Business Associate Agreement (New Zealand)

A Business Associate Agreement (BAA) is a contract between a business that holds personal or health information (the principal agency) and a service provider (the business associate) that processes that information on the principal's behalf. In New Zealand, there is no specific statutory term 'business associate agreement' — the concept derives from the US HIPAA framework. However, the Privacy Act 2020 requires that New Zealand agencies take reasonable steps to protect personal information from unauthorised access, use, or disclosure, which includes ensuring that contractors and service providers who process personal information on the agency's behalf are bound by appropriate contractual obligations. The Privacy Act 2020 imposes obligations on 'agencies' — any person or organisation that holds personal information. Where an agency outsources data processing (e.g. cloud hosting, payroll processing, analytics), the agency remains responsible for the security of that information and should have a written agreement with the processor setting out data handling obligations.

The Privacy Act 2020 contains 13 Information Privacy Principles (IPPs) that apply to all agencies holding personal information in New Zealand. A Business Associate Agreement should address the following key obligations: IPP 5 (storage and security) — the business associate must protect personal information against loss, misuse, or unauthorised access; IPP 10 (limits on use) — the associate must only use the information for the purpose for which it was disclosed; IPP 11 (limits on disclosure) — the associate must not disclose the information to third parties without the principal's consent; and IPP 12 (unique identifiers) — the associate must not use personal identifiers (such as IRD numbers) unless authorised. The Privacy Act 2020 also requires agencies to notify the Office of the Privacy Commissioner (OPC) and affected individuals in the event of a notifiable privacy breach — a breach that is reasonably likely to cause serious harm. The BAA should specify the business associate's obligations to notify the principal promptly of any privacy breach so the principal can meet its statutory notification obligations within the required timeframe.

Health information is a special category of personal information in New Zealand, subject to heightened protection under the Health Information Privacy Code 2020 (HIPC), issued under the Privacy Act 2020. The HIPC imposes stricter obligations on health agencies (including health service providers, ACC, health insurers, and their contractors) in relation to the collection, use, storage, and disclosure of health information. Rule 5 of the HIPC requires health agencies to take reasonable steps to protect health information against loss, misuse, or unauthorised access. The HIPC also has specific rules about the retention of health information, patients' rights of access to their own health records, and the disclosure of health information to third parties. A Business Associate Agreement for a service provider who handles health information (e.g. a cloud storage provider for a medical practice, or a billing processor for a health insurer) must reflect the requirements of the HIPC in addition to the Privacy Act 2020. New Zealand health agencies are also subject to the Code of Health and Disability Services Consumers' Rights, which gives consumers rights in relation to their health information.

If a business associate suffers a privacy breach involving personal information held on behalf of a New Zealand agency, the consequences may include: a complaint to the Office of the Privacy Commissioner (OPC) by an affected individual; an investigation by the OPC; a Human Rights Review Tribunal proceeding; and significant reputational damage. Under the Privacy Act 2020, the OPC may issue compliance notices requiring the agency (and by extension its associates) to comply with the Privacy Act. If the matter proceeds to the Human Rights Review Tribunal, the tribunal may award compensation for interference with privacy. The Privacy Act 2020 also creates a criminal offence for providing false or misleading information to the OPC (s 212). From a contractual perspective, the principal agency may have a claim against the business associate for breach of contract if the BAA requires the associate to comply with the Privacy Act and the associate fails to do so. The BAA should include an indemnity provision requiring the business associate to indemnify the principal against losses arising from the associate's breach of its data protection obligations.

A Business Associate Agreement (New Zealand) does not legally require a lawyer in New Zealand, and individuals and businesses may draft and execute the document independently. The Companies Act 1993 does not mandate legal representation for the creation or signing of this type of document. However, seeking independent legal advice from a qualified New Zealand lawyer is recommended for transactions involving substantial financial value, complex regulatory requirements, or cross-border elements where multiple legal jurisdictions may apply. A lawyer can verify that the document complies with all applicable statutory requirements, identify potential risks specific to the transaction, and confirm that the terms adequately protect the interests of all parties involved. The High Court of New Zealand has jurisdiction over disputes arising from this type of document, and Companies Office may impose additional compliance obligations depending on the nature of the underlying transaction. Professional legal review is particularly advisable where the document will be submitted to government agencies or used as evidence in legal proceedings.