Privacy statement

While there may be small differences in how information is handled in different parts of Health NZ, we will handle your information in line with our obligations under the Privacy Act 2020, Health Information Privacy Code 2020, and other relevant legislation or guidelines.

Privacy Act 2020 (external link)

Health Information Privacy Code 2020 (external link)

This statement does not replace more specific Health NZ privacy statements on our other websites, consent forms, or other ways that we may communicate with you in your specific circumstances.

Health NZ recognises the Government’s Data Protection and Use Policy (DPUP) (external link) and aims to apply the DPUP principles to ensure that we are respectful, trusted and transparent when collecting and using people’s personal and health information.

We may update this privacy statement from time to time. Please check this privacy statement regularly for modifications and updates.

This privacy statement was last updated on 12 September 2024. 

Health NZ leads the day-to-day running of the health system across New Zealand, with functions (delivery and enabling) delivered at community, district, regional and national levels.

Health NZ is responsible for improving health system services and outcomes across the health system.  

The objectives and functions of Health NZ are set out in Section 13 and 14 of the Pae Ora (Healthy Futures) Act 2022 (external link) (Pae Ora).

In order to achieve these, we need to collect, use and share information about people receiving healthcare New Zealand.

We may collect your personal (information about you) and health (information about your health) information so we can: 

• support and enable the provision of appropriate care and treatment.  
• plan for and fund health services 
• carry out teaching for research purposes 
• monitor quality of care/treatment delivery
• maintain and improve the services we deliver including the quality of our services (for example feedback, enquiries, and other communications)  
• inform you of health services that may be relevant to you, for example, vaccinations or screening programmes
• meet our objectives and functions set out in Pae Ora  

We may use information for research or statistical purposes. When this happens, steps will be taken to make sure information is not published in a way that identifies any individuals.

We collect information about you such as your name, date of birth, NHI (if known), address and contact details. This information helps us to correctly identify you and to contact you if and when necessary.

We will also collect information relevant to your health and the health service/s you have already and are accessing, such as your current symptoms and previous medical history.  

We aim to collect any personal or health information from you directly, however if this is not possible or practical we may collect it from another person — for example a whānau member or other support person who is with you at hospital. If this happens, we will check the information with you for accuracy as soon as practical.

When collecting your information, we will explain the purpose for collection, how we will handle and protect your information, and the choices you have. We will ensure we provide you with sufficient detail to have a good understanding and, where appropriate, make informed choices regarding the collection and handling of your personal and health information.

In many cases, it will not be mandatory to provide the information. However, if you choose not to, we may not be able to provide appropriate support you seek or require.  

Phone call recordings

We may record some calls made to Health NZ, such as calls made to or from our contact centres. We use this:

• for staff training purposes, helping us to improve the quality of our customer service and to ensure the information we provide is consistent and accurate
• for reporting on the types and numbers of enquiries we receive
• for an accurate record of your call, which may be needed to support any dispute or complaint
• to protect our people from abusive or threatening behaviour 

CCTV

CCTV cameras are operating in some areas of our hospitals and health services, such as the entrances and reception areas, Emergency Departments, and public areas.  This is to keep our patients, visitors, and kaimahi safe.

Where we have concerns regarding threats to the safety of people or property, we will engage an appropriate authority (such as the NZ Police) and CCTV footage, if still available, may be released to support the purpose of collection.

Our Regional Hospitals and Health Services may engage third parties to support the security function and/ or deliver threat risk assessments to enable us to meet our objective of keeping people and assets safe. Release of CCTV footage to these third parties may be required to deliver this outcome

In most cases we require your authorisation before we share information that is about you with somebody else.

We may share your information with other healthcare professionals and agencies involved in your care and treatment. It is normal practice to give necessary and relevant information about you to: 

• your GP
• the health care professional who referred you
• your community nurse, or  
• other healthcare professionals involved in your ongoing care.

In some circumstances your information may be shared with your whānau (family) support people or with other agencies —  for example ACC, the Police, Oranga Tamariki). This may happen: 

• if you have authorised this sharing
• if we think it is necessary for your care and treatment
• for your safety or the safety of others, or  
• if authorised by law. 

We may also provide your information to the Ministry of Health and other government agencies that require us to provide information for administrative, legal, contractual, statistical, research or public health purposes.  
 
We treat your personal and health information as confidential and have processes to keep your information protected.

You have the right to request access to the information that we hold about you. 
 
The length of time required to collate information will depend on the volume and nature of information requested, particularly where information is held in different places or systems. To help us be able to respond to your request in a timely way, please be as specific as possible about the information you require.  Sometimes we may contact you to clarify your request. 
  
It may take up to 20 working days for us to respond to your request, however, all efforts are made to process all requests as quickly as possible. If your request is urgent, you must provide a reason for the urgency and the timeframe within which you require the information, and all efforts will be made to meet this timeframe.   
  
If we are unable to meet the 20 working day timeframe, we will be in contact with you.  
 
Before releasing any of your information, we will check it to make sure that it can be released to you. Some of your information may be legally withheld in certain circumstances, for example where your health or the privacy or safety of another person is at risk. If this happens, we will tell you why the information is being withheld. 

For more detail on how to request your information and to access our request for personal or health information forms: 

• email hnzprivacy@tewhatuora.govt.nz, or
• contact your local hospital

If you think your information is incorrect, you have the right to request a correction. In the event we are unable to make the requested changes you will be informed of the reason why and a statement with a record of your request will be kept alongside the information.  
 
If you are an inpatient in a hospital and health service, you can request your information via the clinical staff treating you. 
 
For more detail on how to correct your information please: 

• email hnzprivacy@tewhatuora.govt.nz, or
• contact your local hospital 

We take reasonable steps to ensure your personal and health information is protected against loss, unauthorised access, use, modification, disclosure, or other misuse. 

Under the Public Records Act 2005, personal and health information must be retained for the applicable period set out in the Functional Disposal Authorities (DA707) approved by the Chief Archivist.

Sometimes we may destroy original or source information once it has been digitalised. This helps us to meet our retention requirements. Source information will only be destroyed when certain conditions are met. The electronic form of the information then becomes the authoritative record.  

If you have any queries or concerns about how your personal or health information has been managed, please contact us to see if we can resolve the problem. You can: 

• email us at hnzprivacy@tewhatuora.govt.nz  
• write to us at Privacy Officer - Te Whatu Ora, PO Box 793, Wellington 6140, New Zealand

If you are not satisfied with our response to your concerns, you can contact the Office of the Privacy Commissioner. For more information see the Office of the Privacy Commissioner website. (external link)