What Medical Information Can Employers Request In New Zealand?

As a small business owner, you’ll sometimes need medical information to manage leave, keep your workplace safe, and plan staffing. But health information is also some of the most sensitive personal information you can hold.

So what medical information can employers ask for in New Zealand, and where’s the line?

This guide explains the practical “do’s and don’ts” for medical information requests in New Zealand workplaces, including what you can request, when you can request it, and how to handle it lawfully under New Zealand privacy and employment laws.

Why Medical Information Is A High-Risk Area For Employers

From an employer perspective, medical info usually comes up for one of three reasons:

• Leave management (for example, sick leave, long absences, or patterns of absence)
• Fitness for work (for example, whether a worker can safely perform their role)
• Health and safety (for example, managing a risk of harm to the worker or others)

The challenge is that you generally can’t collect medical information “just in case” or out of curiosity. In New Zealand, health information is treated as sensitive information and attracts stricter expectations around:

• Purpose (why you need it)
• Necessity (whether you truly need that level of detail)
• Consent and fair collection
• Storage and access controls

In practice, the key principle is: ask for the minimum medical information needed to address a legitimate workplace issue.

As a starting point, it’s smart to have clear employment documentation in place (including an Employment Contract) and a consistent Workplace Policy framework that explains how you handle leave, privacy, and fitness-for-work concerns.

What Counts As “Medical Information” In A Workplace Context?

Medical information doesn’t just mean a diagnosis. In an employment context, “medical information” can include anything that reveals or suggests a person’s health status, such as:

• Medical certificates and doctor’s notes
• Details of an illness, injury, diagnosis, or symptoms
• Mental health information (for example, anxiety, depression, stress-related conditions)
• Medication details (in some contexts)
• Fitness-for-work restrictions (for example, “no lifting over 10kg for 6 weeks”)
• Results of a drug/alcohol test (where testing is lawful and properly implemented)
• ACC-related medical information (where relevant to work capacity or return-to-work planning)

Under the Privacy Act 2020, health information is protected personal information. In some cases, organisations that are “health agencies” also need to comply with the Health Information Privacy Code 2020 - but most employers are primarily regulated by the Privacy Act unless they’re providing health services (for example, workplace health clinics) or otherwise meet the definition of a health agency. Even if you receive health details informally (for example, an employee telling a manager they’re on medication), you should still treat it as sensitive and restrict who has access.

When Can You Ask For Medical Information (And What Can You Ask For)?

There isn’t one single rule that applies to every scenario, but these practical categories cover most employer situations.

1) Sick Leave And Medical Certificates

If an employee is off sick, you can sometimes request a medical certificate to verify they’re not well enough to work.

Common, practical approach:

• If the sick leave is 3 or more consecutive calendar days, you can generally ask for proof (for example, a medical certificate).
• You may also be able to request proof earlier (for example, on day 1 or 2), but there are conditions and cost implications depending on the situation.

Important detail: under the Holidays Act 2003, if you require proof before the employee has been sick or injured for 3 consecutive calendar days, you generally need to tell them as early as possible (for example, within the first 3 days) and you may need to pay the reasonable expenses of getting that proof (for example, the cost of a GP visit) if the employee asks.

What you should ask for: usually confirmation that the employee is unfit for work (and, where relevant, the expected duration).

What you should generally avoid asking for: the diagnosis or detailed symptoms, unless there’s a genuine, lawful reason you need it (for example, a safety-critical role where specific restrictions matter).

Tip: train your managers not to “dig” for details. If you need more than a standard medical certificate, you should be clear about why you need it and what decision it will inform.

2) Fitness For Work And Return-To-Work Questions

You can ask for medical information where it’s genuinely necessary to confirm whether someone can:

• perform the inherent requirements of their role
• return to work safely
• work with modifications or restrictions

This is especially relevant after an injury, surgery, prolonged illness, or where you have credible reasons to believe the employee may not be fit to work safely.

Best practice is to focus on “capacity” not “diagnosis”. For example:

• “Are they fit to return to work from ?”
• “Can they work full duties?”
• “What restrictions or accommodations are recommended, and for how long?”

If you need medical confirmation for return-to-work planning, it can be appropriate to request consent to liaise with a treating practitioner using a Medical Release Consent Form (particularly if you need clarification about restrictions).

3) Health And Safety (Safety-Critical Work)

Under the Health and Safety at Work Act 2015, you must take reasonably practicable steps to keep workers and others safe.

That doesn’t give you an open licence to collect detailed medical histories. But it can justify asking for medical information where:

• the role is safety-sensitive (for example, operating machinery, driving, working at heights)
• there’s a specific safety risk you’re managing
• the information is necessary to reduce a real risk of harm

Keep the question targeted. For example, “Are there any medical restrictions that affect safe operation of ?” is usually more defensible than “Do you have any medical conditions?”

4) Pre-Employment Medical Questions

Hiring is where many businesses accidentally step into risky territory.

As a general rule, you should avoid broad or intrusive health questions during recruitment. Medical questions can also intersect with discrimination risk under the Human Rights Act 1993 (for example, discrimination on the basis of disability).

What you can do instead:

• Ask whether the candidate can perform the inherent requirements of the role (with reasonable accommodations if needed).
• Ask about restrictions relevant to safety-critical duties (where that is genuinely part of the job).
• If a medical assessment is genuinely necessary, consider doing it after a conditional offer, and only collect what you need.

What to avoid:

• “Do you have any mental health issues?”
• “Do you have any disabilities or health conditions?” (as a broad screening question)
• “What medications are you on?” without a clear, role-specific justification

If you’re employing staff for the first time (or growing quickly), it’s worth having recruitment and privacy handling baked into your systems, including an Employee Privacy Handbook and a fit-for-purpose Privacy Policy (especially if you also collect customer data and want one consistent privacy posture across the business).

5) Drug And Alcohol Testing

Drug and alcohol testing is one of the most sensitive areas because it involves:

• collection of health information
• potential disciplinary outcomes
• privacy and employment process requirements

Testing is not “standard” across all workplaces. It’s usually more justifiable in safety-sensitive roles and where you have a strong, well-communicated policy and a fair process.

In practice, drug and alcohol testing generally needs to be justified by the nature of the work and implemented lawfully (for example, supported by an employment agreement/policy, clear procedures, proper notice, and a fair process). If you do conduct testing, you should use clear consent-based documentation and procedures (for example, a Drug Test Consent Form) and ensure you only collect and store results in a controlled, need-to-know way.

How Should You Ask For Medical Information (Without Overstepping)?

Even if you have a lawful reason to ask, how you ask matters. A clumsy request can create employee relations issues, privacy complaints, and procedural unfairness risks.

Start With The Business Reason (And Document It)

Before you request anything, get clear internally on:

• What decision you’re trying to make (for example, approving leave, planning return to work, managing a safety risk)
• What information you actually need to make it
• Whether there’s a less intrusive way to get it

If the issue becomes contentious later, being able to show that the request was purpose-based and proportionate is important.

Ask For Capacity/Restrictions, Not Diagnoses

A good rule of thumb: you rarely need the “label”; you usually need the impact on work.

Instead of asking “What’s wrong?”, ask questions like:

• “Are you fit to work your normal duties?”
• “Do you need temporary adjustments?”
• “When will you be reviewed?”

This approach also reduces the chance you unintentionally collect information that triggers discrimination concerns.

Get Consent Where Appropriate

If you’re requesting information beyond a standard medical certificate (for example, asking a doctor for clarification), you generally need the employee’s informed consent.

Consent should be:

• specific (what info, from whom, for what purpose)
• voluntary (no heavy-handed pressure)
• informed (the employee understands how it will be used and who will see it)

Limit Who Sees It (Need-To-Know Only)

In small businesses, the temptation is to share information so the team can “understand what’s going on”. That’s risky.

As a default:

• Medical documents should be kept separate from general personnel files.
• Access should be restricted to whoever genuinely needs it (often the owner/manager and payroll/HR function).
• Frontline supervisors should usually only receive operational info (for example, “light duties only for 2 weeks”), not the underlying diagnosis.

Store It Securely And Don’t Keep It Forever

Under the Privacy Act 2020, you must protect personal information against loss, unauthorised access, or misuse. That means thinking about:

• password protection and secure cloud storage
• locked physical storage if you keep paper records
• clear retention rules (delete when no longer required)

If you’re not sure what “secure enough” looks like for your business, it’s worth getting specific Privacy Advice, because what’s reasonable can depend on your size, systems, and the sensitivity of what you hold.

Common Employer Scenarios (And Practical Guidance)

Here are some situations we see often in small businesses, and how to approach them safely.

An Employee Calls In Sick Regularly On Mondays/Fridays

You can manage patterns of absence, but avoid turning it into “prove your diagnosis”. Practical options include:

• requiring medical certificates in line with your legal entitlements
• having a constructive conversation about expectations, capacity, and support
• considering performance management where appropriate (with a fair process)

Don’t ask intrusive questions like “Are you depressed?” or “Are you drinking?” unless you have a clear and defensible reason connected to work and safety.

An Employee Has A Mental Health Condition And Requests Flexibility

You may need some medical confirmation to support a flexible work arrangement, but keep the request focused. For example, you might ask for information about:

• recommended adjustments (hours, duties, breaks, work from home)
• expected timeframe
• any safety-related restrictions (if relevant)

In many cases, you don’t need the diagnosis. You need to know what adjustments are recommended so you can consider them reasonably and operationally.

You’re Not Sure If They’re Safe To Work (Fitness Concern)

If there’s a genuine safety concern, you can seek appropriate information to manage the risk. Depending on the circumstances, that might include:

• a requirement to provide medical clearance to return
• a temporary alternative duty arrangement
• standing the employee down (in very limited circumstances, and only if you can lawfully do so)

This is an area where process matters. If you get it wrong, you can end up with a personal grievance risk on top of a safety risk.

You Want To Know If A Candidate Has Any Medical Conditions

Broad screening questions are usually a bad idea. If there’s a legitimate reason to ask something health-related, tie it directly to the role.

A safer approach is to:

• clearly describe the inherent requirements in the job description
• ask if the candidate can perform those requirements
• invite the candidate to raise any accommodations they may need (without forcing disclosure)

Key Takeaways

• Medical information is sensitive personal information, so you should only collect it when you have a clear, legitimate workplace reason (not out of curiosity).
• In most cases, the safest approach is to request information about capacity for work and restrictions, rather than diagnoses or detailed medical histories.
• When thinking about what medical information an employer can ask for in a New Zealand workplace, the “minimum necessary” principle is a strong practical guide: collect only what you need to manage leave, safety, or work capacity.
• Pre-employment medical questions should be handled carefully to avoid privacy and discrimination risks-focus on inherent role requirements and safety-critical needs only.
• Drug and alcohol testing (and handling test results) requires a clear policy, a fair process, and careful privacy handling, ideally supported by proper consent documentation.
• Store health information securely, limit access to “need-to-know”, and don’t keep medical records longer than necessary.

If you’d like help setting up the right processes and documents for handling employee medical information (including policies, consent forms, and employment documents), you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.