New Zealand Digital Health Standards

New Zealand is a relatively small health system that has invested heavily in national digital health infrastructure — a single national patient identifier, a FHIR-native national shared health record programme, and an active FHIR community that punches above its size in the international standards process. For a builder entering the NZ health IT market, the ecosystem is coherent and the national standards are well-documented.

This page covers both the legal and technical layers. For comparison with the Australian framework (which NZ aligns with on FHIR approach but diverges from on law and terminology), see Australian Digital Health Standards.

Legal framework: Privacy Act 2020

The Privacy Act 2020 replaced the Privacy Act 1993. It is administered by the Office of the Privacy Commissioner (OPC) and applies to any agency (government or private) that collects, holds, or uses personal information about New Zealanders.

The 13 Information Privacy Principles (IPPs) govern personal information handling. Health information is not separately defined as “sensitive” in the main Act — sensitivity is addressed through the Health Information Privacy Code.

Mandatory breach notification

The 2020 Act introduced mandatory notification for notifiable privacy breaches. A notifiable privacy breach is one that has caused, or is likely to cause, serious harm to an affected individual.

Agencies must notify the OPC as soon as practicable after becoming aware. Notification to affected individuals is required if it is reasonable and practicable. The OPC can direct notification if the agency has not acted.

What constitutes serious harm for health data: The OPC’s guidance treats health information breaches as presumptively serious given the sensitivity. Exposure of mental health history, HIV status, reproductive health information, or other stigmatised health conditions is nearly always serious harm.

Penalty for serious breaches: up to NZD $10,000 for individuals; for agencies, the Privacy Commissioner can issue compliance notices and refer to the Human Rights Review Tribunal.

Health Information Privacy Code 2020

The Health Information Privacy Code 2020 (HIPC 2020, effective 1 July 2020) modifies the IPPs specifically for health information. It is issued by the Privacy Commissioner under the Privacy Act and has the same legal force.

Key differences from the general IPPs:

• Rule 2 (collection): Health information must be collected directly from the individual where reasonably practicable; third-party collection requires additional justification
• Rule 6 (access): Individuals have a right to access their health information; the limited exceptions (serious threat to safety) are narrow
• Rule 8 (accuracy): Health agencies must take active steps to ensure accuracy, not just correct inaccurate records on request
• Rule 10 (limits on use): Secondary use of health information (e.g., for research, quality improvement) is restricted; specific HIPC rules apply to each category
• Rule 11 (limits on disclosure): Disclosure to another health agency is permitted only for treatment, health services, audit, or with individual consent

Engineering implication for audit and research: Using patient health data for system quality metrics, model training, or product improvement is a secondary use under HIPC Rule 10. It requires either de-identification (to the OPC’s standard) or compliance with the specific research provisions. Systems should not aggregate patient health data for internal analytics without a legal basis.

Te Whatu Ora — Health New Zealand

In 2022, New Zealand’s 20 District Health Boards (DHBs) were merged into a single national entity: Te Whatu Ora (Health New Zealand). This was a major structural change with ongoing implications for digital health procurement and standards.

Te Whatu Ora is now responsible for national digital health infrastructure including:

• The national shared health record programme (Hira)
• National health IT procurement and standards
• The NHI register
• Integration architecture standards for publicly funded health services

For suppliers, this means a single national engagement point rather than 20 DHB procurement processes — but also that national standards set by Te Whatu Ora apply uniformly across the public health system.

NHI — National Health Index

The NHI number is the national patient identifier for New Zealand. It is a 7-character alphanumeric identifier (3 alpha, 4 numeric — e.g., ZZZ0016) with a check digit.

Effective from a 2023 transition, new NHI numbers use a new format (3 alpha, 4 numeric with a different check algorithm, identified by having 8 characters: AAANNNNA). Systems must handle both formats.

When to use the NHI

All publicly funded health services are expected to identify patients by NHI. Capturing, validating, and propagating the NHI is a fundamental requirement for systems in the NZ public health sector. Unlike some other countries, New Zealand has strong NHI penetration — it is genuinely used as the primary identifier, not as an optional addendum to local MRNs.

NHI FHIR API

Te Whatu Ora operates an NHI FHIR R4 API for patient lookup and verification:

{
  "resourceType": "Patient",
  "id": "ZZZ0016",
  "identifier": [
    {
      "use": "official",
      "system": "https://standards.digital.health.nz/ns/nhi-id",
      "value": "ZZZ0016"
    }
  ]
}

The NHI API supports search by demographics (for NHI tracing) and lookup by NHI number. Authentication uses OAuth2 via the national identity provider. The API follows the NZ Base Patient profile.

NHI status

NHI records have a status: Active (in use), Dormant (record exists but superseded by another), or Retired. Systems must check NHI status; linking to a dormant NHI without following the link to the active record is a common data quality failure.

FHIR NZ Base profiles

FHIR NZ Base is the national FHIR R4 profile set for New Zealand, published by HL7 New Zealand and hosted at fhir.org.nz. It is conceptually parallel to AU Base: it defines NZ-specific extensions and identifier patterns with minimal cardinality obligations.

Key NZ-specific extensions

• nz-nhi — NHI identifier slice on Patient (system https://standards.digital.health.nz/ns/nhi-id)
• nz-citizenship — records New Zealand citizenship status
• nz-iwi — Iwi affiliation; records Māori tribal affiliation using the Statistics NZ Iwi classification
• nz-ethnicity — ethnicity recorded using Statistics NZ level 4 ethnicity classification; multiple ethnicities can be recorded
• nz-dhb (legacy) and nz-health-new-zealand-region — geographic classification; the DHB extension is deprecated post-2022 restructure

NzPatient

The NzPatient profile is the starting point for all patient resources in NZ systems. Beyond the NHI identifier slice, it expects:

• Ethnicity recorded using the Statistics NZ classification (not a free-text field)
• Iwi affiliation captured for Māori patients where known
• NZ citizenship where relevant to entitlement

NzMedication and NZ Medicines Terminology

NZ medicines are coded using the New Zealand Medicines Terminology (NZMT), which is a SNOMED CT-based terminology maintained by the New Zealand Medicines and Medical Devices Safety Authority (Medsafe) and the NZ Health Terminology Service. NZMT concept types mirror AMT:

NZMT concept type	What it represents
MP (Medicinal Product)	The substance and form
MPP (Medicinal Product Pack)	MP with pack size
TP (Trade Product)	Branded product
TPUU (Trade Product Unit of Use)	Branded unit
CTPP (Containered Trade Product Pack)	Packaged brand

NZMT codes are SNOMED CT identifiers in the NZ national extension. System URI: http://snomed.info/sct (as for all SNOMED-based codes).

NZ Health Terminology Service (HTS)

The NZ HTS, hosted by Te Whatu Ora, provides access to:

• SNOMED CT NZ Edition (released twice yearly)
• NZ Medicines Terminology (NZMT)
• New Zealand-specific value sets

Access is via a FHIR terminology server API supporting $expand, $lookup, and $validate-code. The NZ SNOMED portal is the primary UI access point.

LOINC is used for laboratory test coding in NZ, particularly for quantitative lab results, consistent with international practice.

NZePS — NZ Electronic Prescribing and Dispensing

NZePS is the national programme for electronic prescribing and dispensing. It uses HL7 FHIR R4 with NZ-specific profiles for prescriptions (MedicationRequest) and dispense records (MedicationDispense), coded using NZMT.

Key NZePS profiles:

• NZePSMedicationRequest — prescription profile; requires NZMT coding, prescriber HPI-I
• NZePSMedicationDispense — dispense record; links to prescription, records dispensed product

Electronic prescriptions issued via NZePS are accessible to dispensing pharmacies nationally. Systems integrating with NZePS must conform to Te Whatu Ora’s NZePS implementation guide.

HPI — Health Provider Index

The Health Provider Index (HPI), operated by Te Whatu Ora, is the national register of healthcare practitioners, organisations, and facilities.

Identifier	What it identifies	System URI
CPN (Common Person Number)	Individual healthcare practitioner	https://standards.digital.health.nz/ns/hpi-person-id
HPI-ORG	Healthcare organisation	https://standards.digital.health.nz/ns/hpi-organisation-id
HPI-FAC	Physical facility	https://standards.digital.health.nz/ns/hpi-facility-id

HPI is the authoritative source for practitioner identity in NZ. Systems should use CPN in Practitioner resources rather than local identifiers where interoperability matters.

Hira — National Health Information Platform

Hira is Te Whatu Ora’s national shared health record programme — New Zealand’s equivalent of My Health Record in Australia. As of early 2026, Hira is actively under development with components in production:

• Immunisation Register — national immunisation history via FHIR API; mature
• Medications list — national medication view; in development
• Patient summary — longitudinal summary record; roadmap

Hira uses FHIR R4 with NZ Base profiles as the API layer. API access is via OAuth2 with Te Whatu Ora’s national identity provider.

Practical implication: Unlike MHR in Australia (which has years of CDA legacy), Hira was designed FHIR-first. Integrations built for Hira should be pure FHIR R4 — there is no CDA legacy to handle.

Comparison with Australia

NZ and Australia have deliberately aligned their FHIR approaches, and NZ Base and AU Base profiles are structurally similar by design. The key differences:

Dimension	New Zealand	Australia
Patient identifier	NHI (alphanumeric, 7 chars)	IHI (16-digit numeric)
Medicines terminology	NZMT (SNOMED-based)	AMT (SNOMED-based)
Prescribing system	NZePS	Electronic Prescribing (via MHR/state systems)
National shared record	Hira (FHIR-native, developing)	My Health Record (CDA legacy, FHIR evolving)
Privacy law	Privacy Act 2020 + HIPC 2020	Privacy Act 1988 + state laws
Health authority	Te Whatu Ora (single national body)	ADHA + state/territory systems

The most consequential practical difference is the national health authority structure: NZ’s single Te Whatu Ora simplifies procurement and standards alignment compared to Australia’s federated ADHA + state systems model.

See also

• Australian Digital Health Standards — AU Base FHIR, ADHA, AMT, IHI
• Australian Privacy Act and Health Data — AU legal framework for comparison
• FHIR Profiling — profile mechanics and conformance