The incident occurred in June 2020 and the woman filed a complaint with police in July after complaining to the massage clinic directly.
Deputy Health and Disability Commissioner Deborah James said in her findings that after Mr B had massaged the woman's lower back, including the top of her bottom, he asked her to roll over before beginning to massage her neck.
The woman, known as Ms A, was wearing a towel which the masseur moved down to expose her breasts before he began massaging the sides, underneath and between her breasts.
At one point the woman says his palms made contact with her nipples.
Ms A said that the contact Mr B made with her nipples was the part of the massage that she found most inappropriate and that she felt had "crossed the line" and had made her feel "gross".
Mr B told police that he did not touch Ms A's nipples and that she consented to having her breasts massaged - something she denies.
Deputy Commissioner James said in her decision that "often a client may feel vulnerable on the massage table simply by being in a powerless horizontal position and by possibly being disrobed of some clothing. This position of vulnerability and relative powerlessness may mean a client is unable to verbalise their distress.
"Massaging the nipples would be considered a serious breach of conduct and care for a client. This is taught in massage schools in New Zealand as a non-touch area. Massaging the breasts without informed consent is also considered a breach of ethical standards in the massage industry."
After Mr B had finished massaging the woman's breasts he moved the towel and began touching her lower abdomen and the tops of her legs.
At the end of the massage, Mr B left the room and Ms A got up and got dressed and left.
Ms A said that she felt completely violated as she walked out.
The woman contacted the owner of the clinic complaining about Mr B's conduct, who then banned the man from massaging female clients.
Independent expert advice was obtained from a massage therapist, Mr Barry Vautier, about Mr B's conduct.
Vautier said that Mr B failed in a number of areas including not obtaining consent for massaging the client's breasts, touching her nipples, leaving her exposed and overall failing to communicate with the client.
Vauteir said it was unusual for a male masseuse to perform a chest massage on a female client.
"Massaging the breasts across gender is particularly risky due to the possibility of it being considered a sexual assault. There is a high risk to a male practitioner being misinterpreted around their intention," he said.
"Informed consent means the client is told about what is going to happen next in the massage such as a body location of stroke type, and then asked if it is alright to proceed. The client is informed so they have a choice about what happens to their body and thus feel empowered and safe."
Vautier also noted that Mr B reused a towel to drape the client. This towel had been used on several other clients throughout the day.
He said the massage occurred just a month after the level 4 alert lockdown in New Zealand and according to evidence the clinic owner and the other practitioners at the practice knowingly participate in using the same towel across several clients in a day.
"This is a serious breach of health and safety standards of any health practice in New Zealand and is potentially prosecutable under the Health and Safety Act."
Deputy commissioner James recommended in her report that Mr B apologise to the woman.
She also said the practice should create client registration forms, display the code of rights and complaints process at the clinic, be clear on what a full-body massage entails, encourage staff to register with Massage New Zealand and make sure they're clear about the rules on touching sensitive areas of the body.
She also recommended that every client is provided with fresh towels and clean linen.