Medical records - the essentials

• Good medical records are essential for patient care and for communication between healthcare providers.
• Medical records can also assist in the defence of a claim or complaint against you.
• Patients are entitled to request access to their medical records. This is a right under privacy legislation and applies regardless of who owns the records.
• As well as building habits that create good records, it is important to understand and comply with your legal obligations to store, retain and dispose of medical records appropriately.

Detailed medical records are essential for the efficient and safe ongoing care of patients. When creating, maintaining, storing and using medical records, there are a range of legal and ethical issues to consider.

The term ‘medical record’ refers to the collection of various heath information held about a patient’s medical history, care and treatment. It includes information contained in a patient’s progress notes, correspondence between healthcare providers and the patient, pathology and radiology images and reports, other test results, clinical images, medical certificates, and assessments. 

It may also include medico-legal reports prepared by a treating doctor at the request of lawyers or insurers (but not those reports prepared as an independent expert witness as these are not records for a patient).

Medical records are more than notes to assist your memory. Good records are essential for patient care and can also assist in the defence of a claim or complaint against you.

As a general rule, records need to contain enough information to allow another practitioner to identify the patient and continue their care. They should be accurate, clear and contemporaneous.

Records should include information relevant to the diagnosis or treatment of the patient, such as:

• the patient’s medical history, social history and habits
• the findings of any physical examination (including negative findings)
• the results of any tests performed on the patient
• the patient’s mental state
• the provisional diagnosis
• any differential diagnosis considered
• allergies or other factors that may require special consideration
• any plan for treatment
• plan for review and follow up
• details of any medication prescribed.

You should also include the following details of any medical treatment:

• the date of the treatment
• the nature of the treatment
• information or advice given to the patient (for example, an information sheet about risks and benefits of a treatment)
• documentation of patient consent to any procedures
• the name of others involved in the treatment
• the results or findings made in relation to the treatment.

Ensure you make a note of interactions with or about patients that occur outside of a consultation as well, such as telephone calls with the patient or other practitioners involved in the patient’s care. You should document your patient interactions at the time they occur, or as soon as practical.

You may use a clinical software program or artificial intelligence (AI) tool to assist in generating your records. Your obligation to ensure the accuracy of the clinical record still rests with you, so ensure you review the content generated and make sure it is accurate and complete.  For more information, refer to our Artificial Intelligence collection.

While rare, you may find you need to correct information in your records, either because you notice an error or the patient believes the information is incorrect. It is important that medical records are accurate, up to date and not misleading, so any genuine errors should be addressed.

Simple demographic information can be changed so it is accurate and current.

Any changes to information in your clinical notes should be managed by:

• making a new entry of the correct information with reference to the date or place in the records with the incorrect information
• not obliterating the incorrect information but making it clear this has been changed by subsequent information – this might involve striking through a handwritten note so it remains legible, or making an additional time-stamped note in electronic records
• informing  any other practitioners involved in the patient’s care of the correction. 

For information on whether you can alter a medical record, listen to our podcast: Making changes to a medical record. Also see Chapter 13: APP 13 Correction of personal information | OAIC for guidance about the steps to take.

Sometimes the patient’s request is more about a difference of opinion about their diagnosis or condition rather than being a genuine error. In that situation, carefully explain to the patient why you can’t amend or delete the information and document this discussion in the medical records.

Never attempt to amend or rewrite clinical records to portray an incident in a better light. Doing so will be perceived as defensive and dishonest, and will be criticised by the regulator or in any other investigation.

Ownership of records is a separate issue to accessing the record, or the information contained in the record.

Generally, medical records are owned by the individual or entity responsible for making the record – usually the individual practitioner, a private medical practice or a public or private hospital. In public hospitals or facilities, the medical records will be owned by the facility or hospital. In private settings, where doctors practise together or in shared premises, ownership may be less straightforward. The practice may own the record instead of the individual doctor, as it is the entity that maintains and controls the medical records software.

Increasingly, doctors and practices include terms in their written agreements that address who owns the medical record. This is good practice and assists with arrangements when a doctor leaves or closes a practice, although a private agreement cannot override legislation (such as privacy laws about retention and access).   

While patients don’t own the medical records, privacy legislation gives patients a right to request access to their medical records. Access is usually granted, except in a few limited situations such as where access would:

• lead to serious harm to the life, health or safety of any person (the patient or someone else)
• breach another person’s privacy or
• breach a duty of confidentiality. 

Patients might also ask you to provide a copy of their records to a third party, such as a solicitor, insurer or employer.

You can generally provide copies of records to third parties where a patient provides consent. Ideally, this would be in writing and clearly state who the records can be provided to, and which records are covered by the consent. If you receive verbal consent to release records to a third party, you should carefully document the details of the consent in the medical record. The consent should generally be no more than 12 months old.

You may also be compelled by law to provide documents to a third party. This might be through a legal document such as a summons or subpoena, a notice of non-party disclosure, or a warrant from police.

You can find more information in our factsheet on responding to requests for access to records: Responding to a request to access medical records. You can also listen to our podcast: Providing medical records to a third party.

If patient care is being transferred to another practitioner at a different practice, the patient is entitled to the information required for their ongoing care. This includes a treatment summary or, if requested, a copy of the complete medical record.  This is usually facilitated by the patient asking their current practice or practitioner to provide a copy of this information to the new practitioner.

In New South Wales, all requests must be in writing. In other jurisdictions, the request may be verbal, and if so, the request should be documented in the patient record. Often this is done in a form where the patient authorises their information to be provided to the new practitioner and provides their name and date of birth, and signs and dates the form.

There is no obligation to provide original records.

This request must be responded to in a timely manner – in some states, this timeframe is legislated. The patient is responsible for the reasonable cost of providing this information but failure to pay should not prevent relevant information from being provided to the new practitioner. In some states, the cost of providing this information is capped by regulation.

When closing or selling a practice

If you are closing or selling your practice, you will need to determine how to fulfil your obligations regarding your medical records. If selling, this may be negotiated as part of the contract. If closing a practice, for example when retiring, you may be able to transfer ownership to another practice or provide copies to patients. See Preparing for retirement factsheet for further details.  

All medical records, regardless of how they are kept, must be stored in a manner that: 

• preserves the confidentiality of the patient
• protects against misuse or unauthorised access, disclosure or modification
• prevents damage, loss or theft and 
• allows reasonable access to ensure continuity of treatment.  

You must take all reasonable steps to protect the security of your medical records. This means there must be practical measures in place for how records are stored and who has access to them. These will be different for electronic and hardcopy records.  

You can find more information on storing, retaining and disposing of medical records in our factsheet: Storing, retaining and disposing of medical records.

We recommend all doctors retain the complete medical record of an adult patient for at least seven years from the date of last entry in the record. For children, the record should be kept until the child would have reached 25 years old. Some states and territories have legislation that specifies these minimum periods for record-keeping, and these periods provide a useful guide for doctors practising in other states.

Medical records should not be kept forever. Under Australian privacy law, you have an obligation to destroy or permanently de-identify information collected for a specific purpose when you no longer need it for that purpose. Maintaining confidentiality is paramount when you destroy any medical records. Legislation in some states and territories requires you to keep a register of health records that are destroyed. This is good practice in any event.

You can find more information in our factsheet: Storing, retaining and disposing of medical records.

For information on managing records after a patient dies, see our factsheet: Deceased patients and their medical records. You can also listen to our podcast on the topic: Deceased patients’ medical records.

Avant factsheet - Storing, retaining and disposing of medical records

Avant factsheet - Deceased patients and their medical records 

Avant factsheet - Responding to a request to access medical records

For medico-legal advice, please contact us here, or call 1800 128 268, 24/7 in emergencies.