Responding to a records request

Australian Privacy Principle 6 permits a disclosure required or authorised by a court order, so a subpoena needs no consent from the patient and a patient's objection does not excuse production. The schedule sets what you produce.

An access request from the patient runs on Australian Privacy Principle 12, and in Victoria, New South Wales and the Australian Capital Territory on the state or territory health records statute as well.

A third-party authority runs on the patient's consent, so the wording the patient signed sets the scope: an authority drawn around a knee injury does not release the mental health notes. A statutory scheme such as workers compensation carries timeframes of its own.

Confirm the requester's entitlement before anything is searched. A parent's request for the records of a child old enough to consent to their own treatment is not automatically one you can grant, and a guardian or attorney acts within the instrument appointing them.

Under Australian Privacy Principle 12 a private practice must respond within a reasonable period, and the OAIC's guidance on access treats 30 calendar days as the outer edge of that period. Health records legislation in some states and territories sets a different period. Where the timeframe cannot be met, tell the patient why and when you expect to finish.

A subpoena carries a date for production, an address for production and a last date for service on its front page.

Diarise the production date the day the subpoena arrives.

A schedule bounded by two dates reaches only those dates. One asking for all documents relating to the person, including correspondence, imaging, referrals, accounts and recordings, reaches past the progress notes. Producing less than the schedule describes is contempt of court, and producing more discloses health information that no court ordered and no patient consented to.

A schedule of that width reaches the audio, the transcript, superseded drafts, the signed entry and the audit log. The uniform evidence legislation defines a document widely enough to cover anything from which sounds or images can be reproduced, and an unsigned draft is health information that can be required in production.

A subpoena reaches documents in your possession, which in most Australian courts extends to documents you have a present right to obtain from somebody else. Where a scribe, a transcription service or a backup provider holds material answering the schedule, establish whether you can call for it before you certify what you produced.

The two grounds relied on most when refusing a patient access are a serious threat to the life, health or safety of any individual, and an unreasonable impact on the privacy of other individuals. A third covers information relating to legal proceedings between the practice and the patient that would not be accessible through discovery.

Australian Privacy Principle 12 asks you to consider giving access in a way that meets both interests, usually by redacting the third-party content and releasing the rest, or through an agreed intermediary such as another treating practitioner. A refusal goes to the patient in writing, with the reasons and the ways to complain.

Under a subpoena you do not redact on your own judgement. Statutory privileges for counselling and other confidential communications are raised with the court, and child protection legislation protects the identity of a person who makes a notification, which belongs in the covering letter.

Under a third-party authority the patient cannot consent for anyone else, so third-party content is redacted before the record leaves the practice.

The covering letter states the retention period, what it applies to, and the date any expired material expired. Silence about a category the schedule covers tends to produce a second subpoena.

Routine deletion stops for anything connected to a claim, a complaint or a likely proceeding from the moment the practice knows of it, and somebody at the practice has to know how to suspend a deletion timer inside a product.

Do not alter a retention setting once a request is in sight. The change appears in the system's own logs.

Your MDO will advise whether the scope is objectionable and whether your own interests are engaged, and will often run the objection for you. An objection has to be on foot before the date for production.

Write the triggers into the practice procedure.

• A subpoena in proceedings where you or the practice could become a party.
• A request after an adverse outcome, a complaint, or a consult where the patient mentioned lawyers.
• A solicitor's request for the complete file, naming drafts, recordings, metadata or audit logs.
• A coronial request, an Ahpra notification, or a request from a health complaints body.
• Any request where you are considering refusing, redacting, or producing privileged material.

Produce a paginated bundle with an index, numbered continuously, to the address for production stated on the subpoena, and keep an identical copy with the request and the covering letter. Courts generally accept copies unless the subpoena requires the original.

Where material was withheld or redacted, the covering letter says so and states the basis. Make a file note of the date, who asked, under what authority, what was searched, what was produced and who authorised the release. A disclosure to police or another enforcement body under the enforcement exception in the privacy principles requires a written note.