Your GP holds your medical records. But that doesn't mean they can simply refuse to give you access.
Where the Right Actually Comes From
The Office of the Australian Information Commissioner (OAIC) confirms that individuals generally have a right to access their own health information held by providers covered under the Privacy Act 1988 and the Australian Privacy Principles. Which specific law applies can depend on your state or territory and the type of provider — most private health providers fall under the federal Privacy Act, while public hospitals and services in some states are covered by state-based health records legislation instead (for example, Victoria's Health Records Act 2001, or NSW's Health Records and Information Privacy Act 2002).
What a Provider Can and Can't Use as an Excuse
A provider cannot simply refuse a request because it's inconvenient, because you have an outstanding bill, or because "that's not how we do things." Legitimate exceptions are narrow and specific — for example, information that would pose a serious threat to someone's health or safety, or information that would unreasonably impact another person's privacy. These exceptions apply to specific pieces of information, not as a blanket reason to deny the whole record.
Format, Timeframes, and Cost
Providers can charge a reasonable fee to cover the cost of retrieving and providing records, but this must be genuinely cost-based — not an arbitrary or inflated figure, and not a fee that effectively blocks access. There's no single nationally standardized timeframe written into a single number in the way some other countries specify — but providers are expected to respond within a reasonable period, and unreasonable delay is itself a valid basis for complaint.
What to Do If a Provider Refuses or Delays
- Put your request in writing if you haven't already, and ask specifically why any part is being withheld.
- Raise a formal complaint directly with the practice or provider first.
- If unresolved, escalate to the OAIC for federally-regulated providers, or to your state/territory's health records or privacy regulator if a state-based scheme applies instead — check which applies to your specific provider type before assuming.
What This Means Practically
- Put your records request in writing and keep a copy with the date.
- If access is refused or a fee seems excessive, ask for the specific reason in writing — a vague "no" isn't sufficient.
- Confirm whether your provider falls under the federal Privacy Act or a state-based health records scheme before deciding where to escalate.
- Don't let an outstanding bill be used as a reason to withhold your own health information — that's not a recognized exception.
Related Kibbo Tools
Sources
- Office of the Australian Information Commissioner — State and territory privacy legislation. oaic.gov.au