This article is intended to provide general advice only. The contents do not constitute legal advice and should not be relied upon as such. Readers should seek specific expert and legal advice in relation to the information provided in this article.
What are medical records
Medical record is a broad generic term for the information that is collected about a patient. Some examples include:
Progress & clinical notes;
Test Results;
Photographs/ videos; and
Letters to/from other doctors/ specialists.
Genetic Information
Information about Treatment Preferences
Appointment and Billing Details
Correspondence between a medical practitioner and their solicitor or medical indemnity insurer about a patient is not considered as a medical record and should be kept separate.
Who owns the medical records?
Medical records are usually owned by the doctor, hospital, or other health professional who creates those records. Unless there is a specific contractual arrangement, a medical practitioner or practice will own the physical or electronic medical record; despite generally having no intellectual property rights over the information it contains.
Generally speaking, the ownership of a medical record will depend on the agreement or contract between the medical practitioner and practice, and structure of the medical practice. For example:
A Sole Practitioner retains full ownership over their medical records
A Contractor or Employee will usually not own the medical records that they create; with ownership being according to their contract
A Doctor who owns an incorporated practice owns its assets and medical records in the absence of anything to the contrary
It is advisable to clarify and document who owns the medical records prior to commencing at a new practice.
Rights to access health records
There are two primary avenues by which patients can access their health records from a private sector organisation:
Under the Privacy Act 1988 (Cth) (the “Privacy Act”), individuals may request access to their personal information held by an APP Entity. Medical practitioners and practices classify as APP Organisations under the Privacy Act. The right of access extends to Sensitive Information (such as a health record), which is a subset of personal information. Rights of access are subject to some exceptions which are listed in the Privacy Act.
Under the Health Records Act 2001 (Vic) (the “Health Records Act”), individuals have a right of access to their Health Information from any Health Service Provider. Right of access is limited in some circumstances, which are listed in the Health Records Act.
Access via the Health Records Act
This right of access applies to all health information collected and held by a private sector organisation on or after 1 July 2002 (for health information collected before 1 July 2002, an organisation may agree to provide an individual access, or in the absence of an agreement, is entitled to provide an accurate summary of the health information).
Requests for clinical records under the Health Records Act or Health Services Act 1988 (Vic) represent the most efficient and informal mechanism for releasing an individual’s health records. In noting this, it is sometimes appropriate and necessary to process a formal request for health records under the Freedom of Information Act 1982 (Vic) (“FOI Act”). It is usually preferable to encourage informal requests under the Health Records Act; unless the circumstances necessitate a request under the FOI Act.
The Health Records Act primarily creates a right of access to health information about an individual patient that is held by a private sector organisation (such as individual doctors, health professionals, and private hospitals). The right of access in the Health Records Act will not apply to health information held by Victorian public sector organisations (including public hospitals) otherwise subject to the FOI Act; despite the remainder of the Health Records Act being applicable to both public and private sector organisations.
Where there is proper authority from the patient, other parties such as solicitors, WorkSafe Victoria (WorkSafe), the Transport Accident Commission (TAC), insurance companies, a patient’s next of kin, or other healthcare professionals may also be granted rights of access to health information.
Under s 34 of the Health Records Act a Health service provider needs to within 45 days of receiving the request comply with the request by granting access, refusing access, or notifying they will require a fee to provide access. It is possible for some practitioners to charge a fee for access to health information, if a maximum fee has been prescribed for that manner of access.
Access via The Privacy Act
Individuals may request access to their health record under the Privacy Act. A request via the Privacy Act can be made to any APP Entity that holds health information but cannot be made in respect of public hospitals or entities. Any request for access is made under Australian Privacy Principle 12 and must be acknowledged by the holder of the record within a reasonable time (preferably, within 14 days). Subject to any applicable exceptions, access must be provided within a reasonable time (usually within 30 days of acknowledgement of request for access). What is reasonable in the circumstances may depend on factors such as:
The scope and clarity of a request for access
The volume of the material requested
Whether the information can be readily located and assembled
Whether consultation with the individual or other parties is required
Access should be provided in accordance with the practitioner’s or practice’s access policy. A sample access policy is available from AMA Victoria.
If access is refused, written reasons must be provided.
Means of access
If an APP Entity refuses to give access in the manner initially requested by the individual under Australian Privacy Principle 12, but may provide another means of access, the entity must take such steps (if any) that are reasonable in the circumstances to give access in a way that meets the needs of both the entity and individual. A right of access under the Health Records Act allows for Health Information to be accessed by:
Inspecting the health information, or a print-out of that information, with the opportunity to take notes;
Receiving a copy of the health information;
Viewing the health information and having its contents explained by the health service provider; or
Instead of a copy, receiving an accurate summary if the individual agrees.
Providing access in electronic format
A patient requesting access to an electronic copy of their medical records may be provided with an electronic copy on a CD or USB.
Downloading a medical record onto a disc or USB is equivalent to providing a copy of the record in a form other than black and white A4 pages. A doctor may charge a reasonable fee for electronic access to the medical record.
AMA Victoria suggests that a reasonable fee may include an allowance for the cost of the CD or USB device, and a small allowance for the time of the employee who downloaded the record. The recipient should be advised of the cost in advance.
Doctors should be aware of their obligations to take reasonable steps to protect medical records from misuse and loss, and from unauthorised access, modification or disclosure when deciding whether to provide a patient with an electronic copy of their medical records.
Request for access
A request for access to health information under the Health Records Act must:
State the name and address of the individual to whom the health information concerns,
Specify the health information sought, and
Specify the way in which the individual wishes to have access to the health information.
Where the request is made orally, an organisation may request for consent to be provided in writing.
Access by parties other than the patient
The Health Records Act provides that access to health information may be provided by a patient to another person, so long as the patient has a right of access to such health information, and where there is a signed written authority for access to be provided to another person.
Before giving access to another person, reasonable steps must be taken (including requiring evidence) of the identity of the third party, and the authority of the third person to obtain access to a patient’s information.
AMA Victoria advises that contemporary (current) written authority should be obtained from a patient wherever possible.
Medical records of deceased patients
Under the Health Records Act the Health Privacy Principles will apply to a deceased individual and will continue to protect their Medical Records for a period of 30 years after an individual has died.
The Privacy Act will only provide protection of living patients, except in very limited circumstances where the personal information also relates to a living person (such as a relative)
Fees
An organisation may charge fees for providing access to health information, though there is no requirement to do so.
The maximum fees for granting access in response to a request under the Health Records Act are prescribed in the Health Records Regulations 2023 (Vic).
The Privacy Act does not set a recommended fee for access. No charge can be made for the making of request or for providing access in accordance with the Privacy Act. It is possible, however, for an Organisation to impose a charge for giving access to the personal information (such as copying and postage costs); provided that such a charge is not excessive.
Whether a charge is excessive will depend on the nature of the organisation; taking into account the size of the organisation, the resources and functions of the organisation, and the nature and volume of the personal information that the organisation holds.
Time limits under the Health Records Act
Within 45 days of receiving a request for access, a health service provider must either:
Give a written reason for refusal of access;
Give written notice that access will be given on payment of the specified fee; and give access:
Upon payment of the fee
Within 7 days after payment of the specified fee; or
45 days after receiving the request,
whichever is the later; or
Give access as soon as practicable but not later than 45 days after receiving the request.
Further to the relevant provisions of the Health Records Act mentioned above, medical practitioners may also note the different categories of third parties that may request access to health information on a patient’s behalf, and issues that may arise in those circumstances.
Categories of requestors
Requests from Solicitors
Solicitors may request health information on behalf of a patient for a variety of reasons, including situations where the solicitor is the authorised legal representative of a patient (including where the solicitor is legal representative of a deceased patient), and in the course of obtaining medico-legal reports.
Requests from Third Parties
Medical practitioners commonly receive requests from third parties such as parents or next of kin for access to health information of a child or relative.
Medical Records should only be released in these cases after the following are satisfied:
With written consent from the patient;
Where there is sufficient evidence of the identity of the requestor; and
Where there is evidence that the patient has given rights of access to the requestor (including where the requestor is an authorised representative).
Requests for health information of children/minors, the elderly or mentally unwell patients should be considered with care, as well as requests made under a power of attorney.
Requests from other Health Professionals
An individual may request that a copy or written summary of health information is made available to another health service provider.
The individual can make the request or authorise the other health service provider to make the request on the patient’s behalf.
The health information must be provided to the other health service provider as soon as practicable after payment of the specified fee.
Requests from WorkSafe / TAC
As stated above, access rights may be granted to third parties such as WorkSafe and/or the TAC (including insurance companies acting as agents for these organisations), if valid consent is obtained from the patient.
WorkSafe and the TAC customarily rely on consent provided by patients in the course of commencing compensation claims, pursuant to the respective legislation governing WorkSafe and the TAC.
Doctors who are concerned with the validity of consent, or the relevance of information sought by WorkSafe and/or the TAC should contact AMA Victoria or their respective medical indemnity insurers for advice and assistance.
Requests Made by Subpoena / Court Order
Consent from a patient is generally not required in the case of a properly issued subpoena or valid court order, and it is within a medical practitioner’s power to release information to the courts in this regard.
For further information, please refer to the Subpoena Factsheets available on the AMA Victoria Website.
Requests from the Police or Coroner
There are limited circumstances in which a member of Victoria Police can access a patient’s medical record without a valid court order or relevant written authority.
A deceased patient’s medical records may be required in a Coronial Inquest for the purpose of investigating the circumstances surrounding the death of the individual. A doctor who was responsible for the care of deceased person immediately before their death, or who was present at the time of death, is under an obligation to provide the coroner with any information or assistance they require. There are three ways in which the Coroner may obtain access to your deceased patient’s records for this purpose:
The Coroner may authorise a police officer to exercise the powers under s 39 of the Coroners Act 2008 (Vic), to enter a premises and obtain copies of any document relevant to the investigation. This authorisation must be in writing (Form 18) and the police must, if practicable, give the medical practice a copy of the written authority.
The Coroner may exercise their power under s 42 of the Coroners Act 2008 (Vic), to issue a Requirement to Give Document(s) or Prepared Statement (Form 4) requiring the person to whom the notice is addressed to provide the specified documents or prepare a statement addressing the matters specified by the Coroner.
The Coroner may exercise their power under s 55(2) of the Coroners Act 2008 (Vic), to issue a summons for a doctor to produce medical records, or to attend as a witness at a Coronial Inquest.
Purpose of request, and other relevant factors
Lastly, medical practitioners should consider the purpose for which health information was requested; is it for personal use, for a second medical opinion, or for the preparation of an insurance report for example?
Doctors should also be mindful of the scope of the information requested. Is the request a ‘fishing expedition’, where the entire history of a patient is sought (without limiting it to the claim at hand), and there is no indication of the purpose for which the health information is to be used?
Wherever possible, it is reasonable for a medical practitioner to contact the requesting party, and to determine if there are particular aspects of a patient’s records that are sought, rather than all aspects of a patient’s care. Medical practitioners should try wherever possible to provide relevant health information.
Other related publications
Medical Practitioners may also consider the following publications issued by Federal AMA:
Access to Medical Records by Doctors Who Are Not Treating the Patients Concerned (2002)
Guidelines for Doctors on Providing Patient Access to Medical Records (Revised 2002)