Privacy Act 2020 For New Zealand Clinics

Are you wondering how the Privacy Act 2020 applies to your clinic? The reassuring answer is that your obligations are manageable if you build privacy into the everyday way your team takes bookings, collects intake forms, sends reminders and uses software.

Clinics often handle some of the most sensitive information a person can share. That might include symptoms, treatment notes, ACC details, medications, mental health history, payment information and emergency contacts.

You don't need a complicated system to get privacy right. You do need clear workflows, trained staff and documents that match how your clinic actually operates.

Does The Privacy Act Apply To Your Clinic?

Yes, the Privacy Act 2020 will usually apply to your clinic if you collect, use, store or disclose personal information about patients, clients, staff or contractors.

If you provide health services, you may also need to comply with the Health Information Privacy Code 2020. The Code sits under the Privacy Act and gives more specific rules for health information about identifiable individuals in the human health and disability sector.

This can apply to many types of clinics, including:

• medical centres and specialist clinics
• physiotherapy, chiropractic, podiatry and osteopathy clinics
• dental and orthodontic clinics
• psychology, counselling and therapy practices
• beauty, cosmetic and appearance medicine clinics

Veterinary clinics will generally have Privacy Act obligations for client and staff personal information, although the Health Information Privacy Code usually applies to human health information rather than animal patient records.

The Privacy Act applies to your business as an agency. That means your obligations aren't just about clinical records. They can also cover online booking forms, reception notes, SMS reminders, staff files, email enquiries, CCTV footage and third-party software.

Your clinic also needs a privacy officer. This doesn't need to be a full-time role, but someone in your business should be responsible for privacy questions, staff training, access requests and breach response.

What Counts As Personal Or Health Information?

Personal information is any information about an identifiable person, and health information is a sensitive category that clinics need to handle with extra care.

For a clinic, personal and health information can include:

• names, dates of birth, addresses, phone numbers and email addresses
• NHI numbers, ACC claim details and insurer details
• medical history, symptoms, test results, prescriptions and treatment plans
• photos, scans, X-rays, before-and-after images and clinical notes
• appointment history, cancellations and billing records
• support person or emergency contact details
• staff information, such as employment records, medical certificates and disciplinary notes

Information can still be personal even if it seems basic. For example, a booking note saying someone is attending a fertility appointment or mental health session can reveal sensitive information.

Say Mere runs a small physiotherapy clinic in Wellington. Her receptionist writes in the diary, "Tom - back injury after work accident - ACC paperwork needed." That single note includes Tom's identity, health issue and possible workplace accident details. Mere needs to treat it as health information, not just an appointment note.

What Should Your Privacy Statement Say?

Your privacy statement or privacy policy should clearly tell people what information you collect, why you collect it, who you may share it with, how you store it and how they can access or correct it.

Under the Privacy Act and Health Information Privacy Code, you generally need to be open about your collection practices at or before the time you collect the information. For clinics, this often means having privacy wording in a few places rather than hiding everything in one long webpage.

Since 1 May 2026, clinics may also need to take reasonable steps to notify people when you collect their personal information, or health information, from someone else, unless an exception applies. This matters because clinics commonly receive information indirectly, such as referral letters from another provider, ACC or insurer information, notes from a family member or support person, or details from a person's caregiver. Your process should make sure the client still gets the key privacy information, even if they weren't the person who handed you the information first.

Your privacy statement should usually cover:

• the types of personal and health information you collect
• why you collect it, such as providing treatment, managing appointments, billing and meeting legal obligations
• whether collection is required by law or needed so you can provide services
• who may receive the information, such as treating practitioners, labs, insurers, ACC, software providers or payment processors
• where information is stored, including if cloud software stores data outside New Zealand
• how clients can request access to, or correction of, their information
• how clients can make a privacy complaint
• how long you keep health records

For many clinics, your privacy statement should appear in:

• your website footer
• online booking forms
• new client intake forms
• clinic reception signage or handouts
• terms and conditions for your services
• telehealth consent, telehealth terms or onboarding documents

Templates can be a useful starting point, but they often miss the practical details that matter for clinics, such as SMS reminders, patient management software, referral letters, clinical photos and ACC records. Your documents work best when they reflect your real workflows.

How Should You Collect, Store And Use Clinic Information?

You should only collect the information your clinic reasonably needs, store it securely and use it for the purpose you collected it for unless another lawful reason applies.

Privacy isn't just a document exercise. Your day-to-day systems matter just as much as your written policy.

Collect Only What You Need

Before adding another question to your intake form, ask whether your clinic genuinely needs the answer.

For example, a dental clinic may need medical history, current medications and allergies before treatment. It may not need detailed employment information unless it's relevant to billing, ACC or the treatment being provided.

Good collection habits include:

• explaining why sensitive questions are being asked
• separating required fields from optional fields
• avoiding open-ended forms that invite unnecessary details
• checking whether old intake questions are still relevant
• making sure staff don't write casual comments in clinical records

Store Information Securely

Your clinic should use reasonable safeguards and a clear information security policy to protect personal and health information from loss, misuse and unauthorised access.

In practical terms, this may include:

• unique logins for each staff member
• multi-factor authentication for practice management software
• role-based access, so staff only see what they need for their job
• locked cabinets for any paper records
• clear rules for taking files or devices offsite
• secure disposal of old paper records and hard drives
• regular backups and software updates
• staff training on phishing emails and accidental disclosure

If your clinic uses shared inboxes or shared reception computers, be especially careful. A lot of privacy issues happen because access is too broad or passwords are shared for convenience.

Use Information For The Right Purpose

If you collect health information to provide treatment, you should be careful about using it for unrelated purposes.

For example, if a client attends your cosmetic clinic for a consultation, you shouldn't automatically add them to a marketing list unless you have a proper basis to do so and your process is clear. The Unsolicited Electronic Messages Act 2007 may also apply to commercial emails and texts, so consent and unsubscribe functions matter.

Can You Use Reminders, Marketing And Clinic Software?

Yes, you can usually use appointment reminders, marketing tools and clinic software, but you need to make sure your privacy disclosures, consents and supplier arrangements match how those tools work.

This is where many clinics run into practical privacy issues. The tool itself may be common, but the way you use it can create risk.

Appointment Reminders

SMS and email reminders are usually fine for clinic appointments, especially where clients have given you their contact details for booking and clinic communication.

However, think carefully about what the reminder says. A message that simply says, "Your appointment is at 10am tomorrow with ABC Clinic" is lower risk than a message that reveals the service, practitioner type or medical condition.

If your clinic provides sensitive services, consider:

• asking clients their preferred contact method
• using neutral wording in reminders
• letting clients opt out of reminders
• checking mobile numbers before sending first reminders
• avoiding detailed health information in SMS messages

Marketing And Reviews

Marketing can be helpful for growing your clinic, but you need to separate service communications from promotional messages.

Before sending newsletters, promotions or review requests, check that:

• you have consent or another clear basis to send the message
• the person can unsubscribe easily
• your message doesn't reveal sensitive information to someone else who may see the phone or email
• you don't use clinical photos or testimonials without clear written consent
• your claims also comply with the Fair Trading Act 1986 and any professional advertising rules that apply to your sector

Before-and-after images deserve special care. Even if a client's face is cropped out, tattoos, birthmarks, context or treatment details may still identify them. Written consent should be specific about where the image can be used, how long it can be used and whether the client can withdraw permission later.

Clinic Software And Overseas Storage

Many New Zealand clinics use cloud-based booking, patient management, telehealth, accounting and payment systems.

Under the Privacy Act, you need to take care when disclosing personal information to an overseas recipient. If your software provider stores or accesses information overseas, you may need to be satisfied that the information will be protected by comparable privacy safeguards or that another permitted basis applies.

When choosing software, check:

• where data is hosted and whether support teams overseas can access it
• whether the supplier has clear security standards
• whether you can control staff access levels
• what happens if the supplier suffers a data breach
• how you can export your data if you change systems
• whether the contract limits how the supplier can use your clinic's data

This is also where your supplier agreements and any health data sharing agreement matter. If a software provider can use patient data for its own analytics, product development or marketing, you need to understand that before you upload clinic information.

What Happens If There Is A Privacy Breach?

If your clinic has a privacy breach that has caused, or is likely to cause, serious harm, you need to notify the Privacy Commissioner and affected people as soon as practicable.

A privacy breach can include:

• sending a referral letter to the wrong email address
• losing a clinic laptop or phone
• a staff member accessing records without a work reason
• a cyber attack on your practice management system
• leaving paper files visible at reception
• posting an identifiable client image online without proper consent

Not every breach is notifiable. You need to assess whether serious harm is likely. This depends on things like the sensitivity of the information, who received it, whether it was protected, whether it can be contained and the likely impact on the person.

Your breach response plan should set out:

• who staff must tell internally when something goes wrong
• how you'll contain the breach quickly
• who will assess whether notification is required
• how you'll communicate with affected people
• how you'll record the breach and your response
• what changes you'll make to reduce the chance of it happening again

Speed matters, but so does accuracy. A calm, prepared process helps you avoid panic decisions and shows your clinic is taking privacy seriously.

How Long Do You Need To Keep Clinic Records?

You generally need to keep health records for at least 10 years from the day after you last provided health services to the person, under the Health (Retention of Health Information) Regulations 1996.

That minimum retention period is especially relevant for health providers. Some professional standards, funding arrangements or insurer requirements may affect how long you keep particular records, so check the rules that apply to your profession and clinic model.

Once you no longer need records, dispose of them securely. Don't place old files in ordinary rubbish or leave them in an unlocked storage room. For digital records, check whether deletion removes the data from backups and connected systems, or whether it only hides the record from your dashboard.

Your clinic should have a retention policy that covers:

• clinical records
• intake forms, consent forms and access request forms
• billing and payment records
• ACC and insurer records
• staff records
• marketing consent records
• CCTV footage, if used

Staff records aren't always health records, but they're still personal information. If you're an employer, keep employment information secure and limit access to people who need it for payroll, HR or management reasons.

Common Mistakes To Avoid

The most common privacy mistakes in clinics are usually practical workflow problems, not dramatic legal failures.

Watch out for these issues:

• Using one shared login: If everyone uses the same account, it's hard to track who accessed or changed records.
• Collecting too much information: Long intake forms can create unnecessary privacy risk if the answers aren't needed.
• Sending detailed reminders: SMS messages can be seen by family members, flatmates or colleagues.
• Relying on verbal consent for photos: Written consent is much safer, especially for marketing images.
• Forgetting about supplier access: Your software, IT support and marketing platforms may all touch personal information.
• Not training reception staff: Reception teams often handle the most privacy-sensitive moments, including phone calls, waiting rooms and email enquiries.
• No breach plan: If something goes wrong, you don't want your team guessing who to tell or what to do next.

A simple privacy audit can help. Follow one client's journey through your clinic, from first booking to discharge or follow-up marketing. At each point, ask what information you collect, where it goes, who can see it, what you tell the client and how long you keep it.

Key Takeaways

• The Privacy Act 2020 applies to most New Zealand clinics, and health providers also need to consider the Health Information Privacy Code 2020.
• Your clinic should have a clear privacy statement, a privacy officer and day-to-day workflows that protect client information.
• Since 1 May 2026, clinics may need to notify people when collecting their information indirectly, such as from referrers, ACC, insurers or support people.
• Bookings, intake forms, reminders, clinical photos and software all need privacy checks because they can reveal sensitive information.
• Serious privacy breaches must be assessed quickly and may need to be notified to the Privacy Commissioner and affected people as soon as practicable.
• Health records generally need to be kept for at least 10 years after you last provided health services, unless other rules require longer.

If you'd like help with your clinic privacy statement, intake and consent forms, software privacy checks or data breach response plan, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.