If a GP practice, hospital, specialist, physio, pharmacy or dentist in New Zealand holds health information about you, you have a legal right to see it and to get a copy. You do not have to say why you want it.
The right comes from the Privacy Act 2020 and the Health Information Privacy Code 2020, which applies the Act to health information. It covers public and private providers alike.
The short version
- You can ask any health provider for the health information they hold about you (rule 6 of the Code). You can ask in writing or verbally, and the provider must help you make the request.
- They must respond as soon as reasonably practicable, and within 20 working days. They can extend that only for a large or complex request, and they must tell you why and how long.
- It is usually free, and that includes your GP. Public providers, including Health New Zealand hospitals, cannot charge unless the Privacy Commissioner has specifically authorised it. GP practices are private providers, so they can charge only for a repeat request within 12 months, or for copies of x-rays, scans and video.
- If they refuse, take too long or overcharge, complain to them first, then to the Privacy Commissioner.
What the law says
Rule 6 of the Health Information Privacy Code gives you the right to confirmation of whether a provider holds health information about you, and to access it. The procedure comes from Part 4 of the Privacy Act: the provider must respond within 20 working days of receiving your request (section 44), and can extend that time only for a large quantity of information, necessary consultations or complexity (section 48).
You can choose the form. A copy, paper or electronic, a chance to look at the records, or a summary are all options, and the provider must use the way you prefer unless that would be impractical or unlawful (section 56). If it is urgent, say so and give the reason; they must take that into account (section 41).
On cost, the Act lets public sector agencies charge only if the Privacy Commissioner authorises it (sections 66 and 67). For private providers, clause 6 of the Code allows a reasonable charge only in two cases: a repeat request for substantially the same information within 12 months, or a copy of an x-ray, video, MRI, PET or CT image. If the charge is likely to be over $30, they must give you an estimate first.
This includes your GP. Although most GP care is publicly funded, GP practices are private providers, so they cannot charge for your first copy of your notes.
Providers must keep health information for at least 10 years from the last time they provided services to you (Health (Retention of Health Information) Regulations 1996). So even old records are usually still there.
A provider can withhold some information in limited cases set out in the Act, for example if giving it to you would be likely to pose a serious threat to someone’s life, health or safety (section 49). They must tell you if they are withholding anything and that you can complain about it.
If something in your record is wrong, you can ask the provider to correct it (rule 7). If they will not, you can ask them to attach your statement of the correction.
How to ask
- Ask the place that holds the records. Your GP practice holds your GP record. Hospital records are held by the hospital that treated you, usually through its health records or clinical records team. Private specialists, clinics and dentists hold their own.
- Check your patient portal first. Many GP practices let you see results, letters and notes in a patient portal. It is often not the whole record, so ask the practice for anything that is missing.
- Put it in writing if you can. A verbal request is valid, but an email gives you a dated record. Say who you are, what you want (for example “my full GP record”, or “everything from my admission in March 2025”) and how you want to receive it.
- Ask for an electronic copy. It is usually the quickest way, and you are entitled to ask for it.
- Note the date. The 20 working days run from the day after they receive your request.
If they refuse or take too long
Every health provider must have someone to deal with privacy complaints, and most must acknowledge yours in writing within 5 working days (clause 7 of the Code). Raise it with them first.
If that does not resolve it, complain to the Privacy Commissioner. Refusing access without a proper reason, taking too long, or charging when the Code does not allow it can each be an interference with your privacy.
Common situations
- Your child’s records. For a child under 16, a parent or guardian can ask as their representative. A provider can refuse if giving the information would be contrary to the child’s interests, or if it has reasonable grounds to believe the child would not want it disclosed (rule 11(5) of the Code).
- Someone who has died. The Code applies to information about people who have died, and their personal representative (usually the executor or administrator of the estate) can ask for it. Section 22F of the Health Act 1956 also lets a representative request the information, and the provider can refuse on the same grounds as above (rule 11(5)). This does not apply once the person has been dead for 20 years or more.
- Your ACC claim file. ACC holds its own records about your claim. Ask ACC for them directly; as a public agency, it cannot charge you for access.
- Records from a GP you have left. When you enrol with a new practice, your records are usually transferred to it, so ask your current practice first.
Asking for mental health records? See how to get your mental health records in New Zealand, including when something can be withheld.
Why the records are only half of it
Your history is spread across your GP, one or more hospitals, private specialists and other providers, and it arrives as PDFs, scans and paper. None of them shows you everything in one place.
That is where exora fits. Upload the records you get back, from any provider, and it reads them, pulls out your medications, conditions, results, procedures and vaccinations, and lays them out in plain language. Every fact links back to the page it came from, so you can always check it.
exora does not connect to Health New Zealand or to your providers’ systems, and it does not request records for you. You get them, using the rights above, and exora puts them together. How exora handles your copy is set out in our privacy policy.
Sources
- Health Information Privacy Code 2020, rules 6 (access), 7 (correction) and 11 (representatives), clause 6 (charges) and clause 7 (complaints)
- Privacy Act 2020, sections 40 to 49 (requests, urgency, assistance, 20 working days, extensions, withholding), 56 (form of access), 66 and 67 (charges) and 70 (complaints)
- Health (Retention of Health Information) Regulations 1996, regulation 5 (10 years)
- Health Act 1956, section 22F
Checked against the legislation as of November 2026. This is general information, not legal advice.
