Print this topic

HealthInfo Waitaha Canterbury

Privacy and your health information

The Health Information Privacy Code controls how your medical records are handled. The code has 12 rules governing how people in the health sector can collect, use and disclose your health information. If you know your rights, you can help to make sure your information is safe.

Health information and health agencies

Everything your doctor or other health agency holds about your health is health information. Health agencies include hospitals, district health boards, primary health organisations and other community health providers. Health information includes prescriptions, notes, diagnoses, test results and records of conversations.

Keeping your information safe

All health agencies must have reasonable security safeguards for your information. This includes securing computer records, having lockable cabinets for paper files, having confidentiality agreements with administration staff and cleaners, and securely disposing of information when it's no longer needed.

Access to your health information

Doctors, nurses and specialists directly associated with your care will be able to see your health informationDoctors, nurses and specialists directly associated with your care can see your health information so they can care for you appropriately and safely. People working for health agencies such as district health boards, ACC and the Ministry of Health may also be able to see your information if they need it to help you or to plan and manage services.

Some other people may be able to access your records, such as:

Health agencies must tell you who is going to see your health information and why. If you aren't sure what is going to happen with your information, ask your doctor or other health professional.

If you're concerned about where your information goes or who it goes to, you have the right to speak up. You will not always be able to prevent the disclosure of your health information. Sometimes, the law allows it to be disclosed even where you disagree. But you should at least know what is happening and it's important for health professionals to know if you object to the disclosure.

Seeing your health information

You have a right to see your health information. Feel free to ask your health professional to show you your file or for a copy you can keep.

If you ask to see your health information, a health agency has up to 20 working days to respond.

Wrong health information

If you think your information is wrong, you have a right to ask the agency to correct it.

Often, health agencies will not delete information from files – it's important to record everything that has happened. But if you think the information on the file is wrong, you can tell them what you think the right information is. And you can ask to have that view recorded on your file so that everyone looking at the file will see what you think and take your view into account.

National Health Index numbers

Your National Health Index (NHI) number identifies you for health purposes. This number can only be used by people or organisations that are part of the health sector.

Complaining to the Privacy Commissioner

First talk to the agency concerned to give them a chance to put things right for you. If you aren't satisfied with the response, you can complain to the Privacy Commissioner. For instance, you can complain if:

Making a complaint to the Privacy Commissioner is simple and free. Just write a letter or contact the Privacy Commissioner's enquiries line. If you like, you can download a complaint form to help you make your complaint.

Primary health organisations

Most general practices are part of a primary health organisation (PHO). People are encouraged to join a PHO to gain the benefits, which include cheaper doctor visits and reduced costs on prescription medicines.

To enrol, you'll usually have to sign an enrolment form that the doctor, nurse or medical centre receptionist will give you. The form contains a health information privacy statement, which documents how your health information will be used.

For more Information, ask your general practice for a copy of the PHO Health Information Privacy Statement.

Electronic clinical information sharing

A system for sharing electronic patient records called HealthOne is available to South Island health professionals, including GPs, hospital staff, pharmacists, community nursing services and allied health professionals.

Adapted by HealthInfo clinical advisers. Last reviewed June 2021.


Page reference: 65596

Review key: HIYHI-77571