Doctor justified in refusing to give patient access to medical records

Under the Privacy Act 1988 (Cth), healthcare providers must give patients access to their health records, subject to limited exceptions. Access may be denied if the doctor reasonably believes giving access would pose a serious threat to the life, health or safety of an individual or to public health or safety.

Before refusing access on this basis, you must consider whether the risk can be reduced or mitigated by providing access in another way, for example through an intermediary such as another appropriately qualified practitioner.

Refusal of access to personal information

Patient D had been held overnight in a mental health facility. They later requested copies of their discharge summary from the hospital. When they could not pay the fee for access, the hospital agreed to send it to a local medical centre.

D contacted the medical centre and was advised to make an appointment with a GP. Dr E, who was not D’s usual GP, saw the patient. After reviewing the discharge summary, Dr E was concerned that the content might pose a risk to the patient and others. The summary referred to threatened self-harm and harm to another person, possible diagnoses of post-traumatic stress disorder and borderline personality disorder, the patient’s self-reported anger issues and a comment about the risk of “misadventure during future altercations”.

Dr E had limited prior knowledge of the patient and saw in the progress notes that a colleague had raised concerns about D’s psychological health and ongoing psychiatric care.  Dr E sought advice from their MDO and contacted the hospital. The hospital recommended that only the front page of the discharge summary be provided to the patient and advised that D could submit a further formal request to the hospital to access the full document.

The practice informed D that only the front page would be made available.  Seven days later, D lodged a complaint against the practice with the Office of the Australian Information Commissioner (OAIC)

Risk to life, health and safety - APP 12.3

The Commissioner found that the practice was entitled to rely on Dr E’s professional judgement in deciding to deny access. Dr E acted appropriately in seeking both medico-legal and clinical advice, particularly given they were not D’s usual treating doctor. It was reasonable for Dr E to place weight on the opinion of hospital clinicians who had treated D, had specialist psychiatric expertise and had recommended limited disclosure.

The Commissioner was satisfied that Dr E had formed a reasonable belief that full access to the discharge summary would pose a serious threat to D’s life, health or safety, or to the safety of others. On that basis, both Dr E and the practice were justified in refusing access under APP 12.3.

Alternative means of access – APP 12.5

The commissioner also found that Dr E and the practice had complied with APP 12.5, in considering whether access can be provided in another way that reduces the risk. By offering to provide the front page of the discharge summary and advising D of the option to request full access from the hospital, they had taken reasonable steps to facilitate access.

Written notice – APP 12.9

Under APP 12.9, when access is refused, individuals must be given written notice explaining the reasons and their options for lodging a complaint. Responses must be provided within a ‘reasonable period’, which is generally no more than 30 days. Since the patient complained to the OAIC within seven days, the commissioner accepted that the timeframe had not yet expired, and found the practice had not breached this obligation.

Under Australian Privacy Principle (APP) 12.3, you may refuse a patient access to their health information if you reasonably believe that providing access would pose a serious threat to the life, health or safety of any individual or to public health or safety (among other limited exceptions).

Before refusing access, you must first consider whether there is another way to facilitate access that would reduce or eliminate the risk — for example, by providing access through an intermediary (APP 12.5 and APP 12.6), such as another appropriately qualified health practitioner.

If you are unsure whether it is appropriate to provide access, you should seek medico-legal advice or consult with other treating specialists. This can support your decision-making and ensure you meet your privacy obligations.

If you do refuse access, you must provide the patient with a written explanation of your reasons and advise them of their right to lodge a complaint (APP 12.9).

It is important that your reasoning and any steps taken are clearly documented in the patient’s medical records. This includes documenting any discussions with the patient and any written information or supporting material you provided to help them understand the decision.

Avant factsheet: Privacy: the essentials

Avant factsheet: Responding to a request to access medical records

Office of the Australian Information Commissioner: Guide to health privacy

Office of the Australian Information Commissioner: Chapter 12: APP12 Access to personal information