In the ACT, matters relating to the recording, storage, and access to health records are covered by the Health Records (Privacy and Access) Act 1997 (ACT)
Does this legislation apply to me?
The Health Records (Privacy and Access) Act 1997 applies to any person or practice in the ACT that provides a health service, which means a service to diagnose, treat or maintain the physical, mental or emotional health of a consumer. This includes disability and aged care services, massage clinics, unqualified counsellors and alternative health providers.
The Act also applies to any person or organisation that stores information about a person’s health, including employers who hold information about their employee’s health and educational institutions who hold this information.
What is a health record? What forms part of a health record?
A health record is defined in the ACT to be any information held about a person’s health. A health record can be in writing, audio, or be electronic and includes all copies of the record itself.
A consumer’s health record can also include photographs, medical test results, medical imaging reports and clinical notes. If a health service provider has taken notes on a patient that are non-medical in nature, including expressing an opinion on a patient, this will also form part of the health record.
What are my obligations in keeping health records? How should health records be stored?
Once a health record has been taken about a consumer, they must be kept by an organisation for a defined period.
If the consumer was under the age of 18 when the information was collected, the information must be stored until the day they turn 25. If the consumer was over the age of 18 when the information was collected, the information must be stored for seven years, dated from the last time the consumer received a service at the organisation.
The Act requires you to store health records in a way to ensure that the records are reasonably protected against loss, unauthorised access, modification, disclosure or misuse. Measures taken could include physically locking access to physical records and password protecting and keeping a secure backup of electronic records.
Can a consumer’s health record be edited?
No, under the Act, a consumer’s health record cannot be edited or altered or erased, information can only be added to the record. This applies even if the record contains inaccurate information.
How can health records be disposed of?
When disposing of health records, reasonable care must be taken to ensure that patient confidentiality is not compromised. This includes taking steps to de-identify the information.
Organisations must keep a register of the health records that are destroyed or transferred. This register needs to include information about whose records have been destroyed, the period of time the record covered and the date the record was destroyed or transferred.
What if an organisation closes or moves location?
The Act places obligations on health providers that permanently close or relocate. Thirty days before the closure/transfer, they must publish notice of the closure or transfer on an ACT government website, or in an ACT newspaper. This notice must inform consumers that they may request a copy of their health record up to fourteen days after the notice is published. The organisation must also take reasonable steps to try and inform consumers personally about the closure.
Is a consumer entitled to access their health records?
The Act gives consumers the rights to access their health records. The Act prescribes three ways in which a consumer may choose to be given access to their records:
What format does the consumer’s request to access their health records need to be in?
The consumer may make the request either orally or in writing. An organisation may ask the consumer to provide the request in writing.
When does access to a consumer’s health records need to be granted?
After the request for access has been received, within two weeks, an organisation must either give the consumer access (in their desired format) to their health record, or inform them that that it is prohibited to give access to this health record.
When will it be prohibited to give a consumer access to their health records?
The Act specifies certain situations in which it is prohibited to make health records (or parts of health records) available to consumers. Access to a health record cannot be given when:
What about the health records of children or incapacitated persons?
The Act separates children based on their developmental capacity and emotional maturity.
If a child lacks the sufficient maturity and capacity to understand the nature of their health record and to provide informed consent to accessing their health record, their parent/guardian is able to make the request to access their health record on behalf of the child.
However, if the child does have the requisite level of maturity and capacity, their health record may only be requested by, and only be provided to, the child, and not to their parent/guardian.
An incapacitated person’s records can be requested by their legally appointed attorney or guardian, provided the person has the power to make decisions about their health.
What about consumers who are deceased?
A deceased consumer’s health record can only be accessed by the executor of the deceased’s will, or the administrator of the deceased’s estate.
Can a fee be charged for providing access to medical records?
Yes. The Act permits charging a fee for the copying, transfer or giving access to health records. The ACT Minister of Health may determine the maximum fee that can be charged. Information on the applicable fees can be found here.
Employee’s access to records Who in a medical organisation is entitled to access a consumer’s health record?
The consumer’s health service provider, the members of the consumer’s treating team (specialists, referring health service providers, etc) and certain administrative staff may be entitled to access a consumer’s heath record.
Administrative staff may access a consumer’s health record when it is required to perform a management, funding, or quality function as part of their official employment duties. Administrative staff are not permitted to access a consumer’s health record for any other purpose and must only access as much as is required to perform the function.
When can third parties be given access to health records?
A consumer may request that a copy of the consumer’s health record, or that a summary of it, be provided to another health practitioner, or to the consumer’s representative.
Organisations must take reasonable steps to confirm the identity of the third party.
A medical provider may give an individual’s immediate family member access to their health information, without their consent, on compassionate grounds. This would include informing a spouse of a cause of death, or notifying a next of kin about a hospital admission. Information cannot be disclosed where the person has previously expressed a wish contrary to disclosure, and this would ordinarily not extend to disclosing the whole of a person’s health information.
There may be circumstances where an organisation will required to disclose the health record of a consumer without their consent. Circumstances include the disclosure of a notifiable condition to the Chief Health Officer for public health reasons, for the purpose of finding a missing person, or upon the request of a law enforcement agency.
Contact our Employment Law & Investigations Team for more information.