Health professionals will collect a lot of information about your health and the treatment you receive. When you are receiving health care, you have a right to privacy and confidentiality. This means that, in most cases, health professionals can’t collect your health information or disclose it to others without your consent.

It’s important to note that your rights may vary depending on which state or territory you live in. For specific information, contact the Office of the Australian Information Commissioner, talk to your treatment team, or seek independent legal advice.

Medical records

When you receive health care, the person treating you creates notes. This is called a medical record.

A medical record could be handwritten or electronic and it will include notes about:

• personal details (e.g. your name, medical history, genetic information)
• information or opinions about your health or illness
• scans, tests and the interpretation of results
• recommendations about treatments and medicines
• correspondence to other health professionals
• photographs, audio files or video footage.

Every treatment centre you attend will keep a medical record about you, and they will add to that record each time you visit or have tests.

My Health Record

The Australian Government’s My Health Record is an online summary of your health information (e.g. imaging scans, test results, prescribed medicines, your medical conditions and treatments). It allows you and your health care providers to view summaries of your health information at a glance. Insurers and employers are not able to access My Health Record. For more information about managing your record, including your privacy and security, visit myhealthrecord.gov.au.

Ownership of medical records

The health service or health professional who creates a medical record owns and maintains the record. However, Australian law considers ownership and access as separate – so although you don’t own the medical record, you generally have a right to gain access to it.

Medical records must be stored and disposed of securely to prevent unauthorised access. Different states and territories may have different requirements about how long doctors and treatment centres must keep your records after your last consultation.

Access to medical records

Medical records are private and confidential, and can only be viewed by health professionals when necessary for their work. Australian privacy standards establish a general rule that organisations are required to provide you with access to personal information (such as medical records) held about you.

This standard has been developed because giving people access to their medical records:

• allows them to better understand their condition and treatment
• can help ensure the information is accurate
• may make people feel more confident about the health care system.

If you would like to see your medical records, ask your health care provider (e.g. GP, specialist, hospital or treatment centre) for access. You may have to put the request in writing and provide proof of identity, such as a driver’s licence or birth certificate.

There is no set time limit for a health care provider to meet a request for medical records. However, the Office of the Australian Information Commissioner recommends that a request should be processed within 30 days.

The health care provider may charge a fee to copy your record (public hospitals usually charge about $30), but there shouldn’t be a fee to just look at the record.

You can also ask for a copy of your medical record to be sent to another health care provider, for example, if you want to change doctors or treatment centres.

If you make a complaint about your health care, your records may be provided to the health ombudsman or complaints commission in your state or territory. Your medical records may also be accessed by others if you make a claim for insurance benefits.

Denying access

Rarely, you won’t be allowed to have a copy of your medical records because:

• another law requires your information to be kept private (e.g. if the information relates to legal proceedings)
• there’s a risk that the information could harm you or someone else, such as a relative, treatment staff or other patients.

If your health care provider refuses to let you see your medical record, they must let you know the reasons.

Changing medical records

You can ask for changes to your medical records if you think the records are inaccurate, irrelevant or misleading. You should make this request in writing.

If a treatment centre refuses to change your medical record because they think it is correct as it is or that your suggested changes are not appropriate, it must provide a written explanation for the decision. You can also ask them to include a short statement with your record, which explains that you think the information is incorrect.

If you disagree with the decision, you can make a complaint to the Office of the Australian Information Commissioner or to the health ombudsman or complaints commission in your state or territory.