How much time does an organisation have to meet a request for access to....

View printable version of this page

Question: How much time does an organisation have to meet a request for access to an individual’s medical record?

Answer: See National Privacy Principle 6 (NPP 6) this deals with access to medical records held by a private sector organisation. NPP 6 doesn’t set out any time limits for meeting a request for access to records held by an organisation.

An organisation should respond to a request for access to medical records within an appropriate time. What is appropriate will depend on a number of factors which can include the amount of information requested, the complexity of the organisation’s functions and activities and the way the access is to be provided. The Federal Privacy Commissioner recommends that a request for access should be processed in no more than thirty days.

For more information on processing a request for access to medical records, see the Guidelines on Privacy in the Private Health Sector 6.4. For more about requests for access to personal information generally, see Information Sheet 4.