Working with you to strengthen how health information is shared

SECTOR UPDATE - Health NZ | Te Whatu Ora

Health NZ is rolling out an information sharing and security awareness initiative to help strengthen how health information is shared digitally, in a way that works for the sector. Information sharing happens every day and is essential for safe patient care.

This approach builds on our shared commitment to protecting patient information, while also responding to learnings from recent cyber security events.

We will initially work with PHOs and their primary care practices/clinics, as well as with providers of telehealth services, urgent care and afterhours care.

Support includes an online hub, checklist and webinars

The information sharing and security awareness initiative, which will run from the end of June to August 2026, will include:

• webinars and awareness activities
  • register for webinar on 30 June 6:00pm
  • register for webinar on 1 July 12pm
• a security checklist (attached)
• quick reference guides and learning modules
• a central online hub with guidance (available early July), e-learning and resources
• regional workshops with PHOs
• targeted support for PHOs and practices as requested
• ongoing awareness activities over time.

Responsibilities when sharing health information

As part of the Government Digital Delivery Agency (GDDA) Information Sharing Standard, Health NZ has responsibilities when sharing personal information with third parties, including primary care practices and clinics.

We must now undertake due diligence – working alongside practices and clinics to make sure strong safeguards are in place to protect personal information. We will work with our sector partners to make these expectations practical, achievable, and supportive of day-to-day care delivery.

We see this as a collaboration, where we partner with providers to build confidence, capability, and consistency across the system. This includes supporting alignment with the Health Information Privacy Code and Privacy Act 2020, as well as working progressively towards the National Cyber Security Centre’s Minimum Cyber Security Standards and the Health Information Security Framework (HISF).

Health NZ Information Access and Use Agreement

Once due diligence is complete, Health NZ will sign an Information Access and Use Agreement with health service providers, and a separate Information Access and Use Agreement with IT vendors. Signing means an organisation acknowledges and understands its role and the role of Health NZ in keeping data safe.

The Information Access and Use Agreement is a new, single, main agreement between Health NZ and healthcare service providers.

It sets out:

• how information can be shared
• the responsibilities of Health NZ, health providers and IT vendors.
  

Individual schedules set out specifics for data sharing for a service, such as the Shared Digital Health Record.

Next steps

We will work through PHOs to connect with general practices about the information sharing and security awareness initiative and will be in touch with more information shortly. In the meantime, if you would like more information please contact customerservice@health.govt.nz.

We look forward to working with our sector partners as this initiative rolls out and continuing to strengthen trusted information sharing across the sector.

Extended timeline for the Shared Digital Health Record

The Shared Digital Health Record is the first Health NZ data service needing to respond to the requirements of the GDDA’s new Information Sharing Standard. This means additional checks, working with primary care practices/clinics, must be undertaken before information can be shared.

The following must be completed before data sharing:

• information sharing and security awareness initiative
  
• due diligence checks
  
• signing of the Health NZ information access and use agreement 
  
• patient notification about the new data service.
  

The above also support alignment with the Health Information Privacy Code and Privacy Act 2020, the National Cyber Security Centre’s Minimum Cyber Security Standards and the Health Information Security Framework (HISF).

The information sharing and security awareness initiative being rolled out by Health NZ will support primary care practices/clinics to respond to the new requirements.

Updated rollout timeline

To ensure requirements are met before data is shared, the timeline for rolling out the new data service has been extended.

• Immunisation and medication data is now expected to be shared through the Shared Digital Health Record later in 2026.
  
• Primary care data is expected to be available to clinicians from mid 2027.
  

If you would like further information about the Shared Digital Health Record, please email SharedDigitalHealthRecord@TeWhatuOra.govt.nz.

Sector updates are provided by organisations to eHealthNews.nz and have not necessarily been edited or checked for accuracy. Any queries should be directed to the organisation issuing the release.

Do you have an item to add to sector updates?

Email your information to us at updates@hinz.org.nz

Return to eHealthNews.nz home page