Avant’s legal team explains the key lessons from a case before the Australian Information Commissioner…

Requests for medical records are part of everyday practice. Most of the time, the answer is straightforward – patients are entitled to access their personal health information. But what happens when providing access could cause harm?

This case decided by the Australian Information Commissioner and Privacy Commissioner explores how a doctor and a medical centre were justified in refusing a patient access to a hospital discharge summary.

The context

A patient was admitted overnight to a hospital mental health facility. Following discharge, the hospital prepared a discharge summary containing details of the admission, diagnosis, treatment, and observations about the patient’s mental health and risk factors.

The patient later requested a copy of that discharge summary to support an application to a professional body. Unable to afford the hospital’s access fee, the patient arranged for the summary to be sent directly to their general practice.

The hospital faxed the discharge summary to the practice, marked “private and confidential” and addressed to the patient’s treating doctor.

The GP who received the document had only seen the patient on one prior occasion. The consultation occurred at the request of another doctor, for the limited purpose of discussing a pathology result, rather than as part of an ongoing treating relationship.

The summary included references to threats of self-harm and harm to others, as well as possible diagnoses of post-traumatic stress disorder and borderline personality disorder, the patient’s self-reported anger issues and a comment about the risk of “misadventure during future altercations”.

The patient contacted the practice requesting a copy of the document.

Response from the practice

The medical centre did not immediately release the discharge summary.

The request was escalated to the GP who had last consulted with the patient. Given the limited nature of the prior consultation and the content of the discharge summary, the GP reviewed the document and raised concerns about the potential impact of releasing its contents to the patient.

The GP also contacted:

• their medical defence organisation
• the hospital that authored the discharge summary
• another treating doctor involved in the patient’s care

The hospital advised that the full document should not be provided directly to the patient and that, if access was sought, it should occur through a formal FOI process. The GP agreed that releasing the full summary could pose a serious risk to the patient’s health or safety.

The practice offered to provide the front page only of the discharge summary, but the patient declined. The patient then lodged a privacy complaint with the Office of the Australian Information Commissioner (OAIC).

The legal question

The complaint alleged breaches of Australian Privacy Principle (APP) 12, which governs access to personal information.

In simple terms, the Commissioner had to decide:

• Were the medical centre and GP required to give the patient access to the document?
• If not, were they entitled to rely on an exception?
• Did they take reasonable steps to handle the request appropriately?

The “serious threat” exception

APP 12 allows an organisation or health practitioner to refuse access if they reasonably believe that giving access would pose a serious threat to the life, health or safety of any individual.

Importantly:

• The belief must be reasonable, not just genuine or subjective
• It must be based on known facts and professional judgement
• The decision is assessed based on what was known at the time, not in hindsight.

In this case, the Commissioner accepted that:

• The discharge summary contained confronting psychiatric information
• The GP had a duty of care to consider the patient’s safety
• The GP was entitled to rely on the hospital’s advice and their own clinical judgement
• The medical centre was entitled to rely on the GP’s advice, as non-clinical staff were not equipped to assess clinical risk.

On that basis, it was lawful to refuse access to the full discharge summary.

Was refusing access enough?

No. APP 12 also requires consideration of whether access can be provided in another way that balances the needs of both the patient and the practitioner or practice.

In this case, the Commissioner found that:

• The practice and GP considered alternatives
• Partial access (the front page) was offered
• FOI access through the hospital was identified as an option
• The steps taken were reasonable in the circumstances.

Although the Commissioner noted these considerations could have been documented more clearly, the overall approach met the legal threshold.

What this means for your practice

This case confirms that while patients are entitled to access to medical records, this is not absolute.

If you are concerned that providing access could cause serious harm, you should:

• Weigh up any concerns and seek appropriate advice
• Document your reasoning
• Consider safer alternatives to full access
• Inform the patient of the decision and reasons in writing.

The legal perspective

The clause which often appears in doctors’ letters stating something similar to “this report is not to be released without my consent” does not, by itself, prevent a patient’s right to access their records.

The test to exclude patient access to their medical records under APP 12. is whether there is a serious threat to life, health or safety.

This high threshold is not met if a patient will merely become upset or cross regarding the content of their medical record.

If you are relying on APP 12 to restrict patient access to their records, you should only withhold the minimum amount of information to address the serious threat. The patient must also be provided with written notice of the decision and reasons.

The GP perspective

This case is a good reminder to think carefully about requests for release of clinical documentation. While a patient generally has a right to access their medical records, doctors must be mindful of the potential for causing serious patient harm by doing so. The doctor acted appropriately here and engaged in a shared decision-making process where there was uncertainty. In consultation with treating hospital staff, other practitioners and their MDO, the decision to withhold the records was well considered. It is worth noting where there is no concern for harm, the patient is entitled to access all their records, including non-GP specialist letters that are marked not to be released to a third party.

Key takeaways

• Patients generally have a right to access their medical records, but there are limited exceptions.
• You may refuse access if you reasonably believe disclosure would pose a serious threat to life, health or safety of the patient or another person.
• Clinical judgement, supported by appropriate advice, is central to assessing risk.
• Even where access is refused, you must consider whether partial or alternative access is reasonable.

Further reading

Avant collection: Privacy in Practice: what you need to know