• Home /
• Resources /
• Privacy and Health

Resources

Health information privacy is about making sure patients and staff know what's being done with their health information, and why. Collecting, using and disclosing health information to provide care should never be a problem. 

Health Information Privacy Code

The Health Information Privacy Code applies specific rules to agencies in the health sector to better ensure the protection of individual privacy. It covers health information collected, used, held and disclosed by health agencies and takes the place of the information privacy principles for the health sector. The Health Information Privacy Code applies to the health information about identifiable individuals and applies to:

• all agencies providing personal or public health or disability services such as primary health organisations, rest homes, supported accommodation, doctors, nurses, dentists, pharmacists and optometrists; and
  
  
• some agencies that do not provide health services to individuals but which are part of the health sector such as ACC, the Ministry of Health, the Health Research Council, health insurers and professional disciplinary bodies.

Our Health Information Privacy Code pages include handy factsheets on each rule within the code. 

Privacy and COVID-19

All our information on Privacy and COVID-19 is here. 

Health on the road 

Keeping health information safe when you're traveling and working remotely. Our Health on the road guidance aims to help you keep health information safe when you're off-site or on the road.

Resources for the public

Protecting your Personal Information - bilingual brochure for the public about their privacy rights, including their health information rights. 

Free online health privacy training

We offer free online learning modules on a range of privacy-related topics, including an introduction to health and privacy in Health ABC.  

Register for our e-learning

Health-related privacy case notes:

• Case Note 315099 [2022] NZPrivCmr 2 Hospital incorrectly records history of cancer in personal information (information collection)
• Case Note 296919 [2021] NZPrivCmr 6 Father complained that ex-wife obtained health information about daughter (collection; disclosure)
• Case Note 275234 [2016] NZPrivCmr 9 Man objects to urine test process (collection)
• Case Note 226245 [2013] NZPrivCmr 2 Over-collection of medical notes by insurance company (collection)
• Case Note 51345 [2003] NZPrivCmr 20 ACC client objects to ACC copying solicitor's letters to his doctor (collection) 
• Case Note 7454 [1997] NZPrivCmr 7 Patient complains mental health unit questioned third parties (collection; dealing with requests)
• Case Note 270745 [2016] NZPrivCmr 10 Medical centre changes processes after sesntitive disclosure (disclosure; storage)
• Case Note 235915 [2012] NZPrivCmr 5 Hospital employee disclosed health infromation about woman to a mutual friend (disclosure)
• Case Note 228129 [2012] NZPrivCmr 6 Sensitive health information disclosed (disclosure)
• Case Note 228235 [2011] NZPrivCmr 7 Nurse discloses patient information to a mutual friend (disclosure)
• Case Note 231747 [2011] NZPrivCmr 8 Authority of all executors not necessary to release deceased person's health information (disclosure)
• Case Note 210870 [2010] NZPrivCmr 24 Medical centre fails to establish identity of requester and discloses health information about patient to a former partner (disclosure)
• Case Note 211472 [2010] NZPrivCmr 2 Woman's health information released by District Health Board to Ministy of Health (disclosure)
• Case Note 209438 [2009] NZPrivCmr 20 Estate for deceased doctor fails to transfer files (disclosure; storage, security, retention, disposal)
• Case Note 35361 [2003] NZPrivCmr 9 Seaman complains about doctor discussing shipboard injury with employer (disclosure)
• Case Note 55528 [2003] NZPrivCmr 8 Hospital disclosed fact of HIV test to people in waiting room (disclosure)
• Case Note 21110 [2001] NZPrivCmr 10 Patient objects to docotr's disclosing mental health report to three govt Agencies (disclosure)
• Case Note 69555 [2006] NZPrivCmr 6 Dhb Laboratory refuses father access to son's blood test results (dealing with requests)
• Case Note 95042 [2008] NZPrivCmr 1 DHB denies father access to health info about his son (dealing with requests)
• Case Note 93953 [2007] NZPrivCmr 7 Patient requests names of nurses who attended her in hospital (dealing with requests)
• Case Note 269784 [2016] NZPrivCmr 3 Employee repeatedly accessed health records without proper reason (storage; security)
• Case Note 248601 [2013] NZPrivCmr 4 Medical practice mitigates future harm after data breach (storage; security)
• Case Note 203014 [2009] NZPrivCmr 8 Stamp on envelope identified woman's health condition (storage; security, retention, disposal)
• Case Note 99263 [2007] NZPrivCmr 24 Woman's medical notes sent to wrong address (storage; security, retention, disposal)
• Case Note 269041 [2015] NZPrivCmr 9 Man refused son's health information (access)
• Case Note 246939 [2015] NZPrivCmr 7 Patient's shared medical records wrongly disclosed (access; disclosure)
• Case Note 236708 [2012] NZPrivCmr 11 Man refused access to information on his medical file about his deceased mother (access)

Health-related Privacy Act Human Rights Review Tribunal cases:

• HG v Taranaki District Health Board [2009] NZHRRT 29 (dealing with requests)
• Te Koeti v Otago District Health Board [2009] NZHRRT 24 (dealing with requests)
  
  

Health-related High Court case:

• Case Note [2022] NZPrivCmr1: Te Pou Matakana Limited v Attorney-General judicial review: Privacy Commissioner's intervention (No 1) [2021] NZHC 2942 and (no 2) [2021] NZHC 3319
• L v L, High Court Auckland, AP95-SW01, 31 May 2002