• Home /
• Privacy Act & codes /
• Codes of practice /
• Health Information Privacy Code

Privacy Act & codes

This code sets specific rules for agencies in the health sector to better ensure the protection of individual privacy. The code addresses the health information collected, used, held and disclosed by health agencies. For the health sector the code takes the place of the information privacy principles.

Health Information Privacy Code 1994 and commentary (2008 edition)

A revised edition 2008 of the Health Information Privacy Code 1994, incorporating amendments and including revised commentary is available. This edition includes updated commentary, aimed at helping those who work in the health sector understand the code.

The HIPC applies to the health information relating to identifiable individuals and applies to the following agencies:

• all agencies providing personal or public health or disability services such as primary health organisations, district health boards, rest homes, supported accommodation, doctors, nurses, dentists, pharmacists and optometrists; and
• some agencies that do not provide health services to individuals but which are part of the health sector such as ACC, the Ministry of Health, the Health Research Council, health insurers and professional disciplinary bodies.

Order a copy of the HIPC and commentary.

Health Information Privacy Code 1994 Amendment No. 1 (Temporary) - this amendment came into force on 9 February 1994 and expired on 30 June 1994.

Health Information Privacy Code 1994 Amendment No. 2 - this amendment came into force on 30 July 1995.

Health Information Privacy Code 1994 Amendment No. 3 - this amendment came into force on 30 September 1998.

Health Information Privacy Code 1994 Amendment No. 4 - this amendment came into force on 10 April 2000.

Health Information Privacy Code 1994 Amendment No. 5 - this amendment came into force on 30 July 2000.

Health Information Privacy Code 1994 Amendment No. 6 - this amendment came into force on 1 November 2007.
Explanatory note to Amendment No. 6

Health Information Privacy Code 1994 Amendment No. 7 [PDF, 91 KB] - this amendment came into force on 30 April 2013.

This amendment makes four changes to the Health Information Privacy Code 1994.   The amendment:

1. Created a regulatory regime for information derived from Newborn Metabolic Screening Programme blood spot samples;
2. Allowed Medic Alert to use the National Health Index (NHI) number as a unique identifier;
3. Allowed health agencies to identify health practitioners by their Common Practitioner Number; and
4. Changed the definition of ‘serious threat' to harmonise it with sections 4 and 5 of the Privacy Amendment Bill 2013.

For reference, the definition of serious threat in the Privacy Amendment Bill 2013 reads:

serious threat, for the purposes of principle 10(d) or 11(f), means a threat that an agency reasonably believes to be a serious threat having regard to all of the following:

(a) the likelihood of the threat being realised; and

(b) the severity of the consequences if the threat is realised; and

(c) the time at which the threat may be realised.

Health Information Privacy Code 1994 Amendment No. 7 general information [DOC, 161 KB] and media release.

Additional Health resources