Privacy and Health Information Privacy Act 1993 Health Information Privacy Code 1994

1. Privacy and Health Information Privacy Act 1993 Health Information Privacy Code 1994

2. Where to find NZ’s privacy laws • Privacy Act 1993 • Health Information Privacy Code 1994

3. The Privacy Act 1993 • An Act of Parliament • Privacy principles for most areas of life • Establishes Privacy Commissioner to hear complaints • Allows for privacy codes for particular areas of life

4. The Health Information Privacy Code 1994 • Made by Privacy Commissioner • Has force of law • Rules specifically for health services • Includes mental health services

5. Who and what is protected by the Code? • Who? Anyone receiving health services, whether – • voluntarily, or • under the Mental Health Act • What? “Health information”, which means information that – • names you, and • is about your physical or mental health and health services you receive

6. Who must comply with the Health Information Privacy Code? • Any organisation or person that holds health information about you • Includes psychiatrists, GPs, nurses, hospitals, counsellors, social workers, and alternative health professionals • Code uses the term “health agency”

7. Privacy issues • Collecting information • What, how, and from whom • Storing information • Security • Who’s allowed access • How you can access your information • Correcting wrong information

8. Privacy issues (continued) • Use of information • Checking it’s accurate • What it can be used for • Disclosing (giving out) information • Who it can be given to, and when

9. Rules about collecting your information What information can agencies collect? • No more than they need Who should they collect it from? • Usually you, but others in some cases • How can they collect the information? • Can’t be unfair • Can’t intrude on your personal affairs Do I have to give them the information? • Only if a law says you have to

10. Collecting your information from others • Providers can collect information from others if, for example – • you allow this, or • the information can’t be collected from you for some reason, or • you need treatment urgently

11. Rules about storing your information • Keeping it secure • Providers must protect your information and keep it secure • How long can they keep it for? • Must keep it for 10 years since last treatment • Can’t keep it longer than necessary

12. Rules about using your information • What can it be used for? • Generally only for purpose it was originally collected for • Exceptions include – • if you agree to other purposes • if for statistical or research purposes, and you won’t be identified

13. Rules about using your information  • Making sure it’s correct • Information must be accurate, up-to-date, complete, relevant, and not misleading

14. Rules about giving out your information • Who can see my information? • Generally only you • But it can be disclosed to others if – • you agree • you’re under the Mental Health Act • you can’t make decisions for yourself • family or others are caring for you • you’re in hospital, or • there’s a serious threat to someone’s safety

15. Getting access to your own information • You have the right to see your information, including – • GPs’ and psychiatrists’ notes • test results (eg, blood tests) • specialist reports • records of support organisations

16. When you can be refused access  • If, for example – • the information is about you and someone else, or • it would harm your health

17. Correcting your information • If information about you is incorrect – • you can ask the health agency to correct it • If the agency refuses to change it – • they must attach a statement from you • you can make a complaint to the Privacy Commissioner

18. Making a complaint about a breach of your privacy rights • You can make a complaint to – • the particular health agency, or • the Privacy Commissioner

19. Making a complaint to the health agency • Ask family, friends or advocate for support • Ask the agency for a copy of their complaints process • Follow the steps for making a complaint • You don’t have to complain in writing - • but a written complaint gives a useful record

20. Making a complaint to the Privacy Commissioner • Doesn’t have to be in writing • Either by you or by someone on your behalf • Can make a complaint to Commissioner whether or not you’ve complained to the health agency

21. What will the Privacy Commissioner do? • The Commissioner – • will investigate • try to help you and the agency resolve your complaint • can send your case to the Director of Proceedings and Human Rights Review Tribunal

22. The Human Rights Review Tribunal • A special court • Deals with breaches of privacy rules, Human Rights Act, Code of Rights • The Tribunal can order the agency to, for example – • give you a copy of your file • pay you compensation

23. Tips on protecting your health information • Get involved with developing your file • Ask what will happen to your info • Ask to see copies of any report or notes at the time they’re made • Ask for notes or reports to be corrected if you don’t agree with them

24. Tips on protecting your health information (continued) • Prepare in advance for what might happen, by – • completing an information-sharing agreement when you’re well • deciding who your representative will be • Ask for help from advocates, friends, family and whānau • Make a complaint if you’re not satisfied • Keep detail of requests, queries, complaints you make