Our website uses cookies to give you the best experience and for us to analyse our site usage. If you continue to use our site, we will take it you are OK about this. Click on More for information about the cookies on our site and what you can do to opt out.

We respect your Do Not Track preference.

The Right to Know – Made Easy 

Mrs Smith was outraged. She’d visited her GP for a follow-up check after her hand surgery, and he’d asked her about her history of depression.  She didn’t think she’d had anything of the sort, and decided to ask the receptionist for a copy of all her medical notes to see what else was in there. The young receptionist assured her that the doctor owned the notes so she couldn’t have them. 

“But they are about me and I have never seen them!” Mrs Smith protested. 

The receptionist paused for a moment.  “Well,” she said, “put your request in writing and your doctor might let you see some of the notes.  Our administrative charge for dealing with your request is $50.  Now, shall we make an appointment to see your doctor about this?”  Mrs Smith looked at her writing hand, which was still feeling tender, and decided to call the Privacy Commissioner.

The above (fabricated) scenario is an example of the sort of enquiries I receive.  Just in March this year we had 145 enquiries from individuals and agencies for guidance about access requests.  Medical centres in particular are often keen to understand their obligations around access requests.

Access to personal information

Individuals have a fundamental right to ask for access to any health information held about them.  This right also extends to a “representative”: a parent or guardian of a child under the age of 16 years, an executor or administrator of a deceased individual’s estate or the person who has an activated enduring power of attorney for the individual concerned or someone acting in the individual’s best interests. 

We encourage individuals to put their request in writing – this way there is a record of the request and the health agency knows exactly what information is required — but there is no prescribed way to make an access request.  Many health agencies have their own forms to make sure all the necessary details are collected.  However, since Mrs Smith has an injured hand, she could make an verbal access request and the health agency should give her any assistance she needs to do that. Mrs Smith definitely doesn’t need to pay for an appointment with the doctor to make her request.

From the day after the health agency receives an access request, it has 20 working days to decide if it will release the information.  Once it’s decided to release the information, it should do so without undue delay, and if it wants to withhold anything, it should specify the withholding grounds set out in the Privacy Act it is relying upon to do so.

What about information ownership?

Who owns the information is irrelevant. A health agency can’t refuse an access request because it owns the information. Nor can it refuse an access request because the requester owes a debt.

Information should be made available to individuals in the way they prefer.  If Mrs Smith has asked for a copy of her health information that’s what she should get unless it would impair the efficient administration of the health agency. 


Because this is the first time that Mrs Smith has asked for her notes it’s not permissible to charge. However, if copying her medical file requires copying an x-ray, video recording, MRI, PET or CAT scan photograph, the medical centre can levy a reasonable charge. 

Verifying identity

But a word of caution: before handing over the information to the requester, the health agency must be satisfied concerning the identity of the requester. Don’t hand sensitive health information over to the wrong person.

Sometimes requesters confuse making an access request for their information with wanting their physical file instead.  What matters is the information itself – ownership of the health information is irrelevant. That said, a health provider can release the physical copy of the information to the individual the information relates to even though they don’t have to.  Sometimes a doctor will hand over her notes to the patient, say, when the patient is moving permanently overseas or to a different region in New Zealand. This means the patient has possession of their health information and can immediately give their medical file to their new health provider. 

It can be difficult remembering all the procedural aspects, both for the busy health agency and the mystified requester.  The Privacy Commissioner recognises this and is determined to make privacy easy. 

New tool: About Me

To this end, we have developed an online tool to help called: “About Me”. This online tool allows the requester to securely make an access request online.  The request is then electronically transferred to the intended health agency. We never see what is being requested, we just provide the mechanism.  Once the health agency receives the access request, we will guide the health agency to information on how to respond to the request. 

Privacy Week – held on 9-14 May 2016 – is putting the spotlight on an individual’s right to know what information is held about them. As part of Privacy Week we are marking New Zealand’s “Right to Know Day”. For more information on Privacy Week, please visit our website: www.privacy.org.nz

Returning to Mrs Smith, she made a verbal request to the medical centre, which was noted down by the privacy officer (every agency should have one). Mrs Smith received the information promptly and immediately saw the inaccuracy. Her doctor agreed with her and made an appropriate correction in her medical file. Furthermore, Mrs Smith is thrilled that she has full use of her hand again, her trust in her doctor is restored, and she is back playing tennis and tending her roses!