A request for medical records can arrive during a consult, through reception or in a solicitor’s letter. For practice managers and clinicians, responding involves protecting confidentiality while supporting a patient’s right to access their information. Different requesters can bring different authority, disclosure limits and response deadlines.

We recommend a risk-assessed practice procedure that connects the request to the decision and the information actually released. This is workflow guidance, not legal advice. Complex or disputed requests need your privacy lead and, where appropriate, your medical defence organisation or lawyer.

1. Classify the request and assign an owner

Start with who is asking and in what capacity. Under the Australian Privacy Principles (APPs), patient access under APP 12 and a separate use or disclosure under APP 6 are different legal routes.

The Office of the Australian Information Commissioner (OAIC) distinguishes authorised patient access from separate disclosure. The recipient’s job title does not determine the route.

A patient-directed move to a new doctor belongs in your transfer-of-care process. Releasing a copy also does not determine how long you must retain the source record.

Acknowledge receipt and identify the response owner. At intake, log the date received, patient identifier, requester and capacity, requested records and dates, intended recipient, urgency, jurisdiction and public or private record-holder status. Record the proposed legal route. Reception can manage intake and correspondence; the designated approver handles authority, clinical review and disclosure decisions.

Confirm which person or organisation holds the records, especially where clinicians work under different contractual arrangements. The Royal Australian College of General Practitioners (RACGP) includes record-holder identification and legal escalation in its request-response guidance.

2. Confirm identity and authority

For an APP 12 request, collect only the identity information reasonably needed. A known patient asking during a consult needs a different process from an unfamiliar caller seeking an electronic copy. Where suitable, sight identification and record that it was sighted rather than retaining a copy. APP 12 does not require a designated form, a written request or an explanation of why the patient wants access. These are minimum access requirements.

Local statutory routes add different formalities:

• New South Wales (NSW) private sector: section 26 of the health-record access law requires a written request giving the individual's name and address, identifying the information and specifying the requested form of access. Authority for a named substitute recipient must also be written.
• Victoria, Part 5 access: section 33 requires the individual's name, address unless already known, identifiable information and requested access method. An authorised representative's request must be written. For an oral request, the organisation may promptly ask for writing and need not act further on that oral request. Section 30 requires signed written authority naming a substitute recipient. These are Victorian request requirements.
• Australian Capital Territory (ACT): section 12 requires the consumer's name, address unless already known, identifiable records and requested access method. A request by a guardian of a legally incompetent person or by a deceased consumer's legal representative must be written. A person with parental responsibility for a child or young person must also request in writing, unless that person consented, within the preceding 12 months, to the treatment that produced the requested record. The record keeper may ask for an oral request in writing and need not act further on the oral request. The ACT access provisions set out these conditions.

Record which route each formality belongs to. A local writing requirement does not create a mandatory form for every APP 12 request.

For a representative, establish identity separately from authority. A family relationship, emergency-contact entry or accompanying the patient to appointments does not by itself establish authority to obtain the chart. Record the patient’s authorisation or the legal instrument supporting the representative’s role, and the limits of that authority.

A child's request needs assessment of capacity and the representative's role, including parental responsibility, care arrangements and relevant court orders. Avoid a blanket age rule or an assumption that either parent automatically receives everything. The OAIC's child-access guidance addresses these checks; local legislation can add specific requirements.

A separate APP 6 lane can allow limited disclosure to a responsible person when the patient cannot give or communicate consent. The provider must be providing a health service. Disclosure must be necessary for healthcare or made for compassionate reasons, limited to what is reasonable and necessary, and not contrary to wishes the provider knows or could reasonably be expected to know. The OAIC's limited disclosure guidance explains this exception. It does not establish a general right to the full record.

If authority is unclear, contact the patient through an established practice contact channel where appropriate. Escalate safeguarding concerns or disputed representative authority before disclosure; keep the request active and track its response date.

3. Match consent and disclosure scope

A signed authority is evidence to assess, rather than permission to export whatever the software makes available. Match the request against:

• the named patient and recipient
• the information, condition or date range authorised
• the purpose and any limits on use or disclosure
• when consent was given and whether it remains current
• any withdrawal or restriction communicated by the patient.

Resolve ambiguous wording before releasing records. In NSW, valid consent principles require consent to be voluntary, informed, specific, current and given by someone with capacity; past consent and silence do not establish consent to a new disclosure.

For a separate third-party request, document the applicable disclosure basis. APP 6 permits certain disclosures without consent, including those required or authorised by law, but permission and compulsion differ. A serious-threat exception requires that obtaining consent be unreasonable or impracticable and a reasonable belief that disclosure is necessary to lessen or prevent a serious threat to life, health or safety, or to public health or safety. The OAIC’s use and disclosure guidance sets out these conditions.

Common third-party requests

RACGP recommends targeted third-party reports in most circumstances, with release limited to relevant, consented information. An example is an authority covering records about a workplace knee injury: it does not automatically extend to unrelated reproductive-health notes.

4. Locate and review the relevant records

Search the records you possess or control, including relevant paper files, clinical systems, scanned correspondence and other stores containing the requested information. Patient access generally includes information you hold from other clinicians, such as specialist reports. The OAIC's held-information access guidance confirms that authorship elsewhere is not, by itself, a reason to exclude it.

An export is a working release copy. Review it against the approved scope before sending. Printed exports can omit system elements such as alerts or audit trails, a limitation identified in RACGP’s record-extraction guidance. Record any limitation that matters to the request. If information is missing, record the search outcome rather than presenting the package as complete.

For older archives, clear indexing and patient matching support retrieval. Our medical record scanning guide covers capture, index and patient-match checks. It is a practical digitisation guide, not a physical scanning service or an external record-release feature. Digitising a record does not authorise its release.

Partial access and redaction

For APP 12 access, give information in the requested manner where reasonable and practicable. A summary is not an automatic replacement for a valid request to receive a full copy.

Assess a patient-access refusal ground on its facts. Sensitive content is not automatically exempt. Embarrassment or apprehension about a patient reading clinical notes is not a legitimate refusal reason under the OAIC’s health access guidance.

Where disclosure would unreasonably affect another person’s privacy, consider removing that information and providing the balance. Remove identifying context as well as names where necessary. A summary, another format or a mutually agreed intermediary may allow access when the original request cannot be met. APP 12 sets out the alternative access duties.

We recommend recording each withholding decision, its basis and approver, and preserving the source record unchanged. Apply redaction to the release copy and confirm that hidden text, comments or attachments do not reveal the removed material.

Do not apply APP 12 refusal grounds mechanically to a separate third-party disclosure or court production. Those routes require their own authority and scope assessment. Local health-record laws can also impose additional restrictions or review rights.

5. Apply the right timing and fee rules

Set the response date when the request arrives. The rules depend on the legal route and record holder; there is no national deadline or flat fee covering every request.

Private health service providers in NSW, Victoria and the ACT must comply with both federal and local privacy laws. The OAIC explains this overlapping legal coverage. A longer state access limit does not remove an applicable APP 12 obligation.

For NSW private-sector requests, the Information and Privacy Commission NSW states in its access fee guidance that the seven-day wait after payment must not exceed 45 calendar days from receipt. This qualification is in the regulator's guidance; section 27(4) itself specifies the written fee notice and payment branch. Escalate a late-payment timing conflict rather than assuming that an invoice resets the deadline.

The Victorian section 34 and ACT section 13 response duties exclude an oral request that the record holder has asked to be made in writing under the relevant provision. Log that request for writing and any continuing APP 12 obligation. Keep the statutory response or fee-notice date separate from the date access is actually given.

For APP 12 access, explain any proposed charge before providing access. Consider actual access costs, hardship and lower-cost alternatives. Do not pass on legal-advice costs or use a fee to discourage access; flat fees are generally inappropriate. The OAIC’s access-request fee guidance distinguishes these costs.

Under the Victorian fee caps for 2026–27, the maximum assessment-and-collation charge for providing a person a copy is $43.20; A4 black-and-white copying is 20 cents per page, while electronic copies use reasonable costs. These are specific fee categories, not a universal $43.20 release charge. Section 32 also prohibits a mental health and wellbeing service provider from charging for access to information it holds from providing that service to the person.

Patient-directed provider transfers have additional local rules, including Victorian transfer requirements and ACT transfer requirements. Keep them in the transfer route rather than applying their fees or deadlines to insurers and employers. Other public-sector requests may use local privacy or freedom-of-information processes. Western Australia's public-sector privacy laws commenced on 1 July 2026 and may cover some government contractors according to their contracts; they are not a general private-practice access regime.

For a third-party report or compelled production, record the applicable contractual or legal deadline and fee basis separately. A request’s stated urgency does not widen its authority.

6. Record refusals and escalate legal demands

Under APP 12, if you refuse patient access or the requested manner of access, take reasonable steps to provide access by another means. Where no alternative is agreed, give the required written notice with reasons, except to the extent giving them would be unreasonable, and complaint mechanisms. Include the practice’s complaint process and the appropriate external avenue. These requirements are explained in the OAIC’s written refusal guidance.

Distinguish a request awaiting identity evidence or authority clarification from a final refusal. Record what is missing, the next action, owner and response date. Route serious-threat assessments, contested access and uncertainty about withholding to the privacy lead and relevant clinician.

For a subpoena or other legal demand, promptly escalate the authenticated instrument to the record holder and legal adviser. Identify its addressee, records sought, due date and production destination. The Federal Circuit and Family Court of Australia’s family-law production rules, for example, distinguish production from later inspection; sending a chart directly to the requesting solicitor may not meet the instrument’s requirements.

Under the OAIC’s compelled disclosure guidance, court production may be challengeable or exclude some documents. Patient consent is not a substitute for assessing the demand, and its withdrawal does not determine whether a valid legal requirement must be met. Obtain advice through your medical defence organisation or lawyer before deciding a disputed response.

7. Release securely and close the delivery record

APP 11 requires reasonable technical and organisational measures to protect personal information, including against unauthorised disclosure. Its security requirements are contextual; they do not prescribe one channel for every release.

Use a practice-approved channel suited to the recipient, sensitivity and access route. Secure clinical messaging can support provider-to-provider exchange, including delivery tracking, as described by the Australian Digital Health Agency’s secure messaging guidance. Ordinary email, fax or post should not be assumed safe merely because they are familiar.

Before dispatch, confirm the destination independently, the recipient’s authority and that the final package contains only the approved material. Apply the practice’s risk-assessed controls, such as an authenticated download or protected attachment with the access secret communicated separately. Inspect the actual outgoing files, including attachments and redaction results.

Keep a protected release record containing:

• the request, legal route and identity/authority evidence
• the approved scope and any clarifications
• the documents and date range released, with the final version identifiable
• exclusions, redactions or refusal reasons and approval
• fee advice, correspondence and decision dates
• recipient, verified destination, sending staff member, time and channel
• delivery status, failed attempts and follow-up.

These fields are recommended operational controls, rather than one statutory log format. Treat the log itself as protected health information. Follow a failed delivery through to resolution instead of marking the request complete when someone clicks send.

Keep clinical review separate from release approval

A clear, clinician-reviewed report can support a proportionate response where a report is the agreed output. Our Documents & Letters workflow uses a clinical note to generate reports and letters. Treat the output as a draft for clinician review, editing and sign-off before it enters the approved release package.

That drafting step does not determine authority, perform a full-chart access review or authorise disclosure. Keep the release decision, final package review and delivery record within your practice’s governed response process.

Contact us