Summary

Rule 6 of the Health Information Privacy Code (HIPC) provides that where a health agency holds health information in such a way that it can be readily retrieved, the individual concerned is entitled to have access to that information.

Responding to individual requests

Requests may be made orally or in writing, and can be made by the individual themselves or an authorised agent of the individual. An authorised agent is different from a representative (such as another healthcare professional, or where a patient is under 16 years), to whom a different set of rights and procedures apply.¹

Health agencies must be able to satisfy themselves as to the identity of the individual making the request, which may require seeking identification, and accordingly must ensure that the information sought is received by only that individual or their agent.² This may involve using registered mail or requiring the individual to sign a receipt for the information.

If providing information by way of email however, it is advisable for an agency to ensure with the individual that the email address is a private and/or personal address, eg, not a work or family email address. If an agency is unsure of this, then it should seek the consent of the individual before emailing any health information to the latter.

Access

Access should usually be given without a charge, and in the form that the individual prefers. A request for access must be responded to promptly and certainly within 20 working days. When access is given to health information, the individual must be advised that, under Rule 7 of the HIPC, the individual may request correction of that information.³ Note that the right in Rule 6 is to have access to the information, not ownership. Individuals do not have the right to take away original records, although access to the originals may be sought and granted. It is advisable for the practitioner to retain a copy of all records if the original is given to the individual.

Refusing access

There are circumstances in which the request for access may be refused, but these are exceptional cases. Where the request for access is made by the individual concerned, the only valid reasons for refusal are those set out in the Privacy Act. These include situations where disclosure would prejudice the maintenance of law, endanger the safety of any individual, involve the unwarranted disclosure of the affairs of another individual, prejudice the physical or mental health of that individual, or would be contrary to the individual’s interest (where the individual is under 16).⁴

The rights of access within the Privacy Act and the HIPC will also override any other obligations of confidentiality or privilege owed to a third party who provided the information.⁵ Any practitioner making records or collecting information about an individual should do so with the presumption that they will be seen by the individual concerned.

Requests from other authorities

Section 22C of the Health Act 1956 provides that an agency may disclose health information if it is required by certain public officials for designated purposes. This includes disclosure to “Any constable, for the purposes of exercising or performing any of that person’s power, duties or functions.”⁶

There is no absolute duty to disclose under the Health Act, and accordingly the police are not generally entitled to demand or compel disclosure of medical records, only to request such information. Health professionals retain the discretion to release the information, after considering whether disclosure would be unethical in the circumstances.

However, the police may obtain a warrant to seize medical records that may be used as evidence in a prosecution, or a Court may order the production of records, in which case an agency would be forced to provide them. Police also have powers under the Search and Surveillance Act 2012 to apply for examination orders, to obtain medical records that constitutes evidence material in respect of an offence that has, or will be committed by an individual.

If such a mandatory order was issued, the health agency would have to comply otherwise they would be held in contempt of Court. However in practice, the police require medical notes mainly for purposes such as investigating sudden deaths and missing persons, or resolving medical and psychiatric issues in criminal investigations and proceedings.

In these situations the information is required urgently and for the immediate protection of another person’s safety. On that basis, this information is usually provided to police without any official warrant or order, due to these objectives outweighing the privacy concerns. These practices are confirmed in section 22C of the Health Act, and by rule 11(2)(i) of the HIPC, which allow a practitioner the discretion to provide or not. Members are encouraged to contact MPS as each case may have specific issues that render them less than straightforward.

Disclosures without consent

In terms of disclosures (without consent) to other Government agencies, there are a number of enactments which either permit or require disclosure of health information, including:

• Provisions under the Children, Young Persons and Their Families Act 1989, which allow and protect the reporting to the police or to a social worker of suspected neglect or abuse of a young person.
• Duties of doctors under the Land Transport Act 1998 to report to the Director of Land Transport Safety any person they know who is likely to drive a vehicle, but whose mental or physical condition makes it unsafe
• At the request of the Health and Disability Commissioner, under the Health and Disability Commissioner Act 1994.
• At the request of ACC, under the Injury Prevention, Rehabilitation and Compensation Act 2001.

A disclosure to these officials is only to be made when they are performing specified functions, and only relates to “health information” as defined in the Health Act. In these circumstances, the legislative provisions permitting the disclosures in good faith will protect the doctor from any legal or disciplinary action on account of that disclosure.

References

1. Health Act, s 22F (1956)
2. Privacy Act, s 45 (1993)
3. HIPC, r 6(2)
4. Privacy Act, s27, 29 (1993)
5. The Director of Human Rights Proceedings v QD, NZHRTT at n8 (2010)
6. Health Act, s 22 C (2)(f) (1956).