Our website uses cookies so we can analyse our site usage and give you the best experience. Click "Accept" if you’re happy with this, or click "More" for information about cookies on our site, how to opt out, and how to disable cookies altogether.
We respect your Do Not Track preference.
Download a PDF of this factsheet here.
The code regulates how health agencies (such as doctors, nurses, pharmacists, health insurers, hospitals, Primary Health Organisations, ACC and the Ministry of Health) collect, hold, use and disclose health information about identifiable individuals.
Health agencies are often asked to disclose health information. The Code always allows anonymised or statistical information to be disclosed, but closely regulates who may obtain information about identifiable individuals.
For instance, different rules apply to requests that come from:
It is very rare that information must be provided immediately in response to a request. Unless responding to a court order or production order that requires immediate access, the agency can take enough time to make a considered decision.
To help with this, all health agencies must have privacy officers, who should be the first port of call for difficult queries. The Office of the Privacy Commissioner can also provide general advice – contact our enquiries line (number at the end of this fact sheet).
People have the right to access information about themselves under rule 6 of the Code. This right has only a few restrictions – for instance, if disclosure would prejudice the requester’s physical or mental health or would be an unwarranted disclosure of someone else’s affairs. The other grounds for refusal are listed in sections 49-53 of the Privacy Act. There is explanatory material available on the Privacy Commissioner’s website at www.privacy.org.nz/.
Rule 6 requests must be dealt with promptly. Agencies should either:
There are strict limitations on how much (if anything) can be charged for responding to a rule 6 request. Public sector agencies like public hospitals cannot charge at all, while private sector agencies such as GPs may only charge where they have provided the same information within the last 12 months, or where the information is an X-ray, video recording or an MRI/CAT/PET scan photograph.
Requests from parents or relatives of the individual
Parents or guardians of a child under 16 are their child’s “representatives”. Under section 22F of the Health Act, as representatives, they have a limited right to access health information about their child.
A representative request is equivalent to a rule 6 request and should be responded to just as promptly. The request may be refused if one of the withholding grounds (as described in Requests from the individual) applies, or if the request would be against the child’s wishes or interests.
Once a child turns 16 their parents or guardians have no special right to access their health information. However, rule 11(2)(b) of the Code allows health practitioners to disclose health information to a principal caregiver or near relative. The disclosure must be in accordance with recognised professional practice, and there must be some reason why it is not desirable or practical to get the individual’s permission for the disclosure (for instance they are unconscious or very unwell), and the disclosure must not be contrary an express request of the individual or their representative.
Multiple practitioners can need to access health information about an individual in the course of providing care to them. This might be because of a specialist or hospital referral, a transfer between GPs or even a medical emergency.
If the original purpose for collection was to share the information like this (noting that the individual should have been told about that purpose at the point of collection, as required by rule 3) then there are no barriers to the disclosure. Disclosure is also always allowed where the individual or their representative has given their permission.
Otherwise, section 22F of the Health Act allows people providing health services such as doctors and specialists to obtain information about their patients, on request. The information sought must be provided unless the holder of the information thinks the individual would not want the disclosure to occur, or another of the withholding grounds applies.
Some government agencies have powers to require the provision of information. Health agencies that receive a request from a government agency that refers to these powers should confirm that the power exists and that any limitations on the scope of the powers (for instance that only certain kinds of information are covered) are being followed. Notifying the individual that the disclosure has occurred is often good practice, provided that it does not prejudice the purpose of collection.
Government agencies that do not have powers to require the provision of information can, and often do, seek information to carry out their functions. Section 22C of the Health Act allows, but does not require, anyone holding health information to disclose that information to requesters from a list of specified agencies, for instance:
The requesters must be seeking the information for the purpose of carrying out their agencies’ statutory functions, and disclosure under section 22C is always discretionary.
There are also specific legislative provisions that apply to the sharing of information to respond to child welfare or family violence concerns. The Ministry of Health has published guidance for health professionals regarding information sharing under the Oranga Tamariki Act 1989, and the Family Violence Act 2018 which is available at https://www.health.govt.nz/our-work/preventative-health-wellness/family-violence.
There are four other Health Information Privacy Code fact sheets that give a broad overview of how the Code works in practice.
For more detailed information, a copy of the Health Information Privacy Code is available from the Office of the Privacy Commissioner’s website at www.privacy.org.nz
For enquiries, please ring the Office of the Privacy Commissioner on 0800 803 909 or email enquiries@privacy.org.nz
