You asked your previous clinic for a copy of your file three weeks ago and nothing has arrived. Or you are about to ask, and you do not know whether you are entitled to the whole record or only a summary, what it will cost, or how long you should wait before pushing.
The entitlement is Commonwealth law and it does not depend on your reason for asking. Australian Privacy Principle 12, under the Privacy Act 1988 (Cth), gives you access to the personal information a private health service provider holds about you. The Office of the Australian Information Commissioner (OAIC) is explicit that the Act covers every private sector health service provider in Australia, whatever its size, so a solo practice is as bound by it as a national group.
Before you send anything:
- There is no official form. A clear written request is enough. Some practices have their own form and will ask you to use it, but they cannot require it.
- Thirty calendar days is the working outer limit for a private provider to respond.
- A clinic cannot charge you for making the request. It can charge a non-excessive amount for producing the records.
- A refusal must arrive in writing, with reasons and with the complaint options set out.
What are you actually entitled to?
APP 12 covers the personal information a provider holds about you, which in a clinical setting means the file itself: consultation notes, correspondence, results, referrals, the lot. Your access is not limited to a summary, although a summary is one of the forms your access can take if that is the one you want.
The OAIC’s health privacy guidance sets out what access can look like in practice. An electronic or hard copy. Sitting with the record and taking your own notes. Results read to you over the phone. A written summary. Playback of an audio or video recording, where one exists. You nominate which of these you want, and the provider is expected to give access in the manner you asked for unless doing so would be unreasonable or impracticable.
That last point is worth using. If you are moving clinics and want a PDF you can forward, ask for a PDF. A posted photocopy that you then have to scan is a worse outcome for you and a more expensive one for the clinic.
How do you make the request?
Put it in writing. A dated email establishes when the clock started, and the clock is what you will rely on if the records do not arrive.
Give the clinic enough to find you and enough to know what to prepare:
- Your full name, date of birth, and the address or phone number they have on file.
- The period you want covered, or a statement that you want the complete record.
- The format you want and where to send it.
- A request that they confirm any charge before they begin work.
Wording along these lines does the job:
“Under Australian Privacy Principle 12 I am requesting access to the health information you hold about me, covering the full period I was a patient. I would like it as a PDF emailed to this address. Please confirm any charge in writing before you prepare the file.”
The clinic has to satisfy itself that you are who you say you are. OAIC guidance is that sighting an identity document is preferable to keeping a copy of one, and that a patient already known to the practice needs little verification. A demand for certified copies of three documents before anyone will look at a request is worth questioning.
What can a clinic charge you?
Nothing for asking. That part is fixed: a private provider cannot impose a charge on the making of an access request.
For producing the records, a charge is allowed, and the test is that it must not be excessive. The OAIC’s guidance identifies what can legitimately go into it: staff time spent searching for and retrieving the record, the cost of reproducing it, postage, and the cost of an intermediary where one is used. Routine clerical work should be costed at clerical rates rather than at a practitioner’s hourly rate, and the guidance says a provider should have regard to the patient’s financial circumstances.
So a modest administrative fee for a decade of paper records is ordinary. A three-figure quote for emailing a PDF is not, and the word to use in reply is “excessive”, because that is the word the principle uses.
How long should it take?
APP 12 requires an organisation to respond within a reasonable period, and the OAIC’s guidelines treat 30 calendar days as the general maximum. Thirty days is the outer limit for a complicated file, and most requests should come back well inside it. A recent electronic record held in practice software is a few minutes of retrieval, and clinics that handle transfers properly turn those around in days.
Count from the date of your written request. If day 30 passes in silence, you are no longer chasing a favour.
When can a clinic say no?
APP 12.3 sets out a closed list of ten grounds on which an organisation may refuse. Two of them come up in health settings with any regularity: where giving access would pose a serious threat to the life, health or safety of any individual, and where it would have an unreasonable impact on the privacy of other people, which is the situation when a third party is named and discussed in the notes. The rest cover frivolous or vexatious requests, existing or anticipated legal proceedings, unlawful disclosure, and similar.
Being unhappy that you are leaving is not on the list.
Where a provider is genuinely concerned about how the information will land, APP 12.6 offers a middle path rather than a refusal: access can be given through a mutually agreed intermediary, usually another practitioner who goes through the record with you and provides context as you read. If that is offered, take it seriously. It is a legitimate route to the same information.
A refusal has to be given in writing. It has to state the reasons, and it has to tell you what complaint mechanisms are available to you. A phone call saying no, without any of that, is not a compliant refusal.
What if nothing happens at all?
Silence is the most common failure, and it is the easiest to fix, because the escalation path is short and costs you nothing.
- Follow up in writing, quoting the date of your original request and asking for a response within seven days.
- Complain to the clinic itself. Its privacy policy should name a privacy officer or a contact point for privacy complaints. Address it to them and use the word “complaint”, so it is logged as one.
- Give them 30 days. The OAIC asks you to raise the matter with the organisation first and allow it 30 days to respond before escalating.
- Lodge with the OAIC at oaic.gov.au if the 30 days pass without a response, or if the response does not resolve it.
If you are transferring to a new clinic, tell the new clinic where the request has got to. Once you have given them your written consent, they can put the request in from their end, which means the follow-up is not sitting with you alone.
Does your state add anything?
The Privacy Act applies to private health service providers everywhere in Australia. Three jurisdictions layer their own health records legislation on top of it: the Health Records Act 2001 (Vic), the Health Records and Information Privacy Act 2002 (NSW), and the Information Privacy Act 2014 (ACT). If you are in one of those, you have a second avenue, through the Victorian Health Complaints Commissioner, the NSW Information and Privacy Commission, or the ACT Health Services Commissioner respectively.
The other states and territories run health privacy concerns through their health complaints bodies: the Health Ombudsman in Queensland, the Health and Community Services Complaints Commissioner in South Australia and the Northern Territory, and the Health and Disability Services Complaints Office in Western Australia. None of this displaces the Commonwealth right. It gives you somewhere else to take it.
The bottom line
Most people who never get their records asked once, verbally, and then waited. A dated written request changes the position entirely. It starts a thirty-day clock, it puts the onus on the clinic to justify any charge, and it obliges the clinic to refuse in writing with reasons if the answer is no. If nothing comes back, the escalation is a complaint to the clinic, thirty days, then the OAIC, and none of it costs you anything.
If you are weighing up a move, gather what you can and book anyway rather than waiting on a complete file. The changing clinics page sets out how a transfer runs step by step, and moving to a new telehealth clinic covers what is worth having in hand before your first appointment.
At LeafLine Clinic, our patient-support team requests records from your previous clinic once you have given written consent, so the chasing is not left with you. If you would rather ask about it before committing to anything, the 10-minute info call is with the patient-support team and involves no clinical assessment and no payment.
This article is general information only and is not legal advice. The Office of the Australian Information Commissioner publishes plain-language guidance on health privacy and on the Australian Privacy Principles at oaic.gov.au.
