‘Privacy’ and ‘confidentiality’ are terms that are often associated with medical treatment records. It is important to understand that they do not mean the same thing. Privacy is covered by Commonwealth and state legislation that addresses how specific personal information can be used. Confidentiality is a broader obligation that limits the access to information provided by a patient to their healthcare provider during treatment.
The obligation of confidentiality comes from various sources including legislation, ethical codes and the common law. In Queensland, the duty of confidentiality in relation to public health services is also specifically provided for in the Hospitals and Health Boards Act 2011 (Qld).
A medical practitioner’s obligation to maintain confidentiality is not absolute, and there are certain situations where disclosure of confidential information can occur without the practitioner breaching their obligation of confidence. These situations may include, but are not limited to:
The Information Privacy Act 2009 (Qld) regulates how personal information is handled by public hospitals and health services in Queensland. Similar protection is provided to personal information about an individual collected by private sector health providers such as private hospitals, general practitioners and medical centres under the Privacy Act 1988 (Cth).
Both Acts set out requirements in relation to the collection, storage, use and disclosure of personal and sensitive information by health agencies. Those requirements are known as the National Privacy Principles (NNPs) and the Australian Privacy Principles (APPs) respectively. Under the NPPs, a health agency must:
The APPs that apply to organisations such as general practitioners’ practices and private hospitals impose similar obligations regarding collection, security, use and disclosure. For example, a person’s GP can only use or disclose the information they hold about the person for the purpose for which it was collected (i.e. the healthcare or treatment of the individual). It can only be used or disclosed for other purposes in limited situations, including if the individual consents (APP 6.1, 6.2).
The process for accessing medical records will depend on whether the relevant records are held by a public or private practitioner or facility, how much information is being sought, and whether the information is a complete record or specific information.
There are three ways a patient can request their records in the public system:
In Queensland, each hospital and health service (HHS) handles the medical records that are held in the hospitals and clinics in its area. The Queensland Office of the Information Commissioner advises that ‘… each HHS is an independent agency, so will have different procedures in place to access to medical records’. If you are seeking access to your records, it would be worthwhile taking some preliminary steps such as:
Some information is exempt from being released. For example, if the personal information of another person is contained in the medical records, it may be exempt. Finally, if it has been 10 years since your treatment, or if you were a minor at the time of your treatment then 10 years from your 18th birthday, the records may have been destroyed under the Health Sector (Clinical Records) Retention and Disposal Schedule.
For further information on right to information and correction of information see the Queensland Law Handbook chapter ‘Right to Information and Freedom of Information’.
Unlike public medical records, private health records are governed by national legislation rather than state legislation. In particular, the system is covered by the Commonwealth Privacy Act 1988 (Cth) and the AAPs.
In accordance with these principles:
For more information on the NPPs and the APPs see the Queensland Law Handbook chapter ‘Right to Information and Freedom of Information’.
Most Australians will now have access to an online summary of their records through My Health Record. This digital summary contains information such as allergies, current medications, medical history, pathology test results and immunisation records.
Any person with a profile can choose to:
Whilst this information will not provide a patient with a copy of their complete records, it offers an online option for obtaining certain limited information, which may be useful.