NZ Quality & Compliance Hub
Health & Community Support · Employer knowledge

Privacy & health information

Treat personal and health information as something the business must actively manage.

The Health Information Privacy Code 2020 applies specific rules to health information. The Privacy Commissioner states the Code was amended in 2026 to reflect the new IPP3A, in force from 1 May 2026.

What should a manager have in place?

Privacy management should reflect the information your service actually collects, uses, stores and shares. Health and community support services may handle particularly sensitive personal and health information, so workers need clear boundaries and processes.

Information handling rulesClear expectations for collecting, using, storing, accessing and sharing personal and health information.
Access & securityAppropriate access controls and working practices so information is available to people who need it without being unnecessarily exposed.
Worker privacy awarenessRole-relevant learning and instructions covering confidentiality, conversations, records, devices and information sharing.
Privacy incident responseA known process for escalating privacy concerns or breaches, assessing what happened and deciding what action is required.

Manager check

  • Do we know what personal and health information our service collects and why?
  • Can we identify who has access to sensitive information and whether that access is appropriate?
  • Do workers know what they may and may not share, including in everyday conversations and electronic communication?
  • Is there a clear person or pathway for escalating a privacy concern or suspected breach?
  • When our systems, services or information practices change, do we review the privacy implications?
Read the current Health Information Privacy Code →Back to Employer Hub

Connect this to your workforce

Use this topic to decide what workers need to understand for their actual role. NZQC learning supports awareness and knowledge; it does not replace provider-specific procedures, supervision or practical competency checks where those are needed.

Privacy & health information →Dignity, respect & independence →Communication & supporting choice →

Keep the evidence useful

Record the learning or practical check that is relevant to the role, and make the next action visible to the person managing the workforce.

Record relevant worker learning →Privacy Commissioner: Health Information Privacy Code →

NZQC provides practical educational information. It is not legal advice and does not certify that a provider is compliant. Check the official source and the requirements that apply to your service, contracts and scope.