Written by Henry Smith · Reviewed by Smiths Insurance & KiwiSaver — licensed Financial Advice Provider (FSP712931) · Last updated 2026-08-15

Can Insurers Access Your Medical Records in NZ?

No New Zealand insurer can walk into your GP's system and read your file. It needs your authority, and you give that authority twice: once in the declaration you sign when you apply, and again when you lodge a claim. Your doctor is a health agency, and rule 11 of the Health Information Privacy Code 2020 forbids a health agency from disclosing your health information unless it believes on reasonable grounds that you, or your representative, have authorised the disclosure. What the insurer usually receives is a targeted report answering specific questions, not a download of your entire history.

That is the short answer. The mechanism matters more.

The authority you sign, and what it must tell you

The authority is a clause sitting with the declaration in the application. It does two jobs. It covers the insurer, because rule 2 of the Code only lets a health agency collect your health information from someone other than you where it believes on reasonable grounds that you have authorised that collection. It also covers your doctor, who needs to see that authority before releasing anything.

An authority is not a blank cheque; it has to be informed enough to be real. The Code requires the agency collecting your health information to make you aware of the purpose, the intended recipients, whether supply is voluntary or mandatory, the consequences if you do not provide it, and your rights of access and correction. If the wording is vague about what will be requested from whom, ask before you sign. A newer layer sits on top: a principle covering collection of your information from someone other than you took effect on 1 May 2026, mirrored by a new rule 3A in the Code, requiring reasonable steps to make you aware the information has been collected and who holds it.

Targeted report versus full notes

This is the distinction most people miss.

A targeted report is the normal route. The insurer sends your GP a questionnaire built around what you disclosed and what the underwriter still needs to resolve: consultation dates for a named condition, test results, medications, referral outcomes. Your unrelated history stays where it is.

Full notes means the complete consultation record for a stated period, usually several years. The Privacy Commissioner's formal inquiry into the practice was blunt: insurers that collect full medical notes, even for a specified period, risk breaching the Health Information Privacy Code, because they may only collect health information necessary for the insurance decision. Notes carry family and relationship detail recorded by a doctor treating you as a whole person, which is not always relevant to whether you can be insured.

The inquiry set out what good practice looks like, and it is a fair standard to hold an insurer to:

Practice varies: some insurers rarely ask for full notes, some doctors send them anyway because it beats filling in a form. Ask whoever is handling your application exactly what was requested.

Your own right to read the same file

You hold the same right of access the insurer relies on, and it is the most underused tool in the process. Principle 6 of the Privacy Act 2020 gives you the right to ask for access to your own personal information, and rule 6 of the Code entitles you to confirmation of whether a health agency holds health information about you and access to it.

Reading your notes before you apply is not a technicality. In a case published by the Insurance and Financial Services Ombudsman in November 2025, an applicant said he might have forgotten something and invited the insurer to contact his doctor; the insurer declined, saying the duty stayed with him. Cardiology investigations from the year before the application surfaced at claim more than seven years later, and the trauma cover was cancelled from inception. The underwriters who reviewed it noted applicants can obtain their own medical information and lodge it with the application; nobody had suggested that to him.

How long the authority lasts, and what if you decline

There is no statutory expiry date. The Privacy Commissioner's guidance states the Act does not specify when consent or authorisation expires, and recommends seeking a renewed authorisation where there is doubt the original still applies, more often where the consequences are greater. The working test is "no surprises", which is why insurers ask for a fresh authority at claim rather than relying on one signed years earlier.

You can decline, and you can withdraw. What follows is contractual rather than legal: an insurer that cannot verify what it needs will not usually complete underwriting, and at claim it assesses on the evidence it holds. That is precisely the consequence the Code requires the collecting agency to spell out upfront. A narrower authority , this condition, these years, this provider , is often a more productive conversation than a flat refusal.

Can they go back after a claim?

Yes, and this is where most disputes start. The request at claim is not confined to the event you are claiming for; it usually reaches back past the application to test what you disclosed then.

How far the insurer can then unwind the policy depends on the contract. Section 4 of the Insurance Law Reform Act 1977 provides that a life policy cannot be avoided for a statement in the proposal unless that statement was substantially incorrect, material, and made either fraudulently or within the three years immediately preceding the date the policy is sought to be avoided or the date of death, whichever is earlier. Section 5 applies the substantially-incorrect and material tests to contracts not embodied in a life policy, with no equivalent three-year cut-off. Both turn on one definition: a statement is material only if it would have influenced the judgment of a prudent insurer in fixing the premium or deciding whether to take the risk on substantially the same terms. Which section applies to a given benefit depends on how the policy is written, and is worth advice rather than assumption.

That is why the retrospective outcome is often a re-rating rather than a flat decline. In the Ombudsman case above, the life cover survived with a loading; the trauma cover did not survive at all.

The framework is changing. The Contracts of Insurance Act 2024 received the Royal assent on 15 November 2024 and replaces the consumer disclosure duty with a duty to take reasonable care not to make a misrepresentation. MBIE confirms the changes take effect on 15 November 2027, and the FMA has written to insurers on how underwriting questions are asked and disclosure assessed. Until then the tests above govern.

If you think a request went too far

Two doors, different questions. On how your information was handled, start with the privacy officer: the Code requires health providers, and health, disability, accident and medical insurers, to acknowledge a complaint in writing within 5 working days of receipt and to decide within 10 working days of that acknowledgement whether they accept it is justified. The Office of the Privacy Commissioner takes it from there.

For the insurance decision itself, use the insurer's internal complaints process, then its dispute resolution scheme, free to consumers. From 18 July 2024 the lump-sum limit across the approved financial dispute schemes rose to $500,000 plus GST, the limit for non-financial loss such as stress rose to $10,000 plus GST, and the discretionary window for late complaints was set at 9 months after deadlock.

Your next step

If you are about to apply, the most valuable hour you can spend is reading your own GP notes, so what you disclose matches what the report will say. If you are already insured and unsure what your insurer holds, put that to an adviser rather than guess. Start with a free cover check, or read how underwriting works, what happens when a claim is declined, and how life insurance, trauma insurance and income protection are assessed.

This article is general information only and is not personalised financial advice. Privacy rules, insurer authority wording and claims practices differ and change over time; for advice on your own policy or application, speak with a licensed financial adviser. Craig Smith Business Services Limited is a licensed Financial Advice Provider, FSP712931, listed on the Financial Service Providers Register.

References

Read the full insurance guides

Compare your cover with a licensed NZ adviser · free, no obligation.