Medical Records Release (New Zealand)

A Medical Records Release in New Zealand is a written authorisation form through which a patient directs a healthcare provider to disclose their medical or health records to a specified third party for a defined purpose and within a stated timeframe. Medical records in New Zealand are protected health information governed by the Privacy Act 2020 and the Health Information Privacy Code 2020 (the HIPC), administered by the Office of the Privacy Commissioner.

The Health Information Privacy Code 2020 applies to all health agencies in New Zealand — including hospitals, general practitioners, specialists, pharmacies, laboratories, and ACC — and sets out 13 rules governing the collection, use, and disclosure of health information. HIPC Rule 11 prohibits health agencies from disclosing health information to a third party without the patient's authorisation, except in specific permitted circumstances (e.g., direct care purposes, court orders, serious threat to public health).

Each New Zealand resident has an NHI (National Health Index) number assigned by the Ministry of Health — a unique identifier used by all health providers to link patient records across the health system. Including the NHI number in the release form ensures accurate identification and faster processing.

Under Privacy Principle 6 of the Privacy Act 2020, patients have a right to access their own health records held by any agency. Requests must be responded to within 20 working days. The Office of the Privacy Commissioner investigates complaints about improper access, refusal to provide records, and unauthorised disclosure of health information. The Human Rights Review Tribunal may award compensation for Privacy Act 2020 breaches.

The forms-legal.com Medical Records Release (New Zealand) template is drafted in accordance with the Privacy Act 2020 and Health Information Privacy Code 2020 and is accepted by New Zealand hospitals, GP practices, specialists, and other healthcare providers.

Rule 11 of the Health Information Privacy Code 2020 restricts health agencies from disclosing health information to a third party except with the patient's authorisation, for direct healthcare purposes, under a court order, or in other specific permitted circumstances set out in the Code. Rule 3 of the Health Information Privacy Code 2020 requires health agencies to notify patients of the purposes for which information is collected. Section 22 of the Privacy Act 2020 grants individuals the right to direct that their personal information be corrected. Section 44 of the Privacy Act 2020 allows individuals to complain to the Privacy Commissioner about interference with their privacy rights, and the Human Rights Review Tribunal established under the Human Rights Act 1993 has jurisdiction to award compensation for proven Privacy Act 2020 breaches. The Ministry of Health administers the NHI (National Health Index) number system, which is the key patient identifier used by all New Zealand health providers. Including the NHI number in a release form confirms the correct patient record is identified and disclosed.

A Medical Records Release form in New Zealand is needed whenever you require a healthcare provider to share your medical records with another person or organisation. Under the Health Information Privacy Code 2020, health agencies may not disclose your health information to a third party without your written authorisation (except in specific permitted circumstances).

Changing healthcare provider: When transferring to a new general practitioner, specialist, or hospital, your new provider will typically request a summary or copy of your medical history from your previous provider. A signed release authorisation helps this transfer promptly and lawfully under HIPC Rule 11.

Insurance claims: New Zealand life insurers, income protection insurers, and health insurers (including Southern Cross Healthcare) routinely request medical records to assess claims or applications. A written authorisation specifying the scope and purpose of the release protects the patient from over-broad disclosure.

ACC claims: The Accident Compensation Corporation (ACC) processes personal injury claims under the Accident Compensation Act 2001 and may require access to medical records from treating providers. A release form authorises ACC to obtain the relevant records directly from your doctor or hospital.

Legal proceedings: Where medical records are relevant to personal injury litigation, employment disputes before the Employment Relations Authority, or Family Court proceedings, a release authorisation allows your solicitor or the relevant court to obtain the records.

Employment medical assessments: Some employers require pre-employment or fitness-for-work medical assessments, which may involve the release of specific records from your GP to an occupational health provider.

Overseas travel or treatment: New Zealand residents seeking medical treatment overseas may need to provide their medical history to foreign healthcare providers.

Research: Academic or clinical research conducted under approval by a Health and Disability Ethics Committee (HDEC) may require access to de-identified or identified health records with patient consent.

Section 22 of the Privacy Act 2020 grants individuals the right to request correction of their health information. Section 44 allows complaints to the Privacy Commissioner about privacy interference. Rule 11(2) of the Health Information Privacy Code 2020 sets out the specific circumstances in which disclosure without patient authorisation is permitted — including direct healthcare, ACC claims processing, and court orders. For ACC claims under the Accident Compensation Act 2001, Section 280 authorises ACC to collect health information for claims purposes, but a patient-signed release form speeds up processing. For insurance claims with Southern Cross Healthcare or other New Zealand health insurers, a written release authorisation confirms the insurer receives only records relevant to the specific claim rather than the patient's full history. For legal proceedings in the District Court, High Court of New Zealand, Employment Relations Authority, or Family Court, solicitors routinely use a medical records release form to obtain records relevant to the case in a privacy-compliant manner under Rule 11 of the Health Information Privacy Code 2020.

A Medical Records Release form in New Zealand should include the following key elements to comply with the Privacy Act 2020, Health Information Privacy Code 2020, and the administrative requirements of New Zealand healthcare providers.

Patient identification: The patient's full legal name, date of birth, residential address, and NHI (National Health Index) number. Including the NHI number allows accurate matching of records across the New Zealand health system.

Releasing healthcare provider: The full name, address, and contact details of the healthcare provider or organisation holding the records — for example, the patient's general practice, hospital, specialist clinic, or laboratory.

Recipient: The full name, organisation, address, and contact details of the person or organisation to whom the records are to be released — for example, an insurer, new GP, solicitor, ACC, or employer's occupational health provider.

Description of records: A specific description of the records to be released — for example, consultation notes from a defined date range, laboratory results, imaging reports, or a complete medical history. Overly broad authorisations covering all records are less likely to be accepted and may result in disclosure beyond what is necessary.

Purpose of release: A clear statement of why the records are needed — for example, insurance assessment, change of GP, ACC claim, legal proceedings, or specialist referral. The purpose limits how the recipient may use the records under HIPC Rule 10.

Date range: The period covered by the records to be released — for example, records from the past two years, or records relating to a specific condition or injury.

Duration of authorisation: The period for which the authorisation remains valid. A time-limited authorisation reduces the risk of the records being used for purposes beyond the original intention.

Right to revoke: A statement that the patient may revoke the authorisation at any time by written notice to the releasing provider, provided the records have not yet been disclosed.

Patient signature and date: The patient's handwritten or electronic signature and the date of signing. For a minor, the signature of the parent or guardian with guardianship authority under the Care of Children Act 2004.

Privacy Act 2020 acknowledgement: A statement that the release is made in accordance with the Privacy Act 2020 and the Health Information Privacy Code 2020.

The forms-legal.com Medical Records Release (New Zealand) template includes all of these elements and is accepted by New Zealand hospitals, GP practices, specialists, ACC, and health insurers.

Statutory references: Rule 11 of the Health Information Privacy Code 2020 governs disclosure of health information. Section 11 of the Privacy Act 2020 grants the right to access one's own health records. Section 44 of the Privacy Act 2020 provides the right to complain to the Privacy Commissioner. The Office of the Privacy Commissioner investigates complaints about improper access or refusal to provide health records. The Human Rights Review Tribunal may award compensation for Privacy Act 2020 breaches.

Time limits and fees: Health providers must respond to access requests within 20 working days under Section 44 of the Privacy Act 2020. If urgency is required — for a pending insurance claim or court hearing — note the deadline clearly in the release form. A reasonable fee may be charged by the health provider for copying records under Section 44 of the Privacy Act 2020. Revocation: The patient may revoke the authorisation at any time by written notice to the releasing provider, provided the records have not yet been disclosed. The forms-legal.com Medical Records Release (New Zealand) template is accepted by New Zealand hospitals, GP practices, specialists, ACC, and health insurers and is drafted in accordance with the Privacy Act 2020 and Health Information Privacy Code 2020.