Your health information

See your record and who has looked at it

You can ask for a copy of your health record. You can also ask for the audit log, which shows each person or system that opened your record, the date, and the reason they recorded (Health Information and Patient Privacy Act 2026, section 3A(a)).

We must reply within 14 business days. We will need to check who you are first. In rare cases we may hold back a small part of the record, but only where that is narrowly needed to prevent serious harm or to protect someone else's confidential information (Health Information and Patient Privacy Act 2026, section 3A(b)).

Correct your record

If something in your record is wrong or incomplete, you can ask us to correct it. Within 14 business days we will either correct it or attach a clear note of the correction you asked for. Sometimes we must keep the original entry so the record stays clinically safe and auditable (Health Information and Patient Privacy Act 2026, section 3B).

Opt out of research and planning

You can opt out of your identifiable health information being used for research or service planning that is not essential. A lawful overriding public health requirement can still apply. Where information is used, we remove details that identify you wherever the purpose allows (Health Information and Patient Privacy Act 2026, section 3C).

Restricted fields

Your sexual orientation, gender identity, intersex status and legal gender information are restricted fields. They are only recorded, shown or shared when clinically necessary, when you agree, when the law requires it, for safeguarding, to prevent imminent serious harm, or by court order (Health Information and Patient Privacy Act 2026, section 2B). Staff who do not need them for their role will not see them on screen.

Young people

A young person can agree to their own treatment, and see their own record, if their clinician decides they understand the nature, purpose, consequences and confidentiality of the decision. If they do not yet understand, the usual parental or representative rules apply, and we protect the young person's welfare (Health Information and Patient Privacy Act 2026, section 2C).

There is no fixed age for this test in the Act. The age of 16 in the Data Protection Act 2026 is about online services and does not replace the competence test for health care (Data Protection Act 2026, section 5A(c)).

If there is a data breach

If a breach affects your information, we will tell you without undue delay, whatever level of risk we think it carries. We will explain what happened, what it could mean for you, and what you can do to protect yourself (Health Information and Patient Privacy Act 2026, section 4B(b)). We also report qualifying breaches to the Data Protection Commissioner under the 72-hour rule in the Data Protection Act 2026.

When computers help with your care

If a clinical algorithm materially influenced your care, we will tell you. You can ask for a plain-language explanation and for a qualified clinician to review the decision. A computer is never the sole decision-maker for diagnosis, treatment or triage (Clinical Algorithms and Automated Care Act 2026, sections 2A and 3).

Your care does not depend on it

Asking to see or correct your record, or making a complaint about it, will never cost you access to care you clinically need (LHS Act 2026, section 9B(c)).

How long we keep records

We keep an adult's record for at least eight years after their last treatment. We keep a child's record until their 25th birthday, or for eight years after their last treatment if that is later (Health Information and Patient Privacy Act 2026, section 7A).