Clinical AI governance for Aotearoa's health system under HIPC 2020 and Te Tiriti.
We build governance for Te Whatu Ora, primary care, private providers, and healthtech under the Health Information Privacy Code 2020, the Code of Health and Disability Services Consumers' Rights, Medsafe expectations, and Te Tiriti o Waitangi obligations.
Built for
What clinical leadership walks away with.
Full engagement methodologyHIPC compliance assessment
Every flow of health information through AI mapped, classified under the HIPC 2020 rules, and tied to consent and overseas-transfer documentation.
Cultural safety governance
Performance review across Māori and Pacific patient populations, training data gap analysis, and monitoring protocols grounded in kaitiakitanga.
Clinical translation protocols
Validation against NZ clinical practice, human oversight rules per use case, competency frameworks, and override procedures for AI recommendations.
Accountability framework
Documented responsibility allocation when AI fails, vendor change-of-control protections, and incident reporting aligned with Te Whatu Ora quality frameworks.
Why off-the-shelf AI governance fails in NZ healthcare.
International AI governance standards were written for other health systems, and they need significant adaptation before they work in clinical practice in Aotearoa. We start from the NZ regulatory and clinical environment and adapt imported standards to fit it.
- 01Context
International models miss the NZ context.
Frameworks developed overseas do not account for New Zealand's regulatory environment, population health profile, or Te Whatu Ora's operational structure. Importing them wholesale creates governance gaps at the point of patient care. A framework translated from a US hospital system or a UK NHS trust carries that system's assumptions with it, so we build clinical AI governance for the New Zealand context.
Clinical AI governance programme design - 02Constitutional obligation
Cultural safety is not optional in Aotearoa.
AI tools trained on overseas datasets can produce outputs that are clinically unsafe for Māori and Pacific patients. Bias in risk prediction, diagnostic imaging, and treatment recommendations compounds existing health inequities. Kaitiakitanga demands governance that embeds cultural safety assessment from the outset, and Te Tiriti o Waitangi requires it.
Māori data governance for health - 03Accountability gap
Accountability gaps remain unresolved.
When a clinical AI tool fails, who is responsible? When the vendor is acquired, what happens to patient data? Who monitors ongoing performance under HIPC 2020? Who manages conflicts of interest with the vendor? These questions rarely have clear answers in current deployments. Governance frameworks need to answer them around the responsibilities Medsafe, the Office of the Privacy Commissioner, and Te Whatu Ora expect.
Vendor risk and accountability - 04In force
Consent under the Consumer Rights Code.
Right 6 (information) and Right 7 (informed consent) under the Code of Health and Disability Services Consumers' Rights mean patients have to be told when AI is involved in their care, what role it plays, and what the limitations are. Generic consent forms rarely meet this bar for AI scribes, decision-support tools, or diagnostic imaging.
Consent and explainability artefacts
Healthcare AI sits under multiple regulators.
No single framework covers healthcare AI in New Zealand. Organisations must satisfy Medsafe, the Health Information Privacy Code 2020, the Privacy Act 2020, the Code of Health and Disability Services Consumers' Rights, and Treaty of Waitangi obligations simultaneously.
Medsafe
Medical device regulation
- Software as a Medical Device (SaMD) classification under New Zealand regulations.
- Clinical decision support tools may require formal registration and ongoing monitoring.
- AI scribes with diagnostic or recommendation features under regulatory review.
HIPC 2020
Health Information Privacy Code
- Stricter requirements than the Privacy Act for health information processing.
- Additional informed consent requirements when AI processes patient data.
- Cross-border transfer restrictions for overseas AI vendors processing health data.
Privacy Act 2020
Baseline privacy requirements
- All 13 Information Privacy Principles apply to health data processing by AI.
- Automated decision-making transparency required under Privacy Commissioner guidance.
- Individual rights to access, correct, and understand how their information is used.
Clinical & Treaty
Patient safety and cultural safety
- Clinical validation of AI diagnostic and decision support tools for NZ populations.
- Hauora Māori health equity assessment and algorithmic bias monitoring.
- Practitioner competency, incident reporting, and quality monitoring for AI systems.
Where healthcare organisations use AI.
Each use case has its own regulatory pathway and risk profile, so the governance work differs by category.
Use case
Clinical decision support
AI tools that assist diagnosis, treatment planning, or clinical decision-making. May require Medsafe registration depending on intended use and the degree to which the tool influences clinical outcomes.
Use case
AI medical scribes
Consultation recording and clinical note generation. Raises HIPC 2020 consent questions, data residency concerns, and practitioner verification obligations under New Zealand clinical standards.
Use case
Medical imaging AI
Radiology interpretation, pathology analysis, and diagnostic imaging. Requires clinical validation for New Zealand populations, quality monitoring, and ongoing assessment of accuracy across diverse patient groups.
Use case
Predictive analytics
Patient risk stratification, readmission prediction, and resource planning. Needs bias monitoring for hauora Māori equity, clinical oversight, and validation of predictive accuracy for New Zealand populations.
The PolyGovern tracks that apply to healthcare.
Three practice tracks built from the NZ clinical and regulatory environment outward, with cultural safety and Te Tiriti obligations embedded.
Track A
Governance and strategy
Clinical AI governance committees, policy, and operating models that integrate with existing clinical governance and quality improvement, aligned to Te Whatu Ora system-level expectations.
Track B
Assessment and assurance
Clinical risk assessment covering safety, cultural safety, HIPC compliance, vendor risk, and accountability gaps, with bias testing across Māori and Pacific populations.
Track C
Compliance and advisory
HIPC 2020 and Privacy Act 2020 compliance, Māori data governance grounded in kaitiakitanga, Consumer Rights Code-ready consent artefacts, and ongoing clinical advisory support.
Clinical AI across the NZ health system.
AI is moving into clinical practice across every part of Aotearoa's health system. Each setting brings different governance pressure depending on scale, patient populations, and regulatory exposure.
Te Whatu Ora and public hospitals
System-level AI governance that integrates with existing clinical governance, quality improvement, and equity commitments across departments and specialties.
Primary care and general practice
AI scribes and clinical decision support spreading through general practice. Practitioners need consent, verification, and HIPC-aligned policies that fit a busy clinic.
Healthtech and medical device makers
Startups and established businesses building AI-powered clinical tools, needing Medsafe-aware governance, HIPC compliance, and cultural safety evidence to win NZ procurement.
Private hospitals and aged care
Private hospital groups, aged residential care, and specialist clinics deploying AI for clinical and operational purposes under the Privacy Act 2020 and quality-of-care obligations.
Hauora Māori and health equity in AI governance.
Te Tiriti o Waitangi creates obligations for the health system to actively protect Māori health and wellbeing. When healthcare organisations deploy AI, these Treaty obligations extend to the governance of those systems: Māori health data governed under Māori data sovereignty principles, algorithms tested for bias against Māori populations specifically, clinical AI tools validated for effectiveness across diverse New Zealand populations, and Māori communities given meaningful input into how AI is used in the delivery of their healthcare.
AI systems deployed without cultural governance deepen existing disparities through unrepresentative training data and decision logic that ignores the social determinants of health affecting Māori whānau.
We help healthcare organisations build AI governance that centres hauora Māori and health equity alongside clinical safety, privacy compliance, and regulatory requirements. It gets an owner, controls and evidence of its own inside the governance design.
Healthcare AI questions from NZ organisations.
How is the HIPC different from the Privacy Act 2020 for AI?
The Health Information Privacy Code 2020 modifies several Information Privacy Principles for health data. It imposes stricter rules on collection, use, disclosure, and overseas transfer. For AI, that means HIPC-specific consent, tighter restrictions on secondary use for model training, and additional obligations when health information is processed by offshore vendors.
Why do imported AI governance standards need local adaptation?
Imported standards were designed around another country's law, population and health system. Applied to clinical practice in New Zealand without significant adaptation, they leave gaps at the point of care. Governance has to be built around the NZ regulatory environment, population health needs, and health system structure, including Māori and Pacific health priorities.
How do we address Māori data governance in clinical AI tools?
Most clinical AI tools are trained on datasets that underrepresent Māori and Pacific populations. Cultural safety governance requires assessing training data representativeness, testing tool performance across ethnic groups, monitoring for differential outcomes, and including cultural expertise grounded in kaitiakitanga. Te Tiriti o Waitangi requires this level of care for Māori health data.
What are our obligations under the Consumer Rights Code when using AI?
The Code of Health and Disability Services Consumers' Rights gives patients the right to be fully informed about the services they receive. Right 6 (information) and Right 7 (informed consent) require you to tell patients when AI is involved in their care, what role it plays, and what its limitations are. Generic consent forms rarely meet that standard.
What happens to our patient data if the AI vendor is acquired?
If a vendor is sold, merged, or goes into receivership, contractual protections for patient data may not transfer automatically. Vendor risk provisions should address change of ownership: what happens to the data, whether new owners inherit HIPC obligations, and your rights to retrieve or destroy data. Compliance-vetted protections need to be in vendor agreements before deployment.
Does our AI medical scribe require Medsafe registration?
It depends on the intended use. If the scribe only documents what the practitioner says and generates clinical notes for review, it is not classified as a medical device. If it provides diagnostic suggestions, clinical recommendations, or alerts based on the consultation content, it falls within Software as a Medical Device and needs a Medsafe assessment. We assess classification and set out your regulatory obligations under New Zealand law.
What are practitioners' obligations when using AI?
Practitioners remain responsible for the accuracy of clinical notes and decisions generated or informed by AI. Under the Code of Health and Disability Services Consumers' Rights, they must review and verify AI-generated content, understand the tool's limitations, and obtain informed consent from patients. Healthcare organisations have to train practitioners on these obligations and run clinical governance processes that support safe AI use.
Can we use overseas AI vendors for health data processing?
The Health Information Privacy Code 2020 restricts the overseas transfer of health information. You need to assess whether the overseas AI vendor has privacy safeguards comparable to those required under New Zealand law, and document that assessment. The Privacy Commissioner expects organisations to know precisely where health data goes and what protections are in place. We evaluate AI vendors and put contractual and technical protections around cross-border health data flows.
Further reading
AI policy template
The New Zealand edition includes the HIPC rule 12 health variant and a Māori data governance section.
Get the templateAI risk assessment template
A clinical AI risk register and impact assessment in one workbook, with the ISO 23894 and ISO 42005 structure.
Get the templateISO 42001 explained
What ISO 42001 certification attests for a health provider or a software-as-a-medical-device vendor.
Read the guideClinical AI governance built for Aotearoa.
We develop governance that addresses HIPC 2020 compliance, cultural safety, Māori data governance, accountability, and the specific questions your organisation needs answered before deploying AI in patient care.