHB woes and the even wider deficit.

DHB bailouts symptomatic of underfunding - ASMS

From Liz Brown, Association of Salaried Medical Specialists Published 15:25 12/11/2019 Also from NZ DoctorEmergency cash injections for DHBs are a symptom of a woefully inadequate budget planning process that is increasingly an exercise in futility, Association of Salaried Medical Specialists Executive Director Ian Powell says. ... Mr Powell was commenting on a New Zealand Herald story (https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12284283 ) that reveals equity injections to seven DHBs totalling $142 million to keep them afloat in the last financial year. ... Mr Powell says annual DHB budget planning processes have become farcical. Discrimination against Māori rife in DHBs, says Raukawa-Tait

From New Zealand Herald [PAYWALL] Published 15:08 12/11/2019 Raukawa-Tait, who has been on the Lakes District Health Board for nine years, said discrimination against Māori was rife throughout health boards across the country and her own health board, as an organisation, was "no different". ... The Ministry of Health and the Lakes District Health Board have acknowledged her criticism and said work was being done to prevent discrimination. ... Raukawa-Tait said district health boards across the country were aware that systems, policies and procedures in place had not served Māori well.

DHBs wear a further $33M systems write-down but back government project 'reset'

From Reseller News Published 13:11 12/11/2019 New Zealand's stressed district health boards have made further write-downs totaling $32.9 million on the failed National Oracle System (NOS) project in the year to the end of June. ... The system is now live in just four DHBs after six years of effort. ... The DHBs are, however, backing the government's project "reset" to scale back the roll-out of the shared system to just ten DHBs.

Government to unveil 'significant' changes to New Zealand's embattled DHBs next month

From New Zealand Herald Published 12:09 12/11/2019 Also from NZ Herald PoliticsThe Government is poised to unveil "significant changes" around New Zealand's financially embattled District HealthBoards ( DHBs) in the coming weeks, according to Health Minister David Clark. ... This comes after months of widening deficits and emergency government bailout money being paid out to nine DHBs. ... This morning, the Herald revealed close to $400 million of bailout money had been paid out to DHBs after officials warned that, without the payout, staff wages could have been affected.

Nurse's heart still set on Masterton mission - a new clinic in the town

From NZ Doctor Published 17:34 14/11/2019 In this case, she will ask Wairarapa DHB to consider locating an ED doctor in the building at certain hours.

RNZ National 7am - Item 5

From Radio New Zealand Published 07:50 15/11/2019 The Health Minister David Clark admits more resources are needed for drug counselling.

DHB bailouts symptomatic of underfunding - Association of Salaried Medical Specialists

From The Daily Blog Published 05:18 15/11/2019


31

https://urldefense.com/v3/__https:/news.fuseworksmedia.com/17257ddc-7240-4459-8bb9-123ea5a0c560__;!ySm_boIZAJI!Bx3ObMOXGR_I2K_R1zl-znBmYbCelJjSsdvNBeR7esyxjV2SwIrLC7MRId5QMbd65rTsr4v-MQ$

https://urldefense.com/v3/__https:/www.nzdoctor.co.nz/article/undoctored/dhb-bailouts-symptomatic-underfunding__;!ySm_boIZAJI!Bx3ObMOXGR_I2K_R1zl-znBmYbCelJjSsdvNBeR7esyxjV2SwIrLC7MRId5QMbd65rSPKB9miw$

https://urldefense.com/v3/__https:/www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12284283__;!ySm_boIZAJI!Bx3ObMOXGR_I2K_R1zl-znBmYbCelJjSsdvNBeR7esyxjV2SwIrLC7MRId5QMbd65rSawXEsqg$

https://urldefense.com/v3/__https:/www.nzherald.co.nz/premium/news/article.cfm?c_id=1504669&objectid=12283895__;!ySm_boIZAJI!Bx3ObMOXGR_I2K_R1zl-znBmYbCelJjSsdvNBeR7esyxjV2SwIrLC7MRId5QMbd65rTwDlGkuw$

https://urldefense.com/v3/__https:/www.reseller.co.nz/article/668507/dhbs-wear-further-33m-systems-write-down-back-government-project-reset/?fp=2&fpid=1__;!ySm_boIZAJI!Bx3ObMOXGR_I2K_R1zl-znBmYbCelJjSsdvNBeR7esyxjV2SwIrLC7MRId5QMbd65rSbiGp4cQ$

https://urldefense.com/v3/__https:/www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12284491__;!ySm_boIZAJI!Bx3ObMOXGR_I2K_R1zl-znBmYbCelJjSsdvNBeR7esyxjV2SwIrLC7MRId5QMbd65rT5MQsQag$

https://urldefense.com/v3/__https:/www.nzherald.co.nz/politics/news/article.cfm?c_id=280&objectid=12284491__;!ySm_boIZAJI!Bx3ObMOXGR_I2K_R1zl-znBmYbCelJjSsdvNBeR7esyxjV2SwIrLC7MRId5QMbd65rTUTKEbbA$

https://urldefense.com/v3/__https:/www.nzdoctor.co.nz/article/news/nurses-heart-still-set-masterton-mission-new-clinic-town__;!ySm_boIZAJI!G28rgqf1jM_R4jVQfUG5DpO2lGUyi57v__fdG1ftzXWJvtgCT204qz2ICO7dWi3oQsfNsEn5ZQ$

https://urldefense.com/v3/__https:/news.fuseworksmedia.com/6f3138fe-13e0-48f3-8080-fe652feabecc__;!ySm_boIZAJI!G28rgqf1jM_R4jVQfUG5DpO2lGUyi57v__fdG1ftzXWJvtgCT204qz2ICO7dWi3oQsfgkLQHSA$

https://urldefense.com/v3/__https:/thedailyblog.co.nz/2019/11/15/dhb-bailouts-symptomatic-of-underfunding-association-of-salaried-medical-specialists/__;!ySm_boIZAJI!G28rgqf1jM_R4jVQfUG5DpO2lGUyi57v__fdG1ftzXWJvtgCT204qz2ICO7dWi3oQsd3_KtLJw$

DHB bailouts symptomatic of underfunding ... Emergency cash injections for DHBs are a symptom of a woefully inadequate budget planning process that is increasingly an exercise in futility, Association of Salaried Medical Specialists Executive Director Ian Powell says. ... Mr Powell was commenting on a New Zealand Herald story (https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12284283 ) that reveals equity injections to seven DHBs totalling $142 million to keep them afloat in the last financial year.

HDC complaints good for mental health

From NZ Doctor Published 15:47 15/11/2019 There are lessons to be learned from the complaints lodged against DHBs with the health and disability commissioner between January and June this year, says mental health commissioner Kevin Allan. ... The overall total of 427 complaints received by the health and disability commissioner equates to 88.02 per 100,000 discharges for the period between January and June this year which is less than the six-monthly average of 452.

Rise of the health charity

From Newsroom Published 07:06 18/11/2019 Also from MSNIn the ever-constrained health funding environment, DHBs have been setting up charities in order to fund the extras the taxpayer dollar won’t stretch for. ... Theoretically, the public purse should cover all healthcare costs, but in a climate constantly starved of dollars, DHBs are looking to business and community to help out. ... Charities, which subsidise projects and services for DHBs, are not new but there seems to be a rise in the number of so-called health foundations, as the funding environment remains constrained and patient expectations change. Government plan to get food and beverage industry tackle obesity

From Stuff.co.nz Published 10:22 16/11/2019 Widespread availability of high-calorie foods and drinks has contributed to making New Zealand one of the most overweight countries in the world, but health minister David Clark, who was running his first marathon today in Arrowtown, praised the food industry for proposing measures he believed could help cut the cut the $624 million a year cost of obesity-related illness.

Waikato medical school bid brought back to life

From Stuff.co.nz Published 16:59 15/11/2019 In 2016, Waikato University and the Waikato District Health Board announced a joint bid to establish the country's third med school. ... The Coalition Government later shelved the idea after Health Minister David Clark threw his support behind multi-disciplinary hubs for medical training in rural areas. ... Waikato University has a strong working relationship with the Waikato DHB and Quigley's preference is to take the Waikato bid forward with the DHB at the core of the proposal.

Sending love to the lonely

From Wairarapa Times-Age Published 17:00 20/11/2019 People can drop off a card containing a message to Sending Love boxes, which are located at St Teresa’s School in Featherston, the Wairarapa Times-Age office on Chapel St, the Masterton, Greytown and Martinborough libraries, Almo Books in Carterton, and the cafeteria at Wairarapa Hospital. ... Then she will sort the cards and deliver them to the region’s foodbanks, rest homes, Women’s Refuge, Idea Services, Wairarapa Hospital and the hospice, among other organisations.

Gray powers to top award

From Wairarapa Times-Age Published 09:30 20/11/2019 With other Lionesses she donated 32 pairs of children’s pyjamas to Wairarapa Hospital’s paediatric ward this August. Patients' hospital comings and goings now just a click away for South Island practices

From NZ Doctor


32

https://urldefense.com/v3/__https:/www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12284283__;!ySm_boIZAJI!G28rgqf1jM_R4jVQfUG5DpO2lGUyi57v__fdG1ftzXWJvtgCT204qz2ICO7dWi3oQsct5HYPnw$

https://urldefense.com/v3/__https:/www.nzdoctor.co.nz/article/news/hdc-complaints-good-mental-health__;!ySm_boIZAJI!CR081oL-jl4CUYGGZao3IImZ-lCyVckNpe2ymDjP1NacRQ1olQa0504KCo_NJbQzSrXuQpOn2Q$

https://urldefense.com/v3/__https:/www.newsroom.co.nz/2019/11/18/911168/rise-of-the-health-charity__;!ySm_boIZAJI!CR081oL-jl4CUYGGZao3IImZ-lCyVckNpe2ymDjP1NacRQ1olQa0504KCo_NJbQzSrW8mpKVfw$

https://urldefense.com/v3/__https:/www.msn.com/en-nz/news/national/rise-of-the-health-charity/ar-BBWU1YE__;!ySm_boIZAJI!CR081oL-jl4CUYGGZao3IImZ-lCyVckNpe2ymDjP1NacRQ1olQa0504KCo_NJbQzSrV-sJEDVA$

https://urldefense.com/v3/__https:/www.stuff.co.nz/business/117472949/government-plan-to-get-food-and-beverage-industry-tackle-obesity__;!ySm_boIZAJI!CR081oL-jl4CUYGGZao3IImZ-lCyVckNpe2ymDjP1NacRQ1olQa0504KCo_NJbQzSrXXKiPtIw$

https://urldefense.com/v3/__https:/www.stuff.co.nz/national/health/117457864/waikato-medical-school-bid-brought-back-to-life__;!ySm_boIZAJI!CR081oL-jl4CUYGGZao3IImZ-lCyVckNpe2ymDjP1NacRQ1olQa0504KCo_NJbQzSrW6SvSbig$

https://urldefense.com/v3/__https:/times-age.co.nz/sending-love-to-the-lonely/__;!ySm_boIZAJI!D1adT_MWzoPfLm-ab37FWpafrDcOwaTiwBsQJ6gh0NmhbZ1vRqK_WGzaEzXjYgReaO62qS-HQw$

https://urldefense.com/v3/__https:/times-age.co.nz/gray-powers-to-top-award/__;!ySm_boIZAJI!D1adT_MWzoPfLm-ab37FWpafrDcOwaTiwBsQJ6gh0NmhbZ1vRqK_WGzaEzXjYgReaO6CWCoqfw$

https://urldefense.com/v3/__https:/www.nzdoctor.co.nz/article/print-archive/patients-hospital-comings-and-goings-now-just-click-away-south-island__;!ySm_boIZAJI!D1adT_MWzoPfLm-ab37FWpafrDcOwaTiwBsQJ6gh0NmhbZ1vRqK_WGzaEzXjYgReaO4BSR13Ow$

Published 18:01 20/11/2019 An early adopter in the South is Invercargill Medical Centre, a health care home practice where the nursing team use the dashboard to help coordinate and improve patient support.

Positive publicity about HCH journey sees practice swamped

From NZ Doctor Published 18:01 20/11/2019 A Dunedin general practice has temporarily closed its books after positive publicity and word of mouth about its health care home changes contributed to it "drowning" in new patients. ... In 2018, Amity Health Centre became one of the first four WellSouth PHO practices to start on the road to becoming a health care home (HCH), as part of the Southern Primary & Community Care Action Plan. ... The practice has four part-time GPs (2.4FTE) and four part-time nurses with the nursing hours recently increased from about 1.2FTE to 2FTE to help deliver the health care home services.

More than 900 patients harmed in New Zealand

From The Press Published 12:04 21/11/2019 Delayed diagnoses, infections, falls and not recognising a worsening patient all contribute to adverse events, where a patient is seriously harmed through unintended or unexpected events. ... Patients falling over was one of the most common problems across the country, accounting for 255 of DHBs reports. ... But it was clinical mismanagement that made up the majority of mistakes, with patients missing out on referrals and being diagnosed late.

CDHB looking to build new facility

From Otago Daily Times Published 06:08 22/11/2019 It comes after leading clinicians wrote to Health Minister David Clark in July, urging him to intervene to progress slow-moving plans for new facilities at the Christchurch Hospital campus. ... Previously, Canterbury District HealthBoard CEO David Meates said the new $485m Acute Services Building, which is expected to open early next year, will not provide any extra capacity due to the population growing faster than predicted. ... Previously, Mr Meates told the Ministry of Health the programme would pose "significant challenges" to the DHB, which is already cash-strapped and struggling to meet wait time guidelines.


33

https://urldefense.com/v3/__https:/www.nzdoctor.co.nz/article/news/positive-publicity-about-hch-journey-sees-practice-swamped__;!ySm_boIZAJI!D1adT_MWzoPfLm-ab37FWpafrDcOwaTiwBsQJ6gh0NmhbZ1vRqK_WGzaEzXjYgReaO6E8DOjFg$

https://urldefense.com/v3/__https:/www.stuff.co.nz/national/health/117596176/more-than-900-patients-injured-in-new-zealand__;!ySm_boIZAJI!FosrTvW7856XN_iR-eDFTTYXPHzEUl0Y6ZaBfAdnT5KKvIF2y5RGS3Qlbr3O7sd07xjkSu87Tg$

https://urldefense.com/v3/__https:/www.odt.co.nz/star-news/cdhb-looking-build-new-facility__;!ySm_boIZAJI!FosrTvW7856XN_iR-eDFTTYXPHzEUl0Y6ZaBfAdnT5KKvIF2y5RGS3Qlbr3O7sd07xhWGfoQng$

06/12/2019 Health Matters Wairarapa - Summer update

https://mailchi.mp/155d6cabcfec/health-matters-wairarapa-summer-update-3755509?e=29fe030388 1/9

View this email in your browser

SUMMER: November 2019

Wairarapa DHB & Primary Care Newsletter

Kia ora koutou

Welcome to the first of our combined seasonal newsletters, keepingyou up to date with what's hot and what's not in healthcare in ourregion.

Wairarapa is a unique community.

We are relatively small and, as such, we can buildgreat connections that make all the difference tothe way we design and deliver the best healthcarefor our people. Care that supports our staff aswell as our clients.

Good communication is the key. Making surethose that provide services in the community arekept up to date with what is happening, bydeveloping simple ways to keep in touch. Thisnewsletter is a start and we welcome yourfeedback.

Email: [email protected]

Our vision

We are pleased to bring you this inaugural newsletter.We hope that it serves the purpose we propose - to keep you informed of topical issues, to provide aplatform for sharing successes, and to bring a sense of connectivity across our services.We are committed to working together better. We want to work in partnership, putting the patientat the centre of all we do to ensure the best possible outcomes for our community. We wantWairarapa to be well, and we are looking forward to developing a shared strategy that can get usthere. It is a journey we are all on together, negotiating the considerable challenges of our healthsystem to deliver quality care. It is almost year end and we are looking forward to a new and improved and dynamic year

Subscribe Past Issues Translate


34

https://mailchi.mp/155d6cabcfec/health-matters-wairarapa-summer-update-3755509?e=29fe030388

http://eepurl.com/gKs7Fv

https://us3.campaign-archive.com/home/?u=6990c69cab04aae9dfb9c6f6c&id=09def114bd



ahead. 2020 will be a year for change, and we want to have your input and influence to help usshape what that looks like. Thank you for all that you do! We wish you a very merry Christmas, with some relaxing time out.

Dr Annie Lincoln

GP Liaison

Dr Shawn Sturland

Chief Medical Officer, DHB

In this edition:

Meet Dale Oliff, Chief Executive Wairarapa District Health Board

Board papers 25 November 2019

Our surgical delays - the bigger picture

How you can help - streamlining referrals for Wairarapa patients

Farewell Alan Shirley, you will be missed

Information for patients with long-term joint pain

Wairarapa Skin Clinic - Dr Cath Becker

New to the team

In Home Strength & Balance service - Fiona Gamble

Shifting FOCUS

Oral health checks for under 18s - reminder!

Dale OliffCE, Wairarapa DHBDale was most recently the ActingCE at Hutt Valley DHB. Herprevious roles at Lakes, HuttValley, Counties Manukau andSouthland DHBs have includedDirector of Nursing & Midwifery,and Chief Operating Officer. Dale says she is impressed by the"Wairarapa way" in which people,systems and services continue toachieve, despite the challenges infront of us.

“There is no doubting the fact that we have challenges. Healthcare is challenging. But the dedication and



35





the motivation and the true professionalism shown by all our staff is what drives us to meet and overcome thosechallenges. Wairarapa seems to me a place where people meet issues head on. It is a great can-do attitude that wehave here and it makes me very proud.”

Wairarapa DHB board papers for public meeting 25.11.2019 are available CLICK HERE

Clicking on the links on the agenda, p3, will take you directly to papers of interest

Hospital and Community Services report is on p48 of the papers

Recruitment - General Surgeons, Orthopaedic Surgeons, Anaesthetist p50ED wait times p51Planned care performance p55

Surgical delays at WairarapaHospital - the bigger picture

Wairarapa Hospital has 74 inpatient beds, andplanning bed use is a complex business.

We build on a patient safety matrix that works withinour rostered staff resource to allow for an estimatednumber of urgent presentations versus plannedsurgery and resident medical patient cases.Any unexpected increase in unplanned, urgent traumaand illness presentations can that tip that balance.

When that happens, we have more patients than wehave beds and staff for. We call this a Code Red. Tomanage, we are forced to look at finding more beds,bringing in more staff and, as a last resort,rescheduling elective surgeries.

In a Code Red, we can repurpose our small, short stayunit beds to use for admitted patients, and we canbring in extra staff, but this is simply not sustainable

When we have a lot of urgent need, it puts pressure onstaff and patients alike. Patient safety is first andforemost, and all our decisions are made with thepatient at the centre. Delaying surgical appointmentsis the last approach taken – but it is sometimesunavoidable.

The considerable inconvenience for someone inhaving their surgery delayed is well understood – soour patients can be assured that, if it happens, wehave had absolutely unavoidable reason to reschedule.

But there is more to surgical delays than just a busyday at the hospital. Wairarapa Hospital being underpressure is not just down to an influx of seasonalillness and acute injury – there is a bigger picture atplay. The broader context of continuing industrialaction, staffing vacancies and recruitment challenges,and high numbers of low acuity patients all addscomplexity.



36

http://www.wairarapa.dhb.org.nz/about-us/boards-and-governance/meeting-times-papers/2019-11-wairarapa-dhb-board-papers.pdf





long term. We also work hard to assess inpatients,discharging as appropriate and freeing up beds.

We are now exceeding the Ministry of Healthguideline for 4 months wait for planned surgeries.

Read more HERE

So what does this mean for Wairarapa?

The demand for surgical services is greater than our capacity to deliver. Unplanned increase in

emergency demand (trauma) is impacting on planned work, and we don't have enough surgeons.

This is predominantly affecting General Surgery and Orthopaedics where we have seen a significant

push out of wait times and we are in breach of the 4 month guideline.

What are we doing about it?

We have commenced a comprehensive review of our perioperative flow, from door to door, to

identify issues and inefficiencies. We are starting with Orthopaedics. And we are recruiting

surgeons, with some success. Two General Surgeon appointments have been secured, starting in

early 2020 - one for 6 months and one for a year - and active recruitment continues. Orthopaedic

recruitment has also proven successful, with offers underway. Interviews are booked for

Anaesthetist roles.

What else can we do?

Collaborate regionally with neighbouring DHBs - discussions are ongoing and the support of other

providers is a key component of our care planning.

And what do we need YOU to do?

We are streamlining referrals for Wairarapa patientsWe will soon be looking into our referral processes, refining and standardising theway in which practitioners refer Wairarapa patients to hospital services.It is important that Wairarapa people needing hospital care are ALL referred toWairarapa Hospital, where our team can then refer out of district if that is appropriate.We will have more information early in the New Year about any changes that mightmean.

Farewell Alan Shirley,you will be missed!With us for 35 years, fresh to

Wairarapa from the UK in the

1980's, Mr Shirley is an institution.



37

http://www.wairarapa.dhb.org.nz/news-and-publications/latest-news/2019-10-24-code-red-elective-surgery-waitlists/





More a fanfare than a farewell, with

many a story told, we wished Alan

and Diana well on their new

journey - retirement in Auckland.

Patients With Long-Term Joint Pain

When supporting patients managing long term orthopaedic and arthritic pain, beforereferring directly to the Orthopaedic service, other options to consider within the Wairarapaare:

Arthritis NZ. Who can provide support for all types of Arthritis. 0800 663463. www.arthritis.org.nzSelf-Management Courses offered by Tū Ora Compass Health, which support people to bettermanage any long term health condition including chronic pain. For more information call Tū OraCompass Health on 06 2618300 or email [email protected]

The Self-Management course was developed by Stanford University, is evidence based and currently run inmore than 20 countries.

The Wairarapa Skin Clinic at the Health Centre on Park Street, Masterton offers general skin checks to look for skin

cancer, advice on managing skin lesions or cancers, and performs minor surgeries to remove these if needed.

Both public and private surgery is provided at the clinic.



38

https://urldefense.com/v3/__http:/www.arthritis.org.nz__;!ySm_boIZAJI!HQeEAHZLZIBDeO-KcCMjZMQuUN5vOgV7fxjLe5VsLcIEmtLXJmIG5b7v0K_K7x7V2DvxUdqiCw$

mailto:[email protected]





Your skin in in safe hands with this experienced team:

From Left: Mary Anderson, Minor surgery nurse; Ange Rough, Administrator; Janet Hodge, Dermoscopy Nurse;

Dr Cath Becker, Dr Lynette Cherry

More information on the website: www.wairarapaskinclinic.co.nz

Appointments & Enquiries

Call 06 370 2171 or 021 252 1098

Email: [email protected]

Read about Wairarapa Skin Clinic in the Women in Business 2019 feature - on page 32 CLICK HERE

New to the team...

Dr Steve Earnshaw3DHB Chief Clinical Information Officer (CCIO)Steve is an orthopaedic surgeon by background, and will becontinuing part-time clinical work alongside his ICT leadershiprole. He comes to us from the South Island, where he was theCMO for South Canterbury DHB. Steve led the implementation ofseveral systems in South Canterbury, including those for hospitalelectronic prescribing and for the sharing of electronic patientinformation between primary and secondary care. Steve also ledthe rollout of one single Concerto clinical portal across allfive South Island DHBs.

Dr Vok SekickiPhysicianOriginally from Serbia, Vok moved to the US in 2010 to train, afterwhich he worked in Washington DC. He came to New Zealandwith his wife and two children on a 10 day holiday, travelling over2000km in a campervan around the North Island. At the end of theholiday his children wanted to know why they couldn't just stay!

Rachel CoeED ConsultantRachel joined the DHB in August this year as an ED consultant.



39

https://www.beckermedical.co.nz/


https://times-age.co.nz/women-in-business-2019/





In addition, Kate Barnard, Locum Physician – General Medicine, will be joining us while Tim Matthews ison sabbatical, from 2 Dec 2019 to 21 Feb 2020

In home strength and balance

Falls are the most common cause of injury in people 65 years and over. Research has shown that strengthand balance exercises reduce the risk and rate of falling in older people no matter what the level of individualrisk.

Live Stronger For Longer is a nationwide movement involving the Ministry of Health, ACC and the Health,Quality & Safety Commission working together with local communites to prevent falls and falls relatedinjuries in older people.

There are two evidence-based falls prevention exercise interventions running in the Wairarapa:

Community Strength and Balance (CSB) classes are group-based and aimed at people with a widerange of physical abilities, and include seated exercises right through to pilates and line dancing.The In Home Strength and Balance (IHSB) Programme is for people over 75 years old who aremotivated and cognitively able to exercise regularly, but physically unable to access communityclasses.

Information on the criteria for the IHSB Programme and how to access both of these interventions can befound HERE For up to date information on local CSB classes and other resources, click HERE

A referral from a health care professional is required to enter the IHSB Programme. This can be sentelectronically to the WrDHB physiotherapy department, or faxed to WrDHB Allied Health (06) 946 9818.

For further information on the IHSB Programme, contact Fiona Gamble, [email protected].

FOCUS has shifted - find them on Lincoln Road



40

https://3d.healthpathways.org.nz/index.htm

https://www.livestronger.org.nz/home/find-class/find-a-class-near-you/






The FOCUS team has shifted!

Level Two, 49-51 Lincoln Road, Masterton.

Myree Ahpene, FOCUS Manager, is pleased with the move. "Our new offices are more user-friendly forour clients and staff," she said.

"We are conveniently co-located in the same building with Te R.A.M.A child & adolescent mental healthservices, Education and Oranga Tamariki, which will offer synergies and improved interagencyopportunities."

"The office space is larger, lighter and more functional for us, and it will suit our needs well."

Referral pathways and service delivery will not change, and all phone, fax and email contacts remain thesame.

FOCUSPhone 06 946 9813 / 0800 900 001General Fax 06 946 9826 / Referrals Fax: 06 946 9898Email [email protected]

Oral Health checks for under 18s - REMINDER!

Have the 17 yearolds you knowreceived their freedental care?

It's time for Wairarapa’s nearly18 year olds to make sure theyhave been along for their finalFREE dental check-up andtreatment before they turn 18.

They can call any of ourWairarapa clinics to make anappointment.

Wairarapa DHB's latest news, media releases and radio advertising is available on the websitewww.wairarapa.dhb.org.nz

Concerns? Feedback? Questions? Contact us [email protected]

Anna Cardno 027 205 2422



41


http://www.wairarapa.dhb.org.nz/news-and-publications/






This email was sent to [email protected] why did I get this? unsubscribe from this list update subscription preferences

Wairarapa DHB · Blair Street · Masterton, Wairarapa 5840 · New Zealand



42


https://dhb.us3.list-manage.com/about?u=6990c69cab04aae9dfb9c6f6c&id=09def114bd&e=29fe030388&c=69e4e40e74

https://dhb.us3.list-manage.com/unsubscribe?u=6990c69cab04aae9dfb9c6f6c&id=09def114bd&e=29fe030388&c=69e4e40e74

https://dhb.us3.list-manage.com/profile?u=6990c69cab04aae9dfb9c6f6c&id=09def114bd&e=29fe030388

http://www.mailchimp.com/monkey-rewards/?utm_source=freemium_newsletter&utm_medium=email&utm_campaign=monkey_rewards&aid=6990c69cab04aae9dfb9c6f6c&afl=1



Wairarapa DHB

2019/2020

Tapu Te Hā

Tobacco Control


43

2


44

3

KEY FOCUS AREAS FOR TAPU TE HĀ

1. Kainga & Hapūtanga

Building on the strong foundation provided by programmes such as: ka tipu ngā mokopuna, hapū wānanga, hapū māmā, pēpē ora & auahi kore to name a few, we will continue to invest resources to grow and improve these programmes. Our target audience is Māori women.

2. Māori Health Promotion Māori health promotion is about shared leadership, health leadership, community leadership, iwi leadership - we will do ‘with’ not do ‘too’ our whanau, in this sense we all have something to offer to improve the health of our people. The health sector cannot do this alone, we will find ways to work with other agencies within Wairarapa that can affect change for whanau. We also acknowledge that Māori health advancement is intimately connected to Māori culture.

3. Equity in Action We will continue to take ownership of the Smokefree/ Tapu Te Hā kaupapa and endeavour to meet or exceed our targets where possible. We have clear equity priorities we need to consider with the current resource we have allocated to the district.

SMOKEFREE AŌTEAROA 2025 In New Zealand, around 16% of all adults (aged over 15) smoke daily, 38.6% of Māori and 25.5% of Pacific people. Māori, Pacific people and pregnant women are priority groups for all tobacco control, due to the higher prevalence and the impact of smoking in these groups and on their whānau. The New Zealand tobacco control sector is committed to the goal of a Smokefree Aotearoa by 2025. Achieving Smokefree Aotearoa by 2025 means that less than 5% of the population will smoke tobacco. The responsibility and accountability for achieving the Smokefree Aotearoa 2025 goal is shared between the New Zealand Government, health services, the tobacco control sector and communities. Broadly speaking this will be achieved through:

- creating supportive environments and protecting children and young people from exposure to tobacco marketing and promotion;

- making legislative change and reducing the supply of and demand for tobacco; and - providing the best possible support for whānau wanting to quit smoking.

SMOKING STATISTICS FOR WAIRARAPA Wairarapa currently sits above the national statistic for adult smokers at 19.3%, 39.5% Māori and 21.8% Pacific people. A breakdown of the actual numbers of smokers are presented in the table below. The initiation of smoking occurs generally between the teenage years and late twenties.

Table 1. WDHB Enrolled Population Smoking Prevalence

Apr-Jun 2019 Māori Pacific Other Total

Number of people recorded as smoking 1951 143 4172 6266

Enrolled population aged 15-74 years 4936 655 26909 32500

% of enrolled population aged 15-74 years who smoke 39.5% 21.8% 15.5% 19.3%


45

4

Table 2. WDHB Rate of inpatient AB Not C

Graph 1. Māori smoking rates significantly higher

Graph2. Māori smoking rates higher in all age groups

0%

10%

20%

30%

40%

50%

60%

15-19 20-24 25-29 30-34 35-39 40-44 45-49 50-54 55-59 60-64 65-69 70-74

CURRENT SMOKERS BY AGE 15-74 yrs

Other Maori

Year Inpatient Discharges over 15

Hospitalised Smokers

Smokers Offered Advice

Rate of Smokers to Inpatient Discharges

Rate of Smokers Offered Advice

2015 511 62 51 12.1% 82.30%

2016 498 62 49 12.4% 70.00%

2017 595 93 85 15.6% 91.40%

2018 501 84 80 16.8% 95.20%

2019 370 53 50 14.3% 94.30%

39.50%

21.80%

15.50%

19.30%

0% 5% 10% 15% 20% 25% 30% 35% 40% 45%

M A O R I

P A C I F I C

O T H E R

T O T A L

ENROLLED POPN AGED 15-74 SMOKERS


46

5

ABC OF SMOKING CESSATION Supported by the implementation of health targets, the ASK, BRIEF, CESSATION (ABC) method has become well embedded in all three settings (Primary, Secondary and Maternity settings), and remains the cornerstone of efforts to encourage smokers to quit. However these clinical interactions require constant effort to maintain, and need to be resourced. Although health target performance is not currently a primary planning focus, we intend to retain the previous targets as organisational performance indicators.

- ASK the person about their smoking status; - Give BRIEF advice to encourage the person who smokes to make a quit attempt; - Offer CESSATION support and refer them to a Stop Smoking Service.

Graph 3. Inpatient Ask and Brief advice rates meet targets

PROGRESS SO FAR 2019/20 The following sections of this plan summarise our progress to date and key activities for the 2019/20 year.

SECONDARY CARE HIGHLIGHTS The Wairarapa DHB have successfully reached “The Better Help for Smokers to Quit” health target and is no longer required to report quarterly to the Ministry of Health.

The DHB intends to: 1. Retain the previous target “95% of hospitalised smokers will be provided with advice and

help to quit” as an organisational performance indicator. 2. Increase the focus on referrals to cessation support from the hospital in the 19/20. In 2018

5.5% of hospital patients were referred to the SSS. A target of 20% of hospital patients will be referred to the SSS has been set for 2019.

3. Continue to provide weekly updates of the target to the managers of the inpatient wards 4. Continue to give updates of smokefree initiatives to the hospital clinicians 5. Continue to support the Stop Smoking Service in the hospital. 6. Implement a Pepē Ora Navigator /coach to provide wrap around support for high-needs

hapū māmā and their whānau (including delivery of smoking cessation)

82.30%

70.00%

91.40%

95.20% 94.30%

50.00%

2015 2016 2017 2018 2019

RATE OF INPATIENT ASK & BRIEF ADVICE


47

6

7. Ensure that any new kaupapa Māori ante-natal service (e.g. Hapū Wānanga) incorporates smokefree messages and support.

PRIMARY CARE HIGHLIGHTS Primary care clinicians can play a key role in initiating smoking cessation – hence the emphasis over a number of years on the ABC approach as a routine part of a primary care consultation. Primary care clinicians, along with those in other community and hospital settings, are supported in the ABC approach through the pathway promulgated on the 3D Health Pathways website. In order to support primary care to reach and maintain the health target, the DHB has funded Tū Ora Compass Health, over a number of years, to support the education of general practice providers in the ABC approach to smoking cessation. Providing smoking brief advice is considered to be a core primary care function. Tū Ora Compass Health has successfully implemented systems that support general practise teams to focus on patients that smoke, and to maintain the 90% target. In recent years Tū Ora Compass Health and Wairarapa DHB have provided ABC training for Pharmacists and Pharmacy Technicians, and a number of Pharmacy Assistants. The training informs pharmacy staff of the need for increased health and behavioural support of smokers, through referrals to the Regional Stop Smoking Services. Incentivised funding is provided to pharmacies that make referrals and promotion of the service was rolled out in November 2018 – February 2019.

The 2019/20 year will explore opportunities to extend the incentivised programme to include Varenicline Pfizer prescriptions. Dentists will also be invited to join the incentivised programme and ABC training will be offered to all dentists in 2019/20. Primary care has also played a key role in health promotion efforts, including supporting the RSSS branding and promotion, and contributing to a raft of public awareness and support projects Including:

- Pharmacy project - Fresh Air project - Vape to Quit training - World Smokefree day

We consider there is benefit in combining tobacco health promotion with the PHO’s wider health promotion plan.

The 2019/20 Tobacco Control Plan will – 1. Maintain the 90% primary care health target and report quarterly to the Alliance (Tihei

Wairarapa) and the Wairarapa District Health Board. 2. Encourage referrals from primary care and promote the SSS to medical practices. In 2018,

53 referrals were received by the SSS from primary care. 3. Continue to offer ABC training to secondary, primary and pharmacies and extend the training

to include dentists. Continue to support and incentivise the Pharmacy Project and include dentists on completion of the ABC training. “Vape to Quit” training will also be offered on request.

4. Support other agencies as appropriate. For example supporting smokefree environments through the support of the Fresh Air project for smokefree outdoor dining.

5. Ensure PIKI counsellors are aware of support pathways should the individual they are counselling indicate they wish to stop smoking.

6. Investigate funded visits for initial GP visit for Varenicline Pfizer. Investigate current Varenicline Pfizer usage and identify opportunities for increasing uptake.


48

7

OUR PRIORITIES, OUR PARTNERS 2019/20 The emphasis of the DHB Tobacco Control Plan over the past ten years has been on supporting people to quit through the ABC approach at every opportunity presented in a clinical interaction. The DHB has been less successful in systematically offering and encouraging referrals to cessation services. As evidence suggests that smokers are most likely to be successful in their quit attempts when provided with both pharmacological and behavioural support, the DHB intends to increase our focus on referrals to cessation support (SSS) from both hospital and primary care services in the 2019/20 year, including through adoption of improvement milestones. The DHB’s Annual Plan reflects the Government’s and DHB’s equity priority, particularly in health outcomes for Māori. We recognise that smoking remains one of the major drivers of poor health outcomes, and that there is significant disparity in Māori and non-Māori smoking rates across all age groups, we have prioritised five Māori equity targets for 2019/20. These are:

- The first 1000 Days; - 0 – 4 respiratory; - youth mental health; - diabetes, and - oral health.

Smoking is a factor in each of these priority areas, reinforcing the importance of this Tobacco Control Plan. We intend to more deliberately focus our health promotion and cessation support to Māori, and increase the range of support available to Māori whānau with babies. Both nationally and locally, the smoking rate is highest in the 20-29 age group. This age group are not high users of health services, and our efforts to date have probably not reached this group very effectively. We have targeted support to hapū māmā, but our own experience and national evidence suggests that the complexity of many young women’s lives, and the challenges they face, mean that stopping smoking is not a high priority for them. During the 2019/20 year we intend to trial new ways of providing antenatal and post-partum support for Māori women with high or complex needs. Wairarapa DHB has developed this revised Tobacco Control Plan for the 2019/20 year in conjunction with Tākiri Mai Te Ata Whānau Ora Collective and Whaiora Whānui Trust (Regional Smoking Cessation Providers), the Regional Public Health Tobacco Control Team, and Tū Ora Compass Health.

KEY ACTIONS 2019/20 In summary, the headline actions for the 2019/20 Plan include:

1. Refocusing existing health promotion and cessation work to prioritise key population groups in particular whānau Māori, kainga Māori & wahine Māori with babies.

2. Trialling new initiatives, including increasing antenatal and post-partum support for Māori women with complex needs.

3. Strengthening smoking cessation support across the board in primary, secondary, maternity, mental health and community settings.

4. Continuing to support health care practitioners to provide Smokefree ABC (Ask, Brief Advice, offer Cessation support).

5. Increasing the number of referrals to the stop smoking services. 6. Increasing access and reducing inequities to smoking cessation medications in particular

Varenicline Pfizer. 7. Collaborating with key stakeholders (both health and non-health stakeholders) to inform

service planning and implementation.


49

8

CELEBRATING SUCCESS IN OUR REGION HAPŪ MĀMĀ The number of smokers and prevalence rate has steadily increased from 2015 although the 2019 rate indicates that it may be on the decline. This has been a disappointing result, with a number factors perhaps influencing the increase in the prevalence rate and a decrease in engagement onto the current hapū māmā programme.

- In 2015 the Wairarapa had a dedicated smokefree quit coach for the hapū māmā programme (then called Growing Love) who worked closely with the LMCs, the ante-natal programme for our less equitable whānau and the Wairarapa Smokefree Network.

- The local Aukati Kai Paipa service was dis-established. A new regional service, Wairarapa, Hutt Valley and Capital and Coast, were combined and called Tākiri Mai te Ata. This impacted on the delivery and control of the programmes and local health promotion.

- Limited funding was provided for this programme so the promotion of the programme relied on the LMCs, the Whaiora outreach services and other health professionals to recruit women onto the programme. These referrals have gradually increased over the years.

- A part time position, at Whaiora, for a smokefree health promoter is no longer funded. This health promoter actively worked with Māori whānau who smoked to bring them into the service. The smokefree health promoter also worked closely with the Wairarapa Smokefree Network at local events to generate referrals to the service.

The Wairarapa DHB want all children to have a healthy start in life. Babies who are born to smokefree mothers and live in a smoke free home have better outcomes. Maternal smoking is associated with a range of poor outcomes including sudden unexpected death in infancy (SUDI) and low birth weight. One of our key priorities is to reduce the rate of foetal and infant exposure to cigarette smoke. The Wairarapa DHB will do this by:

- Improving the reach and increasing referrals to the Hapū Māmā incentivised programme by using the results of a survey of hapū māmā who were referred to the programme to encourage more māmā to give it a go.

- Employ a Pepē Ora Navigator/coach to work alongside Wairarapa Maternity, Regional Stop Smoking Service and Breast Feeding Wairarapa and provide additional support to hapū māmā and their whānau to give their pepē the best start to life.

- Develop and implement Hapū Wānanga as a core component of the DHBs antenatal programme.

- Provide education in Taki Taki Mai, motivational interviewing techniques and key messages for health professionals to better engage with Māori.

A POSITION ON VAPING & E-CIGARETTES The Ministry of Health considers vaping products have the potential to make a contribution to the Smokefree 2025 goal and could disrupt the significant inequities that are present. The Ministry of Health encourages smokers who want to use vaping products to quit smoking to seek the support of local stop smoking services. Local stop smoking services provide smokers with the best chance of quitting successfully and must support smokers who want to quit with the help of vaping products. (Ministry of Health September 2018)

The Wairarapa DHB provided “Vape to Quit” training for health professionals and the community in 2018/19. The training was presented by the National Training Service. Fifty nine people attended the training. The Wairarapa Smokefree Network have informed the Wairarapa community of the new Health Promotion Agency Vape Facts website and they will distribute the new Vaping Facts brochure through their networks when available. “Vape to Quit” training will be provided again if necessary. The


50

9

Wairarapa DHB Smokefree Coordinator is available to visit workplaces to discuss vaping and provide updates. Two workplaces requested this in 2018/19. HEALTH PROMOTION - AUAHI KORE SMOKEFREE The Wairarapa DHB will continue the work started in 2018 to decrease the number of current smokers by addressing the inter-generational smoking prevalence found in whānau. In 2018 a collaborative community project led by the smokefree coordinator and supported by the three councils, Regional Public Health, Tū Ora Compass Health, Regional Stop Smoking Service, Wairarapa Times Age and Aratoi – Museum of Art and History was implemented. The project was called Ka Tipu Nga Mokopuna (I Quit Smoking for My Moko) and the inspiration came from research by the Ministry of Health “Addressing the Challenges of Young Māori Women who Smoke” (November 2018) and the Health Promotion Agency on “Why Wāhine Māori find it hard to quit smoking”. This project focused on nine local wahine tau who quit smoking for their moko. Through their portraits and stories told in the local media and social media and in the community it highlighted the importance of supporting our wāhine hapū to quit smoking. For 2019/20 health promotion efforts will focus on Smokefree Kapa Haka. The Wairarapa has three teams competing in regional and national competitions in 2019/20: Ngā Puawai o Te Kura Kaupapa Māori o Wairarapa, Wairarapa ki Uta Wairarapa ki Tai (combined secondary schools) and Te Rangiura o Wairarapa (seniors). By supporting these teams with sponsorship the Wairarapa DHB and the Stop Smoking Service will be working directly with performers and their tutors to be smokefree and whānau will be committed to the message “leave your tobacco at home” while attending practices and performances. Local smokefree champions with their smokefree messages from the three teams will be celebrated and published throughout the Wairarapa. The Wairarapa Smokefree Network (WSN), which includes representatives from the DHB, Regional Public Health, Whaiora, Cancer Society and Tū Ora Compass Health, will continue to coordinate other health promotion and advocacy activity relating to tobacco use during the year. This will be guided in part by the national promotional activity of the Health Promotion Agency and Hāpai Te Hauora, the national advocacy group.

Promotional activity includes: - Social media engagement - Community awareness campaigns - Pepē Ora expo - Smokefree May – World Smokefree Day - Local promotions by the Stop Smoking Service at events - Deep Dive Hui

TAPU TE HĀ ROOPU Local stakeholders have identified the 18-29 age group as a priority for future action. During 2019/20 we intend to work together to understand drivers of smoking among young people and investigate options for further targeted interventions PUBLIC HEALTH ACTION Smokefree advocacy activity will continue in 2019/20 in Wairarapa, including:

- RPH retail education - smokefree environments (signage; smokefree public spaces; smokefree outdoor dining) - collaborative work with the Cancer Society “Fresh Air Project” - vaping, communications and sharing of Ministry of Health policy and guidelines to the general

public, workplaces, schools, health professionals regarding vaping. Training provided for health professionals and community workers as required.


51

10

A range of activity is planned in 2019/20, including: - enforcement and complaints - controlled purchase operations - working on legislative submissions that support tobacco activity

IMPLEMENTATION PLAN 2019/20

What Activities Who When

Take ownership and lead Tapu Te Hā

1. Active monitoring of progress against all targets and 2025 goal.

2. Reviewing and updating the district Tobacco Control Plan.

3. Advocating for legislative and regulatory change to reduce the uptake of smoking and support smokers to quit.

WrDHB All

Ongoing

Strive to achieve the tobacco control targets

Achieve the Health Targets 1. 95% of hospitalised smokers will be

provided with advice and help to quit. 2. 90% of PHO enrolled patients who smoke

have been offered help to quit by a health care practitioner in the last 15 months.

3. 90% of women who identify as smokers upon registration with a DHB employed midwife or Lead Maternity Carer are offered brief advice and support to quit smoking.

4. Increase referrals from secondary and primary care to the Stop Smoking Service.

WrDHB Tū Ora WSSS RPH Maternity Hospital

Ongoing

Hapū Māmā 1. Design and implement a survey of female smokers who have recently given birth in the Wairarapa to identify opportunities to improve uptake and effectiveness of the Hapū Māmā programme.

2. Implement any improvement changes from the survey.

3. Design a standard format for data collection of the Hāpu Māmā programme.

WrDHB WSSS Wāhine Māori

Q1

Pepē Ora 1. The Wairarapa DHB will employ a Pepē Ora Navigator /coach, who will work closely with the Maternity Ward to work alongside LMCs and hospital midwives to encourage greater engagement of hapū māmā who smoke onto the incentivised quit smoking programme and encourage exclusive breastfeeding up to six months.

2. Continue to support Pēpe Ora in its collaborative work engaging with services and providing resources for organisations that work with mums from ante natal to five years old.

WrDHB RPH Tū Ora Sport WairarapaPlunket Tamariki Ora LMC’s

Q3 Ongoing


52

11

Hapū Wānanga 1. The WrDHB will implement a hapū wānanga for Wairarapa hapū māmā. This will involve weaving wahakura and learning the principles of Safe Sleep.

WrDHB Wāhine Māori

Q4

Kainga Ora 1. Babies in smokefree household system level measure 95% of whānau are asked about their smoking status at the first well child core check.

2. Continue to provide WCTO with education and training support on the implementation of the Smokefree SLM data standard.

3. Explore the feasibility of increasing referrals from Primary Care to Stop Smoking Services by using primary care data set to target households with babies.

WrDHB Tū Ora WCTO WSSS Rangatahi Māori

Ongoing

Increase referrals to Whaiora Stop Smoking Service

1. If possible add SSS as an option for referral alongside the Quitline in practices.

2. Implement a process for referring hospitalised smokers to Stop Smoking Services. A target for Hospital Service of 20%.

3. Investigate presenting the ABC in specialist’s training.

4. Identify champion pharmacies and continue to support these pharmacies with training, resources and media.

5. Add to the pharmacist referral programme patients who receive a script for Varenicline Pfizer.

6. Develop relationships and approaches to facilitate opportunities to promote access to SSS particularly for priority communities such as Masterton East.

Executive Leader of Operations WrDHB Tū Ora RPH

Q2

Māori Health Promotion 1. Wairarapa DHB will sponsor and support the senior Kapa Haka group, Te Rangiura o Wairarapa to be totally smokefree. The Wairarapa is hosting the lower North Island’s regional Kapa Haka competition at McJorrow Park, February 22 and 23 2020. This will be the Wairarapa DHB’s main smokefree health promotion for 2019/20 and will require collaborative planning and promotion led by the SFC and supported by the Wairarapa Smokefree Network. Other partners include Masterton District Council, the Kapa Haka committee, Wairarapa Times Age and Te Awhina House.

WrDHB Tū Ora WSSS RPH Rangatahi Māori

Q2


53

12

Continue work on compliance and awareness of the Smokefree Environments Act

1. Continue tobacco retailer education programme through newsletters and visits, including plain packaging updates to retailers.

2. Plan for, undertake and report on Controlled Purchase Operations.

3. Respond to possible breaches of the Smokefree Environments Act 1990.

Health Assessment and surveillance - Maintain an internal database of known

tobacco and e-cigarette/vape retailers.

RPH Ongoing

Increase public support for Smokefree Aotearoa

1. Identify and respond to opportunities for written and oral submissions.

2. Continue to support the Fresh Air Project led by the Cancer Society.

3. Provide support for smokefree environments with signage and policy work.

4. Work with Councils and Ministry agencies to strengthen policies and systems to increase smokefree environments.

5. Build and maintain collaborative relationships with key stakeholders eg Te Iwi Kāinga, HPA, Hāpai te Hauora.

6. Participate in regional and national advocacy efforts.

7. Support, inform and respond to Territorial Authorities (TAs) enquiries to create/promote/implement smokefree and/or vape-free environments.

8. Workplace settings: Support, inform and respond to tobacco/vaping enquiries from workplaces.

RPH Cancer Society WrDHB Tū Ora Rangatahi Māori Wāhine Māori

Ongoing

Communications Planning

1. Communication Plan written for collaborative smokefree work.

Tū Ora WrDHB WSSS

Q2

Training & Upskilling

1. Continue to promote the ABC on line training to all health professionals.

2. Provide ABC training to Wairarapa dentists and include them in the incentivised training

3. Provide training as required ie Vape to Quit

Tū Ora WrDHB RPH

Q2 Ongoing

Wairarapa DHB Equity Priorities

Ensure that each of the Wairarapa DHB Equity

Priorities has initiatives linked to Smoking

Cessation:

1. First 1,000 days – ensure that the kaupapa Māori ante-natal initiative will include Smoking Cessation offer and advice to all participants.

WrDHB All

Ongoing


54

13

2. 0-4 respiratory – ensure that all whānau that present to ED for 0-4 Māori respiratory and that identify as smokers are offered/referred smoking cessation advice

3. Youth Mental Health –ensure that the kaupapa Māori provider refers all youth smokers to WSSS

4. Diabetes – ensure that Smoking Cessation is considered in the planning and execution of this equity initiative and where appropriate, referrals are made to WSSS

5. Oral Health – WSSS will identify a cohort of smokers who require emergency oral health care and ensure they are registered for this initiative. WSSS will also assist in the programme during its delivery to ensure each patient who smokes uses patches and other Smoking Cessation tools.


55

14


56

1

PROJECT PROPOSAL – Tapu Te Hā

Prepared for: Wairarapa DHB

Prepared by: Linda Spence, Wairarapa Smokefree Coordinator (SFC)

Project Title: Tapu Te Hā [TTH]

Date: 11/11/2019

Project funding: $15,000 Total

Project Lead: Linda Spence

Project Team: Kaitātaki Tāne/Wāhine (Kapa) Nicola Jackson (Stop Smoking Service), Davi Henare-Kuru (Stop Smoking Service), Leah Clark (RPH) Franklin Walker (Digital Graphics) Jaqs Lumsden (Stop Smoking Service)

Background: In New Zealand, around 16.3% of adults aged over 15 years smoke daily. Māori and Pacific people are more likely to smoke (38.6% and 25.5% respectively). Māori, Pacific and pregnant women are priority groups for all tobacco control work, due to the higher prevalence and/or higher impact of smoking in these groups. Smoking during pregnancy is a major concern in the Wairarapa. Nationally 32% of pregnant Māori women smoke but in the Wairarapa it is 37%. Data from the Ministry of Health indicates that in June 2017, 21% of the PHO enrolled population in the Wairarapa were recorded as a current smoker. The Wairarapa SFC will continue the work started in 2018 to decrease the number of current smokers by addressing the inter-generational smoking prevalence found in whānau. In 2018 a collaborative community project led by the smokefree coordinator and supported by the three councils, Regional Public Health, Tū Ora Compass Health, Stop Smoking Service, Wairarapa Times Age and Aratoi – Museum of Art and History was implemented. The project was called Ka Tipu Nga Mokopuna (I Quit Smoking for My Moko) and the inspiration came from research by the Ministry of Health “Addressing the Challenges of Young Māori Women who Smoke” (November 2018) and the Health Promotion Agency on “Why Wāhine Māori find it hard to quit smoking”. This project focused on nine local wahine tau who quit smoking for their moko. Through their portraits and stories told in the local media and social media and in the community it highlighted the importance of supporting our wāhine hapū to quit smoking. For 2019/20 Māori health promotion efforts will take on a settings based approach using kapahaka as a vehicle for auahi kore lifestyles and champions. Wairarapa has three teams competing in regional and national competitions in 2019/20: Ngā Puawai o Te Kura Kaupapa Māori o Wairarapa, Wairarapa ki Uta Wairarapa ki Tai (combined secondary schools) and Te Rangiura o Wairarapa (seniors). By supporting these teams with sponsorship the Wairarapa DHB and the Stop Smoking Service will be working directly with performers and their tutors to be smokefree and whānau will be committed to the message “waihō tō tupeka” “leave your tobacco at home” while attending practices and performances. Local smokefree champions with their smokefree messages from the three teams will be celebrated and published throughout the Wairarapa.


57

2

Scope: All performers, tutors and those directly involved in the Te Rangiura o Wairarapa Kapa Haka team who smoke will be on the auahi kore journey by the regional competition being held February 22nd and 23rd 2020 at Mc Jorrow Park. The Kapa Haka event will be smokefree with regular messages from the compere reminding whanau that this is a smokefree event. Project Outcome: The secondary aim of this project is to also support all whanau connected to Te Rangiura o Wairarapa Kapahaka to become smokefree and who will then inspire other smokers to make a quit attempt. This will be done through mainstream and social media highlighting the smokefree champions and their quit journey. Delivery Partners: The Kaitātaki tāne and wāhine will provide cultural oversight for the project in its entirety. Whaiora Whānui holds the contract for the Stop Smoking Service in the Wairarapa and they will support those quitting smoking throughout their journey. Tū Ora Compass Health will provide the sponsorship for the team and Regional Public Health will provide funding for the media work. Timeframe:

Month Activity Lead

31 December 2019 Planning Complete Linda

10 January 2020 Performers who smoke, sign up with the Stop Smoking Service. Kapa Haka committee and SFC sign MOU.

Nicola

22 February 2020 Regional Competition Kaitātaki

03 April 2020 Celebration Linda

Reporting: The Stop Smoking Service will report on number of referrals, number who set a quit date and the 4 week CO2 validation form the Kapa Haka Team. The Stop Smoking Service will report on referrals received during the weekend of February 22nd and 23rd. The SFC will compile the data and a narrative into a report by March, 2020.


58

Background

RisksWhilst these services offer significant advantages to the DHB, there are risks and legislative implications that must be addressed prior to the DHB adopting cloud services.

In summary these risks are as follows, however it must be realised that many of these risks exist today with on premise ICT infrastructure which also apply to cloud based ICT.

Consumers have reduced visibility and control of their assets and data.

On-demand self-service simplifies unauthorized use, malicious actors could instantiate resources without organisational consent.

Internet-Accessible Management application programming interfaces can be compromised allowing access to data.

Separation among multiple tenants (customers) on the same cloud system fails allowing data to leak between customers

Data deletion is incomplete so when data is deleted some may remain on the cloud systems

Risk Mitigation There are four important practices, and specific actions, that the DHB

would use to feel secure in the cloud.

Perform due diligence by understanding our networks and applications so as to provide functionality, resilience, and security for

cloud-deployed applications and systems.

Managing access by having the ability to identify and authenticate users, the ability to assign users access rights, and the ability to

create and enforce access control policies for resources.

Protect data involves three separate challenges: protecting data from unauthorized access,

ensuring continued access to critical data in the event of errors and failures, and

preventing the accidental disclosure of data that was

supposedly deleted.

Monitor and defend both by the cloud service provider for their

systems but also by the DHB for our systems on these platforms






New Zealand government requires agencies to accelerate their adoption of public cloud services — in a balanced way — so they can drive digital transformation. This includes:

enhancing customer experiences streamlining operations creating new delivery models.

The move to accelerate adoption was endorsed by Cabinet in 2016 and

this is expected to be re-endorsed in late 2019.

Overseas LegislationIn addition to the risks above, two pieces of legislation by overseas government may impact the DHB with regard to patient data privacy.

Australian Telecommunications and Other Legislation Amendment (Assistance and Access) Act (2018)US Clarifying Lawful Overseas Use of Data Act or CLOUD Act (H.R. 4943)

Both these acts give the respective governments the right to request access to data stored on cloud infrastructure (based in their country or owned by an organisation domiciled within that country)

However permission access to data must be authorised by the countries respective justice systems, additionally neither countries legislation can force cloud providers to give carte blanche access or to build backdoors into these systems.

Internal Affairs

AssuranceThe DIA has undertaken risk assessment and security certification audits on both

Microsoft Azure, O365 and Amazon Web Services (AWS) and has issue security certificates for their use

up to In-Confidence level, that government agencies can utilise as part of their own cloud procurement and Certification and

Assurance processes.

It’s also important to note that the DIA certificate covers use of Microsoft Azure anywhere in the world, not just Australia and the NZ Health

Information Security Framework states that New Zealanders’ medical information is to be classified at no-higher than “Medical – In Confidence”

level.

This means the DHBs can utilise the DIA issued certificates for its certification and auditing purposes. They can obtain these certificates directly from DIA.

The DIA is itself consuming Microsoft cloud services delivered from Australia, including for the purposes of storing and processing New Zealanders’

personal information.

VisionThe move to cloud is intended to

enhance the DHB’s strategic vision by providing technologies and service models that enable the vision

to be realised, in particular enabling a digitally-enabled care network that finds technological solutions to:

provide fast and easy access to information and resources to allow people to make informed health care choices

Support people to manage more of their health needs at home through access to professional advice and self-monitoring, using remote

diagnostics

provide an electronic health record that is secure and supports health care professionals and social service providers to share

accurate and reliable information while retaining appropriate confidentiality

deliver specialist health care that will be more responsive and enabling CHNs to co-ordinate

complex care simply and safely – resulting in improved

health outcomes

Using Cloud for ICT Services

RecommendationTo begin considering the use of cloud computing when procuring, upgrading or replacing clinical and corporate systems subject to right security and privacy assessments which will require Digital and Data Intelligence governance group signoff.


59

Cloud computingELT’s and Board’s information paper

Version: 1.0Date: 23 October 2019Status: DraftAuthor: Rupert Applin, Acting 3DHB ICT Planning ManagerEndorsed by: Tracy Voice, 3DHB ICT Chief Digital Officer


60

ELT’s and Board’s information paper

In Confidence Cloud computing - ELT’s and Board’s information paper Page 2 of 36

0.0 Contents

0.1 Table of Contents

0.0 Contents ................................................................................................................ 20.1 Table of Contents............................................................................................................. 20.2 Table of figures ................................................................................................................ 3

1.0 Recommendations.................................................................................................. 4

2.0 Summary................................................................................................................ 52.1 3DHB vision...................................................................................................................... 52.2 Risks ................................................................................................................................. 62.3 Risk mitigation ................................................................................................................. 82.4 Overseas legislation .........................................................................................................82.5 Use of cloud by the DHB.................................................................................................. 9

3.0 Introduction......................................................................................................... 113.1 What is cloud computing............................................................................................... 113.2 Why cloud computing?..................................................................................................11

4.0 3DHB cloud vision and benefits............................................................................. 124.1 Vision .............................................................................................................................124.2 Benefits to 3DHB of using cloud services ......................................................................124.3 General benefits of cloud services.................................................................................13

5.0 Types of cloud computing ..................................................................................... 145.1 Public cloud.................................................................................................................... 145.2 Private cloud..................................................................................................................145.3 Hybrid cloud...................................................................................................................14

6.0 Types of cloud services ......................................................................................... 156.1 Infrastructure as a service (IaaS) ...................................................................................156.2 Platform as a service (PaaS)...........................................................................................156.3 Serverless computing.....................................................................................................156.4 Software as a service (SaaS) ..........................................................................................15

7.0 Government Chief Digital Officer advice................................................................ 167.1 Cloud services ................................................................................................................167.2 Balancing risks and opportunities..................................................................................167.3 Why agencies must use cloud services.......................................................................... 17

8.0 Risks and threats .................................................................................................. 198.1 Introduction...................................................................................................................198.2 Cloud computing threats, risks, and vulnerabilities ......................................................198.3 Risk mitigation ...............................................................................................................238.4 Summary........................................................................................................................28

9.0 Overseas legislation affecting cloud usage............................................................. 30


61



9.1 Australian Telecommunications and Other Legislation Amendment (Assistance and Access) Act (2018)....................................................................................................................309.2 Clarifying Lawful Overseas Use of Data Act or CLOUD Act (H.R. 4943).........................349.3 Department of Internal Affairs / GCSB opinion .............................................................36

0.2 Table of figures

Figure 1 – Type of cloud services..............................................................................................15Figure 2 Sensitive Data in a Typical Cloud Web Application.....................................................26Figure 3 - CSP and consumer responsibilities for monitoring...................................................27


62



1.0 Recommendations

It is recommended that the Board:

Notes: That cloud computing can offer significant advantages to the DHB with regard to costs, more flexible working, and increased opportunities to improve how data is stored and used in order to improve patient care.

Notes: The Government Chief Digital Officer (GCDO) has indicated that New Zealand government agencies are required to use public cloud services in preference to traditional IT systems.

Notes: That there a risks involved with the use of cloud technologies, however these risks can be mitigated through due diligence, policies and practices.

Notes: That many of these risks exist today with traditional on premise infrastructure.

Notes: The legislation from overseas jurisdictions, in particular the US and Australia do allow these countries to access data stored on cloud data centres, however sufficient processes exist through the respective countries legal systems to allow the DHB to appeal this data access.

Notes: That the use of cloud solutions (Azure and Office365) from Microsoft have been risk assessed by the DIA and has issued security certificates for their use.

Notes: That 3DHB ICT wish to initiate a programme of work to start transitioning services from existing on premise systems to cloud based systems. As such business cases to further this work should be expected.

Recommends: that the DHB adopt the use of cloud technologies, provided that due diligence is applied when selecting and implementing solutions within cloud providers.


63



2.0 Summary







∑ enhancing customer experiences∑ streamlining operations∑ creating new delivery models.

The move to accelerate adoption was endorsed by Cabinet in 2016 and this is expected to be re-endorsed in late 2019.

2.1 3DHB vision





∑ deliver specialist health care that will be more responsive and enabling CHNs to co-ordinate complex care simply and safely – resulting in improved health outcomes.


64



2.2 Risks

Whilst these services offer significant advantages to the DHB, there are risks and legislative implications that must be addressed prior to the DHB adopting cloud services.

These risks are outlined in detailed below in section 7.0. In summary these risks are as follows, however it must be realised that many of these risks also apply to traditional in-house IT systems, as indicated by a *.

Consumers Have Reduced Visibility and Control. When transitioning assets/operations to the cloud, organizations lose some visibility and control over those assets/operations

On-Demand Self Service Simplifies Unauthorized Use. Cloud service providers (CSPs) make it very easy to provision new services, therefore malicious actors could instantiate resources without organisational consent.

Internet-Accessible Management APIs can be Compromised. CSPs expose a set of application programming interfaces (APIs) that customers use to manage and interact with cloud services (also known as the management plane), again as these are exposed to the internet they offer a potential vector for attack.

Separation Among Multiple Tenants Fails. Exploitation of system and software vulnerabilities within a cloud service provider's infrastructure, platforms, or applications that support multi-tenancy can lead to a failure to maintain separation among tenants. This failure can be used by an attacker to gain access from one organization's resource to another user's or organization's assets or data.

Data Deletion is Incomplete. Threats associated with data deletion exist because the consumer has reduced visibility into where their data is physically stored in the cloud and a reduced ability to verify the secure deletion of their data.

Credentials are Stolen*. If an attacker gains access to a user's cloud credentials, the attacker can have access to the cloud service provider's services to provision additional resources (if credentials allowed access to provisioning), as well as target the organization's assets.

Vendor Lock-In Complicates Moving to Other CSPs*. Vendor lock-in becomes an issue when an organization considers moving its assets/operations from one cloud service provider to another.

Increased Complexity Strains IT Staff.* Migrating to the cloud can introduce complexity into IT operations.

Insiders Abuse Authorized Access*. Insiders, such as staff and administrators for both organizations and CSPs, who abuse their authorized access to the organization's or cloud service provider's networks, systems, and data are uniquely positioned to cause damage or exfiltrate information.

Stored Data is Lost*. Data stored in the cloud can be lost for reasons other than malicious attacks.


65



CSP Supply Chain is Compromised*. If the cloud service provider outsources parts of its infrastructure, operations, or maintenance, these third parties may not satisfy/support the requirements that the cloud service provider is contracted to provide with an organization.

Insufficient Due Diligence Increases Cybersecurity Risk*. Organizations migrating to the cloud often perform insufficient due diligence. They move data to the cloud without understanding the full scope of doing so, the security measures used by the cloud service provider, and their own responsibility to provide security measures.


66



2.3 Risk mitigation

There are four important practices, and specific actions, that the DHB can use to feel secure in the cloud.

2.3.1 Perform due diligence

The DHB must fully understand their networks and applications to determine how to providefunctionality, resilience, and security for cloud-deployed applications and systems.

Due diligence must be performed across the lifecycle of applications and systems being deployed to the cloud, including planning, development and deployment, operations, and decommissioning.

2.3.2 Managing access

Access management generally requires three capabilities: the ability to identify and authenticate users, the ability to assign users access rights, and the ability to create and enforce access control policies for resources.

2.3.3 Protect data


2.3.4 Monitor and defend

The cloud service provider is responsible for monitoring the infrastructure and services provided to the DHB, but is not responsible for monitoring the systems and application the DHB create using the provided services.

The DHB should rely on the cloud service providers monitoring information as the first line of monitoring to detect unauthorized access to, or use of, systems and applications, as well as unexpected behaviour or usage of the systems and applications or their users.

The DHB must therefore learn how to use the new data to defend the DHB’s cloud-based resources.

2.3.5 Summary

It is important to remember that CSPs use a shared responsibility model for security. The cloud service provider accepts responsibility for some aspects of security. Other aspects of security are shared between the cloud service provider and the DHB.

2.4 Overseas legislation

In addition to the risks above, two pieces of legislation by overseas government may impact the DHB with regard to patient data privacy. This legislation is as follows:


67



2.4.1 Australian Telecommunications and Other Legislation Amendment (Assistance and

Access) Act (2018)

On December 6, 2018, Australia adopted a new law, the Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 (the “Act”)

This Act creates a pathway for industry to deliver assistance to law enforcement and intelligence agencies where necessary. It does not allow for mass surveillance, the creation of decryption capabilities, the implementation of so-called ‘backdoors’ or the issuing of ‘secret notices’ on employees of communications providers.

The Assistance and Access Act is focused on seeking help from corporate entities that are critical to the supply of communications services and devices in Australia. It does not discriminate between foreign and Australian companies conducting business offshore or place obligations on persons by virtue of their Australian citizenship.

2.4.2 US Clarifying Lawful Overseas Use of Data Act or CLOUD Act (H.R. 4943)

The Clarifying Lawful Overseas Use of Data Act was enacted in the United States in 2018. It enables federal law enforcement to force US-based electronic communications or remote computing service providers to disclose requested data in their possession, custody or control, whether or not that data is stored in the US or a foreign country.

2.5 Use of cloud by the DHB

There are risks associated with using cloud services, both from a platform perspective, but also from a jurisdictional perspective. However there are sufficient safe guards in place which means that use of these services can be used within the DHB safely.

These safe guards include the following actions:

Employee education: For most organizations, there is an easy explanation for the security threats: uneducated employees. By teaching employees proper defence practices, the DHB can minimize risk and prevent cloud security threats.

Secure a data backup plan: As the cloud continues to mature, the possibility of permanent data loss is high. The DHB needs to ensure that whatever happens, there is a secure backup of that data (this is more about securing the DHB business than the actual data, but this provides the same peace of mind).

Who has access to the data? The location of stored data is important — but nowhere near as important as who has access to it. Proper controls to ensure that data is only accessed by authorised people is critical.

Encryption is key: Cloud encryption is critical for protection. It allows for data and text to be transformed using encryption algorithms and is then placed on a storage cloud.

Take passwords seriously: Since files are zipped and encrypted with passwords, it’s important to have a robust and secure password policy. Most passwords — 90%, to be exact — can be cracked within seconds.


68



Testing: When putting measures in place to protect cloud systems and data the DHB must think like a criminal. One of the best ways to do this is penetration testing: an IT security practice designed to identify and address vulnerabilities as well as minimize cloud security threats.

2.5.1 DIA assurance

The DIA has undertaken risk assessment and security certification audits on both Microsoft Azure and O365, and has issue security certificates for their use up to In-Confidence level, that government agencies can utilise as part of their own cloud procurement and Certification and Assurance processes.

It’s also important to note that the DIA certificate covers use of Microsoft Azure anywhere in the world, not just Australia and the NZ Health Information Security Framework states that New Zealanders’ medical information is to be classified at no-higher than “Medical – In Confidence” level.

This means the DHBs can utilise the DIA issued certificates for its certification and auditingpurposes. They can obtain these certificates directly from DIA.

The DIA is itself consuming Microsoft cloud services delivered from Australia, including for the purposes of storing and processing New Zealanders’ personal information.


69



3.0 Introduction

3.1 What is cloud computing

Cloud computing is the delivery of computing services—including servers, storage, databases, networking, software, analytics, and intelligence—over the Internet (“the cloud”) these canoffer faster innovation, flexible resources, and economies of scale. Typically payment is only for the cloud services are used, this helps lower operating costs and allows infrastructure to be run more efficiently, and infrastructure can scale as business needs change.

3.2 Why cloud computing?

Cloud computing can eliminate or reduce the capital expense of buying hardware and software and setting up and running on-site datacentres—the racks of servers, the round-the-clock electricity for power and cooling, and the IT experts for managing the infrastructure.

Most cloud computing services are self service and on demand, so even vast amounts of computing resources can be provisioned in minutes, typically with just a few mouse clicks, giving businesses a lot of flexibility and taking the pressure off capacity planning

The benefits of cloud computing services include the ability to scale elastically. This means delivering the right amount of IT resources—for example, more or less computing power, storage, bandwidth—right when they’re needed, and from the right geographic location.

On-site data centres typically require a lot of “racking and stacking”—hardware setup, software patching, and other time-consuming IT management chores. Cloud computing removes the need for many of these tasks, so IT teams can spend time on achieving more important business goals.

The biggest cloud computing services run on a worldwide network of secure datacentres, which are regularly upgraded to the latest generation of fast and efficient computing hardware. This offers several benefits over a single corporate datacentre, including reduced network latency for applications and greater economies of scale.

Cloud computing makes data backup, disaster recovery, and business continuity easier and less expensive because data can be mirrored at multiple redundant sites on the cloud provider’s network.

Many cloud providers offer a broad set of policies, technologies, and controls that strengthen your security posture overall, helping protect your data, apps, and infrastructure from potential threats.


70



4.0 3DHB cloud vision and benefits

4.1 Vision





∑ deliver specialist health care that will be more responsive and enabling CHNs to co-ordinate complex care simply and safely – resulting in improved health outcomes.

Additionally the move to cloud is intended to improve operational efficiencies, reduce the dependence by the DHB’s on large capital investment and move towards an operationally funded model for ICT services.

In particular the DHB aims to:

∑ When procuring new clinical systems take advantage of cloud technologies, where at all possible, to increase resilience, reduce operational and capital expense.

∑ To take advantage of cloud technologies, including artificial intelligence, remote working and remote delivery of care.

∑ To improve access to clinical systems via mobile technologies in order to support better ways of working.

∑ To provide simpler methods to allow patients to access their clinical data, to provide information and data from their homes through patient portals, connected devices and using remote clinical monitoring.

∑ Initiate a process to migrate all DHB clinical systems from on premise to cloud where at all possible.

4.2 Benefits to 3DHB of using cloud services

There are a number of specific benefits to the 3DHB’s with the adoption of cloud services, these include:


71



∑ In the event of natural disasters using a hybrid cloud would allow access to patient systems from either internal DHB resources (work stations and terminals) but also allow users to access these systems via mobile devices over cellular data networks.

∑ With healthcare organizations moving towards community focussed care collaboration between different doctors, departments, and even institutions. Through a cloud computing server, medical providers can transfer data more effectively between each other boosting collaboration for better treatment.

∑ According to a recent Gartner report the healthcare predictions for 2019, artificial intelligence is moving into mainstream healthcare operations. As more and more cloud platforms integrate artificial intelligence and machine learning into their services, cloud computing can support this transition and help users manage massive amounts of data.

∑ Healthcare providers have to deal with electronic medical records, patient portals, mobile apps, and big data analytics. That's a lot of data to manage and analyse, and not all in-house equipment has the capacity to store it. Cloud computing allows healthcare institutions to store all that data while avoiding extra costs of maintaining physical servers.

∑ Much in the way big data is making it possible for doctors to treat their patients better, the cloud makes it possible via storing and sharing data to speed up the research process. With the ability to gather outside data from multiple fields, data analysts can use the cloud to pool this data and condense it into better results, allowing the medical professionals to get a clearer and more advanced image of the subjects they’re researching. These sort of advances are the kind that cure diseases and improve the kind of care being given.

4.3 General benefits of cloud services

General benefits to using public cloud services include:

∑ reducing costs — public cloud services have very large economies of scale∑ increasing workforce mobility — cloud services can be accessed anywhere there is an

internet connection∑ improving collaboration — people can work across teams, buildings and agency

networks more easily ∑ greater agility — new services can be established rapidly∑ improved security — public cloud services from global providers are typically more

secure than traditional IT systems∑ greater resilience — using public cloud services means agencies can better manage their

risks, reducing the impact of any single event.


72



5.0 Types of cloud computing

Not all clouds are the same and not one type of cloud computing is right for everyone. Several different models, types, and services have evolved to help offer the right solution for a particular organisation’s needs.

There are three different ways to deploy cloud services: public cloud, private cloud, or hybrid cloud.

5.1 Public cloud

Public clouds are owned and operated by a third-party cloud service providers, which deliver their computing resources, like servers and storage, over the Internet. Microsoft Azure is an example of a public cloud. With a public cloud, all hardware, software, and other supporting infrastructure is owned and managed by the cloud provider. You access these services and manage your account using a web browser.

5.1.1 DHB examples of public cloud

∑ Microsoft Intune mobile device management∑ Exchange online∑ Allied Health Activity Capture application hosting∑ Android and iOS cloud functionality – such as iCloud or public App Stores

5.2 Private cloud

A private cloud refers to cloud computing resources used exclusively by a single business or organization. A private cloud can be physically located on the company’s on-site datacentre. Some companies also pay third-party service providers to host their private cloud. A private cloud is one in which the services and infrastructure are maintained on a private network.

∑ DHB examples of private cloud∑ Regional Clinical Portal in Revera data centres∑ Regional Radiology Information System in Revera data centres∑ PACS Archive in Revera data centres

5.3 Hybrid cloud

Hybrid clouds combine public and private clouds, bound together by technology that allows data and applications to be shared between them. By allowing data and applications to move between private and public clouds, a hybrid cloud gives your business greater flexibility, more deployment options, and helps optimize your existing infrastructure, security, and compliance.

5.3.1 DHB examples of hybrid cloud

None at this time, however consideration for this will be made when implementing the following systems, as per the DHB capital plans:

∑ Replacement Concerto and WebPAS∑ Patient Observations and Nursing ∑ Electronic prescribing and administration


73



6.0 Types of cloud services

Most cloud computing services fall into four broad categories: infrastructure as a service (IaaS), platform as a service (PaaS), serverless, and software as a service (SaaS). These are sometimes called the cloud computing "stack" because they build on top of one another. Knowing what they are and how they’re different makes it easier to accomplish your business goals.

Hosted applications and apps

Development tools, database management, business analytics

Operating systems

Servers and storage

Networking firewalls and security

Data centre physical plant and buildings

Figure 1 – Type of cloud services

6.1 Infrastructure as a service (IaaS)

The most basic category of cloud computing services. With IaaS, you rent IT infrastructure—servers and virtual machines (VMs), storage, networks, operating systems—from a cloud provider on a pay-as-you-go basis.

6.2 Platform as a service (PaaS)

Platform as a service refers to cloud computing services that supply an on-demand environment for developing, testing, delivering, and managing software applications. PaaS is designed to make it easier for developers to quickly create web or mobile apps, without worrying about setting up or managing the underlying infrastructure of servers, storage, network, and databases needed for development.

6.3 Serverless computing

Overlapping with PaaS, serverless computing focuses on building app functionality without spending time continually managing the servers and infrastructure required to do so. The cloud provider handles the setup, capacity planning, and server management for you. Serverless architectures are highly scalable and event-driven, only using resources when a specific function or trigger occurs.

6.4 Software as a service (SaaS)

Software as a service is a method for delivering software applications over the Internet, on demand and typically on a subscription basis. With SaaS, cloud providers host and manage the software application and underlying infrastructure, and handle any maintenance, like software upgrades and security patching. Users connect to the application over the Internet, usually with a web browser on their phone, tablet, or PC.


74



7.0 Government Chief Digital Officer advice

The following is taken directly from digital.govt.nz with regard to guidance on use of cloudservices by the Government Chief Digital Officer (GCDO).

7.1 Cloud services

Agencies are required to use public cloud services in preference to traditional IT systems. They are required to adopt these services on a case by case basis, following risk assessments. Public cloud services are ICT services used by multiple organisations from different industries, including public and private sectors.




∑ enhancing customer experiences∑ streamlining operations∑ creating new delivery models.

The move to accelerate adoption was endorsed by Cabinet in 2016.

The Cloud First policy requires agencies to:

∑ adopt public cloud services in preference to traditional IT systems∑ make adoption decisions on a case-by-case basis following a risk assessment∑ only store data classified as RESTRICTED or below in a cloud service, whether it is hosted

onshore or offshore.

Note: Patient data is considered to be “IN CONFIDENCE” which is a lower classification than RESTRICTED.

7.2 Balancing risks and opportunities

The Government Chief Digital Officer (GCDO) supports agencies to balance the opportunities and the risks in using public cloud services. We:

∑ provide guidance to help agencies develop cloud plans∑ worked with security agencies to address key security, jurisdictional and social licence

concerns∑ are showcasing examples of early adopters using public cloud services to drive

transformation.∑ removed restrictions on the use of offshore productivity services and developed specific

security and risk assessment guidance for these services.

Support is also in place for agencies wanting to purchase and use public cloud services.


75

https://www.digital.govt.nz/standards-and-guidance/technology-and-architecture/cloud-services/



∑ There is a centre of excellence to network agency practitioners and encourage sharing and reuse of good practice.

∑ We have negotiated commercial agreements with cloud providers to enable agencies to access their services with a single price book and standard terms and conditions.

∑ A marketplace to give agencies access to a catalogue of public cloud services is in development.

7.3 Why agencies must use cloud services

The following is extracted from the ict.govt.nz website

Cabinet’s Cloud First policy requires agencies to adopt cloud services in preference to traditional IT systems because they are more cost effective, agile, are generally more secure, and provide greater choice. A briefing note on how agency executives can use public cloud services to drive digital transformation is available

7.3.1 Cabinet requires agencies to adopt cloud services

Cabinet requires agencies to:

∑ adopt cloud services in preference to traditional IT systems ∑ make adoption decisions on a case-by-case basis following a risk assessment ∑ only store data classified as RESTRICTED or below in a cloud service, whether it is

hosted onshore or offshore

7.3.2 Why cloud first?

The Cloud First policy enables agencies to better take advantage of emerging technologies to drive innovation and deliver greater value, as described in the Government ICT Strategy.

The key benefits of cloud services for the Government are:

∑ more cost-effective IT services∑ increased agility from quicker deployment times∑ greater choice∑ improved security.

Agencies have also highlighted other key drivers for adopting cloud services including resilience, and, in the October 2016 Agency Survey, mobility and collaboration.

7.3.3 Office productivity services

Recognising the increased maturity of agencies, and cloud service providers’ capabilities and understanding of government requirements, restrictions on the use of offshore-hosted office productivity services were removed in July 2016, provided agencies comply with the security requirements for using these services.

There is strong demand for adopting office productivity services, with over half of agency CIOs stating in [the DIA] October 2016 survey their agencies intend to use these services within the next 12 months. Almost all of these agencies intend to use Microsoft’s Office 365, Skype, Azure Active Directory and Azure Services.


76

https://snapshot.ict.govt.nz/resources/digital-ict-archive/static/localhost_8000/guidance-and-resources/using-cloud-services/why-agencies-must-use-cloud-services/index.html



To support adoption of the services agencies intend to use, [DIA] have produced:

Security requirements for OH Office Productivity - January 2017

In addition, those agencies intending to use Microsoft services can request the following guidance produced by DIA.

∑ Microsoft’s Office 365 service: risk assessment, service security certificate, and independent audit report.

∑ Microsoft’s Azure Active Directory service: risk assessment, service security certificate, and independent audit report.

∑ Microsoft’s Azure service (infrastructure only): risk assessment, service security certificate, and independent audit report.


77

https://snapshot.ict.govt.nz/resources/digital-ict-archive/static/localhost_8000/guidance-and-resources/using-cloud-services/design-for-and-implement-security-controls-for-cloud-services/index.html#Guidance



8.0 Risks and threats

8.1 Introduction

An organization that adopts cloud technologies and/or chooses cloud service providers (CSP)s and services or applications without becoming fully informed of the risks involved exposes itself to a myriad of commercial, financial, technical, legal, and compliance risks.

The following section identifies significant risks, threats, and vulnerabilities that organisations face when moving application or data to the cloud. Then below the section on best practices for cloud security, outlines a series of best practices aimed at helping organizations securely move data and applications to the cloud.

It is important to note that the threats and vulnerabilities involved in migrating to the cloud are ever-evolving, and the ones listed here are by no means exhaustive. It is important to consider other challenges and risks associated with cloud adoption specific to their missions, systems, and data.

Whilst these risks may exist, it is also important to know that similar or greater risks may apply to remaining with on premise infrastructure.

8.2 Cloud computing threats, risks, and vulnerabilities

Cloud environments experience--at a high level--the same threats as traditional data centre environments; the threat picture is the same. That is, cloud computing runs software, software has vulnerabilities, and adversaries try to exploit those vulnerabilities.

However, unlike information technology systems in a traditional data centre, in cloud computing, responsibility for mitigating the risks that result from these software vulnerabilities is shared between the cloud service provider and the cloud consumer.

As a result, consumers must understand the division of responsibilities and trust that the cloud service provider meets their responsibilities.

Based on literature searches and analysis efforts, the following list of cloud-unique and shared cloud/on premise vulnerabilities and threats have been identified.

8.2.1 Cloud-Unique Threats and Risks

The following vulnerabilities have been identified as risks specific to cloud computing. These vulnerabilities do not exist in classic IT data centres.

Consumers Have Reduced Visibility and Control.

When transitioning assets/operations to the cloud, organizations lose some visibility and control over those assets/operations. When using external cloud services, the responsibility for some of the policies and infrastructure moves to the cloud service provider.

The actual shift of responsibility depends on the cloud service model(s) used, leading to a paradigm shift for agencies in relation to security monitoring and logging. Organizations need to perform monitoring and analysis of information about applications, services, data, and


78



users, without using network-based monitoring and logging, which is available for on-premises IT.

On-Demand Self Service Simplifies Unauthorized Use

CSPs make it very easy to provision new services. The on-demand self-service provisioning features of the cloud enable an organization's personnel to provision additional services from the agency's cloud service provider without IT consent. The practice of using software in an organization that is not supported by the organization's IT department is commonly referred to as shadow IT.

Due to the lower costs and ease of implementing PaaS and SaaS products, the probability of unauthorized use of cloud services increases. However, services provisioned or used without IT's knowledge present risks to an organization. The use of unauthorized cloud services could result in an increase in malware infections or data exfiltration since the organization is unable to protect resources it does not know about. The use of unauthorized cloud services also decreases an organization's visibility and control of its network and data.

Internet-Accessible Management APIs can be compromised.

CSPs expose a set of application programming interfaces (APIs) that customers use to manage and interact with cloud services (also known as the management plane). Organizations use these APIs to provision, manage, orchestrate, and monitor their assets and users. These APIs can contain the same software vulnerabilities as an API for an operating system, library, etc. Unlike management APIs for on-premises computing, cloud service provider APIs are accessible via the Internet exposing them more broadly to potential exploitation.

Threat actors look for vulnerabilities in management APIs. If discovered, these vulnerabilities can be turned into successful attacks, and organization cloud assets can be compromised. From there, attackers can use organization assets to perpetrate further attacks against other cloud service provider customers.

Separation Among Multiple Tenants Fails.

Exploitation of system and software vulnerabilities within a cloud service provider's infrastructure, platforms, or applications that support multi-tenancy can lead to a failure to maintain separation among tenants. This failure can be used by an attacker to gain access from one organization's resource to another user's or organization's assets or data. Multi-tenancy increases the attack surface, leading to an increased chance of data leakage if the separation controls fail.

This attack can be accomplished by exploiting vulnerabilities in the cloud service provider's applications, hypervisor, or hardware, subverting logical isolation controls or attacks on the cloud service provider's management API. To date, there has not been a documented security failure of a cloud service provider's SaaS platform that resulted in an external attacker gaining access to tenants' data.

No reports of an attack based on logical separation failure were identified; however, proof-of-concept exploits have been demonstrated.


79



Data Deletion is Incomplete.

Threats associated with data deletion exist because the consumer has reduced visibility into where their data is physically stored in the cloud and a reduced ability to verify the secure deletion of their data. This risk is concerning because the data is spread over a number of different storage devices within the cloud service provider's infrastructure in a multi-tenancy environment. In addition, deletion procedures may differ from provider to provider. Organizations may not be able to verify that their data was securely deleted and that remnants of the data are not available to attackers. This threat increases as an agency uses more cloud service provider services.

8.2.2 Cloud and On-Premise Threats and Risks

The following are risks that apply to both cloud and on premise IT data centres that organizations need to address. Appropriate mitigations to the risks are included against each risk.

Credentials are Stolen.

If an attacker gains access to a user's cloud credentials, the attacker can have access to the CSP's services to provision additional resources (if credentials allowed access to provisioning), as well as target the organization's assets. The attacker could leverage cloud computing resources to target the organization's administrative users, other organizations using the same CSP, or the CSP's administrators. An attacker who gains access to a CSP administrator's cloud credentials may be able to use those credentials to access the agency's systems and data.

Administrator roles vary between a CSP and an organization. The CSP administrator has access to the CSP network, systems, and applications (depending on the service) of the CSP's infrastructure, whereas the consumer's administrators have access only to the organization's cloud implementations. In essence, the CSP administrator has administration rights over more than one customer and supports multiple services.

Vendor Lock-In Complicates Moving to Other CSPs.

Vendor lock-in becomes an issue when an organization considers moving its assets/operations from one CSP to another. The organization discovers the cost/effort/schedule time necessary for the move is much higher than initially considered due to factors such as non-standard data formats, non-standard APIs, and reliance on one CSP's proprietary tools and unique APIs.

This issue increases in service models where the CSP takes more responsibility. As an agency uses more features, services, or APIs, the exposure to a CSP's unique implementations increases. These unique implementations require changes when a capability is moved to a different CSP. If a selected CSP goes out of business, it becomes a major problem since data can be lost or cannot be transferred to another CSP in a timely manner.

Increased Complexity Strains IT Staff.

Migrating to the cloud can introduce complexity into IT operations. Managing, integrating, and operating in the cloud may require that the agency's existing IT staff learn a new model. IT staff must have the capacity and skill level to manage, integrate, and maintain the


80



migration of assets and data to the cloud in addition to their current responsibilities for on-premises IT.

Key management and encryption services become more complex in the cloud. The services, techniques, and tools available to log and monitor cloud services typically vary across CSPs, further increasing complexity. There may also be emergent threats/risks in hybrid cloud implementations due to technology, policies, and implementation methods, which add complexity. This added complexity leads to an increased potential for security gaps in an agency's cloud and on-premises implementations.

Insiders Abuse Authorized Access.

Insiders, such as staff and administrators for both organizations and CSPs, who abuse their authorized access to the organization's or CSP's networks, systems, and data are uniquely positioned to cause damage or exfiltrate information.

The impact is most likely worse when using IaaS due to an insider's ability to provision resources or perform nefarious activities that require forensics for detection. These forensic capabilities may not be available with cloud resources.

Stored Data is Lost.

Data stored in the cloud can be lost for reasons other than malicious attacks. Accidental deletion of data by the cloud service provider or a physical catastrophe, such as a fire or earthquake, can lead to the permanent loss of customer data. The burden of avoiding data loss does not fall solely on the provider's shoulders. If a customer encrypts its data before uploading it to the cloud but loses the encryption key, the data will be lost. In addition, inadequate understanding of a CSP's storage model may result in data loss. Agencies must consider data recovery and be prepared for the possibility of their CSP being acquired, changing service offerings, or going bankrupt.

This threat increases as an agency uses more CSP services. Recovering data on a CSP may be easier than recovering it at an agency because an SLA designates availability/uptime percentages. These percentages should be investigated when the agency selects a CSP.

CSP Supply Chain is Compromised.

If the CSP outsources parts of its infrastructure, operations, or maintenance, these third parties may not satisfy/support the requirements that the CSP is contracted to provide with an organization. An organization needs to evaluate how the CSP enforces compliance and check to see if the CSP flows its own requirements down to third parties. If the requirements are not being levied on the supply chain, then the threat to the agency increases.

This threat increases as an organization uses more CSP services and is dependent on individual CSPs and their supply chain policies.

Insufficient Due Diligence Increases Cybersecurity Risk.

Organizations migrating to the cloud often perform insufficient due diligence. They move data to the cloud without understanding the full scope of doing so, the security measures used by the CSP, and their own responsibility to provide security measures. They make decisions to use cloud services without fully understanding how those services must be secured.


81



8.3 Risk mitigation

The following section outlines best practices that the DHB should use to address the vulnerabilities and risks in moving applications and data to cloud services.

It is important to note that these best practices are not complete and should be complemented with practices provided by cloud service providers, general best cybersecurity practices, regulatory compliance requirements, and practices defined by cloud trade associations, such as the Cloud Security Alliance.

There are four important practices, and specific actions, that the DHB can use to feel secure in the cloud.

8.3.1 Perform due diligence

The DHB must fully understand their networks and applications to determine how to provide functionality, resilience, and security for cloud-deployed applications and systems.

Due diligence must be performed across the lifecycle of applications and systems being deployed to the cloud, including planning, development and deployment, operations, and decommissioning, as described below.

Planning

The first step in a successful cloud deployment is selecting an appropriate system or application to move to, build in, or buy from a cloud service provider. This is a challenging task for a first-time cloud deployment. Benefit from the experience of others and use a cloud adoption framework to enable efficient use of cloud services and consistent architectural designs.

A framework provides a governing process for identifying applications, selecting cloud providers, and managing the ongoing operational tasks associated with public cloud services. Cloud adoption frameworks may be cloud service provider specific (such as for Microsoft O365 or Azure) or cloud service provider agnostic.

Having used a cloud adoption framework to identify both a target system and/or application for cloud deployment and a cloud service provider, educate all staff involved in the deployment on the basics of the selected cloud service provider, architecture, services, and tools available to assist in the deployment. Make sure everyone understands the cloud service provider's shared responsibility model and its impact on their role in the cloud deployment.

Development and deployment

The system or application development and deployment team should be trained in the details of correctly using cloud service provider services to implement applications. cloud service providers provide guidance and documentation on best practices for using their services. If architects are developing a new application or system for the cloud, they should design and develop the system using the cloud service provider's guidance. If migrating an existing application or system, review its architecture and implementation relative to the cloud service provider's guidance--this may include talking to cloud service provider technical


82

https://cloudsecurityalliance.org/



support staff to determine what changes will be needed to deploy the application appropriately.

Cloud computing is based on delivery of abstracted services that often closely resemble existing hardware, networks, and applications. It is critical for effective security, however, that consumers realize these are only abstractions carefully constructed to resemble information technology resources organizations currently use. Review the organization's security policies and current security control implementation approaches.

Check the cloud service provider’s guidance before implementing the on-premises approach in the cloud. First, verify that the on-premises approach would be effective if implemented in the cloud. Then see if cloud service provider services provide a better implementation approach that still meets security policy goals.

Moving to a cloud environment may present risks that were not present in the on-premises deployment of applications and systems. Check for new risks and identify any new security controls needed to mitigate these risks. Again, consider how cloud service provider provided control implementations can help. Likewise, use cloud service provider provided tools to check for proper and secure usage of services.

Operation

Once developed and deployed, applications and systems must be operated securely. Unlike physical servers, disks, and networking devices, software defines the cloud virtual infrastructure. Consequently, the infrastructure can be treated as source code, which should be managed in a source code control system, with change control procedures enforced. Source code control systems have been proven effective in managing software development. These same practices can be adapted to manage cloud infrastructure. Changes to production resources should require independent approval prior to implementation by a system manager.

Decommissioning

There are a variety of reasons that it may be necessary to decommission a cloud-deployed application or system--possibly quickly. For example, the CSP could go out of business ordiscontinue key services used by the application. CSP prices could increase, making the current deployment too expensive. Whatever the reason, planning for decommissioning a cloud application or system should be done before deployment. Cloud services are currently unique to each CSP, so moving an application or system from one CSP to another is likely to be a major effort. Consider what would be involved in leaving a CSP. The most important part of any application or system to the organization is the data stored and processed within. It is therefore critical to understand how the data can be extracted from one CSP and moved to another.

Develop a multiple cloud service provider strategy

When making the initial cloud service provider selection, it should be considered how the selected application could be deployed to more than one CSP. Mappings among CSPs, readily available on the Web, can help identify how an application architected for one cloud service provider might be moved to another. While the application or system will be deployed to only one of these CSPs, it is important to track aspects of the deployment during


83



development that are unique to the chosen cloud service provider and which would need to be redesigned if moved.

8.3.2 Managing access

Access management generally requires three capabilities: the ability to identify and authenticate users, the ability to assign users access rights, and the ability to create and enforce access control policies for resources, as discussed below.

Identify and authenticate Users

Use multifactor authentication to reduce the risk of credential compromise. Stolen privileged user credentials allow an attacker to control and configure cloud consumer resources. Use of multiple factors requires an attacker to acquire multiple, independent authentication elements, reducing the likelihood of compromise.

Assign user access rights

Plan a collection of roles to fill both shared and consumer-specific responsibilities. CSPs and others, such as Gartner, provide advice on designing roles. These roles should ensure that no one person can adversely affect the entire virtual data centre.

Individual developers and system managers should not have uncontrolled access to resources. Limiting access can limit the impact of a credential compromise or a malicious insider. Developers should be constrained to assigned projects. System managers should be constrained to assigned resources. Role-based access control can be used to establish privileges for developers and system managers.

Create and enforce resource access policies

CSPs offer several different types of storage services, such as virtual disks, blob storage, and content delivery services. Each of these services may have unique access policies that must be assigned to protect the data they store. Cloud consumers must understand and configure these service-specific access policies.


84



8.3.3 Protect data


Protect data from unauthorized access

Encrypt data at rest to protect it from disclosure due to unauthorized access. CSPs typically provide encryption capabilities for the storage services they offer. Properly manage the associated encryption keys to ensure effective encryption. CSPs offer consumers a choice of CSP-managed or consumer-managed keys. CSP-managed keys are convenient, but provide the consumer no control over where or how the keys are stored. Consumer-managed keys place the burden of key management on the consumer but provide better control. CSPs offer hardware security modules (HSMs) in the cloud to assist in securely managing keys.

Ensure availability of critical data

CSPs provide significant guarantees against loss of persistent data. No system is perfect, however, and major cloud providers have accidently lost customer data. In addition to CSP errors, cloud consumer staff may also make mistakes that can result in data loss. The DHBmust ensure that CSP data backup and recovery processes meet the DHB’s needs. The DHBmay need to augment CSP processes with additional back-up and recovery actions. CSPs may provide services that the DHB can configure to perform additional backup and recovery operations.

Prevent disclosure of deleted data

CSPs often replicate data to ensure persistence. As shown in the figure above, during the course of system operation, sensitive data can find its way into logging and monitoring services, backups, content distribution services, and other places. When the DHB needs to delete sensitive data, or retire resources containing sensitive data, the DHB must consider the replication and spread of data resulting from normal system operation. Analyse the cloud

Figure 2 Sensitive Data in a Typical Cloud Web Application


85



deployment thoroughly to understand both where sensitive data may have been copied or cached and determine what should be done to ensure these copies will be deleted.

Data is ultimately stored on media, such as magnetic or solid state disks. These media devices fail regularly and must be replaced. Even though the device itself has failed, DHB data still resides in the device. The DHB should therefore understand how the CSP handles storage media removed from production.

8.3.4 Monitor and defend.

The figure below depicts the CSP and the DHB responsibilities for monitoring when some systems and applications are deployed to a CSP. Obviously, the cloud deployment adds complexity to monitoring, as discussed below.

Figure 3 - CSP and consumer responsibilities for monitoring

Monitor cloud-deployed resources

The CSP is responsible for monitoring the infrastructure and services provided to the DHB, but is not responsible for monitoring the systems and application the DHB create using the provided services. The CSP provides monitoring information to the DHB that is related to the DHB’s use of services. Rely on CSP-provided monitoring information as the DHB’s first line of monitoring to detect unauthorized access to, or use of, systems and applications, as well as unexpected behaviour or usage of the systems and applications or their users.

CSP-provided monitoring data is obviously different from the data collected in on-premises monitoring. The DHB must therefore learn how to use the new data to defend the DHB’scloud-based resources. Understand the meaning of the CSP-provided data, determine what is normal for the DHB cloud deployment, and use CSP-provided tools to detect anomalies.

To the extent possible, use CSP-provided monitoring data, but the DHB may want to augment it with additional monitoring of DHB cloud-based resources. Be aware that monitoring approaches used on premises may not work in the cloud. For example, virtual routers do not provide the equivalent of span ports that can see all network traffic, complicating monitoring that is flow-based. The DHB will need to design and implement any additional monitoring carefully to ensure it is fully integrated with cloud automation (e.g., auto scaling in infrastructure as a service (IaaS)) and can be scaled up or down without manual intervention.


86



Analyse both cloud and on-premises monitoring

With a hybrid cloud deployment that moves some resources to a CSP but retains many resources on premises, there is a need to combine CSP-provided monitoring information, consumer cloud-based monitoring information, and the DHB’s on-premises monitoring information to create a complete picture of the DHB’s cybersecurity posture. The figure above shows a cloud-based monitoring and analysis enclave in which all three monitoring data sources are combined. While this enclave could be placed within the cloud or on premises, there may be advantages to a cloud deployment.

First, CSPs typically charge for data transfers into and out of their services. To encourage continued and potentially growing use of their services, CSPs often charge more for transfers out of the cloud than they do for transfers into the cloud. Depending on the volume of data involved, it may therefore simply be cheaper to move data from on-premises monitoring into the cloud than it is to move cloud-based monitoring data to an on premises enclave. Second, storage for large volumes of data may be cheaper in the cloud, especially storage for archived data being preserved but not actively used. Third, the DHB can benefit from the inherent elasticity of the cloud, rapidly increasing analysis capacity when needed and decreasing capacity to save money when it is not needed.

Coordinate with the cloud service provider

The CSP is responsible for monitoring the infrastructure used to provide cloud services, including virtual machines, networks, and storage with IaaS, or entire applications with software as a service (SaaS). The figure above shows a dashed line between the CSP's security analyst (P) and the DHB’s security analyst (C). The CSP may detect events that could adversely affect the DHB’s applications. If so, the CSP will need to inform the DHB and coordinate a response. Similarly, the DHB may detect adverse events and need assistance investigating them.

As with all aspects of cloud computing, responding to security events is a shared responsibility. The DHB needs to learn how to collaborate with the CSP to investigate and respond to potential security incidents. To collaborate effectively, the DHB needs to understand what information the CSP can share, how the information will be shared, and the limits within which the CSP can provide assistance. The CSP cannot share information about another customer or provide assistance that would affect another consumer's use of services. The DHB’s standard operating procedures (SOPs) should be updated to reflect collaboration with the CSP.

8.4 Summary

It is important to remember that CSPs use a shared responsibility model for security. The cloud service provider accepts responsibility for some aspects of security. Other aspects of security are shared between the cloud service provider and the DHB.

Some aspects of security remain the sole responsibility of the consumer. Effective cloud security depends on knowing and meeting all the DHB’s responsibilities. Failure to understand or meet their responsibilities is a leading cause of security incidents in cloud-based systems.

A common theme across these cloud security practices is the need for cloud consumers to develop a deep understanding of the services they are buying and to use the security tools


87



provided by the CSP. Recent cloud security incidents reported in the press, such as unsecured AWS storage services or the Deloitte email compromise, would most likely have been avoided if the cloud consumers had used security tools, such as correctly configured access control, encryption of data at rest, and multi-factor authentication offered by the CSPs.

For organisations new to cloud computing, use of well-established, mature CSPs helps reduce risk associated with transitioning applications and data to the cloud.


88



9.0 Overseas legislation affecting cloud usage

Recent legislation has been passed in a number a countries which may impact the DHB with regard to data sovereignty and privacy.

The following pieces of legislation in particular have direct impact on the DHB if a move to cloud for computing services is pursued.

9.1 Australian Telecommunications and Other Legislation Amendment (Assistance and

Access) Act (2018)

On December 6, 2018, Australia adopted a new law, the Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 (the “Act”)

This Act creates a pathway for industry to deliver assistance to law enforcement and intelligence agencies where necessary. It does not allow for mass surveillance, the creation of decryption capabilities, the implementation of so-called ‘backdoors’ or the issuing of ‘secret notices’ on employees of communications providers.

The Assistance and Access Act is focused on seeking help from corporate entities that are critical to the supply of communications services and devices in Australia. It does not discriminate between foreign and Australian companies conducting business offshore or place obligations on persons by virtue of their Australian citizenship.

The following details statements from the Department of Home Affairs with regard to concerns with regard to this legislation. See the following link: https://www.homeaffairs.gov.au/about-us/our-portfolios/national-security/lawful-access-telecommunications/myths-assistance-access-act

The Assistance and Access Act creates a pathway for industry to deliver assistance to law enforcement and intelligence agencies where necessary. It does not allow for mass surveillance, the creation of decryption capabilities, the implementation of so-called ‘backdoors’ or the issuing of ‘secret notices’ on employees of communications providers. The Assistance and Access Act is focused on seeking help from corporate entities that are critical to the supply of communications services and devices in Australia. It does not discriminate between foreign and Australian companies conducting business offshore or place obligations on persons by virtue of their Australian citizenship.

Some common [misconceptions] about the Assistance and Access Act are identified and corrected below.

This law will create backdoors and undermine information security

The Assistance and Access Act contains an express prohibition against building or implementing any weakness or vulnerability in software or physical devices that would jeopardise the security of innocent users. This is found in section 317ZG of the Act which also makes clear that any assistance that makes a system's encryption or authentication less effective for general users is strictly prohibited. This same section prohibits the construction of new decryption capabilities and rules out any requirements that would prevent a company from patching existing security flaws in their systems.


89

https://www.homeaffairs.gov.au/about-us/our-portfolios/national-security/lawful-access-telecommunications/myths-assistance-access-act

https://www.homeaffairs.gov.au/about-us/our-portfolios/national-security/lawful-access-telecommunications/myths-assistance-access-act



All proposed requirements to build a new capability can be referred to an independent assessment panel consisting of a technical expert and a retired judge. This panel must consider whether the proposed requirements contravene the explicit prohibition against 'backdoors'.

In fact, the Act has no ability to compel a company to build any type of capability that removes a form of electronic protection, like encryption. That is, if the company is not already capable of decrypting something, nothing in the Act can require them to build a capability to do it.

This law does not have adequate oversightAll requests and requirements on industry are subject to extensive independent oversight by either the Inspector-General of Intelligence and Security, the Commonwealth Ombudsman or State and Territory oversight bodies. The relevant Commonwealth body is notified whenever a notice for assistance is issued, varied, extended or revoked. When an agency issues a notice, they must notify the company of their right to complain to the relevant body. Both the Commonwealth Ombudsman and the Inspector-General of Intelligence and Security have the authority to inspect agency use of these powers by relevant agencies at any time. These bodies may make reports to Parliament on the outcome of their inspections.

Compulsory powers carry additional oversight measures to ensure they are used appropriately. For example, where a State or Territory law enforcement agency issues a notice to compel technical assistance, it must first be reviewed by the Australian Federal Police Commissioner.

Strict oversight also applies before a company can be compelled to build a new capability. Technical capability notices may only be issued by the Attorney-General. The Attorney-General’s decision must also be reviewed and approved by the Minister for Communications. This creates a double-lock approval process to ensure the assistance sought has been thoroughly scrutinised and is reasonable, proportionate, practicable and technically feasible.

A company may also refer any requirement to build a capability to an independent assessment panel consisting of a retired senior judge and a technical expert. This panel must consider whether proposed requirements will inadvertently create a backdoor. Further, any decision to compel assistance may be challenged through judicial review proceedings.

Public transparency is insufficientGiven the sensitive work done by law enforcement, security and intelligence agencies and the need to protect commercially sensitive information, it will not always be possible to disclose sensitive details of how assistance has been provided. This principle is consistent with the current protections given to operational intelligence held by Australia’s law enforcement and intelligence community.

Visibility over the use of the industry assistance powers is possible through mandated annual reporting requirements which require law enforcement agencies to record the number of times each power is used within a 12-month period and also disclose the type of offences the powers were used to investigate. This data will be included in the annual report required to be prepared under subsection 186(2) of the Telecommunications (Interception and Access) Act 1979 alongside data concerning the use of related warrants and authorisations.


90



Companies and their specified personnel are also authorised to make statistical disclosures to reveal the number of requests and notices received over the course of a six-month period and reveal whether that assistance was voluntary or compulsory. Additionally, where a company provides assistance they may seek authorisation from the issuing agency to disclose information about this assistance. This process will ensure operational details are protected, while giving companies the possibility to inform interested parties about the help they are giving to authorities. Provision for these disclosures appears in subsections 317ZF(13) and 317ZF(14) – (17).

Police will use this law to prosecute minor offencesThe industry assistance powers are only available to agencies in limited circumstances. There is an express requirement that the industry assistance powers can only be used by police to enforce the criminal law for serious offences, being offences that involve a penalty of at least three years imprisonment.

To access communications content and data an underlying warrant or authorisation is still required. For example, the legislation does not replace the need for police to seek a warrant from an independent authority to intercept communications. Generally these warrants are available for offences punishable by a maximum of seven years imprisonment or more.

The availability of these powers may expand due to scope creepThe list of agencies with access to industry assistance powers can only be expanded through legislative amendment, which would include further parliamentary scrutiny. Only Australia’s core law enforcement, security and intelligence agencies are able to utilise the industry assistance powers.

The Five Eyes alliance may take advantage of this lawThe Assistance and Access Act is an Australian solution to an Australian problem – it was not requested by, or designed for, Australia’s Five Eyes partner countries. While the Five Eyes share intelligence for security purposes, foreign assistance in connection with information obtained under this legislation will be undertaken consistent within the established mutual legal assistance process or through existing, and bounded, channels of cooperation. Foreign partnerships are critical to the detection and disruption of transnational crime and attacks that are coordinated through several countries.

The industry assistance powers for intelligence gathering are limited to collecting intelligence connected with Australia. This is because the Act requires a geographical nexus between the activities of a company and Australia. Further, access to content or non-content data through industry assistance powers requires a valid warrant or authorisation.

Capabilities built by the Government will leakBoth industry and law enforcement and security agencies have robust procedures in place to protect sensitive information and have made significant investments in the development of strong cyber security protocols that will be used to secure information relating to any form of assistance. Additionally, Australia’s law enforcement and security agencies are experienced in managing operational sensitivities and will take steps to minimise risks or exposure of information.

This law will lead to mass surveillanceThe Assistance and Access Act does not authorise mass surveillance. The Act expressly prohibits the Government from requiring a company to build an interception capability or a


91



data retention capability. Any requirements must be reasonable, proportionate, practicable and technically feasible and are subject to independent oversight and judicial review.

If conducted, digital surveillance must be consistent with existing legal regimes, like the warrant process for intercepting telecommunications in the Telecommunications (Interception and Access) Act 1979.

The powers available under these laws are inherently targeted.This law can compel employees to work in secret without the knowledge of their organisationMedia reporting that has proposed this scenario is incorrect and misleading. The industry assistance framework is concerned with getting help from companies not people acting in their capacity as an employee of a company. Requests for assistance will be served on the corporate entity itself in line with the deeming service provisions in section 317ZL. A notice may be served on an individual if that individual is a sole-trader and their own corporate entity.

A company issued a notice can disclose information about it under paragraph 317ZF(3)(a) in connection with the administration or execution of that notice. This allows an employer to disclose information to their employee and vice versa in the normal course of their duty.

Additionally, a company may disclose statistical information about the fact that they have received a notice consistent with subsection 317ZF(13). Further, companies and their specified personnel may disclose notice information for the purposes of legal proceedings, in accordance with any requirements of law or for the purpose of obtaining legal advice. The notices themselves are therefore not ‘secret’ but information about their substance is controlled to protect sensitive operational and commercial information.

This law can compel employees to work in secret without the knowledge of their organisationMedia reporting that has proposed this scenario is incorrect and misleading. The industry assistance framework is concerned with getting help from companies not people acting in their capacity as an employee of a company. Requests for assistance will be served on the corporate entity itself in line with the deeming service provisions in section 317ZL. A notice may be served on an individual if that individual is a sole-trader and their own corporate entity.

A company issued a notice can disclose information about it under paragraph 317ZF(3)(a) in connection with the administration or execution of that notice. This allows an employer to disclose information to their employee and vice versa in the normal course of their duty.

Additionally, a company may disclose statistical information about the fact that they have received a notice consistent with subsection 317ZF(13). Further, companies and their specified personnel may disclose notice information for the purposes of legal proceedings, in accordance with any requirements of law or for the purpose of obtaining legal advice. The notices themselves are therefore not ‘secret’ but information about their substance is controlled to protect sensitive operational and commercial information.

9.1.1 Relevance to the DHB

As the majority of data that the DHB would look to store on cloud computing infrastructure would reside in Australia the above legislation could impact the DHB.


92



Note: It’s important to note though that the large scale cloud infrastructure providers are multinational organisations and have data centres in multiple countries. Data cannot be assumed to be always in a particular country.

The following news articles outlines concerns raised in the media with regard to this legislation, however advice from the DIA has indicated that these services are acceptable to use. See section 7.0 above.

https://www.newsroom.co.nz/2018/12/17/363412/australias-new-encryption-law-threatens-nz-cloud-data

https://www.interest.co.nz/business/98677/change-australian-law-will-have-substantial-practical-impact-new-zealand-government

9.2 Clarifying Lawful Overseas Use of Data Act or CLOUD Act (H.R. 4943)

The Clarifying Lawful Overseas Use of Data Act was enacted in the United States in 2018. It enables federal law enforcement to force US-based electronic communications or remote computing service providers to disclose requested data in their possession, custody or control, whether or not that data is stored in the US or a foreign country. This is a game-changer for global data sovereignty.

The legislation was a response to the case of Microsoft v United States1 where it was ruled that the FBI, undertaking a drug trafficking investigation, could not compel the US-based Microsoft Corporation to turn over data stored in Ireland. The only way for US law enforcement to access overseas data had been to form a Mutual Legal-Assistance Treaty with the country where the data is stored.

Whilst the 2018 Act was passed in the US, it could have serious implications for organisations and individuals in New Zealand.

Even if the data is stored within New Zealand that data could be accessed and disclosed if stored through a US-based service provider such as Microsoft or Amazon.

US law enforcement can compel, through a warrant or similar process, access to data that is within the provider's "possession, custody, or control" and regardless of whether such data is "within or outside of the United States.”

A provider can apply to modify or quash the warrant if it reasonably believes that:

∑ The subject of the request is a non-US person who resides outside the US∑ Complying would create a material risk that the provider would violate the laws of a

"qualifying foreign government". A qualifying foreign government is a government that has entered into an executive agreement with the US government (more below).

∑ If a provider makes an application to modify or refuse a request for data, the court will conduct a conflict of laws analysis to determine whether the provider should be required to provide the data. The CLOUD Act also preserves common law comity claims

1 United States v. Microsoft Corporation, 253 F.3d 34 (D.C. Cir. 2001)


93







(a conflict of laws doctrine) as an option for countries that have not entered into an executive agreement, although that option remains untested.

The CLOUD Act also enables law enforcement agencies from other countries to request data stored by US providers if the request:

∑ Does not target US persons or persons located in the US∑ Comes from a country that has an executive agreement with the US.

No executive agreements exist yet. Over time executive agreements will be entered into between the US government and governments of other countries to enable cross-border access to data.

Each agreement must be presented to Congress with certification from the US Attorney-General that the relevant government satisfies the standards set out in the CLOUD Act.

These standards include "robust substantive and procedural protections for privacy and civil liberties". The CLOUD Act provides further detail regarding what these procedures must include, such as orders for the production of information must be subject to the review of a court or other independent authority in the relevant country.

Several large cloud providers supported the CLOUD Act, including Apple, Google, Facebook and Microsoft. These providers signed a joint letter to Congress that stated "if enacted, theCLOUD Act would be notable progress to protect consumers’ rights and would reduce conflicts of law."

However, the CLOUD Act provides US law enforcement potentially broad access to data stored in the US and abroad. Foreign law enforcement agencies now also have a potentially easier way to request information directly from providers under an executive agreement, rather than using other government-to-government channels. These rights have been criticised by privacy advocates as an unnecessary expansion of investigative powers.

9.2.1 Relevance to New Zealand

As noted above, US-based cloud service providers can resist US law enforcement access to New Zealand residents' data on the basis that it is information about a non-US person who resides outside the US. However, to challenge access on that basis (without relying on common law comity grounds):

∑ There must be an executive agreement between the US and New Zealand or the country in which the data is stored. We understand that the first executive agreement is likely to be between the US and UK but have no information about when this may come into force or any possible agreement with New Zealand

∑ The provider to which the request is made must file potentially costly court proceedings to modify or quash the request

∑ The court must find a conflict of laws and that the "interests of justice dictate" that the order granting access to the information should be modified or quashed.

∑ New Zealand organisations and individuals will therefore rely heavily on service providers to resist requests for their data.


94



Until executive agreements are in place it appears there are only limited, and untested, common law comity grounds available to resist orders for access to information. Given this, it seems likely that, if presented with a valid warrant covering New Zealanders' information, a US-based cloud provider would give access to that information. New Zealand organisations and individuals entering into contracts with such providers may want to consider seeking contractual obligations on providers to file proceedings resisting access to data where possible.

9.3 Department of Internal Affairs / GCSB opinion

MoH has been watching this closely as it could pose a risk for organisations inclusive of PHOs and DHBs.

The Government Chief Digital Office (GCDO) and the National Cyber Policy Office (NCPO) have indicated the ‘Cloud First’ policy still stands. Therefore the use of off-shore services by health sector agencies should remain on the basis formal risk assessments are undertaken and signed-off by health provider’s senior management prior to using the service.


95

public board meeting...1.8.1 communications memo 31 1.8.2 health matters wairarapa newsletter...

Documents