Recent review of the Health Information Privacy Code 2020

17 Jun 22

Code amendments to reflect structural reforms within the public health sector.

The Health Information Privacy Code 2020 (Code) regulates the collection, use and disclosure of health information by health agencies and modifies the Privacy Act 2020’s information privacy principles as applicable to the health sector.

In early April 2022, Liz MacPherson, Deputy Privacy Commissioner (in her role as acting Privacy Commissioner), made public her intention to amend the Code and invited public submissions.

The submissions received broadly agreed that the changes needed to the Code are technical in nature and policy changes beyond what is provided in the primary legislation are not necessary.

The amendments which will come into force on 1 July 2022 are largely to fix technical errors and align the Code with structural reforms within the public health and disability support sector.

In particular the Code will now reflect the Pae Ora (Healthy Futures) Bill (which will become the Pae Ora (Healthy Futures) Act 2022 after 1 July 2022) which provides for the disestablishment of District Health Boards and the establishment of new entities, including Health New Zealand (Hauora Aotearoa) and the Māori Health Authority (Te Mana Hauora Māori). The Code will also recognise the establishment of the new Ministry for Disabled People as well as the recent transfer of some functions of the Ministry of Health to Health New Zealand.

Controls on assignment of NHIs

The National Health Index (NHI) number is a unique identifier that is assigned to every individual who uses health and disability support services in New Zealand. This unique identifier allows for communication between health agencies relating to specific individuals without needing to provide additional information about an individual to ensure the correct individual is being identified.

Rule 13 of the Code imposes controls on the assignment of NHIs by health agencies.

Many submitters asked for guidance on the application of Rule 13, specifically what is means to ‘assign’ an NHI to an individual.

While clarifications on this point have not be made to Rule 13 of the Code, the Office of the Privacy Commissioner has undertaken to provide more guidance on the interpretation of the operation of the rule, including the definition of ‘assign’.

Schedule 2 of the Code sets out the health agencies that are approved to assign an NHI number. The amendments to the Code have reduced the number of agencies expressly approved to assign an NHI number and also clarified that a health agency that has a contract with or is funded by one of the agencies specified in the amended Schedule 2 can also assign the NHI to an individual.

The full list of amendments to the Code is available here.


Want to know more?

If you have any questions about the Code or its application to your business, please contact our specialist Technology & Digital team.

PDF version: here.