Our website uses cookies to give you the best experience and for us to analyse our site usage. If you continue to use our site, we will take it you are OK about this. Click on More for information about the cookies on our site and what you can do to opt out.

We respect your Do Not Track preference.

Privacy for agencies

Annual Report

Purpose: To verify and update information on the National Health Index and to compile mortality statistics.

BDM disclosure to MoH: BDM provides full names (including names at birth), address, occupation, ethnicity and gender, date and place of birth, date and place of death, and cause(s) of death.

Commentary: Compliant.

Verification issue:
MoH makes the NHI available to other agencies (such as DHBs) which may then rely on the information even though the recorded deaths have not yet been verified by MoH.

MoH does not verify that it has matched records correctly before adding date of death to the NHI record.  MoH has no direct interaction with the individuals and so cannot send the equivalent of adverse action notices as required by section 103 of the Privacy Act.

MoH does try to minimise the risk as far as practicable.  MoH has also amended its own process, from June 2009, to check two registers they administer, the National Booking System and the National Immunisation Register, for possible matches, before the NHI is updated.  Where matches are found with these registers verification of the death is sought.  This reduces the risk of people being removed from these registers in error.

MoH has also modified its system to notify downstream users of NHI information that the death has not been verified.  This will reduce the chances that adverse action will be taken against individuals who are incorrectly notified as deceased on the NHI.  MoH makes NHI information available in two ways:

  • MoH provides files to health providers for updating their records. MoH has added a warning to these files that the death information has not been verified.
  • MoH makes the NHI accessible online to authorised users. MoH has changed this system to indicate the source of the death information. This new information will be available to users when they update their systems which allow them to access the NHI.

These measures may not entirely eliminate the risk to individuals who are incorrectly notified as deceased on the NHI.  But they are substantial enough that we are satisfied the risk is reduced and that the match is compliant.

Retention of data issue:
After creating a working file copy of the data received to be used in the match against the NHI, MoH retains the original full data received for a year to help match coroners' reports to the mortality register when needed for statistical purposes.  This creates a risk that MoH will make decisions based upon information that was believed to be accurate when supplied but which may since have been corrected by DIA.

This usae is acceptable because the use is for statistical purposes and because of the costs that would result in requesting data again for this small number of cases.

Technical information

Information matching provision Births, Deaths, Marriages and Relationships Registration Act 1995, s.78A
Year authorised 2009
Year commenced 2009
Programme type Updating data
Unique identifiers Death Registration Number, National Health Index Number

System description
Each month Births, Deaths and Marriages (BDM) provide an encrypted file on CD to the Ministry of Health (MoH). MoH then requests the password and decrypts the file.

Only a subset of the information received is required for matching to the NHI records, so a working file is created for matching. The full records received from BDM are retained for one year to assist in matching coroner’s reports to the NHI. Death records that match to a single NHI record are assumed to be correctly matched. 

Any death records that return more than one possible match to an NHI record are manually reviewed and matched. This may involve identifying and resolving instances where an individual has more than one NHI record.

Death records that are not matched are manually reviewed, and if no match can be found, an NHI record is created. 

All death records that have been matched or have had new NHI records created for them are tagged with the NHI number.

At this stage in the process, the matches have not been verified. They are probably correct, but in any such system a small number of mis-matches is expected. To minimise the risk of people missing scheduled treatments the match results are matched to National Booking Reporting System (NBRS) (for elective surgical procedures) and National Immunisation Register (NIR) databases. Where possible matches to individuals listed on these systems are identified, MoH verifies the match by checking alternate information sources. A separate notification is received for deaths in publicly-funded-hospitals, and this is relied upon as verification for these deaths. For all other deaths, MoH verifies these primarily by checking medical certificates and coroner’s notifications.

The matched file is loaded into the Mortality database. Then an extract from the Mortality database of the matched records (excluding any still pending verification) is used to update the NHI database.

This extract is also loaded to the National Collections data set. From there it is available to other databases and systems run by MoH and made available to health provider organisations (for example District Health Boards), with a warning message indicating that only some of the records have been subject to independent verification. This an important warning because the provider organisation might otherwise use the information to update records it holds without appropriate checking. 

Some external users also have direct access to the NHI and may see the date of death on any record they are looking at. MoH is relying upon these people recognising any false data before action is taken.

Those records which where matched to records on the NBRS or NIR databases but were not able to be verified at the time of the deaths file processing, are subsequently followed-up and manually updated in the NHI, and, if required in the Mortality system.

The information received from BDM is retained for 12 months to assist with matching late-received information (e.g. coroner’s reports) to NHI records.

Recent activity

NHI updating:

   2011/12  2012/13 2013/14  2014/15 2015/16
Records received for matching 29,981 30,141 30,016 31,710 31,551
Matched 26,368 26,758 26,656 28,196 28,224
Not matched 3,502 3,281 3,294 3,394 3,213
New NHIs allocated 111 102 66 120 114
Subsequent corrections 22 14 14 12  9


  2011/12  2012/13  2013/14  2014/15 2015/16
Records received for matching 412 390 391 329 295
Matched 346 322 319 261 262
New NHIs allocated 66 68 72 68 33

Look-ups of retained BDM data:

  2011/12  2012/13  2013/14  2014/15 2015/16
Cause of death check for coroners cases 233 275 370 455 1,115
Cause of death check, Dr certified 3,256 3,026 3,064 3,275 3,298
Cause of death given, no Dr certifying 3,625 3,378 3,448 3,670 3,282
Coroner in Certifying Dr field 589 656 674 575 418
NZ Pharmaco viligance requests 53 610 362 100 93
Total 7,740 8,196 8,188 8,329 8,466