In most families, one person ends up holding everyone’s health history in their head. Which specialist said what. Whether the dose changed. Often that person is doing it for their children and their own parents at once, from memory.
The thing nobody tells you until you need it: caring for someone does not give you a right to see their health records. Responsibility and authority are separate, and they come apart at the wrong moments. Here is how access works in New Zealand, and what to arrange early.
Disclosure
I am a doctor, and I founded exora, which is a personal health record app that can hold records for several people in one account. It appears near the end. Everything before that applies whatever you use.
The rule underneath all of it
Health information in New Zealand is governed by the Health Information Privacy Code 2020. Two parts matter here. Rule 6 gives each person the right to access their own health information. Rule 11 limits when a provider can disclose it to anyone else, and allows it, among other cases, when the person has authorised it, or in some cases to their “representative”.
The Code defines a representative in three ways: for someone who has died, their personal representative; for a child under 16, their parent or guardian; and for anyone else who cannot give consent or exercise their rights, “a person appearing to be lawfully acting on the individual’s behalf in the individual’s interests”. Everything below is a version of one of those.
Your children: guardianship, then their own say
The starting point is guardianship. Under the Care of Children Act 2004, a child’s mother and father are usually joint guardians (section 17). The main exception is where the mother was neither married to, in a civil union with, nor living with the father as a de facto partner between conception and birth; then she is the sole guardian, although the father becomes a guardian if he and the mother both notified the birth and his details were registered (section 18), and he can also apply to the court (section 19). Others, such as a step-parent, can be appointed guardians by the court.
Guardianship includes deciding important matters with or for the child, and the Act lists non-routine medical treatment as one of them (section 16). A guardian keeps that role whether or not the child lives with them, unless a court order says otherwise, so separation does not end it.
Seeing your child’s records
For a child under 16, a parent or guardian can ask for their health information as their representative, under section 22F of the Health Act 1956. It is not automatic. Rule 11(5) of the Code lets the provider refuse if giving it to you would be contrary to the child’s interests, or if the provider has reasonable grounds to believe the child would not want it disclosed.
Day to day, most parents use their GP’s patient portal. ManageMyHealth, one of the most widely used, says parents can view a child’s record through a linked account set up by contacting the health centre. Its FAQ also says access is restricted once the child turns 16, that the accounts are then unlinked automatically, and that re-linking is at the health centre’s discretion and may need the young person’s consent. Other portals work differently, so ask your practice.
For immunisations, Health New Zealand’s My Health Record lets a parent aged 16 or over, at the “Complete” identification level, link children under 12 and see their immunisation records, if the parent’s name matches the child’s New Zealand birth certificate. Children with an overseas birth certificate, or raised by someone other than their birth parents, such as through whāngai, cannot be linked.
Why it changes as they get older
This is the part that catches parents out. The law gives young people their own say well before 18.
- At 16, a young person’s consent, or refusal, to medical, surgical or dental treatment for their own benefit has effect as if they were an adult (Care of Children Act, section 36). Being their parent also stops making you their “representative” under the Code, so you can no longer ask for their records on that basis.
- Before 16, there is no fixed age at which a young person can make their own decisions. The Code of Health and Disability Services Consumers’ Rights presumes every consumer competent to give informed consent unless there are reasonable grounds to think otherwise (Right 7(2)), and the Code sets no minimum age.
- For abortion, at any age, a girl’s or young woman’s own consent or refusal has the same effect as an adult’s (Care of Children Act, section 38).
This is a good system. Teenagers need to be able to see a GP about contraception, mental health or drink and drugs and know the conversation is theirs.
So the practical advice is not a workaround. It is a conversation before they turn 16: your health record is becoming yours, which is right, and I would still like to help with appointments and prescriptions if you are happy for me to. Most teenagers say yes when asked. Fewer do when they find out you have been looking.
A parent or partner who can still make their own decisions
This is the most common situation. If your mother is perfectly capable and wants help with appointments and medicines, you need no legal authority. She authorises it. Rule 11 of the Code allows a provider to disclose information when the person concerned has authorised it.
In practice that means two things. She can tell her GP and specialists that you are involved and what they may discuss with you. And she can give you access to her portal: ManageMyHealth, for example, says you “can choose to authorise access to a family member or caregiver”, with each person needing their own email address. She stays in charge of what is shared.
The thing worth taking away is the timing. Set this up on an ordinary Tuesday, not during a hospital admission. Only someone able to agree can authorise it. The conversation is much easier over a cup of tea than in a hospital corridor.
For hospital or private records, she can make the access request herself, usually free, or authorise the provider to give the copy to you. Our New Zealand records guide covers how to ask.
Someone who can no longer make their own decisions
This is where it gets genuinely complicated. In New Zealand, legal authority to make health and welfare decisions for an adult who has lost capacity comes from one of two places, both under the Protection of Personal and Property Rights Act 1988.
Enduring power of attorney for personal care and welfare
An enduring power of attorney (EPA) lets someone (the donor) appoint a person to act for them. There are two kinds: one for property, and one for personal care and welfare. A donor can make both. Three things about the personal care and welfare kind are often missed:
- Only one person can hold it. The Act does not allow more than one individual, or a trustee corporation, to be the attorney for personal care and welfare (section 98(2)).
- It has a formal signing process. It must be in the prescribed form, and the donor’s signature must be witnessed by an independent lawyer, legal executive or authorised trustee company officer, who must explain its effects and certify that the donor understands it and is not under pressure (section 94A).
- It only works when the person cannot decide for themselves. For a significant matter, such as entering residential care or a major medical procedure, the attorney cannot act until a relevant health practitioner has certified, or the court has decided, that the donor is mentally incapable. For other matters, the attorney must believe on reasonable grounds that they are (section 98(3)). While your mother can decide, she decides.
An attorney acting under a valid EPA is the clearest example of “a person appearing to be lawfully acting on the individual’s behalf”, which is what makes them a representative under the Health Information Privacy Code. Even then, a provider can refuse information under rule 11(5) if giving it would be contrary to the person’s interests, or if there are reasonable grounds to believe they would not want it disclosed. It is information to do the job, not a right to the whole file.
A welfare guardian appointed by the Family Court
If someone has lost capacity without making an EPA, a family member can apply to the Family Court to be appointed their welfare guardian (section 12). The court can only do this if it is satisfied the person wholly lacks the capacity to make or communicate decisions about the relevant parts of their care, and that appointing a welfare guardian is the only satisfactory way to make sure those decisions are made. It is a much harder road than an EPA made in time.
The single most useful line in this article: arrange this while it is hypothetical. An EPA is not only for the very old or very ill, and the difference between a family that has one and a family that does not shows within an hour of an unexpected admission. This is general information, not legal advice; for a specific situation, talk to a lawyer.
After someone has died
The Health Information Privacy Code still applies to their information. Their personal representative, usually the executor or administrator of the estate, can ask for their health information under section 22F of the Health Act, and the provider can refuse on the same grounds as above. The disclosure rule, rule 11, stops applying once the person has been dead for 20 years or more.
Being a carer without the paperwork
The hardest position is responsibility without authority: a friend, a neighbour, a partner nobody has written down, one of several adult children who disagree. Get named while the person is well, by asking them to tell their GP and specialists you are involved. Keep your own notes and copies of documents you are given. Ask for a discharge summary at the time, not months later. And remember the person has full rights themselves: they can request every record any provider holds about them, and you can help them do it.
What actually helps day to day
Legal access is necessary, but what makes a Tuesday easier is smaller: a current medication list for each person, a one-page summary of conditions, allergies and who their doctors are, and the answer to “what changed since last time?”
Note where the official layer stops. A linked portal shows you each person’s GP record, one at a time, as their practice allows, and My Health Record shows immunisations. Both are worth having (I compared them with a personal record here), but neither will assemble hospital letters, private clinic reports and older paperwork into a picture of the family. They were never trying to.
Where exora fits
exora is built for this shape of problem: one account, a separate profile for each person, such as yourself, a child and a parent you care for, and each profile holding its own health record. You upload the documents you have for each person, such as PDFs, photos or scans of the discharge summary, the specialist’s letter or the lab results, and exora reads them for you, with a reading system built for medical records. It pulls out the clinical details and builds one searchable record with a timeline for each person. Every fact links back to the document it came from, so you can check it. You can share a chosen part of one person’s record by link, with a co-parent, a sibling or a clinician, with an expiry, and revoke it at any time. Your health data is never used to train AI models. exora is free to start, with an optional membership.
Where it does not help, plainly:
- It is not legal access. Creating a profile for your mother does not give you any right to her records, and exora does not check guardianship or an EPA. Access comes from the routes above, and nothing in software replaces them.
- You still need their agreement. Managing an adult’s health information without their knowledge is not something any product should help with.
- No connection to Health New Zealand. exora has no link to My Health Record, My Health Account, any GP portal or any Health New Zealand system. You download documents, or request records, and upload them yourself. It cannot get documents you do not have.
- Your data is stored in Sydney, Australia. That is outside New Zealand. exora has no New Zealand health-data certification. How we handle data is on our security page; read it before you upload anything, especially for someone else.
- It can misread. The reading is automated, so check anything that matters against the original. That is why every fact links back to it.
- It is not medical advice. It organises information. It does not diagnose or tell you what to do.
A short checklist
- Young children: ask your GP practice to link your child’s record to your portal, and link children under 12 in My Health Record for their immunisations.
- Teenagers: have the conversation before 16. After that, access depends on them.
- Capable adults you help: ask them to tell their GP and specialists you are involved, and to give you portal access, now, while it is routine.
- Anyone ageing: make an enduring power of attorney for personal care and welfare, and one for property, while it is hypothetical.
- Everyone: keep a medication list and a one-page summary for each person. If you do nothing else on this list, do this.
Sources
- Health Information Privacy Code 2020 (as in force from 1 May 2026), clause 4 (representative), rules 6 and 11, including rule 11(5)
- Care of Children Act 2004, sections 15 to 19 (guardianship), 36 (consent at 16) and 38 (consent to abortion)
- Health Act 1956, section 22F (requests by representatives)
- Code of Health and Disability Services Consumers’ Rights, Right 7 (presumption of competence)
- Protection of Personal and Property Rights Act 1988, sections 12 (welfare guardians), 94A (creating an EPA), 98 and 98A (personal care and welfare)
- ManageMyHealth: FAQs (linked child accounts, unlinking at 16, authorising family or caregivers)
- Health New Zealand: My Health Record (linking children under 12)
Claims about access to health information, guardianship, enduring powers of attorney and welfare guardians are sourced to the legislation, the Privacy Commissioner, the Health and Disability Commissioner, Health New Zealand and ManageMyHealth, linked inline, and were checked on 9 November 2026. GP practices and portals set their own arrangements for linked accounts, so check with yours. This article is general information, not legal or medical advice. Capacity and substitute decision-making turn on the documents in place; for a real situation, talk to a lawyer.
