Print this topic

HealthInfo West Coast-Te Tai Poutini

Privacy and your health information

The Privacy Commissioner's Brochure for Health Consumers provides answers to some key questions about your health information.

This brochure is also available in Māori, Samoan, Simplified Chinese, and Tongan.

How is your health information protected?

The Health Information Privacy Code controls how your medical records are handled. The code has 12 rules governing how people in the health sector can collect, use and disclose your health information. If you know your rights, you can help to make sure your information is safe.

What is health information and who is a health agency?

Everything your doctor or other health agency holds about your health is health information. Health agencies include hospitals, district health boards, primary health organisations and other community health providers. Health information includes prescriptions, notes, diagnoses, test results and records of conversations.

Does your information have to be kept safe?

Yes. All health agencies must have reasonable security safeguards for your information. This includes securing computer records, having lockable cabinets for paper files, having confidentiality agreements with administration staff and cleaners, and securely disposing of information when it's no longer needed.

Who gets to see your health information?

Doctors, nurses and specialists directly associated with your care will be able to see your health informationDoctors, nurses and specialists directly associated with your care can see your health information so that they can care for you appropriately and safely. People working for health agencies such as district health boards, ACC and the Ministry of Health may also be able to see your information if they need it to help you or to plan and manage services.

Some other people may be able to access your records, such as:

Health agencies must tell you who's going to see your health information and why. If you aren't sure what's going to happen with your information, ask your doctor or other health professional.

If you're concerned about where your information goes or who it goes to, you have the right to speak up. You won't always be able to prevent the disclosure of your health information. Sometimes the law allows it to be disclosed even where you disagree. But you should at least know what's happening, and it's important for health professionals to know if you object to the disclosure.

Can you see your health information?

You have a right to see your health information. Feel free to ask your health professional to show you your file or for a copy you can keep.

If you ask to see your health information, a health agency has up to 20 working days to respond.

What if you don't get to see your health information?

If you ask to see your health information and the health agency doesn't respond within 20 working days, send them a reminder or make a complaint to the agency. If you aren't satisfied with the agency's response, you can complain to the Privacy Commissioner.

A health agency needs a very good reason to refuse your request. If it refuses your request, or only makes some of the information available, you can ask the Privacy Commissioner to review that decision.

What if your health information is wrong?

If you think your information is wrong, you have a right to ask the agency to correct it.

Often, health agencies won't delete information from files – it's important to record everything that has happened. But if you think the information on the file is wrong, you can tell them what you think the right information is. And you can ask to have that view recorded on your file, so that everyone looking at the file will see what you think and take your view into account.

What is the National Health Index number?

Your National Health Index (NHI) number identifies you for health purposes. This number can only be used by people or organisations that are part of the health sector.

What if I'm not happy?

First talk to the agency concerned to give them a chance to put things right for you. If you aren't satisfied with the response, you can complain to the Privacy Commissioner. For instance, you can complain if:

How do I make a complaint to the Privacy Commissioner?

It's simple, and free. Just write a letter or contact the Privacy Commissioner's enquiries line. If you like, you can download a complaint form to help you make your complaint.

Primary health organisations

Most general practices are now part of a primary health organisation (PHO). People are encouraged to join a PHO to gain the benefits, which include cheaper doctor visits and reduced costs on prescription medicines. To enrol, you'll usually have to sign an enrolment form that the doctor, nurse or medical centre receptionist will give you. The form contains a health information privacy statement, which documents how your health information will be used. For more Information, ask your general practice for a copy of the PHO Health Information Privacy Statement.

Electronic clinical information sharing

A system for sharing electronic patient records called HealthOne is available to South Island health system clinicians, including GPs, hospital clinicians, pharmacists, community nursing services and allied health professionals.

Adapted by HealthInfo clinical advisers. Last reviewed April 2018.


Page reference: 65596

Review key: HIYHI-77571