Applying the Privacy Act 2020, the Health Information Privacy Code and your regulator's standards in everyday practice
3CPD hours
20final questions
80%pass mark
PDFcertificate
What you will learn
Explain the relationship between the Privacy Act 2020, the Health Information Privacy Code 2020 and the Code of Rights, and identify which body handles which concern.
Apply HIPC rules 1 to 4, including the new rule 3A, when collecting health information directly or from third parties.
Apply rules 5, 8 and 9 and the 10-year retention requirement to protect and manage health information.
Respond to access and correction requests within the 20-working-day limit and on proper grounds.
Analyse a disclosure request using rule 11, distinguishing rule 11(1) grounds, rule 11(2) grounds and the minimum necessary limit.
Assess a serious threat using likelihood, severity and timing, and make and document a defensible disclosure decision.
Identify statutory disclosure routes, including the Oranga Tamariki Act 1989, the Family Violence Act 2018, section 18 of the Land Transport Act 1998 and Police production orders.
Manage confidentiality in conversations, digital systems, social media, telehealth, AI tools, teaching and research.
Respond to a privacy breach using contain, assess, notify, prevent, and apply the notifiable breach test.
Describe Privacy Commissioner, HDC, PCC and HPDT processes and demonstrate insight and targeted remediation after a confidentiality concern.
About this course
This course explains how health practitioners in Aotearoa New Zealand should collect, protect, use and share health information. It works through the Privacy Act 2020 and the Health Information Privacy Code 2020 rule by rule, including the new rule 3A on information collected from someone other than the patient (in force from 1 May 2026), and connects them with the Code of Health and Disability Services Consumers' Rights and the confidentiality standards of the responsible authorities.
It is written for registered health practitioners across professions: doctors, nurses, midwives, oral health practitioners, pharmacists, psychologists, physiotherapists, paramedics and other allied professionals regulated under the Health Practitioners Competence Assurance Act 2003. It is relevant for routine professional development and for practitioners responding to a privacy complaint, a breach or a concern raised by their regulator.
Confidentiality questions in New Zealand are shaped by small, connected communities, whānau-centred care, a mandatory privacy breach notification regime, and specific statutes on child protection, family violence and fitness to drive. Through New Zealand case studies, the course covers disclosure decisions including serious threats, Police requests, whānau involvement, digital and AI risks, breach notification, the Privacy Commissioner and HDC processes, and how to show insight and remediation if things go wrong.
Course facts
CPD value
Approximately 3 CPD hours (estimated learning time including knowledge checks, reflection and assessment)
Audience
Registered health practitioners in New Zealand under the HPCA Act 2003: doctors, nurses, midwives, oral health practitioners, pharmacists and allied health practitioners
Standards covered
Privacy Act 2020; Health Information Privacy Code 2020 (including rule 3A, Amendment No 2); Code of Health and Disability Services Consumers' Rights; Health Act 1956 s 22F; Health (Retention of Health Information) Regulations 1996; Oranga Tamariki Act 1989; Family Violence Act 2018; Land Transport Act 1998 s 18; HPCA Act 2003
Format
Self-paced, gated lessons with knowledge checks, case studies and reflection
Assessment
20 scenario-based questions, 80% to pass (16 of 20)
Outcome
Certificate of completion and a written reflection for your CPD record
Alignment
Confidentiality standards of the Medical Council (Good medical practice; Patient records), Nursing Council (Code of Conduct principle 5), Midwifery Council, Dental Council, Pharmacy Council (Code of Ethics 2018) and other responsible authorities
Syllabus
10 sections, 3 CPD hours, 20-question final assessment
1Foundations of health information privacy in New Zealand3 lessons
Confidentiality, privacy and trust in Aotearoa
The legal framework at a glance
What your responsible authority expects
2Collecting, protecting and giving access to health information3 lessons
Collecting health information: rules 1 to 4 and the new rule 3A
Storage, security, accuracy and retention
Access and correction: rules 6 and 7
3Using and sharing health information lawfully3 lessons
Using and sharing information for care: rules 10 and 11
Authorisation, express wishes and the minimum necessary
Family, whānau, representatives and people who have died
4Disclosure without authorisation: serious threats and legal duties3 lessons
The serious threat exception
When the law requires or authorises disclosure
Making and recording a disclosure decision
5Confidentiality in everyday and digital practice3 lessons
Conversations, workspaces and small communities
Digital records, messaging, telehealth and AI tools
Social media, the media, teaching and research
6Privacy breaches and notification3 lessons
What a privacy breach is and why it happens
Notifiable privacy breaches
Responding to a breach: contain, assess, notify, prevent
7Complaints, regulators and remediation3 lessons
Privacy complaints: the Privacy Commissioner and the Tribunal
HDC, responsible authorities and the Tribunal
Insight, reflection and remediation after a confidentiality concern
8Conclusion and key points1 lesson
Conclusion and key points
9References and further reading1 lesson
References and further reading
10Your reflective account1 lesson
Your reflective account
Who this course is for
Registered health practitioners in New Zealand under the HPCA Act 2003: doctors, nurses, midwives, oral health practitioners, pharmacists and allied health practitioners.
Continuing professional development record for your portfolio.
Your name, the course title and the CPD hours
Completion date and a unique certificate ID that can be verified
Downloads as a PDF; save it to your portfolio
Fitness To Practice
Certificate of Completion
This certifies that
Your Name
has successfully completed
Health Information Privacy and Confidentiality
Completed12 Oct 2026
3CPD hours
Certificate IDFTS-7Q4K-2M9X
Continuing professional development record — New Zealand
Questions about this course
What changed in health privacy law on 1 May 2026?
The Privacy Amendment Act 2025 added information privacy principle 3A, which requires agencies to notify people when personal information about them is collected from someone else. A matching rule 3A was inserted into the Health Information Privacy Code 2020 from the same date. The course explains what this means when you collect health information from whānau, other providers or third parties.
How is this privacy course different from the Privacy Commissioner's free modules?
The Privacy Commissioner's free e-learning gives a general introduction. This course is written for registered health practitioners and works through the Health Information Privacy Code rule by rule alongside your responsible authority's standards and the Code of Rights, with clinical scenarios on serious-threat disclosures, Oranga Tamariki and family violence requests, telehealth and AI tools.
When can I disclose health information without the patient's authorisation?
The course analyses rule 11 of the Health Information Privacy Code, including the serious-threat ground, which you assess by likelihood, severity and timing, and statutory routes such as the Oranga Tamariki Act 1989 and the Family Violence Act 2018. You practise making and documenting a defensible decision and disclosing only the minimum needed.
Does the course explain what to do after a privacy breach?
Yes. You follow a four-step response: contain, assess, notify and prevent. The course explains the notifiable breach test, when you must tell the Privacy Commissioner and affected people, and how Privacy Commissioner, HDC, Professional Conduct Committee and Tribunal processes can follow a serious breach.
How much does the health information privacy course cost?
NZ$139 buys 3 CPD hours with immediate online access. Privacy scenarios and knowledge checks build to a closing 20-question quiz (80% to pass); you then receive a certificate and write up a structured reflection. It is independent education and is not accredited or approved by the Privacy Commissioner or any responsible authority.
Accurate, honest and defensible notes: what a good entry contains, late entries and corrections, AI scribes, access requests and the 10-year retention rule.
Honest communication when care goes wrong: HDC open disclosure guidance, the HQSC adverse events policy, ACC treatment injury and culturally safe apology.