Home / Guides, templates & forms / Health information and data use – guidance

Health information and data use – guidance

Use of health information or data with or without the consent of participants.

What health information includes

In this context, ‘health information’ means information, or data, that can be linked to an identifiable individual – that is, potentially identifiable data. Read guidance on identifiability of data.

The Health Information Privacy Code 1994  regulates the use of health information for studies. For more information go to the  Health Information Privacy Code 1994 – Privacy Commissioner website.

When HDEC review is needed

Using health information for a study, including for screening potential participants in a study, generally requires Health and Disability Ethics Committees (HDEC) review. This is because the study is a secondary use and not what the information was initially collected for.

De-identified or anonymous data

If the data used in your study are fully de-identified or anonymous, you may not require HDEC review. Check the section: Find out if your study requires review.

Using health information without consent

Using health information without consent includes screening the information (including to identity those who access the information in their clinical roles) potential study participants.

The use of health information without consent may be approved by an ethics committee when:

  • the process for obtaining that consent is likely to cause undue anxiety for those whose consent is sought; or the requirement for consent would prejudice the scientific value of the study; or it is impossible in practice to obtain consent due to the quantity or age of the records; and
  • there would be no disadvantage to the participants or their relatives or to anyone involved in collecting the data; and
  • the public interest in the study outweighs the public interest in privacy.

Undue anxiety justification

In some situations, the process of seeking consent may cause undue anxiety or distress for the person whose consent is being sought.


A study into the use of an asthma drug as a possible cause of sudden deaths from asthma, comparing the medical records of individuals who had died from asthma with records of asthmatics who  had not died.

It could be wrong to seek the consent of the group who had not died because informing them of an untested hypothesis might frighten and distress them without good cause.

Scientific justification

The main scientific justification for not seeking consent to use health information for research is that failing to locate participants to seek their consent may lead to less complete ascertainment of cases for study, and therefore possibly a biased (and hence incorrect) result.

This is because the people who are hard to locate or can't provide consent for any reason may differ in their health problems or the outcome of their treatment from those who are easy to locate.

Practicality justifications

Sometimes researchers need to access records in the first instance to determine who might be potential participants in a study before seeking those people’s consent to take part.

Sometimes records for individuals with particular conditions are not held by the individual’s own doctor but by hospitals or disease registries. It can be impractical to track down individuals from a large number of records, especially where many of the individuals may be untraceable or deceased.

Public interest

In their review of a study application, the HDEC will weigh potential benefits of the study against the loss of participants’ privacy.

Potential benefits of a study may include:

  • a contribution to identifying, preventing or treating an illness or injury
  • developing scientific understanding relating to health
  • protecting the health of individuals or communities
  • improving health service delivery.

The loss of privacy might be regarded as more important for very sensitive information, for instance, terminating pregnancies, or genetic information that might have implications for other individuals.

HDEC approval for health information use without consent

If a study meets the NEAC guidelines conditions, then the HDEC might approve the use of health information without consent.

Any application for HDEC review must clearly detail how its use of health information meets the legal and ethical requirements.

For more information

In this section