Guidelines for Doctors on Disclosing Medical Records to Third Parties 2010
1. Trust is a vital component of the doctor-patient relationship. Patients trust doctors to keep their personal health information confidential, including access to their medical records. Because of this relationship, patients should feel confident in fully disclosing their personal information to their doctor and undergoing intimate examinations and investigations that are necessary for their appropriate medical management.
2. Doctors base their professional judgement regarding a patient’s medical management on the full and frank disclosure of the patient’s personal information. It is imperative that patients remain confident that their personal information is protected by their doctor. There is the very real and serious risk that patients may either not attend a doctor or may limit or falsify the personal information they provide to their doctor because of fears that their privacy may be breached, potentially resulting in serious consequences for the patient’s health care. This is especially relevant for patients who may already perceive or experience barriers to appropriate medical care.
3. Doctors have a general ethical and legal duty to protect the privacy of their patients’ personal information, including their medical records. The integrity of the confidentiality of the patient medical record is essential to developing, enhancing, and underpinning the therapeutic relationship. This confidentiality secures the necessary trust and openness that characterises the ongoing communication between doctors and their patients to optimise patient care.
4. As a general rule, the doctor who holds patient information owns and controls it and has legal rights in relation to copyright of their own work. Patients, however, have a general right of access to information held about them. The AMA affirms the principle that patients have a right to know what information is held about them, a right to access it, and to have some control over its use and disclosure to others. Doctors are encouraged to work with their patients and align expectations as to how patients’ personal information, including information held in their medical records, will be handled.
5. The right to confidentiality of medical records is not absolute, however, and the wider community generally agrees that certain exceptions to confidentiality are in the public interest. In such exceptions, disclosure of the patient’s medical record without the consent of the patient may be permitted such as in a medical emergency or where required by law. Where relevant and practical, it is important that doctors ensure patients are made aware of such limits to confidentiality at the outset of any consultation. At all times, such disclosure should be to the minimum extent necessary to achieve the objective.
6. The AMA believes that any initiatives by third parties, including Government, to compel doctors to disclose patients’ medical records must overwhelmingly be proven to serve the public interest. The public benefit of such disclosure must outweigh the risk that patients may not seek medical attention or may modify the personal information they disclose to their doctor because of fears their privacy will be breached.
7. The following Guidelines may assist doctors when responding to third party requests for a patient’s medical record. For the purpose of these Guidelines, the ‘medical record’ refers to any information held in the medical record and may include the full medical record, an extract of the medical record, or a summary of the medical record.
8. Doctors are encouraged to familiarise themselves with relevant Commonwealth, State and Territory legislation; in particular, legislation relevant to privacy and to medical records. If unsure about disclosing a patient’s medical record to a third party, doctors are encouraged to consult the AMA or their medical indemnity insurer.
Consent for Disclosure of Medical Records
9. Other than exceptional circumstances permitted or required by law (see below), medical records should not, without the patient's express up-to-date written consent, be disclosed to persons other than the patient unless the patient would reasonably expect such disclosure to take place, in accordance with relevant privacy legislation. For example, it is likely a patient who has consented to the collection of their personal information for their health care may reasonably expect the doctor to share the patient’s medical record amongst the treating health care team.
10. For patients who are unable to provide consent due to impaired decision-making capacity, their medical records should not be disclosed to persons other than the patient’s legally appointed guardian or attorney (where appropriate) unless the guardian/attorney would reasonably expect such disclosure to take place, in accordance with relevant privacy legislation. There may be exceptional circumstances permitted or required by law (see below).
11. The AMA is increasingly concerned that some third party requests for a patient’s complete medical record may be inappropriate and unnecessary. In order to assist the patient in making an informed decision whether or not to consent to disclosure of their medical record to a third party, the doctor and patient should undertake the following:
- understand and agree on the nature of the third party’s request for the patient’s medical record (eg., why the third party has requested the medical record in the first place);
- discuss the content and details of the medical record;
- understand the implications for the patient of disclosing (or not disclosing) the record to the third party;
- agree on the scope and format in which the medical record should be provided; for example, the full medical record, an extract of the medical record, or a summary of the medical record;
- where a summary or extract of the medical record is provided, agree on what information from the record will be disclosed;
- agree on to whom the medical record will be disclosed (eg., the details of the third party), for what particular purpose, and for how long the patient’s consent to the disclosure remains relevant; and
- agree on within what timeframe the medical record should be disclosed to the third party. In most cases, once the patient has consented to the disclosure of their medical record, the doctor should undertake this within a reasonable timeframe, preferably no more than 30 days after the patient has consented (unless there are compelling reasons why the disclosure should be undertaken earlier).
12. The doctor should document the consent discussion in the patient’s medical record including whether or not the patient consented to the disclosure.
13. When preparing a summary or extract of the medical record, the doctor should ensure that the information provided is relevant and sufficient to meet the objective of the disclosure.
14. To ensure appropriate ongoing care, when a patient transfers to another medical practitioner, the doctor should, when asked by a patient, make available either a copy of the original medical record or a summary. It is appropriate that the reasonable cost for this service should be borne by the patient.
Patients who are minors
15. Doctors recognise that some minors are legally capable of consenting to medical treatment. The confidentiality of those minors must be respected. This implies that parents may not have automatic access to the medical records of minors.
16. Except in circumstances of a medical emergency, during the normal course of professional communication and as required by law, the consent of both parents ought to be obtained, where practical, by the doctor before the records of children are released to persons other than the parents. It should not be assumed that one parent has the right, alone, to request and authorise disclosure of a child's record. Normally, the authority of one parent is accepted; however in some instances, such as separated families and those that relate to child protection, consent of both parents should be sought where practical. If a parent asserts a sole right to authorise disclosure, the doctor should seek a written explanation of that assertion and should seek his or her own legal advice on its correctness. In the situation where a child’s parents are separated or divorced the Family Court may have decided that parental responsibility is to be exercised by one or both parents. The doctor ought to clarify that the parent seeking release of the child’s records has had the issue of parental responsibility determined in their favour by the court.
Patients with impaired decision-making capacity
17. The confidentiality of patients with impaired decision-making capacity must also be respected. This implies that immediate family or loved ones do not have automatic access to the medical records of patients with impaired decision-making capacity.
18. Where necessary and appropriate, the consent of the patient’s legally appointed guardian or attorney should be obtained before disclosing the patient’s medical record to a third party (in those circumstances where patient consent is required).
Patients who are deceased
19. Doctors’ ethical and legal duty to protect the confidentiality of medical records continues even after the patient has died.
20. Information from the medical records of deceased persons cannot be released other than according to statutory requirement, under legal compulsion, or with the consent of the executor or appointed administrator of the deceased person's estate.
Where Disclosure of Patient Records to Third Parties is Authorised By Law Regardless of Patient Consent
21. There may be circumstances where the law authorises, but does not require, a doctor to disclose information from a patient’s medical record, regardless of whether or not the patient has provided consent. This may include certain types of medical research, for certain health management activities, where there is a serious and imminent threat of harm to the patient or another identifiable person or group of persons, or in a medical emergency.
22. If patients’ medical records are to be used for clinical or epidemiological research without specific patient consent, it is incumbent on the treating medical practitioner to ensure that the patient’s identity is safeguarded. Information should be disclosed only for worthwhile medical research conducted according to a written protocol approved by a recognised ethics committee and in accordance with any statutory guidelines. The disclosure should be restricted to the minimum necessary for the research. The protocol should explicitly provide for the maintenance of confidentiality of any individually identified or identifiable data. The treating doctor should reserve the right not to disclose information from the medical record when, in his or her opinion, disclosure would be contrary to the patient’s interests.
23. It may be appropriate to disclose information from a patient’s medical records without specific patient consent in order to undertake certain health service management activities and processes, including (but not limited to):
- complaints handling;
- audit and quality assurance;
- incident monitoring;
- obtaining medico-legal opinions;
- insurance; and
- medical indemnity organisations.
24. A doctor may disclose information from a patient’s medical record without consent if the doctor reasonably believes the patient may cause imminent and serious harm to themselves, an identifiable individual or group of persons. In such circumstances, disclosure may be necessary to lessen or prevent a serious and imminent threat to an individual’s life, health, safety, or welfare or a serious threat to public health, public safety or public welfare.
25. In a medical emergency where the patient cannot provide consent, a doctor may disclose information from a patient’s medical record to the extent necessary to protect the patient’s life or health.
Where Disclosure of Patient Records to Third Parties is Required By Law Regardless of Patient Consent
26. There may be circumstances where the law actually requires a doctor to disclose a patient’s medical record, regardless of whether or not the patient has consented; for example, by statute, warrant, subpoena, or court order.
27. For example, doctors may be required by statute to disclose information from a patient’s medical record in cases of mandatory disease notification or mandatory notification of child abuse.
28. In cases where there is a warrant, subpoena, or court order requiring the doctor to produce a patient’s medical record, some doctors may wish to oppose disclosure of clinically sensitive or potentially harmful information. The records should still be supplied but under seal, asking that the court not release the records to the parties until it has heard argument against disclosure.
29. Whether disclosure of information from a patient’s medical record is permitted or required by law without patient consent, where appropriate the patient should be informed of that having occurred and this information should be documented in the medical record.
Fees For Providing Copies of Medical Records
30. Doctors should be entitled to recover from the patient or from any other legally authorised person or authority requesting the information, the reasonable cost of providing access to the information contained in a medical record. In some jurisdictions, legislation determines the maximum amount a doctor can charge.
31. Within the limits of any relevant legislation, doctors should establish their own fees for providing copies of medical records. This would include an assessment of the time taken for administrative staff to copy the records and the cost of each photocopy. Members are encouraged to contact the AMA Office in their State or Territory for information about any legislation that might apply in that jurisdiction that sets fees for the copying of medical records. In States and Territories that do not regulate the fees for copying medical records, doctors might find the information provided by law societies on the cost of photocopying in the legal sector a useful reference.
For further information:
Office of the Privacy Commissioner www.privacy.gov.au
Other relevant AMA policies:
AMA Guidance on the Provision of Treatment to Minors 2008;
AMA Position Statement on Access to Medical Records by Doctors Who Are not Treating the Patients Concerned 2002;
AMA Position Statement on Transfer of Medical Records Between Treating Doctors 1998. Revised 2002;
AMA Guidelines for Doctors on Providing Patient Access to Medical Records 1997. Revised 2002;
AMA Privacy Resource Handbook. For all Medical Practitioners in the Private Sector. AMA, Canberra 2002.