Health Records Privacy & Patient Access in New Zealand
This guide explains your obligations under New Zealand’s privacy laws when handling health information. It covers the Privacy Act 2020 (especially Information Privacy Principle 6 – IPP6), the Health Information Privacy Code 2020, who can access health records, and how patients can correct their information. Use this as a reference for day‑to‑day compliance.
Key rule – IPP6 right of access
Under section 22 of the Privacy Act 2020, every individual has the right to access their own health information held by an agency, unless an exception applies. This right is reinforced by Rule 6 of the Health Information Privacy Code 2020.
1. The Privacy Act 2020 & IPP6
The Privacy Act 2020 sets out 13 Information Privacy Principles (IPPs). IPP6 (section 22) gives individuals the right to access information about themselves held by any agency, including health providers. You must respond to a request as soon as reasonably practicable and no later than 20 working days after receiving it (section 40).
2. The Health Information Privacy Code 2020
This Code (HIPC 2020) modifies the Privacy Act for the health sector. It applies to all health agencies – from GPs and DHBs to private specialists and allied health providers. Key rules include:
- Rule 6 (Access): Patients can request access to their health information. You must provide it in the way they request (e.g., electronic copy, printed) unless it is unreasonable to do so.
- Rule 7 (Correction): Patients can ask you to correct their health information if it is inaccurate, incomplete, or misleading.
- Rule 11 (Disclosure): You can only disclose health information with the patient’s authorisation, or as permitted by law (e.g., for public health purposes).
Warning – Exceptions to access
You may refuse access under section 27 of the Privacy Act if disclosure would:
• pose a serious threat to the life, health, or safety of the individual or another person;
• involve the unwarranted disclosure of another person’s affairs;
• breach a court order or legal professional privilege.
If you refuse, you must give reasons in writing and inform the patient of their complaint rights.
3. Who can access health records?
Generally, only the patient can access their own health information. However, the following people may also request access:
- Authorised representatives: A person with written authority from the patient (e.g., a lawyer, support person).
- Parents/guardians: For children under 16, unless the child is competent to consent themselves (see the Care of Children Act 2004).
- Enduring Power of Attorney (EPA): A person appointed under the Protection of Personal and Property Rights Act 1988 can access health information if the patient lacks capacity.
- Next of kin: Only if the patient has consented or if disclosure is necessary to prevent serious harm.
4. How to respond to an access request
- Verify identity: Confirm the requester is the patient or an authorised person.
- Clarify scope: Ask what information they want – it can be a specific record or all records.
- Search and retrieve: Locate the information within your systems (including notes, test results, referrals).
- Review for exceptions: Check if any of the refusal grounds apply (see warning box above).
- Provide access: Give a copy in the requested format, or arrange for inspection. You may charge a reasonable fee (section 43) but not for the request itself.
- Document everything: Record the request, your response, and any reasons for refusal.
Key rule – Correction of records
Under Rule 7 of the HIPC 2020, if a patient asks you to correct their health information, you must either:
• make the correction within a reasonable time; or
• attach a statement of correction to the record if you disagree with the change.
You must also notify any third parties you have disclosed the information to (if practicable).
5. Practical tips for staff
- Always ask for ID and written consent if someone else is requesting on behalf of the patient.
- Keep a log of all access requests and responses – this helps with audits and complaints.
- If you are unsure whether an exception applies, seek advice from your privacy officer or the Office of the Privacy Commissioner.
- Remember that patients can request access to their information even if they are in debt or have an outstanding bill – you cannot withhold records as leverage.
6. Complaints and enforcement
If a patient believes their privacy rights have been breached, they can complain to the Office of the Privacy Commissioner. The Commissioner can investigate, mediate, or refer the matter to the Human Rights Review Tribunal. Penalties for serious breaches can include fines up to $10,000 (section 112) and compensation orders.
Need help with compliance?
ShiftScript helps health providers manage patient records securely and in line with NZ privacy laws. Log in to your portal or contact our support team for guidance on access requests, corrections, and data security.
Last updated: May 2026. This guide is for general information only and does not constitute legal advice. For specific situations, consult a privacy officer or legal professional.
Frequently asked questions
How long do I have to respond to a patient’s request for their health records?
Under section 40 of the Privacy Act 2020, you must respond as soon as reasonably practicable and no later than 20 working days after receiving the request. If you need more time, you must notify the patient and explain the delay.
Can a patient access their health records if they have an unpaid bill?
Yes. You cannot withhold health information because of an outstanding debt. The right of access under IPP6 is independent of payment. You may charge a reasonable fee for providing the copy, but you cannot refuse access itself.
Who can request access to a child’s health records?
Generally, a parent or guardian can request access for a child under 16. However, if the child is competent to consent (Gillick competence), they may have the right to control access themselves. Always consider the child’s best interests and any applicable court orders.
What should I do if a patient asks me to correct their health information?
Under Rule 7 of the Health Information Privacy Code 2020, you must either make the correction within a reasonable time or, if you disagree, attach a statement of correction to the record. You should also notify any third parties you have shared the information with, if practicable.
Can I refuse a patient access to their health records?
Yes, but only in limited circumstances under section 27 of the Privacy Act 2020, such as when disclosure would pose a serious threat to life or health, involve another person’s privacy, or breach legal privilege. You must give written reasons and inform the patient of their complaint rights.