Release of health records held by Victorian public sector agencies

Individuals seeking access to their own health records is the most common request for information made under the Freedom of Information Act 1982 (Vic) (FOI Act). However, the FOI Act is not the only way in which individuals can access health records held by Victorian public sector agencies. Mechanisms for informal release exist under both the Health Services Act 1988 (Vic) (Health Services Act), and Health Records Act 2001 (Vic) (Health Records Act).

Victorian public sector agencies (agencies) holding health records include public hospitals, denominational hospitals, region based health services, local councils, and departments.

Often the most efficient method for releasing an individual’s health records will be to do so informally, under the provisions of either the Health Services Act or Health Records Act. Noting this, it is appropriate and sometimes necessary to process requests for health records under the FOI Act.

This practice note details the circumstances in which agencies are permitted to informally release health records under the Health Services Act or Health Records Act, as well as some practical considerations. It also details how to maximise disclosure and efficiencies when releasing health records under the FOI Act.

References in this practice note to a request by an individual for their health records means a request by an individual for their health records, or by their representative or next of kin.

How can requests for health records be handled by agencies?

A request by an individual for access to their health records can be processed by an agency in two ways:

the request can be handled informally outside the FOI Act; or
the request can be handled under the FOI Act.

Agencies are encouraged to handle requests for health records informally by default unless circumstances to the contrary exist, for example:

the individual expresses a preference for the request to be processed under the FOI Act;
sensitivities exist in relation to the content of the health records or surrounding circumstances;
information will be redacted from the health records without the individual’s consent; or
a statutory secrecy provision applies.

How is informal release facilitated by the FOI Act and permitted by the Health Services Act and Health Records Act?

Informal release of an individual’s health records is facilitated by the FOI Act and permitted under both the Health Services Act and Health Records Act as the case requires.

FOI Act

Section 16 of the FOI Act permits agencies to give access to documents (including exempt documents) outside the FOI Act where they ‘can properly do so’.

This means agencies can choose to informally release information (including exempt information) where there isn’t another legislative prohibition or restriction on release.

In any case, section 33(2) provides that the personal affairs exemption under section 33(1) does not apply to an applicant’s personal affairs information. Therefore, it is likely that most of an individual’s health record would comprise their personal affairs information and not be exempt under the FOI Act.

Health Services Act

Agencies subject to the Health Services Act are permitted under section 141(3)(a) to disclose an individual’s health records with the express or implied consent of that person or if the person has died, the consent of their senior next of kin.

A request by an individual for access to their health records constitutes their consent and their health records can be released to them informally in accordance with section 141(3)(a) of the Health Services Act.

However, in relation to an individual seeking access to another person’s health records, the Health Services Act contains a confidentiality provision that restricts the disclosure of information collected in the provision of health services, except in limited circumstances.

Health Records Act

The Health Records Act regulates the collection, use and disclosure of ‘health information’ under the Health Privacy Principles (HPPs).

An individual can request access to their health information held by a private sector organisation under HPP 6. Under section 16 of the Health Records Act, if an agency is subject to the FOI Act and holds a document that contains ‘health information’, then HPP 6 does not apply to that ‘health information’.

Despite this exclusion, the remaining HPPs continue to regulate the use and disclosure of health information in both the public and private sectors.

For example, agencies subject to the Health Records Act are permitted under HPP 2.2(b) to disclose an individual’s health records with the express or implied consent of that person.

A request by an individual for access to their health records constitutes their consent and their health records can be released to them informally in accordance with HPP 2.2(b).

What should be considered when disclosing health records under the Health Services Act or Health Records Act?

Informal release does not require any specific process to be followed. Agencies can establish processes and procedures that suit their operating environment and resources.
For example, subject to any sensitivities concerning a health record, an agency could establish a simple parallel process to FOI, where:
- an individual requests their health records via email or a generic form;
- the agency verifies or confirms the individual’s identity;
- no fees or charges are levied; and
- the individual is provided with a full copy of the requested health records.
Agencies cannot typically impose a fee or charge for a public service unless the fee or charge is set out in legislation or regulations. If an agency determines it can impose fees or charges when informally releasing an individual’s health records, the fee or charge must be reasonable in the circumstances. For example, it can be equivalent to the fees and charges under the FOI Act or Health Records Act.
There is no requirement to undertake mandatory third party consultation (as is required under the FOI Act) when informally releasing an individual’s health records. Noting this, if an agency has any concerns about third party information contained in the health records, they should discuss release of that information with the third party. Informal release is unlikely to be appropriate where a health record contains confidential or sensitive information provided by a third party, including about the individual the subject of the health records.
In most cases, the disclosure of names and details of doctors or health professionals providing medical treatment and care to an individual will comply with Information Privacy Principle 2 of the Privacy and Data Protection Act 2014 (Vic), in that those individuals should reasonably expect their names and details to be disclosed to their patients.
If an individual’s health record contains sensitive or confidential information, this information can be redacted. If information requires redaction, this should be done with the knowledge and agreement of the individual requesting the information. Where the individual disagrees, the request for health records should be handled under the FOI Act.
Agencies can negotiate with the individual to impose restrictions or limit the use of health records disclosed informally. However, any proposed restrictions or limits on use should be carefully considered to ensure it is appropriate, effective, and done so with the individual’s informed consent.
If electronic health records management systems permit, agencies should consider utilising ‘flags’ or similar mechanisms to note when a health record might contain sensitive or confidential information not suitable for informal release to the relevant individual.
Access to health records via self-administered patient portals should be considered in the design and implementation of electronic health records management systems.

How can agencies maximise disclosure and process requests efficiently under the FOI Act?

While agencies are entitled to collect the prescribed application fee and access charges, agencies can waive the application fee and associated access charges, particularly given the cost involved in calculating and collecting the fees and charges can outweigh the actual fee or charges received.
The obligation to consult with third parties when considering certain exemptions (for example section 33(1) and 35(1) of the FOI Act) only applies where consultation is practicable. When appropriate, an agency can determine consultation is not practicable in the circumstances and proceed to make a decision. For example, where a health record contains the names of medical staff, an agency may determine consultation is not practicable due to the number of staff to be consulted, or because it is likely each staff member would consent to disclosure of the relevant information.
Agencies should liaise with an applicant and ask if they require personal affairs information of any third party and where it is not required, redact it in accordance with section 25 of the FOI Act.
Agencies have discretion to release exempt information. If third parties were consulted and objected to the release of information, they will need to be notified of the decision and provided an opportunity to appeal the decision (for example, under section 33(3) and 35(1C) of the FOI Act).