TL;DR: Under rule 6 of the Health Information Privacy Code, you can ask any health agency for the information it holds about you. They must respond within 20 working days (or transfer your request within 10 working days if another agency is more relevant). Public hospitals can’t charge. Private providers like GPs can charge only if they gave you the same info in the last 12 months, or for X-rays, videos and MRI/CT/PET images. After recent health breaches, it’s worth checking.
Your rights
From the Privacy Commissioner’s HIPC fact sheet:
| Rule | Detail |
|---|---|
| Right | Request health information about yourself (rule 6) |
| Deadline | 20 working days to provide it or explain a refusal |
| Transfer | Within 10 working days if another agency is more closely connected |
| Public agencies (e.g. hospitals) | Cannot charge |
| Private providers (e.g. GPs) | Can charge only if they supplied the same info in the last 12 months, or for X-rays, video, MRI/CT/PET images |
When they can refuse
- If disclosure would harm your physical or mental health
- If it would unwarrantedly reveal someone else’s affairs
- Other grounds under sections 49–53 of the Privacy Act
How to ask
- Contact the provider’s privacy officer (health agencies should have one).
- Write a short request: "Under rule 6 of the Health Information Privacy Code, please provide a copy of my health records from [date] to [date]."
- Include ID details they can check.
- Diary 20 working days.
Asking Health NZ (public hospitals)
Health New Zealand’s request fact sheet spells out the practical bits:
- Use the Release of Personal Health Information Request Form, filled in fully and signed.
- Include proof of ID, ideally photo ID with a signature (driver’s licence or passport). If you can’t, tell them early.
- Be specific about what and which dates. Specific requests come back faster.
- Responses can take up to 20 working days. If it’s urgent, say why and when you need it.
- There’s no charge.
| Requesting for... | What you’ll need |
|---|---|
| Your child | Your ID plus proof of relationship (e.g. birth certificate) |
| A relative or friend | Your ID plus their consent, or an activated EPOA/PPPR |
| A deceased relative | Your ID, executor’s consent (if not you), and the Will page or Letter of Administration |
Spot an error? Health NZ says to contact its National Privacy Office at hnzprivacy@tewhatuora.govt.nz to ask for a correction. If they refuse part of your request, they must tell you why, and you can ask the Privacy Commissioner to review it.
Why check now
New Zealand health data has had a rough couple of years: the Manage My Health breach and the MediMap attack, where records were altered. Checking your records for errors is reasonable, especially medications and personal details.
Finding a mistake in your own medical file is the one time "being nosy" is officially encouraged.
If something’s wrong or they don’t respond
- Ask for a correction.
- Contact the Office of the Privacy Commissioner on 0800 803 909, or complain (how).
For non-health organisations, see general access requests. A free exposure check shows which breaches your email is in.
Frequently Asked Questions
Can I get a copy of my medical records in NZ?
Yes. Rule 6 of the Health Information Privacy Code gives you the right to request your health information.
How long does a health provider have to respond?
20 working days.
Do I have to pay for my health records?
Public agencies like hospitals can’t charge. Private providers may charge only in limited cases, like repeat requests within 12 months or imaging.
How do I get my hospital records from Health NZ?
Fill in and sign Health NZ’s Release of Personal Health Information Request Form, attach photo ID, and expect a reply within 20 working days. There’s no charge.
Can a provider refuse my request?
Only on specific grounds, such as serious harm to your health or unwarranted disclosure of someone else’s affairs.
Sources
- Privacy Commissioner: HIPC Factsheet 4, dealing with access requests
- Health New Zealand: Requesting health information fact sheet