Health Data Sharing Agreements For Clinics In NZ

Amelia runs a physiotherapy clinic in Wellington. Her team receives referrals from GPs, sends progress notes back to referrers, and uses booking and practice management software that stores patient information in the cloud.

Everything works well until a referrer asks for more detailed treatment notes, the software provider updates its data terms, and a patient asks exactly who has access to their health information. Suddenly, a process that felt normal and efficient starts to feel legally messy.

If your clinic, health platform or referral network shares patient information, a clear data sharing agreement can make everyone more confident. It helps you document who is responsible for what, how consent is handled, and what happens if something goes wrong.

Do You Need A Health Data Sharing Agreement In NZ?

Yes, you should use a health data sharing agreement if your business regularly shares patient information with referrers, healthcare providers, software platforms or referral partners.

New Zealand privacy law doesn't use one single document called a health data sharing agreement. The need comes from your obligations under the Privacy Act 2020 and the Health Information Privacy Code 2020, which set rules for collecting, using, storing and disclosing health information.

Health information is treated as sensitive because it can include details about a person's body, mind, treatment, medication, disability, ACC history, mental health, family circumstances and contact details. If that information is mishandled, the impact on the patient can be serious.

A written agreement is especially useful where:

• your clinic sends referral updates to GPs, specialists, insurers or other providers
• your platform connects clinics, practitioners and patients
• you use software providers to store or process patient information
• you share information with contractors, locums, virtual assistants or admin support
• you receive referrals from gyms, employers, schools, aged care providers or community organisations
• more than one business is involved in deciding how patient information is used

Without a written agreement, you may still be legally responsible for privacy compliance, but you may struggle to prove what each party agreed to do. You may also end up with gaps around consent, security, access requests, breach reporting and patient complaints.

What Counts As Health Information?

Health information is a broad category, and it usually covers more than clinical notes.

Under the Health Information Privacy Code 2020, health information can include information about a person's health, disability, health services, donations of body parts or substances, and other information collected by a health agency to provide health services.

For a clinic or health platform, health information might include:

• names, dates of birth, contact details and emergency contacts
• referral letters and referral reasons
• clinical notes, diagnoses, treatment plans and progress reports
• test results, images, prescriptions and medication history
• ACC details, insurer details and funding information
• appointment history and attendance notes
• billing information linked to a health service
• messages between a patient and practitioner
• telehealth recordings or transcripts, if you create or store them
• metadata that shows when a patient booked, cancelled or received care

Even information that looks administrative can become health information when it reveals something about a patient's care. For example, an appointment reminder from a fertility clinic, addiction service or mental health provider can say a lot even if it contains no clinical notes.

This is why your data sharing agreement should cover both clinical and operational information. If you only protect obvious medical notes, you can miss the parts of your workflow where privacy risks actually happen.

Can You Share Patient Information With Referrers?

Yes, you can share patient information with referrers where you have a lawful basis, clear patient consent where needed, and the sharing is connected to the patient's care or another permitted purpose.

In practice, clinics often share information with referrers to coordinate treatment. For example, a physiotherapist may send a GP a discharge summary, or a psychologist may send a brief update to a referring doctor where the patient has agreed.

The safer approach is to be clear with patients at the start about:

• what information you collect
• why you collect it
• who you may share it with
• whether sharing is optional or necessary for care
• how they can ask questions, access their information or correct it

From 1 May 2026, the Health Information Privacy Code 2020 also includes Rule 3A for indirect collection of health information. If your clinic or platform receives health information from someone other than the patient, such as a referrer, another provider, an insurer or a third-party platform, you should assess whether Rule 3A requires a notice to the patient. Your privacy notice and data sharing agreement should also say who is responsible for giving any required indirect collection notice.

You don't always need a separate signed consent form for every single disclosure. However, you should be able to show that the patient was properly informed and that the sharing is authorised, was one of the purposes for which the information was obtained, or fits another permitted reason under the Privacy Act 2020 and Health Information Privacy Code 2020.

Say Amelia's physio clinic receives a referral from a GP. At intake, the patient signs up through an online form that explains the clinic may send relevant assessment findings and progress updates back to the referring GP. In that case, a concise update about the treatment plan will usually be easier to justify than sending the patient's full file without checking whether that level of detail is needed.

The practical test is: does the recipient need this information for the purpose the patient was told about? If not, pause and get tailored advice before sharing.

Do You Need Patient Consent For Clinic Referral Data?

It depends on what you're sharing, who you're sharing it with, and what the patient has already been told.

Consent isn't the only basis for handling health information, but it's often a key part of a good referral process. The Health Information Privacy Code 2020 permits some uses for a directly related purpose. For disclosures, you generally need authorisation, disclosure must be one of the purposes for which the information was obtained, or another Rule 11 exception must apply. A directly related disclosure may be available only where it isn't desirable or practicable to obtain authorisation and the relevant Rule 11 conditions are met. So, relying on implied consent can be risky if your process is unclear.

When Express Consent Is Sensible

You should strongly consider clear, express consent where:

• you're sending detailed clinical notes rather than a short update
• the recipient isn't a registered health provider involved in the patient's care
• you're sharing information with an employer, school, insurer, gym or community organisation
• you're using health information for research, training, analytics or marketing
• you're recording telehealth sessions
• you're sharing particularly sensitive information, such as mental health, sexual health, family violence or addiction treatment details

What Good Consent Looks Like

Good patient consent is specific, informed and voluntary. Your patient should understand what they're agreeing to, not just click through a vague privacy statement.

Your consent form wording should cover:

• the categories of information being shared
• the names or types of recipients
• the reason for sharing
• how long the consent lasts
• whether the patient can withdraw consent
• what may happen if they don't consent, such as limits on coordinated care

Templates can be a useful starting point, but health workflows vary a lot. A dental practice, telehealth platform, fertility clinic and occupational health provider may all need different consent wording.

What Should A Health Data Sharing Agreement Include?

A health data sharing agreement should clearly set out the information being shared, the purpose of sharing, each party's responsibilities, and the processes for consent, security and breaches.

Think of the agreement as the operational rulebook between your business and the other party. It should match what actually happens in your booking system, referral pathway, patient portal and admin processes.

Core Clauses To Include

A well-drafted agreement will usually cover:

• Parties: who is sharing information and who is receiving it
• Purpose: why information is shared, such as patient care coordination, referrals, reporting or platform support
• Data categories: what types of health information, contact details, billing data or usage data are included
• Patient notices and consent: who is responsible for telling patients and collecting any required consent
• Permitted use: what each party can and can't do with the information
• Security standards: access controls, password practices, encryption, staff permissions and device security
• Subcontractors: whether software providers, hosting providers or admin contractors can access the information
• Overseas storage or processing: whether information is stored or accessed outside New Zealand, and what safeguards apply
• Access and correction requests: how patient requests will be handled and who responds
• Retention and deletion: how long information is kept and what happens when the relationship ends
• Privacy breaches: notification steps, timeframes, cooperation and record keeping
• Audit or review rights: how you can check whether the other party is meeting its obligations
• Liability: who is responsible if a breach, misuse or unauthorised disclosure occurs

If you operate a software platform, your agreement may also need technical terms about API access, data exports, backups, integrations, user permissions and support staff access.

Controller Or Processor Style Responsibilities

New Zealand privacy law doesn't use exactly the same controller and processor language as some overseas regimes, but the concept is still useful. You should be clear about whether each party is making its own decisions about patient information, or only handling it on your instructions.

For example, a clinic may decide why and how patient information is collected for treatment. A cloud software provider may only store and process that information so the clinic can run its practice. Those roles should be reflected in the contract.

How Do Privacy Act Rules Apply To Software Platforms?

Software platforms are usually part of your privacy compliance picture, even if they never speak directly to your patients.

If your clinic uses booking software, practice management tools, online forms, email marketing tools, AI transcription tools or telehealth platforms, patient information may be collected, stored, accessed or processed by third party systems. You need to know what those systems do with the data.

Before you use a platform for health information, check:

• where the data is hosted
• whether support teams can access patient information
• whether data is used for analytics, product improvement, AI training, cookies or marketing
• whether the provider uses subcontractors
• how backups and deletion work
• whether audit logs are available
• what happens if you leave the platform
• how quickly the provider will tell you about a security incident

The Privacy Act 2020 includes specific rules around disclosing personal information overseas. If health information is stored or processed outside New Zealand, you need to be comfortable that appropriate privacy protections apply. This can be more than a technical IT question because your patient notice and contract terms may need to reflect the offshore arrangement.

If your platform uses AI features, be especially careful. You should check whether patient information is used to train models, whether data is de-identified, and whether patients have been told about that use. De-identification can be helpful, but it needs to be done properly. Simply removing a name may not be enough if the person can still be identified from other details.

What Happens If There Is A Privacy Breach?

If there's a privacy breach, you need to assess it quickly, contain it, and decide whether it's a notifiable privacy breach under the Privacy Act 2020.

A privacy breach can include unauthorised access, accidental disclosure, loss of information, cyber incidents, emails sent to the wrong person, or a staff member viewing records they don't need for their role.

Under the Privacy Act 2020, a notifiable privacy breach is one that has caused serious harm, or is likely to cause serious harm, to an affected person. If the threshold is met, the agency must notify the Privacy Commissioner and affected individuals as soon as practicable after becoming aware that the breach is notifiable.

Your data sharing agreement should make breach handling practical, not theoretical. It should say:

• who must notify whom when a suspected breach occurs
• what information must be provided in the first notice
• who contacts affected patients
• who reports to the Privacy Commissioner if required
• how the parties will cooperate with investigation and containment
• who pays reasonable costs caused by their own breach
• how records of the breach will be kept

Speed matters because patient trust can be damaged by silence or confusion. If two businesses are involved and each assumes the other is handling it, you can lose valuable time.

How Do You Set Up A Safer Referral Data Process?

You set up a safer process by mapping the data flow first, then matching your notices, consents, agreements and internal procedures to that flow.

You don't need to make this overly complicated. Start with what actually happens in your business.

1. Map The Referral Journey: write down how patient information enters your business, who sees it, where it's stored, and where it's sent.
2. Identify Each Recipient: list referrers, providers, software platforms, contractors, funders and admin support who may access the information.
3. Check The Purpose: decide why each recipient needs the information and whether the patient has been told.
4. Review Your Privacy Notice: make sure it clearly explains your collection, use, disclosure, storage and access practices, including any indirect collection notices required under Rule 3A.
5. Tighten Consent Steps: update intake forms, referral forms or platform prompts where express consent is needed.
6. Put Agreements In Place: use written terms with referrers, platform providers and contractors who handle health information.
7. Train Your Team: make sure staff know what can be shared, with whom, and how to check if they're unsure.
8. Review Regularly: revisit the process when you add a new platform, referral partner, contractor or service line.

One common mistake is to treat privacy as a document problem only. Your privacy policy and internal information security policy might say the right things, but if your receptionist, practitioner and software provider are all doing something different, the paperwork won't protect you well.

Another common mistake is oversharing. A referrer may ask for a full file when a short update is enough. Sharing less, but sharing the right information, is often the safer and more professional option.

Key Takeaways

• A health data sharing agreement in NZ helps clinics, referrers and platforms document how patient information is shared and protected.
• The Privacy Act 2020 and Health Information Privacy Code 2020 are central to health information sharing, especially around notice, consent, use, disclosure and security.
• From 1 May 2026, clinics and platforms that receive health information indirectly should check Rule 3A notice obligations.
• Patient consent should be clear where information is sensitive, detailed or shared outside the direct care team.
• Your agreement should cover permitted use, security, overseas storage, subcontractors, access requests, retention, deletion and privacy breaches.
• Good privacy processes build patient trust and help your business work smoothly with referrers and service partners.

If you'd like help with your data sharing agreements, patient consent wording, privacy notices or software provider terms, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.