Consumers
Healthcare consumers can choose to:
- Cancel their My Health Record
- Direct healthcare providers to not upload specific information
- Remove documents from view by anyone. Click here for information on patient access controls
- Restrict healthcare organisations’ access to specific documents
- Restrict healthcare organisations’ access to the whole record
- Track access and updates to their record through an audit log
- Receive notifications when their record has been accessed
- Upload health information such as personal health summaries, emergency contact details, advance care planning documents etc
- Nominate representatives who can access their record on their behalf, with varying degrees of access levels.
Healthcare consumers cannot:
- Edit/alter the content of a clinical document created by a healthcare provider
- Restrict access by particular healthcare providers within a specific healthcare organisation
- Restrict access to Shared Health Summaries, Personal Health Summaries, or Advance Care Planning information. Note, it is possible for consumers to hide or remove these documents.
Patient access controls
An individual’s My Health Record may contain various types of content added from the consumer, their healthcare providers, and Medicare. Healthcare providers can still upload to a My Health Record regardless of any type of access controls put in place. Consumers have the option to restrict or remove access to some or all documents in their My Health Record using two different methods:
Record access code (RAC)
A record access code can be used if the patient wants to restrict access to their entire record. In a consultation, they will need to give you this code in order to see their record. In an emergency situation, you can use the emergency access function which overrides any access codes or restrictions the patient may have set so you can access their record. It is important to keep detailed notes relating to the incident in your local patient records as all instances of emergency access are audited by the System Operator. The My Health Record website outlines appropriate circumstances for using the emergency access function.
Limited document access code (LDAC)
Patients can restrict access to a document in their My Health Record using a limited document access code (LDAC). A patient can choose to allow your practice access to their restricted documents. Once your practice has used the LDAC, the practice will be listed in the patient’s provider access list. This means you will be able to view their restricted documents.
Access restrictions applied to a general practice
A patient can restrict specific practices (and therefore, all GPs linked to that practice) from having access to documents or their entire record. This is different to applying an access code.
Emergency Access
There are certain emergency situations, defined in the My Health Records Act 2012 (section 64), where it may be permissible for you to bypass the access code(s) using an emergency access function available through your clinical information system. This is sometimes referred to as a ‘break glass’ function. It is important to understand when this function can lawfully be used. More information on emergency access can be found here.
Cancelling a My Health Record
If a patient has a My Health Record and no longer wants one, they can cancel it at any time. The information in their record, including any backups, will be permanently deleted from the system.
This change was introduced with the legislative changes to strengthen the My Health Record Act in late 2018 following the Senate inquiry into My Health Record.
Relevant RACGP resources
