Case Citation: A v Private Sector Health Service Provider [2004] PrivCmrA 14

Subject Heading: Excessive charge imposed for access to personal information (medical records)

Law: National Privacy Principle 6 in Schedule 3 of the Privacy Act 1988 (Cth)

The complainant sought access to their personal information, medical records, held by a private sector health service provider, a doctor. After making the request, the complainant was advised that their complete medical file would be available on payment of a fee. The invoice detailing the fee itemised the cost of access to include the provision of a legal report and photocopying the entire medical record.

The complainant wrote to the doctor indicating that they considered the fee an excessive access charge. The complainant had not requested the preparation of a medical report, but only a copy of their medical records.

National Privacy Principle (NPP) 6 gives individuals a general right of access to information about them held by organisations. NPP 6.4 states an organisation must not charge an individual for lodging a request for access (NPP 6.4(b)) but may apply a charge that is not excessive to recover costs of making information available (NPP 6.4(a)).

The doctor denied that the access charge was excessive and claimed that they were entitled to charge for their time spent reviewing the complainant's notes. The doctor stated they spent in excess of two hours examining the relevant notes to ensure compliance with the Privacy Act. Further, the doctor advised that they spent time answering the complainant's letters and in legal consultation with the Australian Medical Association's (AMA's) legal team and their medical defence organisation.

The Commissioner had to consider if, in making access to the complainant's medical records conditional on payment for a medical report, the doctor had breached NPP 6.4(a). The Commissioner takes the view that access provided under NPP 6 should generally be provided in the form requested by the individual. In this case the complainant did not ask the doctor to write a report but simply to provide a copy of the information. In addition, the Commissioner does not consider it reasonable that charges incurred by an organisation in seeking advice about complying with its legal obligations under the Privacy Act be transferred to the individual seeking access.

In the course of the complaint the doctor wrote to the Commissioner and claimed that it was not their standard practice to provide an accompanying report when providing access to personal information under NPP 6. The doctor stated that patients are able to access their records without a report; in this case the invoice included an incorrect description for the service provided. The doctor claimed that the charge related to their time spent in dealing with the request for copies of the complainant's record (and not to the preparation of a report), contending that the time taken to prepare the records, excluding the time consulting with the AMA or medical defence organisation, was in excess of two hours.

However, the doctor also advised that after considering the matter further, they believed that by dealing with the matter personally, this could result in an excessive charge to the patient. Accordingly, the doctor advised that in future access requests would primarily be processed by secretarial staff however this would occur with the doctor's supervision to ensure that the access request was carefully considered. The doctor believed the photocopying charge, which included an element for administrative costs, was a reasonable charge under the circumstances. The doctor therefore reduced the original access charge by the amount which was unrelated to photocopying and administrative costs. This reduced the access charge by almost two thirds. The complainant was happy to pay the revised charge.

Under section 41(2)(a) of the Act, the Commissioner may decide not to investigate further an act or practice about which a complaint has been made if the Commissioner is satisfied that the respondent has dealt adequately with the complaint.

The Commissioner was of the view that by offering this revised charge for access and developing a new policy with respect to access requests in general, the doctor had adequately dealt with the complaint. The complaint was closed on the basis that it had been adequately dealt with.

OFFICE OF THE PRIVACY COMMISSIONER June 2004