Privacy statement

While there may be small differences in how information is handled in different parts of Health NZ, we will handle your information in line with our obligations under the Privacy Act 2020, Health Information Privacy Code 2020, and other relevant legislation or guidelines.

Privacy Act 2020external link

Health Information Privacy Code 2020external link

This statement does not replace more specific Health NZ privacy statements on our other websites, consent forms, or other ways that we may communicate with you in your specific circumstances.

Health NZ recognises the Government’s Data Protection and Use Policy (DPUP)external link and aims to apply the DPUP principles to ensure that we are respectful, trusted and transparent when collecting and using people’s personal and health information.

We may update this privacy statement from time to time. Please check this privacy statement regularly for modifications and updates.

This privacy statement was last updated on 12 September 2024. 

Health NZ leads the day-to-day running of the health system across New Zealand, with functions (delivery and enabling) delivered at community, district, regional and national levels.

Health NZ is responsible for improving health system services and outcomes across the health system.  

The objectives and functions of Health NZ are set out in Section 13 and 14 of the Pae Ora (Healthy Futures) Act 2022external link (Pae Ora).

In order to achieve these, we need to collect, use and share information about people receiving healthcare New Zealand.

We may collect your personal (information about you) and health (information about your health) information so we can: 

• support and enable the provision of appropriate care and treatment.  
• plan for and fund health services 
• carry out teaching for research purposes 
• monitor quality of care/treatment delivery
• maintain and improve the services we deliver including the quality of our services (for example feedback, enquiries, and other communications)  
• inform you of health services that may be relevant to you, for example, vaccinations or screening programmes
• meet our objectives and functions set out in Pae Ora  

We may use information for research or statistical purposes. When this happens, steps will be taken to make sure information is not published in a way that identifies any individuals.

We collect information about you such as your name, date of birth, NHI (if known), address and contact details. This information helps us to correctly identify you and to contact you if and when necessary.

We will also collect information relevant to your health and the health service/s you have already and are accessing, such as your current symptoms and previous medical history.  

We aim to collect any personal or health information from you directly, however if this is not possible or practical we may collect it from another person — for example a whānau member or other support person who is with you at hospital. If this happens, we will check the information with you for accuracy as soon as practical.

When collecting your information, we will explain the purpose for collection, how we will handle and protect your information, and the choices you have. We will ensure we provide you with sufficient detail to have a good understanding and, where appropriate, make informed choices regarding the collection and handling of your personal and health information.

In many cases, it will not be mandatory to provide the information. However, if you choose not to, we may not be able to provide appropriate support you seek or require.  

Phone call recordings

We may record some calls made to Health NZ, such as calls made to or from our contact centres. We use this:

• for staff training purposes, helping us to improve the quality of our customer service and to ensure the information we provide is consistent and accurate
• for reporting on the types and numbers of enquiries we receive
• for an accurate record of your call, which may be needed to support any dispute or complaint
• to protect our people from abusive or threatening behaviour 

CCTV

CCTV cameras are operating in some areas of our hospitals and health services, such as the entrances and reception areas, Emergency Departments, and public areas.  This is to keep our patients, visitors, and kaimahi safe.

Where we have concerns regarding threats to the safety of people or property, we will engage an appropriate authority (such as the NZ Police) and CCTV footage, if still available, may be released to support the purpose of collection.

Our Regional Hospitals and Health Services may engage third parties to support the security function and/ or deliver threat risk assessments to enable us to meet our objective of keeping people and assets safe. Release of CCTV footage to these third parties may be required to deliver this outcome

Artificial intelligence

We are committed to protecting your personal information when using artificial intelligence (AI) technologies. We use AI to improve healthcare services while applying appropriate privacy controls and safeguards. We do not allow AI to collect information about you. When we use AI, it operates in a closed environment that means your personal information will not leave Health NZ’s technology and cannot be used to design or make commercial AI technology or generative AI (such as large language models). 

In some cases, there is short term disclosure to AI technology providers for support or to utilise the AI technology. In these situations, personal information is deleted shortly after disclosure and is never used to train commercial AI models or improve third-party products. 

We use AI technology to:

• Write code, which does not include the use of any personal information
• Provide transcription services (automatically dictate letters or clinical reports)
• Automatically transcribe consultations (automatically provide a summary of the clinical consultation and document this in the patient record)
• Provide document summary, generation, and knowledge resources for staff, including training using chatbots and generative AI writing and knowledge tools such as Microsoft Copilot
• Read, analyse, or review clinical information to provide preliminary results (such as initial review of images, x-rays, scans, or mammograms)

Many of these activities are in a pilot phase and are being carefully tested on a limited basis to ensure the risks and benefits are fully understood before they are more widely introduced. Any information generated by AI, which might have an impact on patient records or clinical decision making, is reviewed by the responsible clinician before it becomes part of the clinical record or decision. 

We do not use AI to make automated decisions about your healthcare. When AI is used by clinicians, it serves as a tool to assist clinicians. Where this occurs, final decisions about your diagnosis, treatment, and care remain with qualified healthcare professionals.

We may, where it is legally acceptable, agree ethically approved research which utilises, or tests artificial intelligence, and this activity may include the inclusion of personal information into generative or other kinds of AI. Participants in this kind of research are informed about the activity before it takes place.

In most cases we require your authorisation before we share information that is about you with somebody else.

We may share your information with other healthcare professionals and agencies involved in your care and treatment. It is normal practice to give necessary and relevant information about you to: 

• your GP
• the health care professional who referred you
• your community nurse, or  
• other healthcare professionals involved in your ongoing care.

In some circumstances your information may be shared with your whānau (family) support people or with other agencies —  for example ACC, the Police, Oranga Tamariki). This may happen: 

• if you have authorised this sharing
• if we think it is necessary for your care and treatment
• for your safety or the safety of others, or  
• if authorised by law. 

We may also provide your information to the Ministry of Health and other government agencies that require us to provide information for administrative, legal, contractual, statistical, research or public health purposes.  
 
We treat your personal and health information as confidential and have processes to keep your information protected.

You have the right to request access to the information that we hold about you. 
 
The length of time required to collate information will depend on the volume and nature of information requested, particularly where information is held in different places or systems. To help us be able to respond to your request in a timely way, please be as specific as possible about the information you require.  Sometimes we may contact you to clarify your request. 
  
It may take up to 20 working days for us to respond to your request, however, all efforts are made to process all requests as quickly as possible. If your request is urgent, you must provide a reason for the urgency and the timeframe within which you require the information, and all efforts will be made to meet this timeframe.   
  
If we are unable to meet the 20 working day timeframe, we will be in contact with you.  
 
Before releasing any of your information, we will check it to make sure that it can be released to you. Some of your information may be legally withheld in certain circumstances, for example where your health or the privacy or safety of another person is at risk. If this happens, we will tell you why the information is being withheld. 

For more information about getting your information, read:

• Requesting health information fact sheetPDF205 KB

To request your personal health information, complete a:

• Release of personal health information request formPDF269 KB

Email the completed form to:

• hnzprivacy@tewhatuora.govt.nzexternal link, or
• the email address listed for your region below.

You have the right to request a correction to your information if you think it is wrong.

You can make a request by:

• asking the clinical staff treating you, if you are an inpatient in a hospital or health service
• emailing hnzprivacy@tewhatuora.govt.nzexternal link — include the name of the hospital you want to correct your information.

If we cannot make the requested changes we will let you know. A statement with a record of your request will be kept with your information.

We take reasonable steps to ensure your personal and health information is protected against loss, unauthorised access, use, modification, disclosure, or other misuse. 

Under the Public Records Act 2005, personal and health information must be retained for the applicable period set out in the Functional Disposal Authorities (DA707) approved by the Chief Archivist.

Sometimes we may destroy original or source information once it has been digitalised. This helps us to meet our retention requirements. Source information will only be destroyed when certain conditions are met. The electronic form of the information then becomes the authoritative record.  

If you have any queries or concerns about how your personal or health information has been managed, please contact us to see if we can resolve the problem. You can: 

• email us at hnzprivacy@tewhatuora.govt.nzexternal link  
• write to us at Privacy Officer - Te Whatu Ora, PO Box 793, Wellington 6140, New Zealand

If you are not satisfied with our response to your concerns, you can contact the Office of the Privacy Commissioner. For more information see the Office of the Privacy Commissioner website.external link