Medical records may be drawn upon as evidence in legal proceedings, including medical negligence claims, motor vehicle accident claims, workplace injury claims, or coronial inquests. Attwood Marshall Lawyers Compensation Law Senior Associate, Henry Garrett, explains what medical professionals need to know about requests for medical records.
Medical records are fundamental in good quality patient care. The predominant purpose of the medical record is to enable patient care and permit you or another practitioner to continue the medical management of the patient.
When someone gets injured or becomes unwell, good medical records will play a vital role in that person pursuing a compensation claim for their injuries or illness. The quality and comprehensiveness of someone’s medical records can drastically improve the defensibility of a claim.
If someone is pursuing a compensation claim, whether it be for a motor vehicle accident CTP claim, workers’ compensation claim, a public liability claim, or a TPD or Income Protection claim, insurers and other third parties may ask medical practitioners for patient information. It is important to understand the vital role medical records will play in a compensation claim and what can go wrong if records are not recorded accurately.
Why the Privacy Act and Australian Privacy Principles are relevant?
The Privacy Act sets out rules of conduct called the Australian Privacy Principles (APP). Medical records held by private health services are accessible under the APP. There are 13 APPs that govern standards, rights and obligations around the collection, disclosure, and use of personal information, governance and responsibilities requirements, integrity of personal information, and an individual’s right to access personal information.
Obligations regarding the storage of medical records
Australian Privacy Principle (APP) 11 – Security of Personal Information – enforces a statutory duty upon practices/practitioners to establish safeguards to protect a patient’s health information. The principle applies to recording a patient’s personal information, whether on paper, electronic format, diagnostic imaging, audio, or video. Although the Australian Privacy Principles impart some guidance, it is the responsibility of health professionals and healthcare institutions to determine how data security is to be preserved and secured.
The prevailing duty is to ensure that patient confidentiality is upheld and that records are not altered, lost, stolen, or damaged.
Who owns the medical records?
Unless there are contractual arrangements, medical records typically belong to the medical practice or hospital in which they were generated.
Can patients access their medical records?
Australian Privacy Principle (APP) 12 – Access to Personal Information – permits patients the right to access their medical records upon request. The holder of the records must substantiate that the individual concerned made the request and must provide access to the records as requested by the individual (e.g. via email, in person, or hard copy) as is reasonable and practicable.
Timeframe to process a medical record access request
As a guide, the Office of the Australian Information Commissioner (OAIC) recommends that the time for processing an access request should be less than 30 days.
Should a medical records access request be made in writing?
If a third party is requesting access to a patient’s medical records, this must be submitted in writing and include a signed authority from the patient. However, there are rare instances where a patient authority is not necessary, such as when served with a valid search warrant or subpoena. When granting access to someone’s medical records, it is recommended that you record details in the patient’s record of whom you provided access to and when.
Refusal to provide patients access to their medical records
Access to medical records can only be refused to the patient (or nominated representative) in exceptional circumstances, such as:
- a legitimate threat to life, health, or safety of any individual, or public health or safety
- unreasonable effect on the privacy of other individuals.
If access is rejected, the patient must be advised in writing as to why the request was denied and what avenues the patient may have to issue a complaint. Medical professionals should also note the reasons for refusing access to the patient’s records. We recommend obtaining advice from a legal professional if you intend to refuse a person access to their medical records.
Who can access a deceased patient’s medical records?
A patient’s right to confidentiality does not cease when they are deceased. If the patient is deceased, the provision of consent to access their medical records lies with the executor or administrator of their estate. In ACT or Victoria, only the executor of the Will (where probate has been granted) or the administrator of the estate has a right of access to a deceased patient’s medical records.
In New South Wales, Queensland, Western Australia, South Australia, Northern Territory, and Tasmania, it is recommended that medical professionals provide medical records to eligible persons who make a written request with a certified copy of the Will proving their appointment as executor.
An access request should:
- State the name and address of the person requesting access and their relationship to the deceased
- identify the health information being sought
- specify how the individual is seeking access, e.g., provision of copies by mail or email, or collect physical copies in-person
- state the basis of the request being made.
When access is provided to a deceased patient’s medical records, it should be noted in the record stipulating who was given access, the basis for allowing access, and the extent of the information provided.
Can a practitioner delete or alter a medical record relating to a particular incident?
After receiving a request for medical records to support a patient’s complaint or claim, you may feel tempted to change the medical records, or document all your recollections of the incident in the notes. Although substandard medical records may make a claim difficult to defend, altered medical records will make a claim virtually impossible to defend. If you become aware that personal information is incorrect in the ordinary course of patient management, you are required to correct it. It is acceptable to add a contemporaneously dated electronic note, or rule across the incorrect entry (without deleting it), initialling the correction and including the date that you corrected.
If information concerning a particular incident is received later, insert an entry but mark it “additional” and include the date and time it was made. Note that Australian Privacy Principle (APP) 13 – Correction of Personal Information – requires personal information found to be incorrect to be corrected in the ordinary course of care.
Attwood Marshall Lawyers – helping people access the treatment they need when suffering an accident or injury
We understand the confusion and difficulty that you can face when you have been requested to partake in the claim process and release medical records for the purpose of your patient pursuing a compensation claim.
If you have any questions about handling health record requests from patients or third parties, our Compensation Law team at Attwood Marshall Lawyers can provide advice to help you understand how to protect your patient’s privacy and confidentiality and the role you may play in the claim’s process.
Contact our team any time on 1800 621 071.
