National MP Hamish Walker has owned up to leaking Covid-19 patient details to the media.
He said in a statement this evening that the details were "given to me by a source".
A short time after Mr Walker's statement, former National Party president Michelle Boag admitted being the original source who passed the information on to the National MP.
Ms Boag said in a statement the information was "made available to me in my position as then Acting CEO of the Auckland Rescue Helicopter Trust, although it was sent to my private email address".
Mr Walker, the MP for Clutha-Southland says he did it to, "expose the Government’s shortcomings so they would be rectified".
"It was never intended that the personal details would be made public, and they have not been, either by me or the persons I forwarded them to."
Mr Walker says he has received legal advice that he has not committed any criminal offence.
National leader Todd Muller says Mr Walker made an "error of judgement".
"I have asked Hamish to acknowledge this to Michael Heron QC and cooperate fully with his inquiry into how the information made it into the public domain," Mr Muller said in a statement.
"I have expressed to Hamish my view that forwarding on this information was an error of judgement.
"While I wait for the result of the inquiry I have transferred his Forestry, Land Information and Associate Tourism portfolio responsibilities to Ian McKelvie."
Ms Boag released a statement outlining her part in the leak: "This was a massive error of judgement on my part and I apologise to my colleagues at ARHT whom I have let down badly.
"I very much regret my actions and did not anticipate that Hamish would choose to send it on to some media outlets but I am grateful that the media involved have chosen not to publish the 18 names that were contained within it.
"I take full responsibility for my actions and have resigned as Acting CEO of ARHT, which is in very good hands as the result of a recent restructure and the appointment of a new CEO for the Trust’s operations and the appointment of a General Manager to oversee the Trusts’s marketing and fundraising operations."
It comes as three media outlets reported last week they had been sent the personal and quarantine details of 18 of New Zealand's active cases.
A Government inquiry into the leak was underway before Mr Walker's admission this evening.
Mr Walker went on to say the following in his statement: "The information that I received was not password protected by the Government.
"It was not stored on a secure system where authorised people needed to log on. There was no redaction to protect patient details, and no confidentiality statement on the document.
"By exposing a significant privacy issue I hope the Government will improve its protocols and get its safeguards right.
"I made serious allegations against the Government’s Covid-19 response and passed on this information to prove those allegations.
"Private health information does not have basic safeguards in place and the Government needs to immediately change its protocols and store the information on a secure, safe network that at a minimum requires a password.
"I sincerely apologise for how I have handled this information and to the individuals impacted by this. I will be fully cooperating with the Michael Heron QC inquiry."
A police spokesperson told 1 NEWS they have noted media reporting around the matter.
"If a complaint is received it will be assessed to determine the necessary action, if any, police will take," the spokesperson said.
"We will not be making any further comment at this stage."
State Services Commissioner Peter Hughes responded to the admission in a statement that said the inquiry is ongoing.
"We need to establish all of the facts here. I will be making no further comment until the investigation is completed," he said.