Chapter 3 Section H: Access to health records
This section provides information about what rights you have to access your health or medical records, what limits there are on these rights, how to exercise your rights and other related issues.
There are sections on:
- Your right of access to your health records
- Moving your health records from one health care professional to another
- Keeping of your health records by your doctor
- Exceptions to your right of access to your health records
- Right to have information on your health records corrected
- Personally Controlled Electronic Health Record (eHealth Record)
You have a right to access your health records held by a health care professional, such as a doctor or dentist, or held by a health care provider, such as a hospital, clinic or community health service.
The right that people in NSW have to access their health records comes from several sources. There are both Commonwealth and NSW Acts of Parliament about information privacy giving you access to records held by both private and public health care providers . In NSW, you can also access medical and hospital records held by NSW Government bodies such as public hospitals and community health centres using Government Information(Public Access) law (formerly Freedom of information (FOI) law.
Usually the actual record, that is, the paper, the folder, the CD, etc, is kept by the health care professional or health care provider who made the record or who holds the record.
Getting access to your health record usually means the person or body holding the record gives you a copy. If you get access to your records this way, you may have to pay for the costs of making and sending you the copy.
Right of access can also mean that you are allowed to look at the original record at the office of the holder of the record. Sometimes, with private doctors, you may be only given a summary of the records.
If you ask for a copy of your public hospital records in NSW, you are likely to be asked to make an Information Access request. Every public hospital has a records department that deals with Information Access applications. They have a set fee for applications, with a discount rate for Health Care Card holders.
Not only do you have a right to access your records, these days it is considered 'best practice' for all those providing a health care service to be open about what is recorded on the patient's medical record.
If you think or have been told that a private health care provider is reluctant to give you a copy of your records, it is probably best to put your request in writing, stating very clearly the records you want to access, and how you want to access the records, i.e., that you want to photocopy them, or just view them, etc. If the health care provider refuses to give you access, you should also ask for the reasons for this refusal in writing.
You only have a right to access records made by private health care providers after 2001 (when the Privacy Act 1988 (Cth) was expanded to include some private sector agencies).
There are exceptions to the right of access, click here to find out about the exceptions.
For more about making an Information Access application for access to your health records held by public health care providers, click here.
For more about accessing your health records using privacy law, click here.
3H.1.1: Right to access health records held by public health providers using Government Information (Public Access) law
The stated primary purpose for Government Information (Public Access) law in NSW is to provide members of the public with access to documents and information held by NSW Government departments and agencies. The general principle of Information Access law is that information must be made available on request, unless there is an exemption that applies.
NSW public hospitals will ask you to make an Information Access application if you want a copy of your health records. You could also ask for access under NSW privacy laws, but NSW Health (the Government Department) has a system of access based on Government Information (Public Access) law. If you want the health records of someone else (including someone who has passed away) then you usually need to make an Information Access application.
There are certain situations where the law allows access to records to be refused. These are exceptions to the right of access. Click here [link to 3H.5] to find out about the exceptions.
If your request for access is refused or you are unhappy about any other aspect of the information you have been given as a result of your Information Access application, you can ask for an internal review by the department or agency, eg, the public hospital or community health centre that dealt with your application. Often government bodies have full-time or part-time Information Access officers who deal with such requests. There are time limits within which these requests and reviews have to be finalised.
If you are still not satisfied after the internal review you can ask the NSW Ombudsman or the NSW Civil and Administrative Tribunal to review the decision. For more about these processes, click here
NSW has an Information Commissioner.
The Information and Privacy Commission has information available for the public about the current Information Access process. Contact the Commission’s office on: 1800 472 679* or click here to go to its website.
* Remember, mobile phone calls to freecall numbers (numbers starting with 1800) are charged to the caller at the usual mobile rate.
You have a right to access records about you made by both public and private health care providers under privacy laws. In relation to private health care providers, you can only ask for records about you that were made after 2001 (when the Privacy Act 1988 (Cth) was amended to include some private sector agencies).
If you want to access your medical record using privacy law, you should start by asking the health care provider to show or give you a copy. If the health care provider refuses or you are not happy with the amount of information you are given, or believe that the record is incorrect in some way, you should speak to the health care provider to try to sort this out. If that does not resolve your concerns, you may be able to make a privacy complaint. To find out more, click here.
In limited circumstances, the body holding the records can refuse to give you access; these are called ‘exceptions to the right of access’. Click here to find out about these exceptions.
To find out what you can do if your application for access to your records under privacy law is refused, click here.
To find out what you can do if your Information Access application for access to your records is refused, click here.
If a private health care provider refuses to give you access to your medical records you can complain to either the Commonwealth Privacy Commissioner or the NSW Privacy Commissioner. If you do not get what you want through the NSW Privacy Commissioner, you can take your request to the NSW Civil and Administrative Tribunal. This process only applies to requests under NSW privacy law.
Often, the staff of the Privacy Commissioners (Commonwealth and NSW) can help you get what you want by talking to the doctor or health care provider. However, if this does not work, it can take some time before the NSW Civil and Administrative Tribunal can deal with your request. If you want or need access to your health information urgently, you may have to negotiate and compromise. Sometimes doctors will agree to provide your records to another doctor who can discuss them with you. If you are simply changing doctors and want your records to give to your new doctor, sometimes your previous doctor will be more willing to send a copy directly to the new GP, rather than give you a copy. Also, more than one doctor or health care provider may have a copy of the same documents that you urgently want.
The Office of the Privacy Commissioner (Commonwealth), in particular, has lots of information available on the Internet about health information privacy, as well as how to make a complaint. Click here to go to its website. The Office of the Privacy Commissioner (Commonwealth) can be contacted by phone on 1300 363 992.
The NSW Information and Privacy Commission can be contacted on 1800 472 679. Click here to go to the NSW Information and Privacy Commission's website.
Under NSW Government Information (Public Access) law, if you are not happy with a decision to refuse you access to your records or about the amount of access you are given, you can first ask for an internal review of the decision. You should make your written request for a review, preferably with reasons, to the place where you made the original Information Access request.
Each NSW Health service has a Right to Information Co-ordinator who can answer questions about Information Access requests, including internal review processes. You will be able to find the Right to Information Coordinator for the health service that holds the records you want by following this link.
If you are not happy with the outcome of the internal review you can apply to have that decision reviewed by the NSW Civil and Administrative Tribunal.
If you are changing health care providers (within the same part of the health care profession, eg, moving from one GP to another), they will usually, with your written consent, pass a copy of your records to your new health care provider. They can ask you for a 'reasonable' fee to do this (called an 'administrative fee'). Some health care providers have a set fee, so it doesn't matter how many pages are in the records. A set fee is permitted so long as the fee is not excessive. If you can't afford the fee suggested, you could try to negotiate with the health care provider, setting out why you can't afford the fee. Alternatively, if the fee is large because of the amount of documents involved, you should talk to your new health care provider about what records are absolutely necessary for your ongoing health care and limit your request for transfer to those records.
Health care providers must keep copies of medical records for seven years (more for children).
Seven years after the last consultation you had with a health care provider, that provider can destroy the records made about your treatment and care.
Many hospitals and even some private doctors keep copies of their records much longer than seven years. The rule for health privacy and access to information is that if the health care provider has a record, you are entitled to access a copy of that record if it is about you. The exception is that you have no right of access under the Privacy Act 1988 (Cth) to health records made before 2001. For information about other exceptions, click here.
Both the privacy and access to information laws have exceptions to the right of access that lets the holder of the information refuse to give you access to all or parts of your records.
The exceptions are called exemptions under access to information law because they refer to a document either being exempt from access to information law or not. If you are using access to information law to ask for access health records and the holder of the record thinks you may be seriously affected by accessing information about your physical or mental health, then they can regard the document as exempt from access and refuse access. Under NSW information access law guidelines you can ask that your medical doctor be given access to the information and tell you about it.
The most common exception in the privacy principles is that access can be refused if letting a person see their records would pose a serious threat to the person's life or health, or the life or health of someone else (such as a relative, a health care provider, staff or other patients).
Under the Commonwealth privacy principles the threat must be significant. An example would be where there is a serious risk that the person may harm himself or herself or another person if they saw the information.
The threat can be to physical or mental health, but does not need to be imminent; it can be a serious threat that would occur some time after access is granted.
Because of this exception, access to records held by psychiatrists or psychiatric hospitals is sometimes denied.
If you want access to your records in this situation, you could ask for a copy of the records to be supplied to another person, usually another health care professional. This other person can then talk to you about what is in the records. If this is refused, you can ask for a review or appeal.
For more about asking for a review or appeal, click here.
If you have accessed a copy of your medical records and noticed something in the records that you think is wrong, you have a right to have the mistakes corrected. This right is found in both privacy law and Government Information (Public Access) and Freedom of Information law.
This does not mean that the mistake can be crossed out and the correct information put in to replace it. The rules are very strict about changing medical records after they are made. Certainly, if the holder of the records agrees with you about the mistake, then the record should very clearly note the correct information so that anyone reading the information will not be misled.
However, it is possible that the holder of the information will not agree with you that their record is inaccurate.
If you disagree with someone’s opinion that is included in your medical records, then it is not likely that there will simply be a change to the record. A diagnosis is an opinion, including a diagnosis of a mental illness or mental disorder. If you disagree with a doctor’s diagnosis of your physical or mental health, then this is seen as a disagreement about opinion, not fact.
Most arguable parts of the reports prepared by health care professionals, in particular medico-legal reports prepared for tribunals and courts and sometimes for private bodies like insurance companies, are opinion. That is, they contain conclusions drawn by the health care professional who wrote the report based on the facts presented to that professional.
If there is disagreement about whether information or an opinion written in your medical record is correct, you may still ask to have other written material included in your medical record with the challenged information or opinion to contradict the information it contains. If you write to the body that has your medical record setting out what you believe is an error, you should specifically ask that a copy of your letter is placed next to the document or documents in your records that you say contain the error (most hospitals keep at least two sets of files, a clinical file that records your treatment and an administrative file that deals with your complaints, etc). If you have another health care professional’s report that disagrees with, say, the diagnosis in your medical record, you can ask for a copy of that report to be placed next to the other report in the clinical file.
Because the right of correction is part of privacy and Access to Information/FOI law, if you are not satisfied with how a health care provider has dealt with your request to correct records, you can complain to the NSW Information and Privacy Commission and/or the Commonwealth Privacy Commissioner, and, if your complaint is about a NSW authority, you can also make a complaint under Government Information (Public Access) law.
If you want to correct your health record you are strongly advised to put your request in writing. Given current practice, if the holder of the record disagrees with you about the accuracy of the record, unless you put your complaint about the accuracy of the record in writing or you complain as set out above, there is no guarantee that the staff of the health care provider, either private or public, will either record or do anything about a verbal complaint of this nature.
For information about where to get help with a complaint about correction to your records, click here.
A personally controlled electronic health record, or 'eHealth record', is secure on-line electronic record of all your personal health information. You control what information is included in it, and who is allowed to access it. It may include information about your medical history, such as immunisations, allergies, test results, prescribed medication, hospital discharge summaries, referrals to specialists and specialists’ letters.
Your eHealth record allows you and your doctors, hospital and other healthcare providers to view and share your health information so that they are able to provide you with timely, safe and effective care. For example, eHealth will allow your GP to access information about the consultation you had at the after-hours medical centre, about tests and assessments, your consultations with a specialist, information about the treatment you received in hospital and the prescriptions that were dispensed at the pharmacy. At home, you can also choose to access your eHealth record to see a summary of your health information which now includes information about your recent healthcare event.
eHealth records are not compulsory. You can choose to have one or not. If you want to create an ehealth record, you must register.
Privacy protection and appropriate security are critical aspects to eHealth. Policy, governance and legislative safeguards are in place to facilitate access by the right people and prevent inappropriate access and use of healthcare information.
A booklet is available to help you understand the eHealth record registration process. This document explains the terms used, your eHealth privacy safeguards, details about how your information is handled, and where and how you can apply for an eHealth record.