National Headquarters
Fire and Emergency New Zealand
National Headquarters
Spark Central, Level 7
42-52 Willis Street
Wellington Central
Wellington 6011
Phone +64 4 496 3600
26 February 2026
Ref: 20492
George Wilkins
[FYI request #33482 email] Tēnā koe George
Thank you for your request of 10 January 2026 to Fire and Emergency New Zealand requesting
information relating to health information under the Official Information Act 1982 (OIA). We copy
and respond to each aspect of your request below.
1. Does FENZ hold any health data for employees, contractors, volunteers or any other third
parties?
2. For what purpose or purposes does FENZ collect health information?
Yes. Fire and Emergency collects health information about employees, contractors, volunteers and
third parties for the following purposes:
• To ensure we meet obligations under the Fire and Emergency New Zealand Act 2017 by
assessing fitness and suitability for operational duties. Ensuring personnel are medically
able to safely perform the tasks required of their role e.g. pre-employment medical
screening, medical review process.
• Fire and Emergency is a self-managing accredited employer under the ACC Accredited
Employers Programme. This means that Fire and Emergency self-manage all employee ACC
work-related injury and illness claims on behalf of ACC. To support the health, wellbeing,
and rehabilitation of personnel, work-related injury and illness information for employees
may be used, with consent from employees, to provide support services, manage injuries,
and plan return to work or rehabilitation activities.
• We were required to collect COVID-19 vaccination data for purposes of the COVID-19
Public Health Response (Vaccinations) Order 2021 and its vaccination policy at the time.
We are required under the Public Records Act 2005 to retain this information for a
minimum of seven years. However, the data is not used and access to it is heavily
restricted.
• We receive response requests from ambulance organisations and New Zealand Police
which contain details regarding injuries or medical conditions to assist our response.
• We routinely receive health information from personnel. For example, it may be contained
within an email advising of sick leave. Therefore, some health information may be stored in
the Microsoft 365 apps, i.e., Outlook and Teams.
• We collect health information when attending incidents as part of our patient assessment.
This information is given to ambulance crews as part of the handover process. We also
record instances of injuries and fatalities relating to members of the public for anonymised
reporting of statistics.
3. In which system or systems is health information stored at FENZ?
Health information held by Fire and Emergency is stored within approved internal systems and, in
some cases, by contracted third party service providers. Internally, this may include personnel
files, recruitment systems, incident and injury reporting systems, operational systems used to
record information gathered at incidents, and secure network drives or collaboration platforms
with restricted access.
Certain health related information, such as health monitoring records, pre-employment medical
assessments, or work-related injury information, may be managed or stored by contracted
providers in accordance with their contractual and privacy obligations. Access to health
information is limited to authorised personnel who require access for legitimate business
purposes.
4. If health information is stored in official, secure systems, is there any knowledge of health
information held by FENZ in non-secure or non official systems/external systems such as
online file share sites e.g. Dropbox?
Fire and Emergency uses approved information management and file sharing systems for the
storage and transmission of information. We are not aware of health information being
permanently stored in non-official or unauthorised external systems.
5. What IT security controls are used by FENZ to secure any health information held?
Fire and Emergency has people, processes and security tools to protect information, the systems
holding that information including health information, to prepare for and respond to information
security threats, and identify, respond to and recover from incidents should they occur. We also
have a programme of work that both maintains current capabilities and uplifts capabilities to
reduce risk.
Government best practice guidance (supplemented by industry best practice) is well-developed
and is our reference, including for example:
- Protective Security Requirements
- New Zealand Information Security Manual
- NCSC Cyber Security Framework
- NCSC Minimum Cyber Security Standards
- NIST
- Privacy Act 2020
- Advice and guidance published by the Privacy Commissioner and the Government Chief
Privacy Officer.
Risks are identified and reviewed regularly, which is essential in a changing threat, business, and
technical landscape. Our control environment is reviewed regularly by internal and external
assurance experts to ensure controls continue to be effective.
6. Does FENZ have any policies or procedures for users to request updates to or deletions of
their health data? Please provide copies of these policies or procedures if so.
Fire and Emergency adhere to the Privacy Act 2020 and the twelve principles of th
e Health
Information Privacy Code 2020. The privacy code captures the individuals’ requests relating to
their own health data and information.
The information we collect is also covered by the requirements of th
e Public Records Act 2005. We
are required to retain records for minimum time periods in line with rules set out in Archives New
Zealand approved Disposal Authorities. We currently have a draft disposal schedule with Archives
New Zealand for approval. This will include retention and disposal rules for health-related
information
Please find attached, as an
Appendix to this response, copies of the following documents:
• Our Privacy policy; and
• Section 12 of the Safety, Health and Wellbeing Manual
We trust that the information being provided is of assistance. If you require further information,
please email [FENZ request email]
Please note that because of the identified public interest in the information that you have
requested, we intend to publish this response (with your personal details removed) on our
website.
Nāku noa, nā
Aidan Saunders
Manager, Information Requests
