Who Can Access Medical Records? NZ Business Guide

In New Zealand, health information is highly sensitive. If your business handles medical records, employee medical certificates, patient notes, ACC documents, fitness-for-work reports, insurance forms or health data in an app, you can't simply share it because someone is curious, related to the person, manages them at work, or says they need it urgently.

People can usually access their own health information, and other people or organisations can only see it where the person has authorised it, they're directly involved in care, or a specific legal exception applies. For your business, the practical question isn't just who can access medical records, but how you verify requests, limit disclosures, keep records secure and respond if something goes wrong.

If your business is an employer, health agency, wellness provider or digital health platform, you need practical rules for handling medical records and health information access requests.

What Counts As Medical Records In New Zealand?

In NZ, medical records aren't just a GP's handwritten notes. They can include any health information you hold about an identifiable person, whether it's in a clinical system, email, patient portal, booking platform, HR file, referral letter, spreadsheet or scanned document.

Common examples include:

• GP and specialist clinical notes
• Hospital records, discharge summaries and outpatient letters
• Lab results and imaging reports, including x-rays, MRIs and ultrasounds
• Prescription history, medication charts and pharmacy information
• Mental health, counselling and therapy notes, with some important limits
• ACC medical certificates, treatment injury records and rehabilitation reports
• Dental, physiotherapy, occupational therapy and allied health notes
• Referrals, consult letters and correspondence between providers
• Information held in booking apps, health platforms or online patient portals
• Employee medical certificates, workplace injury reports and fitness-for-work assessments

Legally, health information is personal information under the Privacy Act 2020. It's also covered by the Health Information Privacy Code 2020 when it's held by a health agency. The Code sets privacy rules for health information, including how information is collected, used, stored, accessed and disclosed.

If your business handles health information, even indirectly, you need stronger privacy settings than many ordinary businesses. For example, if you run a telehealth platform, wellness clinic, gym running health assessments, counselling provider, occupational health service, or software supplier to clinics, you should be clear about what you collect, why you collect it, who can access it and how long you keep it. A well drafted Privacy Policy and internal procedures are essential.

Who Can Access Medical Records?

The starting point is simple: access should be limited to the person the information is about, authorised people, people who genuinely need the information to provide care or services, and organisations with a lawful reason to receive it.

For your business, that means access should never be based on curiosity, seniority, convenience or family connection. A manager, receptionist, director, relative, partner, insurer, police officer or support person may have a good reason to ask, but your team still needs to check the legal basis before sharing anything.

In practice, access may be appropriate where:

• the individual requests access to their own records
• the individual has given informed authority for a third party to receive specific information
• healthcare providers are sharing relevant information for the person's care
• an employer is collecting limited proof of illness, injury or fitness for work
• ACC or an insurer requests relevant information for a claim, entitlement or cover decision
• a law, warrant, court order or Coroner process requires disclosure
• disclosure is necessary to prevent or lessen a serious threat to health or safety

Even where disclosure is allowed, you should still ask: what is the minimum information needed for this purpose? Sending a full file when a short certificate or targeted report would do can create unnecessary privacy risk for you and the person involved.

Responding To Access Requests From Patients, Clients Or Employees

People can usually request access to their own hospital records, GP records and other medical records about them. If you're the person the information is about, your right of access comes from the Privacy Act 2020 and the Health Information Privacy Code 2020. For your business, this means you need a clear process for recognising and responding to access requests, even if the person doesn't use legal language.

A request might arrive by email, phone, portal message, letter or in person. A patient might ask you for a full copy of their file, a client might ask for counselling notes, or an employee might ask to see a fitness-for-work report held in their HR file.

An agency must respond as soon as reasonably practicable and no later than 20 working days after receiving the request, unless a lawful extension applies. A response doesn't always mean sending every document on day 20. It means you must decide whether to provide access, refuse access, extend the timeframe, or explain what else you need.

A practical procedure for your business should include these steps:

1. Log The Request: Record the date received, who made the request, what information they're asking for, and who is responsible for responding.
2. Verify Identity: Check that the requester is the person concerned or has proper authority to act for them. Ask for ID where needed, but keep the process proportionate.
3. Clarify Scope: If the request is broad, ask whether they want a full file, a date range, a specific test, a report, notes from an appointment, or records sent to or received from another provider.
4. Find The Records: Check the systems where the information may be held, including email, portals, scanned files, HR systems and archived records.
5. Review Before Release: Consider whether any information needs to be withheld, redacted or explained, especially if it includes another person's information.
6. Provide Secure Access: Use a secure channel, such as a portal, encrypted file, secure email process or verified postal address.
7. Record The Outcome: Keep a note of what was provided, what was withheld, why, and when the response was sent.

You can refuse or limit access in some situations, but refusal shouldn't be your default. Examples include where giving access would be likely to create a serious threat to someone's life, health or safety, where the record would unreasonably reveal information about another person, or where another law prevents disclosure. If only part of a record is sensitive, consider whether you can redact that part and provide the rest.

If information is wrong or misleading, the person can request a correction. If your business doesn't agree to amend the record, you may still need to attach their statement of correction so their position travels with the file.

Family, Whanau, Children And Deceased Patients

Family members, whanau and carers don't automatically have a right to see someone's medical records, even if they're a partner, adult child, parent, caregiver or next of kin. This is an area where your front desk team and managers can feel pressure, so a simple script and escalation process can help.

Your business may be able to share information with a support person if the individual has agreed, if the support person has written authority, if the person can't consent and disclosure is necessary for care or safety, or if another legal basis applies. Written authorisation is often safest for non-urgent third-party access.

Parents and guardians can often access health information for younger children, but not always. As children get older, you may need to consider whether the young person has enough maturity and understanding to make decisions about their own health information. For teenagers, some information may be kept confidential from parents, especially where the young person is competent to decide and disclosure could undermine their care, safety or trust.

Medical confidentiality also doesn't simply disappear when someone dies. You may be asked for access by an executor or administrator, next of kin, insurer, Coroner, court, or agency with legal authority, depending on the purpose and the information requested. Before disclosing, consider the requester's role, why they need the information, whether the deceased person expressed wishes about confidentiality, and whether disclosure would affect other people's privacy.

Employers And Medical Information

Employers are common sources of confusion because you may legitimately need some health information, but that doesn't mean you can access an employee's full medical file.

If an employee takes sick leave, you can ask for proof in some situations under the Holidays Act 2003. For example, you can require proof if the employee has been sick or injured for three or more consecutive calendar days. You can also ask earlier if you tell the employee as soon as possible and meet the reasonable expenses of getting that proof.

That proof is usually a medical certificate confirming the employee is unfit for work or needs time off. It normally doesn't need to state their diagnosis, treatment history or full clinical notes. In safety-sensitive roles, you may need more information about fitness for work, restrictions or accommodations, but your request should still be necessary, proportionate and handled carefully.

If you're an employer, avoid collecting more medical information than you genuinely need. Store it securely, restrict access to people who need it for HR, payroll or health and safety reasons, and be clear with employees about why you're collecting it. Good Employment Contract terms and workplace privacy processes can reduce risk.

For example, imagine Ana works for a small construction company in Hamilton. She injures her back and takes five consecutive calendar days of sick leave. Her employer can ask for proof because the absence is three or more consecutive calendar days. Ana gives a medical certificate saying she is unfit for work for five days and should avoid lifting more than 5kg for two weeks.

The employer asks Ana's GP for her full clinical notes, x-ray report and past back injury history. The GP shouldn't provide those records just because the employer asked. Ana's certificate gives the employer enough information to manage payroll and temporary duties. If the employer genuinely needs more information for health and safety planning, the better approach is to ask Ana for consent to obtain a targeted fitness-for-work report that answers specific work-related questions.

Insurers, ACC, Police And Other External Requests

Insurers, ACC, police and government agencies may all request health information from time to time. Your team should treat these requests carefully, not automatically.

Health, life, income protection and trauma insurers often request medical information to assess an application, underwrite cover, investigate non-disclosure, or decide a claim. They usually rely on a signed authority from the individual. Before you respond, check whether the authority is current, specific enough, and actually covers the records being requested. A request for all medical records from every provider for the last 20 years may be broader than needed for a simple claim.

ACC can collect medical information relevant to an injury claim, rehabilitation, weekly compensation, treatment injury assessment or entitlements. Some of ACC's powers come from legislation, and some information sharing is supported by consent or ACC forms. You should still think about relevance and privacy, rather than sending unrelated history by default.

Police and government agencies may be able to access health information where a specific law authorises it, a warrant or court order applies, or disclosure is necessary for a serious threat to health or safety. A broad informal request isn't the same as a clear legal requirement. If your team receives a request, ask for it in writing, identify the legal basis, check the scope, and escalate it internally before disclosing.

Where possible, keep an audit trail showing what was requested, what authority was provided, what you disclosed, who approved it, and when it was sent.

Consent, Collection Notices And Online Platforms

Consent is strongest when it's informed, specific, voluntary and current. In plain English, the person should understand what information is being shared, who will receive it, why they need it, and how long the authority lasts.

Consent can be verbal in some healthcare settings, especially where information is being shared for ordinary care. Written consent is usually better for third-party access, such as insurers, employers, lawyers, support people or digital platforms, because it gives you a clear record.

If your business collects health information, your consent wording should match your real processes. A Privacy Collection Notice can explain what you collect, why you collect it, whether disclosure is compulsory or optional, who you share it with, and how people can access or correct it.

This is especially important for online services. Some records may be available through a GP patient portal, hospital portal or government health service using a My Health Account, but there's usually no single online file that contains every GP, hospital, ACC, pharmacy and specialist record about a person. If your platform lets users upload, request, view or share health records, your terms, privacy notices and access controls need to be clear about what your platform does and doesn't hold.

You should also set role-based access permissions. For example, a receptionist may need booking details, a clinician may need clinical notes, and an accounts team may need billing information, but not everyone needs access to the full record.

What To Do If Health Information Is Shared Incorrectly

If medical records or health information are accessed or shared improperly, move quickly and keep a written record. Many issues are caused by mistaken identity, outdated authorities, autocomplete email errors or unclear internal processes, but health information is too sensitive for your business to leave unresolved.

Your response plan should include:

1. Contain The Issue: Stop any further access or disclosure, recall emails if possible, disable links and secure the affected records.
2. Work Out What Happened: Identify the date, information involved, who accessed or received it, and the likely cause.
3. Assess Harm: Consider the sensitivity of the information, who received it, whether it can be misused, and the likely impact on the affected person.
4. Notify If Required: If the breach has caused serious harm or is likely to do so, notify the Office of the Privacy Commissioner and affected people as soon as practicable.
5. Fix The Process: Update permissions, templates, training, verification steps or technical controls to reduce the risk of a repeat.
6. Keep Records: Document your decisions, notifications and remediation steps.

A documented data breach response plan helps your team respond quickly and consistently. A periodic Legal Health Check can also help you spot gaps in privacy documents, access procedures and workplace processes before they become a problem.

Key Takeaways

• Health information is sensitive personal information, and your business should only collect, use or disclose it for clear and lawful reasons.
• People can usually request access to their own medical records, and you should have a documented process for responding within 20 working days unless an extension applies.
• Employers normally only need limited proof of illness or fitness for work, not an employee's diagnosis or full clinical history.
• Insurer, ACC, police and government requests should be checked for authority, relevance and scope before you release information.
• Consent should be informed, specific, voluntary and current, especially for third-party access and digital health platforms.
• If you handle health information, you need clear privacy policies, collection notices, access request procedures, staff permissions and breach response plans.

If you'd like help with health information privacy policies, access request procedures, consent wording, or employer medical information processes, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.