Our website uses cookies so we can analyse our site usage and give you the best experience. Click "Accept" if you’re happy with this, or click "More" for information about cookies on our site, how to opt out, and how to disable cookies altogether.

More Accept ×

We respect your Do Not Track preference.

Close ×

opc header logo

Privacy Act 2020

Print | Email this page

Health Information Privacy Code 2020

A blonde doctor wearing a white shirt and stethoscope sits at a desk looking at a clipboard. She has disposable gloves on and wears glasses. A patient sits with her back to the camera. She has red hair and a white shirt. About the code

The Health Information Privacy Code 2020 (HIPC) covers health information about identifiable individuals that is collected, used, held, and disclosed by health agencies. It takes the place of the information privacy principles (IPPs) for the health sector and applies to:

  • all agencies providing personal or public health or disability services such as primary health organisations, rest homes, supported accommodation, doctors, nurses, dentists, pharmacists and optometrists;

  • and some agencies that do not provide health services to individuals but which are part of the health sector such as ACC, the Ministry of Health, the Health Research Council, health insurers and professional disciplinary bodies.

We have amended the HIPC twice. In March 2026 we issued Amendment No 2 to the code to reflect new Information Privacy Principle 3A (IPP3A).

In May 2022 we issued Amendment No 1 to address structural changes in the health sector.

Read the full code

Health Information Privacy Code 2020 (in force 1 May 2026; opens to PDF, 463 KB)

Read our summary factsheets 

Health Information Privacy Code Amendment No 2

The Privacy Amendment Act 2025 introduced IPP3A, which is in force from 1 May 2026. In March 2026, following consultation on how to reflect IPP3A in codes of practice, the Privacy Commissioner made changes to several of our codes. You can find more about those changes, including any amendments or submissions specific to this code, below:

We have drafted guidance to help health agencies understand how to meet their IPP3A obligations from 1 May 2026. This guidance is undergoing targeted consultation in April 2026 and we will update this webpage with a link to the final guidance when it is published.

Previous versions

Health Information Privacy Code 2020 incorporating Amendment No 1

Health Information Privacy Code 2020 Amendment No 1

Amendment No 1 was issued on 25 May 2022 and came into force on 1 July 2022. The amendment aligned the Code with structural reforms within the public health and disability support sector. The amendment removed references to District Health Boards given their disestablishment by the Pae Ora (Healthy Futures) Bill (the Pae Ora (Healthy Futures) Act 2022 after 1 July 2022).

It also added Health New Zealand (Te Whatu Ora), and the Ministry of Disabled People (Whaikaha) to Schedule 2 of the Code, allowing them to assign an NHI, and updated the contracting provision in Schedule 2 and updated some terms used and fixed two minor errors identified following the repeal and replacement of the Code in 2020.

Supporting documents 

Health Information Privacy Code 2020

In 2020 codes of practice were revoked and replaced to align with the Privacy Act 2020. You can read papers about that version of the code here:

Previous versions (now revoked)

Back to top