5. My Health Account new feature - Q&As for general practice teams

My Health Account Q&As for general practice team administrators – new feature for health consumers to confirm who they are using their healthcare provider released February 2022

Questions and Answers The health consumer user journey for setting up a My Health Account by confirming who they are using their contact details held by their healthcare provider (i.e. general practice team) How does it work?

Step 1:

Health consumers select the option to confirm who they are using their healthcare provider

Step 2:

They consent to My Health Account using their residential address and mobile phone number details held by their general practice team to confirm their identity.

Step 3:

They search for and select their enrolled general practice on My Health Account using a type-ahead search. Once selected, the general practice team’s details are displayed so the health consumer knows they have chosen the correct one.

Step 4:

They enter their full name, date of birth and residential address, which is used to search for their NHI number. They may also choose to tell us their gender, middle name(s) and NHI number (if known) – this is optional.

Step 5:

Once the NHI number is matched, their mobile phone number is retrieved from their National Enrolment Service records and the last four digits displayed (so they can check it is their current phone number).

Step 6:

We send a six-digit code to the mobile phone number once the health consumer confirms it is their correct mobile phone number.

Step 7:

The person enters the six-digit code into My Health Account, then the person is able to successfully confirm who they are and are either redirected back to My Covid Record or to their My Health Account landing page.

NB:

If the health consumer finds their details held by their general practice team are out-of-date, they will need to contact their General practice team to update these details before they can complete their My Health Account set-up.

Why do health consumers need to confirm their identity?

Health information about health consumers is private. We need to make sure that the identity a health consumer is claiming is theirs. We can do this by comparing the information they give us to their identity and contact information held by their enrolled general practice team. No clinical information is involved in this process.

What types of healthcare providers can health consumers use to confirm their identity?

We can confirm health consumers’ details only with the National Enrolment Records held by their general practice team. Other healthcare providers, such as physiotherapists or dentists, are not able to be used to confirm a health consumer’s identity.

What information do health consumers need to provide?

We need health consumers to provide their first and last names, date of birth, and residential address. They also have the option to provide their middle name(s) (if they have any), gender, and NHI number. Please note that these details need to match the records created on the National Enrolment Service by their general practice team. Health consumers may need to contact their general practice team to update any incorrect information before they can complete the set-up of their My Health Account.

What do health consumers do if they are not enrolled with a healthcare provider?

If health consumers are not enrolled with a general practice team, they can still confirm who they are using one of the six identity documents currently supported.

What if a health consumer hasn’t visited or contacted their general practice team for a long time?

If their contact details have not changed, they can carry on setting up their My Health Account. If their details have changed, they will need to contact their general practice team first and update their details. Health consumers must advise their general practice team if there has been any change of name, address, mobile phone number, or email address. Then they can come back and set up their My Health Account.

Page 3 of 6

What if a health consumer can’t find the name of their general practice team on the list?

They will need to check that they have spelled the name of their general practice team correctly. They will not need to enter the full name of the general practice team for it to appear.

If the name still doesn’t show up, health consumers will be prompted to call the Ministry of Health contact centre for assistance. Note: some health consumers may choose to call their general practice team direct to ask for the correct name.

Advice to general practice team Managers and Administrators on how to correctly update patient contact details What details might a health consumer ask their general practice team to update?

They may ask for any of the following contact details to be updated: their name, their address, their mobile telephone number, or their email address.

What do I need to do before I update the person’s details?

If general practice teams are contacted by health consumers asking to update their contact details so that they can set up a My Health Account, general practice teams need to ensure that they confirm the identity of the person asking for their details to be updated. General practice teams may have their own policies and practices to mitigate the risk of identity theft or people registering with false information in order to obtain prescription drugs. The general practice team can also refer to the Identity-NHI User Reference Information and Best Practice Advice that can be found on the Ministry website.

Why is it necessary to verify a person’s identity before updating their details?

It is essential to verify a person’s identity before changing their contact details in order to mitigate any risk of identity theft, to prevent people making changes to NHI records that are not their own or people registering with false information in order to obtain prescription drugs.

Page 4 of 6

Healthcare providers must comply with relevant legislation (Privacy Act 2020 and Health Information Privacy Code 2020).

How do I verify a person’s identity?

General practice teams generally have a robust process to confirm the person’s identity before updating any patient contact records to protect people’s privacy and prevent identity theft. This is normally done by: 1. asking them to confirm the email address held on record by the general practice team 2. asking them to confirm their NHI number 3. asking them to confirm the contact mobile phone number held on record by the general practice team 4. asking them to answer a question that only they would know, such as: a. “Please tell us the details of any repeat prescriptions that you have” or b. “Please tell us if you have had a lab test within the last six months and, if yes, what it was for”.

Please note: when verifying a person’s identity, do not ask for the person’s name, date of birth, or address in order to confirm their identity as this information is often easily discoverable, particularly on social media. This makes these details susceptible to socially-engineered attacks.

When can I update the person’s contact details?

Name, address, mobile phone number, and email address details should only be updated once the person’s identity has been confirmed.

What should I do if I have concerns about the validity of the person’s identity who is asking to update their details?

If there are any concerns about the validity of the request to update details, please ask the person to come to the general practice team in person with proof of identity.

What if a young person between 12 and 15 years old asks for their contact details to be updated?

Anyone over 12 years of age can create a My Health Account. General practice teams may be contacted by 12 to 15-year-olds asking for their contact details (mobile telephone number or email address) to be updated. In these instances, it is

Page 5 of 6

common policy for general practice administrators to ask to speak to the young person’s parent, caregiver, or someone with legal appointment as a guardian before making changes to the young person’s contact details. General practice teams must follow the same robust process to confirm the person’s identity before updating any patient records for 12 to 15-year-olds.

Who do I contact if I have any questions about the new My Health Account feature or updating patient details?

If general practice administrators or managers have any questions, you can: •

call us on 0800 222 478 or +64 6 927 6900 during standard office hours, 8am to 5pm Monday to Friday

•

email your query and/or feedback to support@identity.health.nz

You can also read more about My Health Account on the Ministry of Health’s website.

Page 6 of 6