This article is intended to provide general advice only. The contents do not constitute legal advice and should not be relied upon as such. Readers should seek specific expert and legal advice in relation to the information provided in this article.
Storage of Medical Records
Under the Privacy Act 1988 (Cth) (the “Privacy Act”) and the Health Records Act 2001 (Vic) (the “Health Records Act”), reasonable steps must be taken to protect health information from misuse and loss and from unauthorised access, interference, modification or disclosure.
You may hold the information at your practice or transfer it to a secure storage facility until such time that the health information can be destroyed.
Electronic medical records
If your medical records are in electronic form, you must ensure that those records are secure from misuse and loss, and from unauthorised access, interference, modification or disclosure.
This may include using a password protected operating system and having an adequate firewall and virus protection. A backup of all data should also be stored offsite to prevent loss of information.
Retention of Medical Records
Under the Health Records Act 2001 (Vic) you must keep a patient’s medical records for at least 7 years after the patient’s last consultation.
In the case of children, information may only be destroyed after the individual is 25 years old, or 7 years after the patient’s last consultation, whichever is the later.
Notwithstanding the above, medical practitioners should not arrange for the destruction of a medical record if the medical practitioner is aware that the relevant medical record is or would be required for a legal or other purpose (for example, if the records contain information about a matter that is before the courts).
Your medical indemnity insurer is able to provide you with advice on a case-by-case basis on this issue.
Destruction of medical records
When medical records are destroyed, you must make a written note of the name of the individual to whom the health information relates, the period covered by it and the date on which it was destroyed.
The Crimes Act 1958 (Vic) creates a criminal offence through s 254 for the destruction or concealment of documents, where a person knows those documents are reasonably likely to be required in any ongoing or potential future legal proceedings, and particularly where there is an intention to prevent those documents from being used in legal proceedings.
Medical records should also be destroyed securely, preserving the confidentiality of the information they withhold. This can be done by contracting a secure document shredding service provider.
Practice policies
Medical practitioners should consider implementing a Document Retention and Destruction Policy, to ensure that your medical practice is complying with its obligations under the Health Records Act and the Privacy Act.
The policy should include the following:
Identification of documents that should be destroyed from time to time;
Review of documents to ensure that they are not relevant for any existing or possible future dispute;
Ensuring that the final decision on destruction of the documents is made at the appropriate management level;
Notification of all practice staff of the policy, and ensuring that the policy is enforced; and
Ensuring that your document management system allows for efficient searching and retrieval of documents and prevents the destruction of documents without first complying with the policy.
Health Records Act 2001 (Vic)
Crimes Act 1958 (Vic)
Privacy Act 1988 (Cth)