New Zealand HISF

No changes recorded yet — we are watching, and nothing has been published.

No key dates confirmed by an official source yet.

1. —
   HISO 10029:2022 with segment guidance (supplier guidance HISO 10029.4:2025) RevisionCurrent

   Health New Zealand released HISO 10029.4:2025, the guidance for health sector suppliers and their sub-contractors. source

   More

   • The guidance covers suppliers of on-premises or cloud services to the health sector, such as software and medical device resellers, internet and outsourced service providers and SaaS providers.
   • HISF requirements have been mapped to the Secure Controls Framework (SCF).
2. —
   HISO 10029:2022 Health Information Security Framework Major version

   A new framework that moved from the ISO-centric 2015 edition to a model based on the NIST Cybersecurity Framework, with guidance tailored to segments of the health sector. source

The HISF covers health information collected and used in New Zealand, wherever it is stored, and tailors its guidance to four segments, one of them suppliers.

Scope

The framework covers the security of all health information collected and used within New Zealand, wherever it is stored. source

Hospitals

HISO 10029.1:2023 applies to public and private hospitals. source

Micro to small organisations

HISO 10029.2:2023 fits organisations that typically meet two or more criteria such as up to 25 staff, a population under 10,000 and mostly outsourced IT. source

Medium to large organisations

HISO 10029.3:2023 fits organisations that typically meet two or more criteria such as more than 25 staff, a population over 10,000 or in-house software development. source

Suppliers

HISO 10029.4:2025 is for health sector suppliers and their sub-contractors. source

Privacy

Privacy is covered by the Health Information Privacy Code 2020 and is outside the framework's scope. source

Participants assess their own maturity against the requirements for their segment on a five-level scale and share it with Health New Zealand.

Self-assessment

Participants are expected to acknowledge their obligations, assess themselves and share their level of maturity with Te Whatu Ora and other key stakeholders. source

Maturity scale

The maturity assessment model rates each requirement from 1 (None) to 5 (Embedded). source

Supplier controls

The supplier guidance says its controls are recommendations and that requirements can be met in other ways. source

Not confirmed by an official source yet.

1. Standard HISO 10029:2022 Health Information Security Framework
2. Guidance HISO 10029.1:2023 HISF guidance for hospitals
3. Guidance HISO 10029.2:2023 HISF guidance for micro to small organisations
4. Guidance HISO 10029.3:2023 HISF guidance for medium to large organisations
5. Guidance HISO 10029.4:2025 HISF guidance for suppliers

1. NZISM

   The government-wide security manual; the HISF maps its controls to the NZISM among other frameworks.

2. NIST CSF

   The NIST framework on which the 2022 HISF model is based.

3. NZ Privacy Act

   New Zealand's privacy statute; health privacy is outside the HISF's scope.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to New Zealand HISF (RSS)