Resources and learning

Education providers often collect health information about a learner to help support the learner through their education journey.

On this page:

Download a PDF of the guidance on this page (PDF, 372KB).

Health information

Information about a learner’s health or medical conditions can, depending on the context, be sensitive information so extra care is required when collecting, storing, using or sharing a learner’s health information.

Health information is defined in section 4(1) of the Health Information Privacy Code 2020. It is a broad definition, but in an education sector context includes:

information about a learner’s health, including medical history, including mental and physical health
information about any disabilities and the supports a learner may require (e.g. assistance in an evacuation, reading or writing assistance for assessments or exams)
information about any health or disability support services that are or have been provided to a learner (e.g. learning support, counselling in schools)
any information collected before, after or in the course of and incidental to, the provision of any health or disability support service to a learner.

Purposes for collecting health information in the education sector can include:

ensuring a school or ECE service has appropriate resources to support a learner while attending school or an ECE service
ensuring learners with health or disabilities are able to safely participate in activities, including education out of the classroom (e.g. school camps, ECE service adventure walks)
ensuring schools and ECE services that provide meals meet food safety standards
providing health and disability support services including counselling
enabling the year 7 and 8 school-based immunisation programme
to support a disciplinary process e.g. evidence of medical or health conditions, requirement to undergo drug counselling or testing as part of a suspension condition.

Health information will in most cases also be confidential information and may be subject to professional codes of practice (for example, health information collected by a speech language therapist or a counsellor). Read more information about confidentiality and professional codes of practice in Chapter 4: Privacy and Confidentiality.

Health agencies and the Health Information Privacy Code 2020

The Health Information Privacy Code (the HIPC) applies to all health information collected and held by health agencies.

The HIPC mirrors, to a large degree, the Information Privacy Principles (IPPs) in the Privacy Act 2020 and regulates how health agencies collect, hold, use and disclose health information.

Health agencies are defined in the HIPC as agencies, or parts of agencies, that provide personal or public health or disability support services and include:

general practitioners, doctors, nurses and dentists
healthcare providers
mental health providers
disability support service providers
occupational health providers.

Service providers who provide health or disability support services to learners (either in the school or ECE service environment or externally) will generally be a health agency, and the HIPC will apply to health information they collect, hold, use or share.

Schools and ECE services

Schools and ECE services may also collect and hold health information about learners.

However, just because you collect and hold health information does not mean that the HIPC applies – the HIPC only applies to health agencies.

When is a school considered a health agency?

In some specific cases, a school may be considered a health agency. This includes situations where a school provides health and disability support services to learners. For example:

where a school operates a health or medical clinic
where a school employs or contracts health practitioners such as a school nurse, guidance counsellors, speech language therapists or occupational therapists
health schools and specialist residential schools.

Where your school is considered a health agency, the HIPC will govern all health information collected as part of the delivery of those health and disability support services. The HIPC will also apply to any requests for health information collected by health and disability support services function of your school about a learner. The HIPC doesn’t apply to other information collected by your school outside of the delivery of health and disability support services – the IPPs will apply to those other activities.

Other health information collected by schools and ECE services

Where a school (or ECE service) is not providing any health and disability support services themselves, they are not considered a health agency and the IPPs will apply to the collection, use and disclosure of health information about learners.

The Privacy Act will also apply to any requests for health information that you may hold about a learner.

For more information about managing a learner’s health information under the Privacy Act 2020 follow the guidance in:

Health information in practice

This section provides some examples of health agencies and managing health information in the education sector.

Example: Health NZ mobile oral health services

A primary school has a mobile oral health clinic visit the school once a year. The clinic is operated by Health NZ. During the days the mobile clinic is on school grounds, learners can visit the dentist and receive oral health checks. The school principal obtains consent from learners (or their parents) to attend the clinic and receive an oral health check.

Is the school a health agency?

No. While the mobile clinic is on school grounds, the school is not providing the oral health services – the services are provided by Health NZ. Any health information the school collects as part of facilitating the visit by the mobile oral health clinic would be governed by the IPPs.

Example: Counselling in schools

An intermediate school employs a counsellor to provide counselling services to its learners. Learners can access the counselling service through self-referrals, or referrals made by teachers or the learners family.

Is the school a health agency?

Yes, but only with respect to the information collected as part of the delivery of counselling services. All information collected as part of the delivery of the counselling services will be health information and governed by the HIPC. Any health information collected by the school outside of the counselling services will be governed by the IPPs.

Example: School based health clinic

A secondary school operates a health clinic on the school grounds. The health clinic has two nurses who provide health services to learners. Where required, the nurses will arrange referrals to external healthcare providers.

Is the school a health agency?

Yes, but only with respect to the information collected by the health clinic. All information collected as part of the delivery of health services by the health clinic will be health information and governed by the HIPC. Any health information collected by the school outside of the health clinic services will be governed by the IPPs.

Example: Holding a learner’s medications

A school holds medications that specific learners require while they are attending school. The medications are held securely in the school office. A school administrator makes the medications available to the learners according to agreed protocol between the school, the learner and their parents.

Is the school a health agency?

No. The school is not providing health or disability support services. They are simply ensuring that medications learners may require while they are attending school are stored securely and are made available to the learner when they require them.

Example: Holding a learners immunisation record

Primary schools and ECE services are required to maintain immunisation registers for all learners (Health (Immunisation) Regulations 1995). The immunisation registers hold the learner’s immunisation certificate.

Is the primary school or ECE service a health agency?

No. The primary school or ECE service is not delivering a health or disability support service. The requirement to maintain an immunisation register which holds the learner’s immunisation certificate does not make the primary school or ECE service a health agency.

Example: Request for health information by representative

A school administrator has received a request from a parent for all health information the school holds about their child. The learner is in year 10 and has been receiving speech language therapy from a speech language therapist employed by the school. The health information includes the sessions notes of the therapist and assessment and evaluation documentation.

Can the school administrator provide access to the health information?

In this case, as the school provides health and disability support services, it will be considered a health agency and the HIPC will apply to all personal information collected as part of the delivery of those services.

Parents or guardians of a child under 16 are their child’s representatives under the HIPC. Under section 22F of the Health Act, as representatives they have a limited right to access health information about their child. A request from a learner’s parent or guardian for health information is treated as a HIPC rule 6 access request.

In this case, because the learner is under the age of 16, the parent making the request is considered a representative for the purposes of accessing their child’s health information.

The school administrator still needs to consider whether any refusal grounds set out in in sections 49 to 56 of the Privacy Act apply before they release the learner’s health information to the parent.

The school may also hold health information collected outside of the health clinic, for example, school camp health information and information about medical or health conditions. This health information should be considered IPP6 and the rules set out in sections 39 to 57 of the Privacy Act.

Example: Request for health information by parent (refusal)

A school operates a health clinic which is run by a school nurse who provides health services to the learners attending that school. A learner’s parents make a request to the school principal for all health information about their child. The learner is in year 13 (16 years old) and has received health services from the school nurse.

Can the school principal provide access to the health information?

As the school operates a health clinic the school will be considered a health agency with respect to the health clinic. Therefore, all information collected by the school nurse in the course of providing health services will be governed by the HIPC.

As the learner is 16 years old, the parent is not automatically considered a representative. The school principal will need to assess whether the parent is acting as the learner’s representative when making the request (see: Responding to requests for a child or young person’s personal information). If the principal determines that the parent is not acting at the learner’s representative, they can refuse the request.

Where the parent has been determined to be acting as the learner’s representative, the request for information held by the health clinic should be considered under rule 6 of the HIPC. The principal will need to consider whether any of the refusal grounds set out in sections 49 to 56 of the Privacy Act apply before they release the learner’s health information to the parent.

The school may also hold health information collected outside of the health clinic, for example, school camp health information and information about medical or health conditions. This health information should be considered under IPP6 and the rules set out rules set out in sections 39 to 57 of the Privacy Act.

Example: ECE service providing meals

An ECE service provides meals for its learners. To ensure they are meeting food safety standards the ECE service manager requests parents provide information about any food allergies or dietary requirements their child may have. This information is used to ensure appropriate food is provided to its learners.

The allergy and diet information are health information. The ECE service is not a health agency, so the IPPs apply to the information. The ECE service manager records this information in a learner food safety register and securely stores the register in the ECE services business system. Only staff with responsibility for making or serving food within the ECE service have access to the register. Parents are asked to update food safety information every six months. When the learner leaves the ECE service the ECE service manager removes the learner’s information from the current version of the food safety register.

Example: School camp health information

A school runs a year 12 camp each year. As part of the camp consent process, parents are required to review and update the health profile form for their child. The form includes all health information the school holds about the learner, and parents are asked to provide any new health information, including medication requirements.

The information collected helps the school camp managers to manage the learner’s health and medical conditions while at camp.

Does the HIPC apply to the health and medical information?

No. The school is not providing health or disability support services (i.e. is not a health agency), so the Privacy Act applies to the information.

What if the school was a health agency?

If the school did provide health and disability support services, and was considered a health agency, the collection of the school camp health information would not fall under the HIPC as the school camp health information was not collected as part of the school’s health and disability support services function.

Learning support information

As an education provider, you will likely collect information about learners to enable you to identify and deliver effective learning support interventions for learners with additional needs.

Learning support information will often include health and disability support information about the learner, and at times this information could be sensitive, so extra care is required when collecting, holding, using and sharing learning support information.

Learning support information, including health and disability support information, collected by a school or ECE service will generally be subject to the Privacy Act. In some cases, the learning support information may be collected by a health agency (e.g. a service provider providing health and disability support services). In this case, the health information collected by that service provider will be governed by the Health Information Privacy Code.

To ensure you are collecting, using, storing and sharing learning support information appropriately follow the guidance in:

In some cases, learning support information may be collected and held by a health agency (e.g. a service provider providing health and disability support services). In this case, the health information collected by that service provider will be governed by the Health Information Privacy Code (see Health Agencies and the Health Information Privacy Code section above).

Learning support registers

Learning support registers can help you understand and effectively respond to the needs of your learners. A register can be a tool for a school or ECE service to record information about learners that are receiving a learning support intervention, including what those interventions are and who is providing them.

Registers can be at different levels – a learner level, and a school or ECE service level.

A learner level register will contain personal information specific to the learner and their learning support needs. A school or ECE service level register can be used to provide non-identifiable information about the number of learners and the types of need and be used for resource planning and capability.

Registers, particularly learner level registers, can create privacy risk. It is important that you set up and manage your registers appropriately. Some things to think about when developing your register include:

What is the purpose of the register? Can you achieve that purpose without a register?
What is the minimum amount of information required for the register to be effective and achieve its purpose?
Are you collecting new information about the learner?
Should you get consent from the learner (or their parent) to be included on the register and what do you need to tell them about the register and the information that it holds?
Who requires access to the register, or information contained in the register, and why?
How will you keep the information safe? Where will you store the register?
How will you keep the information up to date? How will you manage learners that no longer require learning support interventions?

Example: Creating a learning support register

A school principal has a number of learners with various learning support needs. The principal wants to create a register to ensure the school respond to and manage its learners needs effectively. The register also helps the principal manage resourcing and funding of learning support interventions.

The principal wants to ensure that only the minimum personal information required is collected and held in the register to protect the privacy of the learners (IPP1). As part of this thinking the principal determines:

that the date of birth of the learner isn’t necessary as the register records the year level of the learner
the NSN is included in the register to ensure the learning support information is linked to the correct learner
the type of need and a description of the need is important to identifying appropriate supports
the organisation or person providing the intervention is required so the principal knows who is coming into the school to provide services and to which learners
the date the service started helps the principal determine the effectiveness of the intervention when linked with other information like attendance and achievement information
knowing whether the intervention is funded, and by whom, helps the principal manage resourcing
only learners actively receiving learning support services should be visible in the register.

Having completed the upfront thinking, the principal creates the following learning support register:

Having created the register, the principal thinks about the other requirements of the Privacy Act. The information in the register is sensitive information, so the principal saves the register in a secure location in the school’s education or learner management system (IPP5).

To further mitigate against unauthorised access, use or sharing of the information, the principal also password protects the spreadsheet, and only provides the password to staff who are responsible for managing learning support within the school (IPP5). The password is updated on a regular basis. The list of staff that have the password should be reviewed regularly to ensure it is up to date.

If the school has an education management system that enables the setting of access controls, the principal can use that functionality to ensure that only authorised staff have access to the location where the register is electronically stored. The list of staff that have access to the register should be reviewed regularly to ensure it is up to date.

The principal then creates a Learning Support Register Policy which clearly sets out why the information is being collected, what it is used for and who the information may be shared with (IPP10 and 11). Staff are made aware of the Policy and training is provided at a staff meeting.

The principal makes the Policy available to all learners (and their parents), so they are aware of the collection, use and sharing of their child’s learning support information (IPP3 and 3A) and retention requirements under IPP9 and the Public Records Act 2005. The Policy also sets out how learners (or their parents) can request access to, and correction of, information contained in the register (IPP6 and 7).