In May 2026 the Office of the Privacy Commissioner confirmed its intention to issue compliance notices to Manage My Health Limited and Health New Zealand for failing to protect health information, following a breach affecting Manage My Health in January 2026.
Health providers hold the most obvious exposure. A great many ordinary businesses hold health information too, without treating it as the sensitive category it is.
Where ordinary employers hold health information
- Medical certificates for sick leave.
- Pre-employment health assessments and functional capacity information.
- ACC claim documentation and return-to-work plans.
- Health monitoring results where workers are exposed to hazardous substances, noise or vibration.
- Drug and alcohol test results.
- Accommodation of a disability or ongoing condition.
- Anything disclosed in a wellbeing or absence conversation, including mental health.
Every one of those is personal information, and health information sits among the most sensitive categories under the Privacy Act 2020.
The failures that recur
Storage in a general personnel file. Health information should be access-restricted, not readable by any manager who can open the HR folder.
Sharing beyond need. A manager telling the team why someone is away, however sympathetically, is a disclosure. The team needs to know about coverage, not diagnosis.
Collecting more than necessary. A pre-employment questionnaire asking about every condition, unrelated to the role, collects sensitive information you have no purpose for and must then protect.
Keeping it indefinitely. Applications from unsuccessful candidates, and health records for people who left years ago, are liability rather than asset.
Email. Medical certificates forwarded around an organisation, sitting in multiple mailboxes with no retention control.
What you are entitled to know
For absence, you are entitled to know the employee is unfit for work and broadly when they are likely to return. You are not entitled to a diagnosis.
Proof of sickness can be required where absence is three or more consecutive calendar days. For a shorter absence, only if you inform the employee as early as possible, have reasonable grounds to suspect the leave is not genuine, and pay the employee’s reasonable expenses in obtaining it. That last condition is regularly overlooked.
Where you need medical information for a return-to-work plan or capability process, seek it with informed consent and frame the question around functional capacity rather than diagnosis — what tasks can this person safely perform, and what accommodations would help.
Where an occupational health provider conducts an assessment, the appropriate output to the employer is a fitness statement, not clinical detail.
Health monitoring under health and safety law
Where workers are exposed to substances hazardous to health, exposure and health monitoring may be required — lung function for respiratory hazards, audiometry for noise, biological monitoring for certain substances.
Baseline monitoring at the start of employment matters, because without it later deterioration cannot be attributed. And the results are health information requiring the same protection.
Practical controls
- Separate storage with restricted access, not the general personnel file.
- A named person responsible for health information, with others receiving only fitness-for-work conclusions.
- Collect only what the purpose requires, and be able to state the purpose.
- Retention periods set and applied, including deleting unsuccessful applicant material.
- Train managers on what they may ask and what they may share. Most breaches here are well-intentioned.
If it goes wrong
Where a breach has caused or is likely to cause serious harm, you must notify the Privacy Commissioner and affected individuals as soon as practicable. Health information raises the likelihood of serious harm considerably compared with, say, a mailing address.
The Office received approximately 1,598 complaints and 1,093 breach notifications in the year to 30 June 2025, with 67 percent of closed complaints resolved by settlement — which suggests constructive engagement produces better outcomes than defensiveness.
The Office of the Privacy Commissioner publishes guidance on health information and a breach notification tool free at privacy.org.nz, and WorkSafe publishes health monitoring guidance.
Figures: Office of the Privacy Commissioner Annual Report, year ending 30 June 2025; compliance notice announcements May 2026. General information only, not legal advice.
