Do Telehealth Clinics Need Privacy Consent In New Zealand?

Mia runs a small online clinic in Wellington. Patients book through her website, fill in a health questionnaire, have a video appointment, receive follow-up notes by email, and sometimes get referred to a specialist.

It feels simple for patients, which is the whole point. Behind the scenes, though, Mia is collecting some of the most sensitive information a business can hold: health information.

If you run a telehealth clinic in New Zealand, privacy consent isn't just a box to tick. It needs to connect properly with your privacy notice, online clinic consent form, software tools, patient messages, information security policy settings and day-to-day health information handling.

The good news is that this doesn't have to be complicated. With the right documents and processes, you can make the patient experience smooth while keeping your clinic protected.

Do Telehealth Clinics Need Privacy Consent In New Zealand?

Yes, in most cases you should get clear privacy consent when you collect, use or share patient information online, but consent is only one part of your privacy obligations.

Telehealth clinics in New Zealand need to comply with the Privacy Act 2020 and the Health Information Privacy Code 2020. The Code applies extra health-specific rules to the way you collect, store, use and disclose health information.

Health information can include:

• Symptoms, diagnoses, treatment notes, biometric details and prescriptions
• Medical history, medications and allergies
• Mental health information
• ACC details or referral information
• Photos, videos, test results and uploaded documents
• Names, contact details, dates of birth and NHI numbers where used in a health context
• Payment or booking information linked to health services

Consent is especially useful where you want to do something the patient may not reasonably expect. For example, you may need clear wording if you share information with an overseas platform, send health-related messages by email or SMS, or disclose information to another provider as part of a referral.

Privacy consent should also sit alongside clinical informed consent. They're related, but they aren't the same thing.

• Privacy consent is about how you collect, use, store and share personal and health information.
• Clinical informed consent is about whether the patient understands and agrees to the health service, treatment or consultation itself.

For health services, the Code of Health and Disability Services Consumers' Rights also matters. Patients have rights to information and informed choice. So, your telehealth consent process should cover both the privacy side and the care delivery side.

What Should A Telehealth Privacy Policy Say?

Your telehealth privacy policy should clearly explain what information you collect, why you collect it, how you use it, who you share it with, where it may be stored, and how patients can access or correct it.

A good privacy policy isn't just website wording. It's the main privacy notice patients rely on when deciding whether to give you their information.

For a telehealth clinic, your privacy policy will usually need to cover:

• What health and personal information you collect during bookings, consultations and follow-up care
• Whether you collect information directly from patients, from referrers, carers, parents, guardians, other providers or third-party platforms
• The purposes for collection, such as providing consultations, issuing prescriptions, managing referrals, taking payments and improving your service
• Who may access patient information within your business
• When you may share information with GPs, specialists, pharmacies, labs, payment providers, insurers, ACC, regulators or emergency services
• Which software tools you use to book appointments, host video calls, store records, send messages or process payments
• Whether information may be stored or accessed outside New Zealand
• How patients can request access to or correction of their information
• How patients can make a privacy complaint
• How long you keep information and when you may delete or de-identify it

Plain language matters here. If your patient is reading your privacy policy on their phone before a consultation, they shouldn't need a law degree to understand it.

Try to avoid vague phrases like we may share your information with trusted partners. Instead, say what types of service providers are involved and why they need access.

For example, you might say your clinic uses secure booking software to manage appointments, video consultation software to deliver appointments, and payment processors to take fees. If any of these providers may store or access patient information overseas, say that too.

What Should An Online Clinic Consent Form Include?

An online clinic consent form should cover both consent to the telehealth service and consent to the privacy handling that supports it.

This is where many clinics fall short. A simple checkbox saying I consent may not be enough if the patient hasn't been told what they're consenting to.

Your consent form should be easy to read and should usually appear before the patient provides detailed health information or attends the consultation. You may build it into your intake form, booking flow or patient portal.

Privacy Consent Wording

Your privacy consent wording should make it clear that the patient agrees to your clinic collecting, using and sharing their information for specific purposes.

For example, your wording might cover consent for your clinic to:

• Collect health information through online forms, video consultations, phone calls, emails and uploaded documents
• Use that information to assess the patient, provide health services, issue prescriptions and arrange follow-up care
• Share relevant information with pharmacies, laboratories, referral providers or other health professionals involved in the patient's care
• Use third-party software providers to host consultations, store records, send messages and process payments
• Contact the patient about appointments, results, prescriptions, recalls and care-related updates

You should also point the patient to your privacy policy before they consent. The form and policy should match. If one says you use overseas software and the other does not, that creates confusion.

Telehealth Service Consent

Your online consent form should also explain how telehealth works and its limits.

This might include:

• Telehealth may not be suitable for every condition
• The clinician may recommend an in-person appointment or urgent care
• Video or audio quality may affect the consultation
• The patient should provide accurate information and update you if anything changes
• The patient should be in a private and safe location for the consultation
• Your clinic may need to confirm the patient's identity
• Your clinic may need emergency contact or location details in some situations

For example, say you provide online mental health consultations. If a patient discloses a serious and immediate risk of harm, your team may need to contact emergency services or another appropriate support. Your privacy wording should explain that you may disclose information where needed to prevent or lessen a serious threat to health or safety.

Can You Share Patient Information With Other Providers?

Yes, you can share patient information with other providers where it's needed for care and the disclosure is allowed under the Privacy Act 2020 and the Health Information Privacy Code 2020.

In many telehealth settings, sharing information is part of providing the service. For example, you may need to send a prescription to a pharmacy, refer a patient to a specialist, order lab tests, use a health data sharing agreement or update the patient's regular GP.

The safer approach is to tell patients about these disclosures upfront and get consent where appropriate. This is especially true if the disclosure isn't obvious from the service they requested.

You should think carefully about:

• Purpose: Why are you sharing the information?
• Minimum necessary: Are you only sharing what the recipient needs?
• Recipient: Is the recipient a health provider, software provider, funder, insurer, regulator or someone else?
• Patient expectation: Would the patient reasonably expect this disclosure?
• Consent: Have you told the patient and, where needed, obtained clear consent?
• Records: Are you recording what was shared, with whom and why?

Be careful with disclosures to family members, employers, schools, sporting organisations or other third parties, and consider whether a privacy consent form is needed. Even if someone is trying to help the patient, you shouldn't assume you can share health information with them.

If you treat children or young people, your consent and privacy process may need extra thought. The right approach can depend on the young person's age, maturity, the service being provided and who is paying for or booking the appointment.

What If Your Telehealth Software Stores Data Overseas?

You can use overseas software tools, but you need to understand where patient information goes and whether the arrangement meets New Zealand privacy requirements.

Telehealth clinics often use a mix of tools, such as:

• Video consultation platforms
• Practice management systems
• Online booking tools
• Electronic prescribing tools
• Payment processors
• Email, SMS and reminder platforms
• Cloud storage and analytics tools

Some of these providers may store data in Australia, the United States, the European Union or other locations. Some may also allow overseas support teams to access data.

Under the Privacy Act 2020, overseas disclosures can trigger extra obligations. In some cases, sending information to an overseas provider for storage or processing on your behalf may be treated differently from disclosing it to an overseas recipient for their own use. Either way, you still need strong contractual and security controls.

Before you use a platform for patient information, check:

• Where the data is stored and backed up
• Who can access the data and from which countries
• Whether the provider can use patient information for its own purposes, such as product development or advertising
• Whether the provider has security measures such as encryption, access controls and audit logs
• Whether you can export or delete data if you leave the platform
• Whether the contract requires the provider to help with privacy requests and privacy breaches
• Whether the provider notifies you promptly if there's a security incident

This is also where template documents can miss the mark. A generic privacy policy may not mention your actual software stack, and a generic supplier contract may not deal properly with health information, breach notification or overseas access.

If a platform's terms allow it to use patient information for broad purposes, think carefully before using it for clinical data. Patient trust is hard to win back if your tools do more with their information than they expected.

How Should You Communicate With Patients Online?

You can communicate with patients online, but you need to choose channels that are suitable for the sensitivity of the information being shared.

Many patients prefer email or SMS because it's convenient. That doesn't mean every message should include detailed health information.

For lower-risk communications, email or SMS may be suitable. This can include appointment reminders, payment confirmations or a prompt to log into a secure portal.

For more sensitive communications, consider using a secure patient portal or another protected channel. This can include test results, detailed clinical notes, mental health information, prescriptions, medical release consent forms or specialist reports.

Your patient communication process should cover:

• What types of information you send by email, SMS, portal message or phone
• Whether patients can choose their preferred communication channel
• Whether you warn patients about the risks of email and SMS
• How you confirm patient identity before discussing health information
• What happens if a message bounces or is sent to the wrong contact details
• Who in your team can send messages and access message histories

For example, Luca runs a teledermatology clinic. His booking system sends an SMS saying the appointment is confirmed, but clinical photos and treatment notes are only shared through the clinic's secure portal. That split keeps the patient experience convenient without putting sensitive information into ordinary text messages.

You should also train your team on patient communications. A strong privacy policy won't help much if staff routinely send sensitive results to shared family email addresses without checking consent.

What Happens If There Is A Privacy Breach?

If a privacy breach is likely to cause serious harm, you usually need to notify the Office of the Privacy Commissioner and affected individuals as soon as practicable.

Under the Privacy Act 2020, a notifiable privacy breach can include unauthorised access, loss, disclosure or alteration of personal information where serious harm is likely. In telehealth, that could include a misdirected referral letter, a hacked patient database, a lost device with consultation notes, or an email attachment sent to the wrong person.

Serious harm can depend on factors such as:

• The sensitivity of the information
• Whether the information is protected by encryption or passwords
• Who received or accessed it
• Whether the information could lead to financial loss, humiliation, discrimination or other harm
• Whether you have taken steps to reduce the risk

Your clinic should have a simple privacy breach response plan before something goes wrong.

What Your Breach Plan Should Cover

Your plan should set out who does what, so your team isn't making it up under pressure.

• How staff report a suspected breach internally
• Who investigates and makes decisions
• How you contain the breach, such as disabling access or recalling an email
• How you assess whether serious harm is likely
• When and how you notify the Office of the Privacy Commissioner
• What you tell affected patients
• How you document the incident and improve your systems afterwards

Speed matters, but accuracy matters too. If you're unsure whether a breach is notifiable, get tailored advice promptly and keep clear records of your decision-making.

Key Takeaways

• Telehealth privacy consent in New Zealand should work together with your privacy policy, online consent form and clinical informed consent process.
• The Privacy Act 2020 and Health Information Privacy Code 2020 set key rules for collecting, using, storing and sharing patient health information.
• Your privacy policy should name the types of information you collect, who you share it with, and whether overseas software providers may access or store it.
• Your online clinic consent form should explain both how telehealth works and how patient information will be handled.
• Be careful with email, SMS, overseas software tools and disclosures to third parties, as these are common risk areas for online clinics.
• Have a privacy breach response plan ready so you can act quickly if patient information is lost, misdirected or accessed without authority.

If you'd like help with your telehealth privacy policy, patient consent wording, health information processes and software provider contracts, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.