Health Information Privacy Fact Sheet 4 : Dealing with requests for health information

Health Information Privacy Code 1994

The code regulates how health agencies (such as doctors, nurses, pharmacists, health insurers, Primary Health Organisations and District Health Boards) collect, hold, use and disclose health information about identifiable individuals.

Dealing with requests

Health agencies are often asked to disclose health information. The code always allows anonymised or statistical information to be disclosed, but closely regulates who may obtain information about identifiable individuals.

For instance, different rules apply to requests that come from:

  • •the individual
  • a parent, relative or representative of the individual
  • other clinicians
  • other agencies in the health sector, such as District Health Boards or the Ministry of Health
  • government agencies with enforcement roles, such as the Ministry of Social Development and the Police.

It is very rare that information must be provided immediately in response to a request. Unless responding to a court order or search warrant, the agency can take enough time to make a considered decision.

To help with this, all health agencies must have privacy officers, who should be the first port of call for difficult queries. The Privacy Commissioner’s office can also provide general advice – contact our enquiries line (number at the end of this fact sheet).

Requests from the individual

People have the right to access information about themselves under rule 6 of the code. This right has only a few restrictions – for instance, if disclosure would prejudice the requester’s physical or mental health, or would be an unwarranted disclosure of someone else’s affairs. The other grounds for refusal are listed in sections 27-29 of the Privacy Act. There is explanatory material available on the Privacy Commissioner’s website at

Rule 6 requests must be dealt with promptly. Agencies should either:

  • •respond (as soon as possible but within 20 working days) saying whether they will provide the information sought, and if not stating reasons for refusal or
  • transfer the request (within ten working days) to someone who is better placed to answer it.

There are strict limitations on how much (if anything) can be charged for responding to a rule 6 request. Public sector agencies like District Health Boards cannot charge at all, while private sector agencies such as GPs may only charge where they have provided the same information within the last twelve months.

Requests from parents or relatives of the individual

Parents or guardians of a child under 16 are their child’s ‘representatives’. Under section 22F of the Health Act, as representatives, they have a limited right to access health information about their child.

A representative request is equivalent to a rule 6 request and should be responded to just as promptly. The request may be refused if one of the withholding grounds (as described in Requests from the individual) applies, or if the request would be against the child’s wishes or interests.

Once a child turns 16 their parents or guardians have no special right to access their health information. However, rule 11(2)(b) of the code allows health practitioners to disclose health information to a principal caregiver or near relative. The disclosure must be in line with recognised professional practice, and there must be some reason why it is not desirable or practical to get the individual’s permission for the disclosure (for instance they are unconscious or very unwell).

Other clinicians

Multiple practitioners can need to access health information about an individual in the course of providing care to him or her. This might be because of a specialist or hospital referral, a transfer between GPs or even a medical emergency.

If the original purpose for collection was to share the information like this (and the individual was told about that purpose at the point of collection, as required by rule 3) then there are no barriers to the disclosure. Disclosure is also always allowed where the individual or their representative has given their permission.

Otherwise, section 22F of the Health Act allows people providing health services such as doctors and specialists to obtain information about their patients, on request. The information sought must be provided unless the holder of the information thinks the individual would not want the disclosure to occur, or another of the withholding grounds applies.

Government agencies

Some government agencies have powers to obtain information. Health agencies that receive a request from a government agency that refers to these powers should confirm that the power exists and that any limitations on the scope of the powers (for instance that only certain kinds of information are covered) are being followed. Notifying the individual that the disclosure has occurred is also often a good idea, even though not a legal obligation.

Government agencies that do not have information-gathering powers can, and often do, seek information to carry out their functions. Section 22C of the Health Act allows, but does not require, anyone holding health information to disclose that information to requesters from a list of specified agencies, for instance:

  • •a probation officer
  • •a Social Worker or a Care and Protection Co-ordinator or
  • a member of the Police.

The requesters must be seeking the information for the purpose of carrying out their agencies’ statutory functions, and disclosure under section 22C is always discretionary.

Where to get additional assistance

There are four other health information privacy fact sheets that give a broad overview of how the code works in practice.

For more detailed information, a copy of the Health Information Privacy Code (with explanatory commentary) is available for free download from the Privacy Commissioner’s website at, as is On the Record: a Practical Guide to Health Information Privacy.

The Privacy Commissioner also has an 0800 number, 0800 803 909, and conducts regular workshops on health information privacy.

View HIPC Fact Sheet #4, dealing with requests for health information.