Protecting your health information

Discover the importance of protecting your health information. Learn about your rights whenever your health information is collected and shared.

Learn more about:

• Overview
• What are health records?
• My Health Record
• Who owns my medical records?
• Who can access my medical records?
• Why might access be denied?
• How can I change my medical records?
• Useful websites

Overview

When you receive health care, you have a right to privacy and confidentiality. This means that health professionals must usually ask your permission before they collect or share your health information. Your health service provider should explain to you why they are collecting your health information and how they plan to store, protect and use it.

Laws in each state and territory protect your health information. For specific information on privacy laws that apply to Commonwealth government agencies and the private sector, contact the Office of the Australian Information Commissioner, talk to your treatment team, or talk to a lawyer.

What are health records?

When you receive health care, the person caring for you writes notes about your care. This is called a health record. It can be handwritten or electronic and may include:

	Personal information Personal details (e.g. your name, medical history, genetic information)
	Health information Information or opinions about your health or illness
	Test results Scans, tests and the comments on the results
	Medical information Recommendations about treatments and medicines
	Medical collaboration Correspondence with other health professionals about your care
	Supporting information Photographs, audio files or video footage

Every health service you visit will keep a health record about you, and they will add to that record each time you visit or have tests. If you have any concerns about the security of your health information, talk to your health service or ask to see a copy of their privacy policy.

Who owns my medical records?

The health service or health professional who creates a health record owns and maintains the record. However, under Australian law, ownership and access are different. Even though you don’t own the health record, you generally have a right to see it or get a copy of it, unless an exception applies.

Health records must be kept safe. They must not be shown (disclosed) to people except for a permitted purpose (such as medical treatment) without consent and they need to be disposed of securely.

Different states and territories may have different requirements for how long doctors and health care providers must keep your records after your last consultation, or, for a child, after they turn 18, or 7 years after the last treatment, whichever is later.

Who can access my medical records?

Health records are private and confidential. Health professionals directly involved in your care can view and use your personal and medical information. They should only do this when it’s necessary or reasonably expected to be used for their work.

The Australian privacy principles say generally that health care providers must let you see the information they hold about you when you ask to see it. This includes your health records.

Giving people access to their health records has many benefits. Some of these include:

• helping them better understand their condition and treatment
• checking their information is accurate
• making you feel more confident about the health care system.

If you make a complaint about your health care, your health records may be provided to the health ombudsman or complaints commission in your state or territory. Your health records may also be accessed by others if you make a claim for insurance benefits.

How to access your health information

If you would like to see your health records, ask your health care provider (e.g. GP, specialist, hospital or treatment centre) for access. You may need to ask in writing and provide proof of identity, such as a driver licence or birth certificate.

There is no fixed time limit for providing health records, but providers should respond within a reasonable time.

The Office of the Australian Information Commissioner recommends responding within 30 days, while some of the state and territory privacy laws have set time limits.

The health care provider may charge a “reasonable” fee to copy your record based on the size of the record, or to recover other costs involved in providing access, but there shouldn’t be a fee to request access in most cases.

You can also ask for a copy of your medical record to be sent to another health care provider (e.g. if you want to change doctors or treatment centres).

Why might access be denied?

In rare cases, you may not be able to get a copy of your medical records. This may happen if giving you access could seriously harm you or the privacy of another person who is mentioned in the record.

If your health care provider refuses to let you see your medical record, they must let you know the reasons.

How can I change my medical records?

If you think your medical records are wrong, missing information, out-of-date, irrelevant or misleading, you can ask for changes. You may be asked to make this request in writing.

If a health service refuses to change your medical record because they think the record is correct as it is or that your suggested changes are not appropriate, the health service must explain the decision in writing. You can also ask them to include a short statement with your record, which explains that you think the information is incorrect.

If you disagree with the health service’s decision, you can make a complaint to the Office of the Australian Information Commissioner (call 1300 363 992) or to the health ombudsman or complaints commission in your state or territory.

See Cancer Care and Your Rights for information about making a health care complaint.

Questions for your doctor

You may find this checklist helpful when thinking about the questions you want to ask your doctor. Consider taking a support person with you – this could be a family member or a friend – to help you record and remember the answers.

• What information are you collecting?
• What do you plan to use this information for?
• Do you have a privacy policy? Can I have a copy?
• What is the process for me to access my health information?
• Is there a fee to access my information?
• Will you share my information with my specialists or other doctors?
• What is the process for changing my health information?

Useful websites

Podcast: Coping with a cancer diagnosis

Listen to more of our podcast for people affected by cancer