A doctor ordered blood tests for a patient. The sample was sent to the laboratory of a crown health enterprise (CHE) for testing. The results were returned to the patient's doctor. The patient contacted his doctor's practice but could not obtain the results immediately because the doctor was away.

The patient contacted the CHE which suggested he could ensure access to future results by asking his doctor to note on the request form that a copy of the results be sent to the patient as well as to the ordering doctor. He did not want to do that. The CHE also invited the patient to make a request through its patient information service which would be actioned within 20 days.

The patient complained to my office that rule 6 of the Health Information Privacy Code was not being complied with. He alleged that as the CHE held the information and he had given appropriate evidence of identity, he should have had immediate access to the test results. He did not accept the CHE's offer to deal with the matter within 20 days. The CHE had pointed out that it processed tens of thousands of results every month and claimed it had adequate procedures for access.

Rule 6 of the Code provides that where a health agency holds health information in such a way that it can readily be retrieved, the individual concerned is entitled to have access to that information. This rule is subject to Part V of the Privacy Act (sections 33-45) which sets out procedural provisions relating to access to information. Section 40 provides that an agency which has received a request for personal information must as soon as reasonably practicable (and not later than 20 working days following receipt of the request) decide whether the request is to be granted.

I accepted that the CHE had a procedure which allowed patients to access personal information. Provided requests were dealt with as soon as reasonably practicable and within 20 working days as required by s 40, the procedure would comply with rule 6 and would not constitute an interference with the patient's privacy. I also noted that the CHE had in place a procedure whereby requests could be dealt with on an urgent basis, if required. The patient could have his doctor request that a copy of the results be simultaneously sent to the patient.

I concluded that these procedures complied with the access provisions in the Privacy Act and the Health Information Privacy Code even though they did not allow the patient to have immediate access on demand.

July 1997

Indexing terms: Access to health information - Crown Health Enterprise - Patient requested test results - Policy for dealing with requests - Privacy Act 1993, s 40 - Health Information Privacy Code, rule 6