Quick guide:
- A valid authority must accompany a request for records from a third party.
- Authorities must be current, signed by the patient and specific enough for you to comply with – including which records
should be released and to whom.
- There are times when you may be legally required to release patient information to a third party without consent, such as
when you receive a subpoena, summons or when legislation requires it.
When to provide information to third parties
Patients often request their medical records themselves.
However, you may receive a request for a patient's medical
record from a third party.
You can provide copies of records to a third party if you have the
patient’s consent to do so.
Requests can come in many forms, but the common ones include:
- a letter from a solicitor for the purpose of legal proceedings
- an insurer asking for medical records in relation to a patient’s workers’ compensation or life insurance claim
- a patient's employer asking you for information about their
medical condition
Where a request is accompanied by a valid 'authority' (the patient's
consent), it is generally appropriate to provide copies of the records
to the requesting third party.
The requirements for an authority to be valid are that it should:
- clearly indicate to whom the records can be released
- clearly identify the records covered by the authority
- be reasonably current. Generally, you should query
authorities older than 12 months.
Ideally, the authority should be in writing and signed by the
patient. If you received verbal authority to release the records,
take a detailed note (including about the details above) and
store it in the patient’s medical record. If you have any doubt
about the patient’s authority, you should contact the patient to
clarify. Document this discussion in the patient’s medical record.
Recent changes from the Financial Services Council allow life
insurers to request your patient's health information using two
standard authorities. Authority 1 allows the insurer access to a
patient's records, including imaging and tests, but excluding,
importantly, a GP's consultation notes. Authority 2 allows a life
insurer to request the entire file, including the notes, if the GP
doesn't respond to Authority 1.
Compulsion by law
You have a legal obligation to provide a patient’s medical
records to a third party (without the need to seek a patient's
authority) in these circumstances:
- Legislation requires you to do so – such as public health
requirements to report infectious diseases, or mandatory
reporting of children at risk.
- You receive a summons or subpoena to produce medical
records to a court or tribunal.
- You receive a notice of non-party disclosure (Queensland
and the ACT).
- You receive a warrant from the police to produce
documents. A verbal request from the police will not be
enough for you to produce information or records.
If you are legally compelled to release records to a third party,
we recommend you let your patient know.
What documents should you supply?
You should supply a copy of the record and keep the original
in your possession.
You should read the request carefully to ensure you do not
include or exclude documents captured by the request and the
scope of the patient’s authority. For example, a request from
an insurer may be for all the medical records but the authority
signed by the patient may only authorise a release of records
relevant to the claim.
Where a medical record contains sensitive information, for
example about mental or sexual health issues, check the patient
is aware that the authority they signed may extend to these
documents and confirm they can be released. The patient
may not have considered the implications of releasing all the
information held within their record, particularly very sensitive
information. Document any conversations you have with the
patient in this regard.
Sometimes specialists write to general practitioners stating that
their letters should not be supplied to third parties without their
consent. These letters form part of the patient’s medical record
and, like any other part of the record, such as personal notes or
photographs, should be produced to the patient or third party
whether or not the specialist has provided specific consent. It
is important to keep in mind though, who may read letters or
patient notes when you are documenting care. Ensure your
notes remain professional.
Limited exceptions not to provide records
There may be situations in which you are concerned about
providing records to a third party even though there is a valid
authority or a legal requirement to do so. It may be possible to
object to providing records in certain circumstances.
This could include a situation where supplying the records will,
in your opinion, result in significant harm to an individual, or you
think the request is unclear. Objections are rarely successful in
a medical case; we recommend you contact Avant for advice if
you are concerned about providing records.
Additional resources
Available at avant.org.au/avant-learning-centre:
For more information or immediate medico-legal advice, call us on 1800 128 268, 24/7 in emergencies.
