Privacy Act and Health Information Privacy Code

The Privacy Act 2020 is New Zealand's main legislation that protects the privacy of personal information.  It covers both the public and private sectors, and aims to: 

  • Promote and protect individual privacy
  • Give effect to international privacy standards
  • Strengthen privacy protections
  • Promote early intervention and risk management
  • Enhance the role of the Privacy Commissioner. 

You can find about more about the Privacy Act 2020 and the Privacy Principles here: Office of the Privacy Commissioner: Privacy Act and Privacy Principles

Under the Privacy Act there is the Health Information Privacy Code (HIPC) 2020.  This Code regulates how health agencies in New Zealand collect, use, hold, and disclose health information about individuals.  It is the guiding document for health providers in terms of sharing personal health information with other people or agencies.

  • Who does the Code apply to?

The HIPC applies to all health agencies, including doctors, nurses, pharmacists, health insurers, hospitals, Primary Health Organisations, ACC, and the Ministry of Health. 

  • What does the Code protect?

The HIPC protects all personal health information relating to an identifiable individual. 

  • What does the Code include?

The HIPC includes rules and principles, such as:

    • Rule 11: Prohibits disclosure of information, except where one or more of its exceptions apply.  In particular it states that a health agency must not disclose information they hold about an individual unless they are satisfied that they are disclosing it to the individual themselves, or to the individual’s representative, or that the disclosure to a third party has been authorised by the individual or their representative.  You can find out more about being a representative here:  Kathy we need to put a link in here
    • Principle 10: Limits the use of personal information to the purpose it was collected for 
    • Rule 6: Gives individuals the right to access information about themselves 
    • Rule 7: Gives individuals the right to seek correction of information they think is inaccurate or misleading.