The Health Information Privacy Code 2020: All 14 Rules in Clinical Practice

What the Code is and who it binds

The Privacy Act 2020 sets out general information privacy principles (IPPs) for every organisation in New Zealand. The Act lets the Privacy Commissioner issue codes of practice that modify those principles for a sector, and the HIPC is the code for health. The Commissioner describes it as taking the place of the information privacy principles for the health sector. If you handle health information, the rules in the Code, not the IPPs, are what you are measured against. Our New Zealand CPD hub lists the Code alongside the HPCA Act and the Code of Rights as the three laws every course is built on; this article goes into the privacy Code in depth.

Three definitions decide whether and how the Code applies to you:

Two points practitioners often miss. First, for rules 5 to 12 a "health agency" includes a former provider who still holds records, so retiring or leaving a practice does not end your obligations for records you keep. Second, the Code sits beside, not instead of, your professional duties. Right 1 of the Code of Health and Disability Services Consumers' Rights includes respect for privacy (see our practitioner's guide to the Code of Rights), and every responsible authority's code of conduct has its own confidentiality standard, compared in our codes of conduct guide. A privacy failure can therefore be a Privacy Act complaint, an HDC complaint and a conduct matter for your regulator at the same time.

How the Code has changed since 2020

The HIPC 2020 replaced the 1994 Code when the Privacy Act 2020 took effect. It has been amended twice, and the second amendment is the reason many older guides, fact sheets and policy templates are now out of date.

The 14 rules at a glance

The rules follow the life of a piece of health information: why and how you collect it, how you protect it, the patient's rights over it, how long you keep it, and when it can leave your hands. The table gives the clinical meaning of each rule and the mistake that most often turns it into a complaint.

Rules 1 to 4 and 3A: collecting information

Collection rules feel like paperwork until something goes wrong. They matter because everything later in the Code (who you can share with, for what purpose) depends on what you told the patient when you collected the information. Factsheet 3 makes the link explicit: disclosure to a specialist is straightforward when referral was a purpose of collection and the patient was told about it under rule 3.

Rule 1 and rule 4: collect what you need, fairly

Rule 1 allows collection only for a lawful purpose connected with your functions, and only where collection is necessary for that purpose. Rule 4 adds that the way you collect must be lawful and fair and must not intrude unreasonably on the person's affairs, with particular care for children and young people. In practice that means auditing your forms, thinking about where conversations happen, and asking whether a question really needs answering for this service.

Rule 2 and rule 3: from the patient, with an explanation

The starting point is that information comes from the patient. Rule 2 lists the exceptions, including where the patient authorises collection from someone else, where the patient cannot consent and the information comes from their representative, where collecting directly would prejudice their interests or anyone's health or safety, or where it is not reasonably practicable. Rule 3 then requires reasonable steps, before collection or as soon as practicable after, to make the patient aware of the purpose, the intended recipients, the agency holding the information, whether supplying it is voluntary, what happens if they do not, and their rights of access and correction.

Rule 3A: the 2026 addition

Rule 3A applies when a health agency collects health information about someone from anyone other than that individual or their representative. You must take reasonable steps to ensure the individual, or their representative, is aware of six things, as soon as reasonably practicable after collection:

• that the information has been collected;
• the purpose of the collection;
• the intended recipients;
• the name and address of the agency that collected it and the agency that holds it;
• any specific law that authorises or requires the collection;
• their rights of access and correction under rules 6 and 7.

You do not need to notify if the person has already been made aware of all six matters by any means, or if you reasonably believe an exception applies: notification would prejudice the person's interests or the purpose of collection, it is not reasonably practicable, it is needed to avoid prejudice to the maintenance of the law by a public sector agency, to protect public revenue or for court or tribunal proceedings, it would cause a serious threat to public health or safety or someone's health or safety, the information is publicly available, it was collected from the person to assemble a family or genetic history, or it will not be used in an identifiable form. The rule does not apply to information collected before 1 May 2026.

The Commissioner's rule 3A guidance works through clinical examples and an exceptions table, summarised below. Note its warning that "inconvenience, cost, or administrative burden doesn't automatically mean notification is 'not reasonably practicable'", and that incompatible systems are not a valid reason to rely on that exception.

Most practices will meet rule 3 and rule 3A together through layered privacy notices: a short first layer on enrolment forms, posters and the portal, with full detail online or in a brochure, backed up by a verbal explanation in suitable language. The RNZCGP Foundation Standard now expects practices to update staff, privacy documents and patient information to reflect rule 3A.

Rule 5: security, snooping and personal devices

Rule 5 requires reasonable security safeguards against loss and against unauthorised access, use, modification or disclosure. Where a vendor stores, processes or destroys information for you, you must take all reasonably available steps to prevent unauthorised use or disclosure, and you must dispose of documents in a way that preserves privacy. Factsheet 5 describes security as an ongoing duty: identify your risks, make a plan covering electronic, operational and physical security, and carry it out. The higher the potential harm, the higher the standard expected.

Personal phones and clinical photos

The Commissioner's "Health on the road" guidance (June 2025) says you should not use a personal device to access health information unless your agency permits it, and where you do, its security must be at least as good as what you use at work: strong passwords or passcodes, multi-factor authentication, current security software and firewalls, encryption, and only secure Wi-Fi. It notes that clinical images on mobile devices are easy to misplace and need the same care. Practically, that means using your organisation's approved clinical photography app or process, transferring images into the record promptly and deleting them from the device, and keeping them out of personal cloud backups and messaging apps. The RNZCGP Foundation Standard also expects a practice privacy policy to cover how photographs are taken, submitted and stored.

Emailing results and letters

Misdirected email and post is a recurring cause of health sector breaches. The Commissioner gives examples of a typo sending medical records to a member of the public and a letter with the wrong street number being opened by a neighbour. The Commissioner's advice: double-check the recipient, confirm contact details before sending (for new patients, send a confirmation email first), consider a delayed-send setting, use BCC for group emails, and encrypt sensitive attachments with the password sent by a different route.

Practice-level controls

• Individual logins for every user, with access set by role. The RNZCGP Foundation Standard says cleaning and custodial staff must not have practice management system access, and screens should lock automatically after no more than 15 minutes of inactivity.
• Screens, whiteboards, run sheets and patient lists out of public view, and paper run sheets collected and destroyed at the end of each shift.
• Daily backups (if not real-time) stored securely offsite or online, not at a team member's home, with restoration tested.
• USB devices only where needed and encrypted, paper records out of sight in transit (a locked glovebox or boot), and records returned to the office at the earliest opportunity.
• Regular, proactive audits of who accessed what, not only audits prompted by a complaint.

Rules 6 and 7: patient access and correction

Rule 6 gives individuals the right to confirm whether you hold their health information and to have access to it. When you give access, you must tell them they can ask for a correction under rule 7. The right is subject to Part 4 of the Privacy Act, which sets the procedure and the grounds for refusal, and to the Code's own charging rules. Nothing in rule 6 requires the patient to give a reason for asking.

Access request workflow

1. Log the date received

   The clock starts the day after you receive the request, whether it comes by email, letter, portal or in person. Working days exclude weekends, public holidays and the period from 25 December to 15 January.

2. Confirm identity and authority

   Verify the requester is the patient or is authorised to act for them. In the Commissioner's case note 210870 (2010), a medical centre assumed a patient's former partner's new partner was the patient, did not check, and released everything it held on the patient, the former partner and their children, including a separate file about the patient's anxiety disorder. The centre apologised, paid compensation and made extensive changes to its identification policy.

3. Decide whether another agency holds it more closely

   If the information is more closely connected with another agency, transfer the request within 10 working days and tell the requester.

4. Check for withholding grounds

   Refusal is the exception. The main health ground is section 49(1)(b): disclosure would be likely to prejudice the person's health, as decided after consulting their health practitioner where practicable. Another common ground is that release would be an unwarranted disclosure of someone else's affairs, such as third-party information a relative gave in confidence. Consider redaction or a summary rather than refusing the whole record.

5. Give a decision within 20 working days

   Section 44 requires a decision no later than 20 working days after the day you receive the request. If you agree to release but the information is not included, provide it without undue delay. If you refuse any part, say which ground you rely on and that the person can complain to the Privacy Commissioner.

6. Extend only on a listed ground, in time

   Section 48 allows a reasonable extension if the request involves a large quantity of information, consultations are needed, or the issues are complex. The extension notice must reach the requester within the original 20 working days and state the period, the reasons and their right to complain.

7. Release, record and remind

   Release in a usable format, note in the record what was released, when and to whom, and tell the patient they can ask for a correction.

Parents, guardians and young people

For a child under 16, a parent or guardian is the child's representative and has a limited right to the child's information under section 22F of the Health Act 1956. Rule 11(5) says you must treat that request like a rule 6 request, and you may refuse if releasing it would be contrary to the young person's interests, they would not want it released, or a Privacy Act withholding ground applies. Once a young person turns 16, parents have no special access right; any disclosure to them must fit a rule 11 exception, usually the young person's own authority.

Rule 7: corrections done properly

Patients can ask you to correct information. You must take reasonable steps to ensure it is accurate, up to date, complete and not misleading, having regard to the purposes it is used for. If you decide not to change it, the patient can give you a statement of the correction they sought, and you must attach it so that it is always read with the disputed information. After correcting or attaching a statement, you must, so far as reasonably practicable, tell anyone you previously disclosed the information to. Make corrections as dated additions with your name, never by overwriting or deleting the original entry; altered notes can cause more trouble than the original error.

Rules 8 and 9: accuracy and retention

Rule 8 requires reasonable steps, before you use or disclose information, to check that it is accurate, up to date, complete, relevant and not misleading. It is the privacy rule behind good referral letters, reconciled medication lists and checked allergy records. It also applies to AI-generated drafts: any note or letter produced with a tool must be checked before it enters the record or leaves the practice.

Rule 9 says you must not keep health information longer than required for the purposes for which it may lawfully be used, but it expressly allows retention where it is necessary or desirable for providing health or disability services to the person. It sits alongside a hard minimum in the Health (Retention of Health Information) Regulations 1996.

Health (Retention of Health Information) Regulations 1996, regulations 5, 6 and 11; HIPC 2020 rule 11(7).

The duty falls on whichever provider currently holds the information, and it does not prevent you from transferring records to another provider, to the patient, or to a deceased patient's personal representative. Information does not have to be kept in any particular form. Public sector agencies are also bound by the Public Records Act and its disposal authorities. When a sole practitioner retires or dies, Factsheet 5 says records should go to the new treating clinician, back to the patient, or be held securely in trust until that can happen; the PHO can help. After the retention period ends, dispose of records securely, including backups and copies held by vendors.

Rules 10 and 11: use and disclosure

Rule 10 limits how you use information inside your agency: for the purpose you collected it, a directly related purpose, with authority, or under a listed exception such as preventing a serious threat or anonymised research. Rule 11 governs disclosure outside your agency and is the rule behind most of the difficult phone calls. It works in two layers.

Two limits apply to every rule 11(2) disclosure: disclose only to the extent necessary for the particular purpose (rule 11(4)), and remember the Commissioner's reminder in Factsheet 3 that "just because the law allows a disclosure doesn't mean it would always be ethical to disclose". The exceptions permit disclosure; they rarely require it.

Scenario: a family member asks for an update

Scenario: Police ask for information

The Commissioner's guide for health professionals on disclosing to Police sets out the approach. A search warrant or production order issued by a court must be complied with, and refusing a production order is an offence. An informal request is different. Section 22C of the Health Act 1956 allows, but does not require, disclosure to Police and some other officials who need the information to do their job, and rule 11(2) allows disclosure where it is necessary to avoid prejudice to the maintenance of the law. The guide says "this is your discretion" and "it's Police's job to convince you".

• Ask Police for a form or an explanation of what is needed and why.
• Consider whether a serious threat or the law enforcement exception genuinely applies, and record your reasoning.
• Disclose only what is necessary and proportionate.
• If unsure, you may decline and ask Police to obtain a production order, and you can seek legal advice or contact your medical defence organisation.
• If you believe a child or young person has been or is likely to be harmed, you can report it to a social worker or Police.

Scenario: employers, insurers and ACC

Employers are not treating providers and have no general right to an employee's health information. Release information to an employer only with the patient's authority, limited to what the patient agreed to (for example, fitness for duties rather than a diagnosis). Health insurers and ACC are themselves health agencies under the Code. Where a request relies on the patient's signed authority, check the authority covers what is being asked and the period requested, and send only what is relevant; a request about a knee injury does not need the whole file, including unrelated sexual health or mental health entries.

Scenario: another provider asks for records

Sharing with the next treating clinician is usually a purpose of collection and needs no special step if the patient was told about it. Section 22F of the Health Act also lets a provider who is treating the patient request their information, and you must generally provide it unless the patient would not want it disclosed or you have another lawful reason to refuse, such as a Privacy Act withholding ground.

The serious threat exception, step by step

1. Can you get authority?

   If the patient or representative agrees, rely on authority instead. The exception only applies if seeking authority is not desirable or practicable, for example because asking could increase the danger.

2. Is the threat serious?

   Use clinical judgement to weigh the likelihood of the threat, the seriousness of the harm that could result, and how imminent it is.

3. Who can act on it?

   Disclose only to someone who can help prevent or lessen the threat.

4. How much is needed?

   Share only the information needed to lessen the threat, and record your reasoning about the recipient and the amount shared.

Rule 12: overseas recipients, cloud tools and AI

Rule 12 applies when you disclose health information to a recipient outside New Zealand under certain rule 11 grounds. You may do so only if the patient authorises it after being told the recipient may not have comparable protection, or you reasonably believe the recipient is subject to the Privacy Act, is bound by comparable privacy law, has agreed to protect the information to comparable standards (for example, by contract), or another listed basis applies. Amendment No 2 slightly reworded the rule's provisions on prescribed countries, so check any overseas transfer policy against the 1 May 2026 text.

Using a cloud host is often not a rule 12 "disclosure" at all. Under section 11 of the Privacy Act, information held by a provider purely as your agent (to store or process it on your behalf, not for its own purposes) is treated as held by you, and passing it to that agent is not a disclosure. The Commissioner's guidance says that in most circumstances you are not legally required to have a principle 12 agreement with a cloud provider, but you will usually remain responsible for the information. Rule 5 then does the work: you must take all reasonably available steps to prevent unauthorised use or disclosure by the provider, which is why reviewing where data is stored, who can access it and whether the vendor uses it for its own purposes matters.

AI scribes and generative AI

The Commissioner's guidance on artificial intelligence (September 2023) starts from the position that the Privacy Act applies to everyone using AI tools in New Zealand. It expects agencies to understand a tool well enough to be confident they are meeting their obligations before using it, recommends a privacy impact assessment before starting (updated regularly, and involving communities including Māori where relevant), points to security of prompts and data, accuracy checking and purpose limits, and says: "If in doubt, we recommend you do not use AI tools to handle personal information." It does not set rules specific to AI scribes.

For health settings, Health New Zealand's guidance says staff must not enter personal, confidential or sensitive patient information into unapproved large language models or generative AI tools, and must not use them for clinical decisions or personalised patient advice. Health NZ lists four ambient AI scribe tools as endorsed for use within Health NZ (some subject to completing privacy, security and contractual processes), with others under review by its National Artificial Intelligence and Algorithm Expert Advisory Group. In a private practice, the practice owner is the agency responsible for any scribe or AI tool: assess it, tell patients, check every draft under rule 8, and know where the audio and text are stored. If you are a nurse, the Nursing Council's position on AI in recertification evidence is a separate issue, covered in our guide to the Nursing Council AI declaration.

Rule 13: NHI numbers and other identifiers

Rule 13 lets an agency assign a unique identifier only where it is necessary for its functions, and generally not one already assigned by another agency. The agencies in Schedule 2, such as Health New Zealand, may assign the National Health Index (NHI) number, and health practitioners may be identified by their registration number or Common Person Number (the term Amendment No 2 uses). Agencies must take reasonable steps to confirm identity before assigning an identifier and to minimise misuse, and nobody can be required to disclose an identifier except for the purpose it was assigned for or a directly related purpose. For clinicians, the practical rule is simple: use the NHI to identify the right patient in health systems, and do not use it as a convenience identifier elsewhere.

When it goes wrong: notifiable privacy breaches

Since the Privacy Act 2020, an agency must notify the Privacy Commissioner and affected people of a notifiable privacy breach. That is unauthorised or accidental access to, or disclosure, alteration, loss or destruction of, personal information that it is reasonable to believe has caused or is likely to cause serious harm. Health information is treated as more sensitive, so serious harm is more likely.

Office of the Privacy Commissioner "How long is 72 hours?" (May 2024), prosecution policy (March 2026) and knowledge base.

1. Contain

   Act immediately: recall the email, retrieve the document, disable the account, change passwords, and tell your privacy officer. Report internally even if you think it is minor; the Commissioner recommends recording and reviewing every breach like a near miss.

2. Assess serious harm

   Section 113 of the Act lists the factors: action taken to reduce the risk of harm, the sensitivity of the information, the nature of the harm that may be caused, who has obtained or may obtain it, whether it was protected by a security measure such as encryption, and any other relevant matters. The Commissioner's NotifyUs tool can help, and if you are unsure, notify.

3. Notify the Commissioner

   As soon as practicable after you become aware that the breach is notifiable, through NotifyUs; the Commissioner's expectation is within 72 hours, as a guide. You can notify in stages and update later. Knowledge held by staff or contractors counts as the agency's knowledge.

4. Notify affected people

   Tell them what information was involved, what you are doing to reduce harm, steps they can take, that the Commissioner has been notified, their right to complain, and who to contact. Exceptions include a person under 16 where notifying would not be in their interests, and where notification would likely prejudice the person's health after consulting their health practitioner where practicable; in those cases notify a representative instead.

5. Prevent

   Fix the cause: training, settings, templates, access controls or audit. Document what changed.

Not every breach is notifiable, but every breach is a privacy issue. A misdirected letter to a trusted colleague who confirms deletion may not cause serious harm; a mental health record emailed to an unknown address, or a lost unencrypted laptop, is very likely to. Serious or repeated privacy failures can also raise questions about a practitioner's conduct; our guides to the fitness to practise process and professional conduct committees explain what follows if a regulator becomes involved.

Practice owner checklist

Section 201 of the Privacy Act requires every agency to have at least one privacy officer, whose role includes encouraging compliance, dealing with requests made to the agency and working with the Commissioner. In general practice, the RNZCGP Foundation Standard expects a privacy officer on site who has completed the Commissioner's Privacy 101 and Health 101 modules, and all team members to complete current Privacy Act and Code training (Health ABC and Privacy ABC for most of the team). Whatever your setting, these are the items worth checking this quarter:

• A named privacy officer, known to staff and patients.
• A privacy statement updated for rule 3A, shown at enrolment, on the website and on posters, in accessible formats.
• An access request log with received dates, decision dates and outcomes, and a template decision letter that names withholding grounds and the right to complain.
• A written process for verifying identity before releasing information by phone, email or in person.
• Role-based access, individual logins, automatic screen lock and periodic access audits.
• Approved processes for clinical photos, email and remote work, and a list of approved AI and cloud tools with completed privacy impact assessments.
• A breach procedure covering containment, serious harm assessment, NotifyUs and patient notification, with a breach register.
• A retention and disposal policy that reflects the 10-year minimum and covers backups and vendors.
• Staff training records, refreshed annually.

Self-check: test yourself on four scenarios

Frequently asked questions

Primary sources

26 official documents

1. Office of the Privacy Commissioner: Health Information Privacy Code 2020 (code page, amendments and consultation history)
2. Office of the Privacy Commissioner: Health Information Privacy Code 2020, consolidated version in force 1 May 2026
3. Office of the Privacy Commissioner: Amendment No 2 to the Health Information Privacy Code 2020 (March 2026)
4. Office of the Privacy Commissioner: HIPC rule 3A guidance for health agencies
5. Office of the Privacy Commissioner: HIPC Factsheet 3, Disclosure of information
6. Office of the Privacy Commissioner: HIPC Factsheet 4, Dealing with access requests
7. Office of the Privacy Commissioner: HIPC Factsheet 5, Storage, security, retention and disposal
8. Office of the Privacy Commissioner: The serious threat to life or health exception in the HIPC
9. Office of the Privacy Commissioner: Withholding for prejudice to physical or mental health
10. Office of the Privacy Commissioner: How long does an agency have to respond to my request?
11. Office of the Privacy Commissioner: Disclosing information to Police, a guide for health professionals
12. Office of the Privacy Commissioner: Health on the road (June 2025)
13. Office of the Privacy Commissioner: Reporting and avoiding privacy breaches in the health sector
14. Office of the Privacy Commissioner: Case note 269784 [2016] NZPrivCmr 3, employee repeatedly accessed health records
15. Office of the Privacy Commissioner: Case note 210870 [2010] NZPrivCmr 24, medical centre fails to establish requester's identity
16. Office of the Privacy Commissioner: Poupou Matatapu, Breach management
17. Office of the Privacy Commissioner: What is a notifiable privacy breach?
18. Office of the Privacy Commissioner: How long is 72 hours? (May 2024)
19. Office of the Privacy Commissioner: What are the consequences if I breach the Privacy Act?
20. Office of the Privacy Commissioner: Prosecution policy (March 2026)
21. Office of the Privacy Commissioner: Disclosing personal information outside New Zealand
22. Office of the Privacy Commissioner: Artificial intelligence and the information privacy principles (September 2023)
23. New Zealand Legislation: Privacy Act 2020 (version as at 1 May 2026)
24. New Zealand Legislation: Health (Retention of Health Information) Regulations 1996
25. Health New Zealand Te Whatu Ora: Generative AI and large language models
26. Royal New Zealand College of General Practitioners: Foundation Standard 2.1, The Privacy Act and Health Information Privacy Code