Our website uses cookies to give you the best experience and for us to analyse our site usage. If you continue to use our site, we will take it you are OK about this. Click on More for information about the cookies on our site and what you can do to opt out.

We respect your Do Not Track preference.

Privacy Act & codes


Some agencies give people a “unique identifier” instead of using their name. Examples are a driver’s licence number, a student ID number, or an IRD number.

A health agency cannot use the unique identifier given to a person by another agency. People are not required to disclose their unique identifier unless this is one of the purposes for which the unique identifier was set up (or directly related to those purposes).

Full rule

(1) A health agency must not assign a unique identifier to an individual unless the assignment of that identifier is necessary to enable the health agency to carry out any one or more of its functions efficiently.

(2) A health agency must not assign to an individual a unique identifier that, to that agency’s knowledge, has been assigned to that individual by another agency, unless:

(a) those 2 agencies are associated persons within the meaning of [[subpart YB of the Income Tax Act 2007]]; or

Note: Subrule 12(2)(a) was amended by Amendment No 3 and by Amendment No 8.

(b) it is permitted by subrule (3) or (4).

[(3) The following agencies may assign the same National Health Index number to an individual:

(a) any agency authorised expressly by an enactment; or

(b) any agency or class of agencies listed in Schedule 2]

Note: Subrule 12(3) was substituted by Amendment No 5.

[(4) Notwithstanding subrule (2) any health agency may assign to a health practitioner as a unique identifier:

(i) the registration number assigned to that individual by the relevant health professional body; or

(ii) the Common Provider Number assigned to that individual by the Ministry of Health.]

Note: Subrule 12(4) was initially substituted by Amendment No 6. The current wording of subrule 12(4) was substituted by Amendment No 7.

(5) A health agency that assigns unique identifiers to individuals must take all reasonable steps to ensure that unique identifiers are assigned only to individuals whose identity is clearly established.

(6) A health agency must not require an individual to disclose any unique identifier assigned to that individual unless the disclosure is for one of the purposes in connection with which that unique identifier was assigned or for a purpose that is directly related to one of those purposes.

(7) Subrules (1) to (5) do not apply in relation to the assignment of unique identifiers before the commencement of this code. 

(8) Subrule (6) applies to any unique identifier, whether assigned before or after the commencement of this code.

Note: An action is not a breach of this rule if it is authorised or required by or under law: Privacy Act 1993, section 7(4).