Someone mishandled your health information. Do you complain to the doctor, the hospital, your state regulator, or the OAIC?
What My Health Record Actually Is, Legally
My Health Record is Australia's national digital health record system, governed by the My Health Records Act. Under the Privacy Act 1988, an unauthorised collection, use, or disclosure of information in your My Health Record is treated as an "interference with privacy" — this specifically triggers the Office of the Australian Information Commissioner's (OAIC) investigative and enforcement powers, both under the My Health Records Act itself and the Privacy Act more broadly.
The Question That Determines Where You Complain: Who Actually Runs the Service?
The OAIC is direct about this distinction: if the organisation that mishandled your information is not run by a state or territory government, you lodge your complaint with the OAIC directly, in writing (complaints can't be taken by phone). If it is a state or territory government-run service, your complaint may need to go to that state's own privacy or health records regulator instead — the OAIC may transfer your complaint if this applies, rather than investigate it directly itself.
What the OAIC Actually Does With a Complaint
Once the OAIC determines it's the right body, it assesses whether to investigate. The OAIC generally attempts to resolve complaints through conciliation between you and the organisation first. If a healthcare provider has already told the OAIC they're taking their own corrective action, the OAIC may hold off on investigating immediately to let that process play out.
Correcting Inaccurate Information in Your My Health Record
Separately from a privacy breach complaint, if you find inaccurate information in your My Health Record itself, you have a right to request correction — this is a different process from a privacy/mishandling complaint, and generally starts with the specific healthcare provider or organisation that entered the incorrect information, rather than the OAIC directly.
What This Means Practically
- First identify whether the organisation involved is run by a state/territory government or not — this single fact determines whether you start with the OAIC or a state regulator.
- Put your complaint to the OAIC in writing using their official complaint form — they cannot accept it by phone.
- If you're correcting an inaccuracy rather than reporting a privacy breach, start with the specific provider who entered the information, not the OAIC.
- If you're genuinely unsure which body applies, the OAIC's own process includes assessing and transferring your complaint if they're not the right destination — submitting to them is a reasonable starting point when in doubt.
Related Kibbo Tools
Sources
- Office of the Australian Information Commissioner — Make a My Health Record complaint. oaic.gov.au
- Office of the Australian Information Commissioner — Handling information in a My Health Record. oaic.gov.au