Releasing medical records

Requests for medical records might come directly from a patient, a lawyer, an insurance company, or another interested third party. There are also other legal mechanisms in place (such as a summons or a subpoena) which compel the release of specific records.

Patients have a right to access their own health information, and they can delegate this authority to a third party. It is important to facilitate this access in a timely manner to ensure compliance with Australian health and privacy law.

While each request for records is different, here are some common considerations.

Who should respond to the request?

The person who receives the request should acknowledge receipt as soon as possible and advise how the request will be handled. This task will often fall to practice staff, who will generally liaise with the patient’s treating practitioner about the request before deciding next steps.

If the request is sent directly to the practitioner, the practice will often be involved at an administrative level, because the practice is usually the custodian of the notes.

Although this is the general principle in a standard practice–practitioner relationship, arrangements may vary according to business arrangements and contractual obligations.

Can you release the notes to the person requesting them?

Before releasing any records, you must ensure that you have the patient’s consent. This may involve confirming the identity of the patient if they are requesting a copy of their own medical record. A request from a lawyer, insurance company or other third party should always be accompanied by a (recent) signed patient authority.

Patients can withdraw prior consent; so if you have any concerns at all, you should advise the patient of the request and confirm their authority to release the notes. If you obtain the patient’s verbal consent, this should be recorded in the medical record.

According to the Guide to Health Privacy published by the Office of the Australian Information Commissioner (OAIC), you should respond to a request for records within 30 days of receiving the request. Do not leave the request sitting until the last minute, because some requests can be quite complex to process. This is particularly the case with the records of deceased patients, and where family law disputes are afoot.

Deceased patients

Patients are still entitled to confidentiality after death, and requests of this nature require delicate handling.

A bereavement discussion with the next of kin shortly after the patient’s death is very different to a request for a complete copy of the deceased patient’s medical record a year down the track.

Some legal instruments, such as an enduring power of attorney or guardianship, die with the patient. They have no legal standing once the patient is deceased.

Obtaining a copy of a deceased patient’s medical record usually requires a legal authority such as a subpoena, a grant of probate, or letters of administration.

In some states, being the named executor is sufficient in the absence of any known disputes over the estate. It is important to consider these requests carefully, and we recommend you contact MDA National to discuss the situation in more detail.

Is there anything that should not be released?

Under the Privacy Act 1988 (Cth), there are grounds on which you can refuse to comply with a request for records. Two of the most common bases for refusal is where you “reasonably believe that giving access would pose a serious threat to life, health or safety of any individual, or to public health or public safety”, and where “giving access would have an unreasonable impact on the privacy of other individuals”.

While the practice usually maintains custody of the records, it is important to seek input from the patient’s treating clinician, where possible, to ensure none of the exceptions apply. You should also consider whether it is appropriate to refuse access to the entire record, or whether any information should be redacted before the record is provided to the patient.

If you are relying on one of the exceptions under the privacy legislation, there is a process that needs to be followed – so please refer to the Guide to Health Privacy or contact MDA National for advice.

Can I charge a fee for the release of records?

You can charge the patient a ‘reasonable administrative fee’ for the production of records, although you should consider the patient’s individual circumstances when considering what would be reasonable.

The OAIC provides guidance on the factors to consider when raising a fee, but they make it clear that the cost should not be excessive or discourage a patient from obtaining their medical records, and flat fees are not generally appropriate.

Remember

The medical record is not just the progress notes made by doctors in the practice. It can include tests results, referrals, specialist reports, and notes obtained from the patient’s previous practice.

Requests for medical records: family disputes

Separated parents

One particularly complex scenario is a request for records where the separated parents of children are requesting access to the notes – or objecting to the other parent accessing the notes.

The default position, in the absence of court orders to the contrary, is that either parent can consent to treatment, and either parent can access the child’s medical records.

When such a request is made, you should acknowledge receipt and ask the parent requesting the records whether there are any custody arrangements or court orders in place which might affect your ability to provide these records.

Once this has been confirmed, you should seek the views of the other parent as to whether there is any reason the records should not be released (for example, it might be necessary to redact third-party information such as this parent’s address or contact information).

It is important to respect both parents’ rights to access their children’s medical records, unless there is a legal basis that prohibits access. There is also an exception based on serious risk of harm as detailed earlier. If you are getting into this territory, we strongly advise you to contact MDA National for advice.

Protected confidences

A relatively new concept which intersects the family law and medico-legal space concerns amendments to the Family Law Act 1975 (Cth), which introduced the notion of a ‘protected confidence’.

As a medical practitioner, sensitive information you collect while providing care can be the subject of a protected confidence order (PCO). Essentially, a PCO prohibits disclosure or use of particular sensitive information, if the Court decides that the likely harm from this use or disclosure outweighs the benefit of being able to use the information.

Any information held in a patient’s medical record can be the subject of a protected confidence. While you, as the practitioner (or ‘confidant’, in the language of the Act), can make an application for a PCO, we would generally advise against this. It is up to each party, or their legal representatives, to make an application to the Court.

If you have concerns about a patient’s welfare or the information held on their file, you should still comply with the subpoena or summons and produce the material to the Court (as not doing so can constitute an offence), but you can alert the Court to the sensitive information you are concerned about. This will allow the Court to consider whether it is appropriate to make a PCO on its own motion.

Alternatively, you can reach out to the patient and explain you have received a subpoena and intend to comply with it. If they have concerns about the records being provided to the Court, you can suggest they either seek independent legal advice or contact the Court registry for advice on steps they can take to protect their sensitive information.

Family disputes are often complex and difficult to navigate.

Our Medico-legal Advisory Services team has experience in these matters, so please contact us for advice.