Management of personal information | Bay of Plenty District Health Board | Hauora a Toi | BOPDHB

Management of personal information

Find out how we store, collect, use and share personal information for healthcare purposes.

This section explains how we collect, use and share information to fulfil our obligations of providing health care to the population of Bay of Plenty, and ensuring that we maintain the quality of the services we deliver.

As a District Health Board, BOPDHB collects personal information primarily to fulfil its functions to plan, procure and provide publicly funded health services for the people of the Bay of Plenty. Included in these functions is work to improve, promote and protect the health of the population and communities, including planning for and funding health services, carrying out teaching and research, monitoring quality and improving the services we deliver.

Although BOPDHB does not have any law enforcement responsibilities, it does have mandatory reporting requirements.  While BOPDHB does not gather information specifically for mandatory reporting, it does provide personal information to third parties when it is considered necessary for the safety of any person.

In accordance with New Zealand privacy law, the information we hold is used only for the purpose for which it is collected (refer statement in paragraph above) or as otherwise advised.

BOPDHB is mindful that personal information collected and used by it, is governed by the Privacy Act 2020 and Health Information Privacy Code 2020 and can only be disclosed in very limited circumstances.

In some circumstances your information may be shared with family, support people or other agencies if you give us your permission, or disclosure is authorised by law, or for providing treatment to you. Where the sharing or disclosure of personal information to third parties, including other Government agencies, is required by other legislation, this will supersede the Privacy Act and BOPDHB will be obliged to share this information. This disclosure of information may occur without your prior notice or consent.

Where the disclosure of information is not required by law but is at odds with the purpose for which it was collected, we will inform you of the need for the disclosure and seek your consent to the disclosure.

BOPDHB secures your personal information from unauthorised access, use or disclosure.

The security of our information is managed in accordance with our Privacy and Information Management policies, and in compliance with the Privacy Act 2020, the Official Information Act 1982 and the Public Records Act 2005.

In securely processing and storing personal information, we utilise the services of a range of third party providers and, in some cases, personal information may be stored overseas. All such parties are subject to contracted confidentiality arrangements and in the case of cloud-based providers, we comply with Government requirements for the use of cloud-based services.

This section explains how we collect, use and share information when we are carrying out the functions such as considering and investigating compliance breaches, complaints and initiating our own investigations or inquiries.

It is important to us that patients, visitors and staff are safe while on DHB premises and that DHB assets are appropriately protected. Security for people and assets is managed in accordance with the DHB's Health and Safety and Security policies. We operate Closed Circuit Television (CCTV) systems, and video footage is collected, stored, used and disclosed in accordance with our Privacy, Security and CCTV policies.

Where we have concerns regarding threats to the safety of people or property, our security service staff or the NZ Police may be contacted and CCTV footage may be released to support the purpose of collection.

You have the right to know what personal information we hold about you and therefore you have the right to request that we provide this to you.

You can request access to personal information held by us about you and we have 20 working days to respond to your request.  If your request is urgent, please state the reasons why in your request  (as provided for in the Privacy Act).

Before releasing personal information it will be checked to make sure that confidential information remains confidential and that other people's privacy is protected.

Requests should be made on a request form or by email.  However, where the information requested relates to a single document only (for example a specific discharge summary) and the Health Records staff are, through the use of security questions, able to confirm the identity of the requestor, a verbal request may be actioned.  

Our staff can assist you with making the request, including explaining what is needed to meet the personal identification requirements if the request is made in person, or by email.

To submit a request you can write to:

Medical Records
Bay of Plenty District Health Board
Private Bag 12024
Tauranga 3143



You also have the right to request correction or alteration of your information. Although your request may not result in changes being made to clinical information, a note will always be added to your health record advising that the information is disputed by you and should not be relied on for clinical decision making without first talking with you or your nominated support person. 

If you have any queries about our information gathering activities, or believe we have not acted in accordance with our commitment to ensuring your privacy, you should contact us at the following address:

The Privacy Officer
Bay of Plenty District Health Board
Private Bag 12024
Tauranga 3143