HISO 10029:2022 Health Information Security Framework (New Zealand) compliance software
Protect health information to New Zealand's national standard — assess HISO 10029:2022 across plan, identify, protect, detect and respond.
What NZ HISO 10029 requires
HISO 10029:2022, the Health Information Security Framework, is New Zealand's standard for protecting health information, published by Te Whatu Ora. It applies across the health and disability sector — from large providers to community organisations handling health records.
The framework is organised around governance obligations and functional security processes aligned to recognised practice (plan, identify, protect, detect, respond), and explicitly addresses New Zealand-specific obligations including Te Tiriti o Waitangi considerations and Māori data governance.
Health providers face acute security pressure with modest security teams. A structured, owned assessment with evidence beats policy binders — and gives boards the visibility their accountability requires.
Who it applies to
- District and national health providers under Te Whatu Ora
- Primary care, community and NGO providers handling health information
- Health software and service vendors to the NZ sector
- Organisations evidencing safeguards for Māori health data
At a glance
- Publisher: Te Whatu Ora — Health New Zealand
- Edition: HISO 10029:2022
- Organisation: Plan (obligations & governance) + Identify, Protect, Detect, Respond
- Context: Includes Te Tiriti and Māori data governance obligations
How GRCLens supports NZ HISO 10029
NZ HISO 10029 runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
Framework-aligned catalogue
HISO 10029 requirements pre-loaded across the plan/identify/protect/detect/respond structure with guidance and deliverables.
Owner accountability
Assign controls to clinical, IT and governance owners with dated assessments and evidence.
Board-level reporting
Implementation dashboards and exportable reports give governance bodies the visibility the framework expects.
Evidence reuse
Controls overlapping ISO/IEC 27001 share evidence on the same platform, easing dual-alignment for vendors.
NZ HISO 10029 frequently asked questions
Who should assess against HISO 10029?
Any organisation in the New Zealand health and disability sector handling health information, and vendors supplying them. The framework is the sector's reference standard for information security.
Does the framework cover Māori data obligations?
Yes. HISO 10029:2022 includes Te Tiriti o Waitangi and Māori data governance considerations, and GRCLens carries these as explicit, evidenceable controls in the Plan domain.
How does it relate to ISO/IEC 27001?
The framework draws on recognised security practice, and many controls overlap 27001. GRCLens maps the overlap so evidence is captured once.
Can small providers use it?
Yes. Assessment scales with the organisation: mark non-applicable controls with justification and focus evidence on what matters for your services.
One platform, many obligations
Talk to us about NZ HISO 10029
Security Solution Consultants provides Health sector security advisory alongside the platform, so you can combine tooling with hands-on expertise.
Contact us