Information Commissioner clarifies doctors’ obligations to provide patient with access to records 

Healthcare organisations must allow patients to access their personal information if requested (subject to limited exceptions). The Australian Information and Privacy Commissioner confirmed this obligation applies even where the patient already has obtained the information, for example referral letters or images, from other sources. Practices may charge a reasonable fee for access, but must not charge patients for any time spent dealing with a privacy complaint. 

Under the Privacy Act 1988 (Cth), Australian Privacy Principle 12 (APP 12) gives individuals the right to access personal information held about them, unless a specific exception applies.

Around six months after a single appointment with an obstetrician and gynaecologist (O&G), patient AGX contacted the practice and requested a copy of their full medical file.  

The practice responded, explaining the only information on file was copies of imaging reports and the letter back to the referring GP (GP letter). AGX already had copies of these documents from the referring GP and the practice advised there was no other information it could provide. AGX sent a second request, claiming the practice did hold more information and requesting it provide that. When the practice did not reply to the second request, AGX complained to the Office of the Australian Information Commissioner (OAIC). 

After the OAIC began investigating, the practice sent an invoice for $440 for time spent reviewing the Privacy Act and addressing the OAIC complaint. It offered to provide AGX with copies of the GP letter and AGX’s signed consent form once the invoice was paid. 

The commissioner concluded the O&G practice held the following personal information about AGX: 

• The initial referral letter 
• GP letter  
• AGX’s signed consent form 
• Imaging reports 
• Patient questionnaire completed during the appointment 
• AGX’s personal identifiers such as contact details, Medicare and private health insurance identifiers 

The commissioner accepted the O&G had reported back to the GP that they were unable to assist AGX and that there were no separate patient notes other than those noted in the questionnaire and GP letter.  

The practice explained that their initial search of the electronic file had missed the questionnaire, which had been kept in hard copy and never scanned into the file. 

The commissioner clarified that the Privacy Act required a healthcare organisation to provide patients with access to personal information it holds about them. This obligation applies regardless of whether the patient has obtained or may obtain that information from another source. 

Frivolous and vexatious requests 

The practice claimed it was entitled to refuse access as AGX’s request was frivolous and vexatious (exception APP 12.3(c)). 

The commissioner clarified that a request should only be refused on this ground if there is a clear and convincing basis for deciding it is frivolous or vexatious. Examples could include: 

• persistent requests for information that has already been provided or that the organisation has explained it does not hold or cannot locate, or 
• requests that appear to be made for the purpose of harassing or intimidating staff or interfering unreasonably with the practice’s operations. 

In this case, AGX’s second request was not unreasonable, and not frivolous or vexatious.  

The commissioner concluded that the practice’s conduct in refusing AGX access to their personal information amounted to an interference with AGX’s privacy.  

Fee for access to records 

The commissioner confirmed practices can charge a fee for providing access to personal information. This can comprise costs including staff time in searching for the information, making copies and posting or delivering materials. The charge should not be excessive and cannot be used to discourage an individual from accessing their personal information. 

Ideally practices should let a patient know in advance if they will charge a fee for access and how much that is likely to be. 

Whether a charge is excessive will depend on the circumstances, but in this case the practice had given no information to justify the cost. It was not permitted to charge for time spent responding to a complaint to the OAIC.  

The commissioner concluded the fee was excessive. 

The practice withdrew the invoice and provided AGX with their personal information at no charge. 

Compensation 

AGX requested compensation on the basis that the practice caused them distress and that the practice’s conduct exacerbated their stress and pre-existing psychological and medical conditions. 

The fact that AGX had access to, or was aware of the contents of information held about them was not relevant to the practice’s obligation to provide it. However, it was relevant to assessing the impact of the practice’s refusal on AGX. 

In this case, the commissioner was not persuaded that the practice’s conduct, rather than other factors, exacerbated AGX’s condition. Therefore, the practice’s conduct did not warrant the payment of compensation. 

Patients have a right to access personal information you or your practice hold about them. This includes information the patient may already have obtained from other sources. 

You can refuse access on the grounds the request is frivolous or vexatious – but only if there are clear and convincing reasons for reaching this conclusion. Contact Avant for advice if you are unsure. 

You are entitled to charge a reasonable fee for access. This might include costs for time spent reviewing the record, making copies, posting copies etc. Note that in some jurisdictions, access fees are specified or capped, so check the position in your state or territory. 

Ideally advise patients upfront if you are going to charge a fee and how much that could be.  

Explain what the fee is for, and be careful that it does not cause the patient hardship or deter them from accessing their personal information. 

Office of the Australian Information Commissioner: Guide to health privacy. Chapter 4 - Giving access to health information 

Avant factsheet – Medical records: What you need to know 

Avant factsheet – Responding to a request to access medical records 

Avant factsheet – Privacy essentials 

Avant eLearning – Medical records: part two – managing medical records 

For medico-legal advice, please contact us here, or call 1800 128 268, 24/7 in emergencies.