Health Information Privacy in NZ — Your Records (2026)
About this article
Sourced from New Zealand Acts of Parliament (legislation.govt.nz), regulations, and official government guidance. Written in plain language for general understanding — this is educational content, not legal advice. Our editorial standards
What is this right?
Your medical and health information gets extra protection under the Health Information Privacy Code 2020, issued under the Privacy Act 2020. The Code applies to GPs, hospitals, specialists, pharmacists and other health agencies, and sets specific rules on how your health information is collected, stored, used and shared.
Under Rule 6, you have the right to access your own health records — to see your notes, test results and correspondence — usually within 20 working days. You can also ask for corrections under Rule 7. Health providers can only share your information in defined circumstances (such as for your care, or where the law requires). Complaints go to the Office of the Privacy Commissioner and, separately, treatment concerns can go to the Health and Disability Commissioner.
When does it apply?
- You want a copy of your medical records or test results.
- You think your health information was shared without authority.
- There's an error in your health record.
What to do to access your health records
- Ask your provider in writing for your records under Rule 6 of the Health Information Privacy Code.
- Request corrections for any errors (Rule 7).
- Complain to the OPC if access is refused or information was misused.
What should you NOT do?
- Don't accept a flat refusal — access can only be declined on specific grounds.
- Don't confuse a privacy complaint with a treatment complaint — care quality goes to the HDC.
About Data Privacy & Digital Rights in New Zealand
New Zealand's Privacy Act 2020 gives you real control over your personal information through 13 Information Privacy Principles (IPPs). You can access what an organisation holds about you (IPP 6) and ask it to correct mistakes (IPP 7), usually free and within 20 working days. Organisations that suffer a serious data breach must notify the Office of the Privacy Commissioner (OPC) and affected people. Complaints go to the OPC and, if needed, the Human Rights Review Tribunal, which can award damages. Government-held information is accessed under the Official Information Act 1982, and online harm is handled under the Harmful Digital Communications Act 2015.
OPC: 0800 803 909. Online harm (Netsafe): 0508 638 723.
Common Questions
What is the health information privacy right in New Zealand?
Your medical and health information gets extra protection under the Health Information Privacy Code 2020, issued under the Privacy Act 2020. The Code applies to GPs, hospitals, specialists, pharmacists and other health agencies, and sets specific rules on how your health information is collected, stored, used and shared.Under Rule 6, you have the right to access your own health records — to see your notes, test results and correspondence — usually within 20 working days. You can also ask for corrections under Rule 7. Health providers can only share your information in defined circumstances (su...
When does it apply — health information privacy?
You want a copy of your medical records or test results.You think your health information was shared without authority.There's an error in your health record.
How do I get a copy of my medical records in New Zealand?
Ask your provider in writing for your records under Rule 6 of the Health Information Privacy Code.Request corrections for any errors (Rule 7).Complain to the OPC if access is refused or information was misused.
What should you NOT do — health information privacy?
Don't accept a flat refusal — access can only be declined on specific grounds.Don't confuse a privacy complaint with a treatment complaint — care quality goes to the HDC.