Our website uses cookies to give you the best experience and for us to analyse our site usage. If you continue to use our site, we will take it you are OK about this. Click on More for information about the cookies on our site and what you can do to opt out.

We respect your Do Not Track preference.

Privacy Act & codes

Summary

Health agencies can only disclose health information in limited circumstances. One example is where another law requires them to disclose the information. Also, a health agency can disclose information if it reasonably believes, for example, that:

  • disclosure is one of the purposes for which the agency got the information
  • disclosure is necessary to uphold or enforce the law
  • disclosure is necessary for court proceedings
  • the person concerned authorised the disclosure
  • the information is going to be used in a form that does not identify the person concerned.

Full rule

(1) A health agency that holds health information must not disclose the information unless the agency believes, on reasonable grounds:

(a) that the disclosure is to:

(i) the individual concerned; or

(ii) the individual’s representative where the individual is dead or is unable to exercise his or her rights under these rules;

(b) that the disclosure is authorised by:

(i) the individual concerned; or

(ii) the individual’s representative where the individual is dead or is unable to give his or her authority under this rule;

(c) that the disclosure of the information is one of the purposes in connection with which the information was obtained;

(d) that the source of the information is a publicly available publication [and that, in the circumstances of the case, it would not be unfair or unreasonable to disclose the information];

Note: Subrule 11(1)(d) was amended by Amendment No 8.

(e) the information is information in general terms concerning the presence, location, and condition and progress of the patient in a hospital, on the day on which the information is disclosed, and the disclosure is not contrary to the express request of the individual or his or her representative; [..]

Note: Subrule 11(1)I was amended by Amendment No 4.

(f) that the information to be disclosed concerns only the fact of death and the disclosure is by a [health practitioner] or by a person authorised by a health agency, to a person nominated by the individual concerned, or the individual’s representative, partner, spouse, principal caregiver, next of kin, whānau, close relative, or other person whom it is reasonable in the circumstances to inform; [or]

Note: Subrule 11(1)(f) was amended by Amendment No 4 and Amendment No 6.

[(g) the information to be disclosed concerns only the fact that an individual is to be, or has been, released from compulsory status under the Mental Health (Compulsory Assessment and Treatment) Act 1992 and the disclosure is to the individual’s principal caregiver.]

Note: Subrule 11(1)(g) was inserted by Amendment No 3.

(2) Compliance with paragraph (1)(b) is not necessary if the health agency believes on reasonable grounds that it is either not desirable or not practicable to obtain authorisation from the individual concerned and:

(a) that the disclosure of the information is directly related to one of the purposes in connection with which the information was obtained;

(b) that the information is disclosed by a [health practitioner] to a person nominated by the individual concerned or to the principal caregiver or a near relative of the individual concerned in accordance with recognised professional practice and the disclosure is not contrary to the express request of the individual or his or her representative;

Note: Subrule 11(2)(b) was amended by Amendment No 6.

(c) that the information:

(i) is to be used in a form in which the individual concerned is not identified;

(ii) is to be used for statistical purposes and will not be published in a form that could reasonably be expected to identify the individual concerned; or

(iii) is to be used for research purposes (for which approval by an ethics committee, if required, has been given) and will not be published in a form that could reasonably be expected to identify the individual concerned;

(d) that the disclosure of the information is necessary to prevent or lessen a serious […] threat to:

(i) public health or public safety; or

(ii) the life or health of the individual concerned or another individual; Note:

Subrule 11(2)(d) was amended by Amendment No 7.

[(da) the disclosure of the information is necessary to enable an intelligence and security agency to perform any of its functions;]

Note: Subrule 11(2)(da) was amended by Amendment No 9.

Note: See Intelligence and Security Act 2017, ss 10-16, for the functions of intelligence and security agencies.

Note: Intelligence and Security Act, section 122(3) provides that the Director-General of an intelligence and security agency may certify that he or she believes on reasonable grounds that the disclosure is necessary, for the purpose of enabling an agency to decide whether to disclose the information.

(e) that the disclosure of the information is essential to facilitate the sale or other disposition of a business as a going concern;

(f) that the information to be disclosed briefly describes only the nature of injuries of an individual sustained in an accident and that individual’s identity and the disclosure is:

(i) by a person authorised by the person in charge of a hospital;

(ii) to a person a person authorised by the person in charge of a news medium; for the purpose of publication or broadcast in connection with the news activities of that news medium and the disclosure is not contrary to the express request of the individual concerned or his or her representative;

(g) that the disclosure of the information:

(i) is required for the purpose of identifying whether an individual is suitable to be involved in health education and so that individuals so identified may be able to be contacted to seek their authority in accordance with paragraph (1)(b); and

(ii) is by a person authorised by the health agency to a person authorised by a health training institution;

(h) that the disclosure of the information:

(i) is required for the purpose of a professionally recognised accreditation of a health or disability service;

(ii) is required for a professionally recognised external quality assurance programme; or

(iii) is required for risk management assessment and the disclosure is solely to a person engaged by the agency for the purpose of assessing the agency’s risk;

and the information will not be published in a form which could reasonably be expected to identify any individual nor disclosed by the accreditation quality assurance or risk management organisation to third parties except as required by law;

(i) that non-compliance is necessary:

(i) to avoid prejudice to the maintenance of the law by any public sector agency, including the prevention, detection, investigation, prosecution and punishment of offences; or

(ii) for the conduct of proceedings before any court or tribunal (being proceedings that have been commenced or are reasonably in contemplation);

(j) that the individual concerned is or is likely to become dependent upon a controlled drug, prescription medicine, or restricted medicine and the disclosure is by a [health practitioner] to a Medical Officer of Health for the purposes of section 20 of the Misuse of Drugs Act 1975 or section 49A of the Medicines Act 1981; or

Note: Subrule 11(2)(j) was amended by Amendment No 6.

(k) that the disclosure of the information is in accordance with an authority granted under section 54 of the Act.

[(2A) A health agency that holds health information that was obtained from the testing or examination of a blood sample collected in connection with the Newborn Metabolic Screening Programme shall not disclose that information unless it believes, on reasonable grounds, that the disclosure is in accordance with Schedule 3.]

Note: Subrule 11(2A) was inserted by Amendment No 7.

(3) Disclosure under subrule (2) is permitted only to the extent necessary for the particular purpose.

(4) Where under section 22F(1) of the Health Act 1956, the individual concerned or a representative of that individual requests the disclosure of health information to that individual or representative, a health agency:

(a) must treat any request by that individual as if it were a health information privacy request made under rule 6; and

(b) may refuse to disclose information to the representative if:

(i) the disclosure of the information would be contrary to the individual’s interests;

(ii) the agency has reasonable grounds for believing that the individual does not or would not wish the information to be disclosed; or

(iii) there would be good grounds for withholding the information under Part IV of the Act if the request had been made by the individual concerned.

(5) This rule applies to health information about living or deceased persons obtained before or after the commencement of this code.

[(6) Despite subrule (5), a health agency is exempted from compliance with this rule in respect of health information about an identifiable deceased person who has been dead for not less than 20 years.]

Note: An amended subrule 11(6) was inserted by Amendment No 3.

Note: Except as provided in subrule 11(4), nothing in this rule derogates from any provision in an enactment which authorises or requires information to be made available, prohibits or restricts the availability of health information, or regulates the manner in which health information may be obtained or made available: Privacy Act 1993, section 7. Note also that rule 11, unlike the other rules, applies not only to information about living individuals, but also about deceased persons: Privacy Act 1993, section 46(6).