Mrs Patel was outraged. She’d visited her GP for a follow-up check after her hand surgery, and he’d asked her about her history of depression. She didn’t think she’d had anything of the sort, and decided to ask the receptionist for a copy of all her medical notes to see what else was in there. The young receptionist assured her that the doctor owned the notes so she couldn’t have them. 

“But they are about me and I have never seen them!” Mrs Patel protested. 

The receptionist paused for a moment. “Well,” she said, “put your request in writing and your doctor might let you see some of the notes. Our administrative charge for dealing with your request is $50. Now, shall we make an appointment to see your doctor about this?” Mrs Patel looked at her writing hand, which was still feeling tender, and decided to call the Privacy Commissioner.

The above (fabricated) scenario is an example of the sort of enquiries I receive. Just in March this year we had 145 enquiries from individuals and agencies for guidance about access requests. Medical centres in particular are often keen to understand their obligations around access requests.

Access to personal information

Individuals have a fundamental right to ask for access to any health information held about them. This right also extends to a “representative”: a parent or guardian of a child under the age of 16 years, an executor or administrator of a deceased individual’s estate or the person who has an activated enduring power of attorney for the individual concerned or someone acting in the individual’s best interests. 

We encourage individuals to put their request in writing - this way there is a record of the request and the health agency knows exactly what information is required - but there is no prescribed way to make an access request. Many health agencies have their own forms to make sure all the necessary details are collected. However, since Mrs Patel has an injured hand, she could make a verbal access request and the health agency should give her any assistance she needs to do that. Mrs Patel definitely doesn’t need to pay for an appointment with the doctor to make her request.

From the day after the health agency receives an access request, it has 20 working days to decide if it will release the information. Once it’s decided to release the information, it should do so without undue delay, and if it wants to withhold anything, it should specify the withholding grounds set out in the Privacy Act it is relying upon to do so.

What about information ownership?

Who owns the information is irrelevant. A health agency can’t refuse an access request because it owns the information. Nor can it refuse an access request because the requester owes a debt.

Information should be made available to individuals in the way they prefer. If Mrs Patel has asked for a copy of her health information that’s what she should get unless it would impair the efficient administration of the health agency. 

Charging

Because this is the first time that Mrs Patel has asked for her notes it’s not permissible to charge. But if copying her medical file requires copying an x-ray, video recording, MRI, PET or CAT scan photograph, the medical centre can levy a reasonable charge. 

Verifying identity

But a word of caution: before handing over the information to the requester, the health agency must be satisfied concerning the identity of the requester. Don’t hand sensitive health information over to the wrong person.

Sometimes requesters confuse making an access request for their information with wanting their physical file instead. What matters is the information itself - ownership of the health information is irrelevant. That said, a health provider can release the physical copy of the information to the individual the information relates to even though they don’t have to. Sometimes a doctor will hand over her notes to the patient, say, when the patient is moving permanently overseas or to a different region in New Zealand. This means the patient has possession of their health information and can immediately give their medical file to their new health provider. 

It can be difficult remembering all the procedural aspects, both for the busy health agency and the mystified requester. The Privacy Commissioner recognises this and is determined to make privacy easy. 

New tool: AboutMe

To this end, we have developed an online tool to help called “AboutMe”. This online tool helps you make an access request. The request is then emailed to the agency you choose. We never see what is being requested, we just provide the mechanism. The request includes a standard note from us about what the agency needs to do to respond to the request and by when. 

Returning to Mrs Patel - she made a verbal request to the medical centre which was noted down by the privacy officer (every agency should have one). Mrs Patel received the information promptly and immediately saw the inaccuracy. Her doctor agreed with her and made an appropriate correction in her medical file. Furthermore, Mrs Patel is thrilled that she has full use of her hand again, her trust in her doctor is restored, and she is back playing tennis and tending her roses!

First published in NZ Doctor on 25 May 2016

Image credit: Artist Paul Holmes via Vincents Art Workshop.

IPP6 - access, health, Health Information Privacy Code