15 November 2022
AS Van Wey
[FYI request #20883 email]
Tēnā koe AS
Your Official Information Act request, reference: HNZ00005636
Thank you for your email on 17 October 2022 asking for information which has been considered
under the Of icial Information Act 1982 (the Act).
As you may be aware a new government agency, Health New Zealand (Health NZ), was
established on 1 July 2022 pursuant to the Pae Ora (Healthy Futures) Act 2022 (the Act). As such,
the functions previously under the former District Health Boards have transferred to Te Whatu Ora
Health New Zealand. As the matters you have raised now fall under the functions of Te Whatu
Ora, our agency wil respond to your request.
On 11 November 2022 we provided you with an initial response to your request for information.
You wil find responses to the remaining parts of your request below.
Te Whatu Ora Policies on communications which comply with HISO 10029(2015).
You requested:
The Health NZ Policies on communications which comply with HISO 10029(2015), or the
equivalent if updated, sections 8 and 12 and the Crimes Act 1961.
For clarity, under section 216A-B of the Crimes Act 1961, it is unlawful for an individual to
intercept personal communications without the consent of the sender or the intended
recipient. In the health sector, the sender would be a patient and the intended recipient
would be a specific department or individual (e.g., named physician). Alternatively, the
sender would be a physician, or employee who has restricted access to medical information
(e.g., clinical records team, nurse, or scheduler in accordance with HISO 10064) and the
intended recipient would be the patient or their legal gradian.
Te Whatu Ora is not aware of any policy that specifically addresses this part of the Crimes Act
1961. The Privacy Policy covers the collection of personal information, including that Te Whatu Ora
wil only collect personal information in a way that is lawful, fair, open and transparent. A copy of
the privacy policy has been included in this response as Document One. This document is being
released to you in full.
Please note, the districts are stil under their own policies. They have their own privacy policy which
covers information collection. A copy of the districts privacy policy has been included as Document
Two. This document is being released to you in full.
Interception of private information.
You requested:
the policy, which allows the agency (e.g. DHB or now referred to as Te Whatu Ora Health
NZ) to intercept private, protected, confidential communications without the consent of the
sender (e.g., patient) or the intended recipient (e.g., physician or other specified individual
or department).
Te Whatu Ora collects information in line with the Privacy Act 2020 and Health Information Privacy
Code. Te Whatu Ora does not intercept private communications between a sender and their
intended recipient.
Audit log policies.
You requested:
Policies regarding provision of audit logs and what must be included in such audit logs
(such as name of the individual and the purpose of the access), in accordance with HISO
10064 and the Health Information Privacy Code, when requested by the patient.
The Privacy Act 2020 and Heath Information Privacy Code give individuals the right to access their
personal information (which can include audit logs, where available), and this is covered in our
privacy policy.
Access to medical information without patient consent.
You requested:
Access to medical information without the consent of the patent (or their legal
representative) by individuals not directly engaged in their care. What access is permitted
for employees who are not physicians or nurses directly involved in the care and treatment
of a patient? For instance, are people in Clinical Records, or other secondary purpose
departments, permitted to read through the patients health information? Especially to the
extent that they memorize the names of the patient's spouse or children who have different
surnames (emergency contacts), or become authorities on the patients health information
or behavior?
Te Whatu Ora staff members are only permitted to access clinical records or other personal
information for work related purposes. Instances of inappropriate access wil be considered a
breach of privacy and of the code of conduct. A copy of the code of conduct has been included as
Document Three. This document is being provided to you in full.
Access of private information to respond to Official Information Act requests.
You asked for:
The policy which permits health agency employees to access personal health information to
verify the individual is a NZ resident or citizen in order to respond to an OIA request."
Eligibility criteria for making a request for official information is provided for under Section 12 of the
Act. Te Whatu Ora may ask questions to determine whether the requestor is eligible to make a
request. This may include checking of identification such as a passport or New Zealand driver’s
licence. If a requestor is not eligible to make a request, Te Whatu Ora may consider the request,
however, they are not required to respond under the Act.
How to get in contact
I trust the information provided is of assistance. Should you have any concerns with this
response, I would encourage you to raise these with Te Whatu Ora at:
[email address].
If you are not happy with this response, you have the right to make a complaint to the
Ombudsman. Information about how to do this is available at
www.ombudsman.parliament.nz or
by phoning 0800 802 602.
As this information may be of interest to other members of the public, Health NZ may proactively
release a copy of this response on Health NZ’s website. Al requester data, including your name
and contact details, wil be removed prior to release. The released response wil be made available
on our website.
Nāku iti noa, nā
Sasha Wood
Interim Lead OIA & Proactive Release
Government Partnership and Risk
Appendix 1: Documents for release
#
Date
Title
Decision on release
1
N/A
Te Whatu Ora Privacy Policy
Released in full
2
National Privacy Policy
3
Te Whatu Ora Code of Conduct
TeWhatuOra.govt.nz
