Health Information Privacy Statement

 I understand the following:

W respect privacy and confidentiality. We collect, use, store and share your health information in accordance with the Health Information Privacy Code 2020 and other applicable laws. This statement explains why we collect your information, how we use and share it, and your rights.

Why we collect and share your health information

• We (the practice) collect and share health information about you (the patient) so we can:
• provide safe and effective care
• keep accurate health records
• coordinate your care with other providers
• meet our legal and funding requirements

Your information may also help our Primary Health Organisation (PHO) and the Government to:

• plan and fund health services
• prepare and publish statistics

You consent to your health information being collected when you sign our patient enrolment form.

Assurances

• We’re required to keep your information accurate, up-to-date and relevant for your treatment and care:
• We only collect and retain what we need to deliver health services for you and your whānau. 
• We only use what we know to improve your health and the health of the community. 
• We only share what we know with people in the health system who we know will look after your 

Information and protect your privacy.

• We look after the information we hold about you and keep it secure. 

Your privacy is our priority. We will keep your information secure and prevent unauthorised access. We work with a range of data sources and platforms, and we regularly evaluate our systems and processes to ensure we are using secure and up-to-date technology. This includes any AI tools that may be used to assist with the provision of your healthcare.

Direct Collection of Health Information 

Direct collection is when we (the practice) collect personal or health information directly from you (the patient) or someone you have agreed we can speak to. We collect information about you through:

• enrolment forms
• appointments
• online forms
• emails
• conversations with our team

Indirect Health Information Collection 2

Indirect collection is when we receive personal or health information about you from another source, not directly from you.

We collect information about you from other agencies for the purpose of maintaining an up-to- date health record and providing safe and quality primary health care.  

This may include:

• Receipt of laboratory, radiology or other results
• Correspondence from after-hours services, hospitals and specialists which can include discharge summaries, specialist letters, lab and imaging results.
• Letters and notifications from referral providers reporting back on health or screening programmes for which you have been referred (for example, Green Prescription, smoking cessation, dietitian).
• Information from Health NZ and WellSouth in regard to updated demographic, NHI or eligibility information.
• Contact from or correspondence from non-health agencies such as Police, legal representatives, Oranga Tamariki, insurance companies, Ministry of Social Development (Work and Income New Zealand) and the Accident Compensation Corporation
• Receipt of correspondence from employers, regarding, for example, fitness to work

We will notify you if we receive any information about you from a third party not identified above, or if the information we receive is unexpected or sensitive.

Health Information Sharing

We share information about you with other trusted health organisations for a range of purposes:

Shared Electronic Health Record

• HealthOne is a secure shared electronic record used across the South Island. HealthOne may be used to view records held by other healthcare providers involved in your care, and to share relevant information with them. This information can include test results, allergies, medications, clinician summaries and hospital information.
• HealthOne operates in accordance with the Privacy Act 2020 and the Health Information Privacy Code 2020. You can ask the practice for more information, or you can restrict the sharing of your records by contacting HealthOne directly on 0508 837 872 or healthone.privacy@pegasus.org.nz.

Health Programmes 

• Health data relevant to a programme you are enrolled in (e.g., Breast Screening, Immunisation, Diabetes) may be sent to the PHO or the external health agency managing this programme. 

Health New Zealand, Ministry of Health, Primary Health Organisation (PHO) 
Your health information may be shared with health agencies such as Health New Zealand, Ministry of Health, or PHO for the following purposes:

• The provision of a National Health Index number or to update your details
• Health service planning and reporting;
• Monitoring service quality; and
• Payment 

Audit  
In the case of financial audits, your health information may be reviewed by an Auditor for checking a financial claim made by the Practice, but only according to the terms and conditions of section 22G of the Health Act (or any subsequent applicable Act).  The Auditor may contact you to check that services have been received.  If the audit involves checking on health matters, an appropriately qualified healthcare Practitioner will view the health records.

Research 
Your health information may be used for health research, but only if approved by an Ethics Committee or when it has identifying details removed:

• Research which may directly or indirectly identify you can only be published if the researcher has previously obtained your consent and the study has received ethics approval
• Under the law, you are not required to give consent to the use of your health information if it’s for unpublished research or statistical purposes, or if it’s published in a way that doesn’t identify you. 

Complaint Investigations 
If you make a complaint about the care or services you receive, relevant information may need to be disclosed to the practice regulators, insurers, indemnity providers, or legal advisors for the purposes or managing or responding to the concerns you have raised. 

Visiting Another GP

If you visit another GP who is not your regular doctor, you will be asked for permission to share information from the visit with your regular doctor or practice.

If you are under fourteen years old or have a High Use Health Card, or a Community Services Card, and visit another GP who is not your regular doctor, they can make a claim for a subsidy, and the practice you are enrolled in will be informed of the date of that visit.  The name of the practice you visited and the reason(s) for the visit will not be disclosed unless you consent. 

Access to your Health Information

You have the right to access, and request corrections to, your health information under Rules 6 and 7 of the Health Information Privacy Code 2020.

• You don't have to explain why you're requesting the information, but you may be required to provide proof of your identity. If you request a second copy of that information within 12 months, you may have to pay an administration fee to cover reasonable costs to provide that information.  
• If asking for your health information to be corrected, your health provider should provide you with reasonable assistance. If your healthcare provider chooses not to change that information, you can have this noted on your file. 

Complaints 

It’s OK to complain if you’re not happy with the way your health information is collected or used. 

Talk to your healthcare provider in the first instance. If you are still unhappy with the response you can call the Office of the Privacy Commissioner toll-free on 0800 803 909, as they can investigate this further.

Except as described above, details about your health status or the services you have received will remain confidential within the Practice unless you give specific consent for this information to be communicated.

Use of Artificial Intelligence 

We may use approved artificial intelligence (AI) tools to support healthcare services, including helping clinicians prepare consultation notes. If your clinician intends to use an AI transcribing tool during your consultation, they will explain how it will be used and ask for your consent before it is used. 

Information processed through approved AI tools is managed securely and in accordance with applicable privacy laws and health information requirements. You can ask questions or request further information about how AI is used in your care at any time.