Navigating requests for medical records

Helena, the receptionist of an ophthalmologist practice, has just got off the phone with Steve, a long-time patient of the practice, who made an unexpected request: a full copy of his medical records. “I heard that, legally, the records belong to me, not the practice,” he said. Helena is uncertain. What should she do?

While Steve is not correct that his records belong to him, patients generally do have the right to access their medical records, except in limited circumstances.

A patient’s right to access may include being provided with a copy of their records, inspecting them, and providing a copy to an authorised third party (for example, a solicitor or insurer).

You can refuse to give patients access to their records where there is:

Serious threat – You have grounds to believe that if a patient accessed their health information, it would pose a serious threat to the life, health or safety of the patient, another person, or the public.

Unreasonable impact on the privacy of other individuals – The patient’s health information contains another individual’s information, which would impact that individual’s privacy.

If you refuse a patient’s request, you must still take reasonable steps to provide access to the requested information in another way. 

You can charge the patient for the cost of providing access, for example, the cost of making copies, but you cannot charge the patient for making the request. 

The amount must reflect the way that access is provided. There should not be any costs for obtaining legal advice about the request. You should advise the patient of the cost before providing access to the records to ensure that they agree. You may negotiate the patient’s request (for example, the volume of records) to minimise the charge.

In Victoria and the ACT, the cost of providing medical records is capped by regulations that are updated periodically.

Aim to provide access to records in the form that the patient requests it, where possible. Health information can be provided in several ways, such as:

• sharing a copy of the information (electronic or hard copy)
• providing a summary of the information
• providing information over the phone (for example, test results)
• allowing the patient to view or listen to an audio or video recording of the information and take notes.

While this request came from Steve, in other situations, patient records may be requested by third parties (for example, from a solicitor for legal proceedings or an insurer in relation to a patient’s workers’ compensation or life insurance claim). In that situation, your response depends on whether you have ‘authority’ (the patient’s consent) to release the information.

Often, requests are accompanied by a document signed and dated by the patient. To ensure the authority is valid, check the patient’s full name, date of birth, and address and ensure it is signed and dated by the patient. While the authority doesn’t necessarily expire, if the document is more than 12 months old, we recommend you contact the patient to confirm that they still authorise the release.

To avoid breaching the patient’s confidentiality or releasing records inappropriately, only provide the documents that are captured by the scope of the authority.

For more information, refer to our factsheet Responding to a request to access medical records.

For Steve’s request, Helena should document the conversation in the record, discuss the request with the ophthalmologist and, unless an exception applies, she can arrange to provide him with a copy of his records after determining a reasonable fee.

Avant collection - Medical records: what you need to know

Avant factsheet - Responding to a request to access medical records

Avant eLearning - Medical records: part one documentation

For medico-legal advice, please contact us here, or call 1800 128 268, 24/7 in emergencies.