Fact Sheet - Providing access to health information - guidance for health care providers

• a copy of the record in electronic or paper format (or, in the case of extensive medical records, a summary of the key information in the record), or
• a reasonable opportunity to view the record and take notes.

Who can request access?

Individuals can request access to their own health information[3], or to another individual’s health information if they present evidence of written consent from that individual.

Individuals can also request access to information about an individual who is incapable of making the request as their authorised representative, such as for children they have parental responsibility or guardianship for; or other individuals for whom they hold power of attorney.[4]

As a provider, you must ensure that the person requesting access to the health information has the right to do so. You may request proof of a person’s identity and, where relevant, evidence of parental authority, guardianship and power of attorney[5].

When will access not be granted?

There is a limited set of situations[6] where access may not be granted that is applicable to a private sector person.

These include situations where:

Law enforcement agencies or court orders may also prevent you from providing access.

Valid requests should be granted access in all other situations.

In considering requests for access to information under the HRIP Act, public sector agencies should also be aware of section 22 of the HRIP with regard to the provisions of the Government Information (Public Access) Act 2009 that impose conditions or limitations.[7]

• In writing
• Include the name and address of the person making the request
• Identify the health information that is requested
• State the form in which the information is requested

You are required to send a response even when it is appropriate not to grant access. The response should include a clear explanation of why access can’t be granted, with reference to the specific reason as contained in the HRIP Act.

It may be that access can be provided for parts of the information requested. In these cases, you should explain clearly why only partial access has been provided.

In sensitive cases, it may be beneficial for the response to be carefully worded and for the relevant clinicians to review it before it is sent to the individual.

How should I provide access?

Access should where possible be provided in the format requested by the individual. This will likely be as a document in a commonly-used format, such as a spreadsheet or PDF.

You do not have to grant individuals direct access to your systems. You should consider the privacy impacts of providing information and the requested format. You should never grant access to or provide the health information of any individual other than the one who is the subject of the request, except to an authorised representative or with written authority.

Depending on the size of the record, it may be appropriate to provide a summary, rather than the full medical record.

One of my patients is moving to a new practice. Do I need to give the new GP access to the patient’s record?

Records should be made available to ensure continuity of care for the patient, if the patient has provided consent for this transfer to occur. If the patient’s record is extensive it is acceptable to provide a summary of relevant information. The Royal Australian College of General Practitioners (RACGP) has published a guideline about the information that should be included in the transfer of care document, which can be found on the RACGP website.[8]

You should keep a record of the person and practice the information has been provided to and the date this occurred.

What is a reasonable timeframe to provide access?

The public sector is required to send a response within a reasonable timeframe. The IPC recommends a response should be provided within 28 calendar days of first receiving the request.

The HRIP Act requires that a response to a request for access must be given within 45 calendar days. This response must either be the granting of access to the requested information or a refusal to grant this access; any other communication about the request is not a response under the terms of the Act. If a response is not given within 45 calendar days it will be treated as if the request has been refused.

However, all access requests should be processed as quickly as possible.

What fees can I charge?

Under the HRIP Act access should be provided without excessive expense. Fees can be charged to cover the cost of providing access to a medical record, such as administration, photocopying and printing. This fee must not be excessive, and should consider the individual circumstances of the patient so it does not act as a barrier for the patient to access their record or to the continuity of health care. It is recommended that health providers be transparent with individuals about the fees involved with granting access and the way those fees have been calculated.

Once the requester has been notified that a fee is being charged and that access won’t be granted until that fee is paid, a private organisation can wait until 7 days after the fee has been paid to provide access, provided that this 7 days does not exceed 45 calendar days from when the request was received.

In circumstances where the individual has indicated that they would have difficulty in paying the fee, you may consider alternative pricing models, or else suggest providing access to a summary of the health information, which may carry a lower fee.

Information about the charges for providing access to health records within the NSW public health system can be found at: https://www1.health.nsw.gov.au/pds/Pages/doc.aspx?dn=IB2019_036

Please note information on charges in the public health system is regularly updated.

Section 2.6 of The RACGP Guide – Privacy and Managing Health Information in General Practice provides advice on charging for providing access to health information for GPs. This can be found here.

What should I do if I receive a request for access to a medical record as part of a legal proceeding?

If a health care provider receives a subpoena or court order to produce medical records they are generally required to comply. Failure to produce the record may result in penalties or legal action. The RACGP has prepared advice on the information that should be provided to meet the requirement of a comprehensive medical record, which can be accessed on the RACGP website[9]. Medical Defence Organisations can provide advice on compliance with subpoenas or court orders if you have concerns about compliance.

Should I provide medical records if requested by an insurer?

You must obtain the consent of the patient before releasing any information to a third party, including insurers or Insurance and Care NSW (icare). You should ensure that the information disclosed is consistent with the consent provided.

Do parents always have a right to access their child’s records?

In most cases a parent who holds parental responsibility or guardianship may be able to access their child’s records.

You may ask the parent/guardian to provide evidence or authority of that arrangement before providing access.

However, between the ages of 14-16, young people may seek treatment without the knowledge of a parent or guardian, subject to the health care provider’s assessment of the young person’s capacity to understand the consequences of any proposed treatment. A similar assessment should be made in determining whether information can be disclosed to parents/guardians in situations where the young person has capacity to make independent decisions about their health care.

As stated above, you may request evidence of parental authority, or guardianship.

Can I provide information about a deceased patient to a family member?

Please refer to the IPC Fact Sheet on Access to a deceased person’s health information (currently under review). 

What am I required to do with my records if I close my Practice?

If you are closing your Practice you (or your representative) should make arrangements for records to be stored for the required statutory period, or transferred to another provider nominated by the patient.

Patient consent must be obtained before records are transferred to any other provider. If records are to be stored, reasonable steps must be taken to inform patients how they can locate and access their records, and to protect records from unauthorised access, modification or disclosure.

Advice on how to manage changes in Practice circumstances can be found at: https://www.racgp.org.au/FSDEDEV/media/documents/Running%20a%20practice/Practice%20resources/Management%20toolkit/Closing-a-medical-practice.pdf.

Useful resources

Good medical practice: code of conduct for doctors in Australian which includes information about privacy, closing a practice and record keeping requirements:
https://www.medicalboard.gov.au/codes-guidelines-policies/code-of-conduct.aspx

Patient access to health information:
https://www.racgp.org.au/FSDEDEV/media/documents/Running%20a%20practice/Protecting%20practice%20information/Privacy-and-managing-health-information-in-general-practice.pdf

Fees and charging for access to health information:
https://www1.health.nsw.gov.au/pds/Pages/doc.aspx?dn=IB2019_036

Guidelines on managing requests from third parties:
https://www.racgp.org.au/download/Documents/e-health/managing-external-requests-for-patient-information.pdf

OAIC Guide to Health Privacy:
https://www.oaic.gov.au/privacy/guidance-and-advice/guide-to-health-privacy/

IPC checklist for private sector providers (responding to a request for patient access):
https://www.ipc.nsw.gov.au/media/2451

IPC checklist for public sector providers (responding to a request for patient access): https://www.ipc.nsw.gov.au/media/3694 

For more information

Contact the Information and Privacy Commission NSW (IPC):

Freecall:           1800 472 679
Email:             ipcinfo@ipc.nsw.gov.au
Website:           www.ipc.nsw.gov.au

Next review date: February 2022

NOTE: The information in this Fact Sheet is to be used as a guide only.
Legal advice should be sought in relation to individual circumstances.