Site Changes

On 1 November 2010 the Office of the Privacy Commissioner was integrated into the Office of the Australian Information Commissioner and a new website established at www.oaic.gov.au.

Note 1: Major changes to the Privacy Act 1988 will come into effect in March 2014. Agencies, businesses and not for profits need to start preparing for these changes. For more information go to our privacy law reform page at www.oaic.gov.au
Note 2: From 12 March 2013 content is no longer being added to, or amended, on this site, consequently some information may be out of date. For new privacy content visit the www.oaic.gov.au website.

How much time does an organisation have to meet a request for access to an individual`s medical record?

See National Privacy Principle 6 (NPP 6) this deals with access to medical records held by a private sector organisation. NPP 6 doesnï¿½t set out any time limits for meeting a request for access to records held by an organisation.

An organisation should respond to a request for access to medical records within an appropriate time. What is appropriate will depend on a number of factors which can include the amount of information requested, the complexity of the organisationï¿½s functions and activities and the way the access is to be provided. The Federal Privacy Commissioner recommends that a request for access should be processed in no more than thirty days.

For more information on processing a request for access to medical records, see the Guidelines on Privacy in the Private Health Sector 6.4. For more about requests for access to personal information generally, see Information Sheet 4.