How to Access Your Medical Records in Australia: My Health Record and APP 12 Explained

In Australia, your right to access your own medical records depends on who holds them: a state or territory law governs a public hospital or public health service, while a federal law, the Privacy Act 1988's Australian Privacy Principle 12, governs a private GP, specialist or private hospital in every state and territory, with three states adding their own extra layer on top.

Why Your Access Rights Depend on Who Holds the Record

There is no single Australian medical-records law. Instead there are several overlapping regimes, and which one applies to a given request turns on whether the record sits with a public or private provider.

A public hospital or public health service is a state or territory government instrumentality acting under state law. State instrumentalities are generally outside the ordinary reach of the federal Privacy Act, so a public hospital record is instead governed by that jurisdiction's own health-records, privacy or freedom of information legislation. Every state and territory runs its own version of this, with its own deadline, fee schedule and complaints body, covered on the state and territory pages linked below.

A private provider, meaning a private GP clinic, specialist practice or private hospital, is covered by the federal Privacy Act 1988 and its Australian Privacy Principle 12 (APP 12) in every state and territory. Private health providers are covered regardless of size: the Privacy Act's usual small-business exemption for businesses under 3 million dollars in annual turnover does not apply to an organisation that provides a health service and holds health information.

In three jurisdictions, a state Act reaches further and covers private providers on top of federal APP 12, rather than instead of it. Victoria's Health Records Act 2001, New South Wales's Health Records and Information Privacy Act 2002, and the ACT's Health Records (Privacy and Access) Act 1997 each independently apply to a private clinic in that state or territory, so a patient there can invoke either regime, or make a complaint under either one. Queensland, Western Australia, South Australia, Tasmania and the Northern Territory have no such Act. In those five jurisdictions a private provider's patients rely on federal APP 12 alone for access to their own record.

My Health Record

My Health Record is a separate national system, governed by its own statute, the My Health Records Act 2012 (Cth). It is not part of APP 12 and not part of any Freedom of Information regime. It is an opt-out system: a record exists for almost every Medicare-eligible person unless they chose not to have one.

My Health Record is not a complete clinical history. It typically includes information that populates automatically, such as Pharmaceutical Benefits Scheme dispensing data and Medicare claims data, alongside information that depends entirely on which of your treating providers actually participate and upload to the system, such as shared health summaries, pathology and imaging reports, hospital discharge summaries and immunisation records. Because provider participation is uneven, a document you expect to see in My Health Record may simply not be there. Your GP's own file or a hospital's own medical record will generally be a more complete source for a specific piece of clinical history.

The Act itself does not name the Australian Digital Health Agency as the system's operator. Section 14 of the Act sets out that the System Operator is the Secretary of the Department, unless a body is prescribed by regulation to hold that role instead. A separate regulation, the My Health Records Regulation 2012, is what actually prescribes the Australian Digital Health Agency for that function. The Act gives the System Operator authority to run an index service and an access-control mechanism, so you can restrict who is able to see particular documents within your own record.

The Act sets a specific emergency access rule. A healthcare provider may access, use or disclose your information without your consent if they reasonably believe it is necessary to lessen or prevent a serious threat to a person's life, health or safety, and getting consent first is unreasonable or impractical. Unless the provider is the System Operator itself, they must advise the System Operator of the access, and the access must occur no later than 5 days after that advice is given. A separate rule allows access to lessen or prevent a serious threat to public health or safety, without those same conditions attached.

If you ask for your My Health Record to be cancelled, the System Operator must destroy it, along with any copy and any earlier version, as soon as practicable, subject to narrow exceptions such as an active court order or a pending mandatory-disclosure obligation. Absent a cancellation request, the Act sets a default retention period of 30 years after death, or 130 years after birth if the date of death is unknown.

Unauthorised collection, use or disclosure of My Health Record information carries real penalties: a criminal offence carrying up to 5 years' imprisonment or 300 penalty units, or both, and a separate civil penalty of up to 1,500 penalty units. At the penalty unit value of 364 dollars that took effect 1 July 2026, that works out to roughly 109,200 dollars for the maximum criminal fine component and roughly 546,000 dollars for the maximum civil penalty, though whether a further multiplier applies for a body corporate was not established in this research and should not be assumed.

Accessing Records From a Private GP, Specialist or Private Hospital: APP 12

For a private provider anywhere in Australia, the starting point is Australian Privacy Principle 12 of the Privacy Act 1988. APP 12.1 requires an entity holding your personal information to give you access on request. This applies to both government agencies and private organisations, but the two are treated differently on timing, refusal and cost.

The timeframe is genuinely two separate rules, and conflating them is the single most common mistake in describing this area. APP 12.4(a)(i) sets a hard 30 day statutory deadline for a federal agency. APP 12.4(a)(ii) sets a different standard for an organisation, meaning essentially every private GP clinic, specialist practice and private hospital: a response within a reasonable period, with no fixed number of days written into the Act itself. The Office of the Australian Information Commissioner (OAIC) treats 30 calendar days as good practice guidance for organisations, but that is guidance, not law, and a provider that takes longer has not automatically broken the statute the way an agency missing its 30 day deadline has.

A private organisation may refuse access under APP 12.3 on limited grounds, including a reasonable belief that giving access would pose a serious threat to someone's life, health or safety, an unreasonable impact on another person's privacy, a frivolous or vexatious request, a request related to anticipated legal proceedings, or where access is otherwise unlawful. A refusal must generally come with written reasons and information about how to complain.

On cost, APP 12.8 permits an organisation to charge for actually providing access, provided the charge is not excessive, but an organisation must never charge simply for the making of the request. A federal agency, under APP 12.7, cannot charge at all, for the request or for giving access.

If a private provider refuses access, does not respond within a reasonable time, or charges an amount you consider excessive, you can complain to the Office of the Australian Information Commissioner. In Victoria, New South Wales and the ACT, an equivalent state complaints body also has jurisdiction, since the state Act applies alongside APP 12 there.

Accessing Records From a Federal Agency: Commonwealth Freedom of Information

A small number of medical-record scenarios involve a federal agency directly, such as Services Australia (Medicare), the Department of Veterans' Affairs, the Aged Care Quality and Safety Commission, or the Australian Digital Health Agency in its capacity as My Health Record's System Operator. These are handled under the Freedom of Information Act 1982 (Cth), which runs alongside, rather than instead of, the Privacy Act's own APP 12 access right.

The FOI Act sets hard statutory deadlines, unlike APP 12's reasonable-period standard for organisations: an agency must take reasonable steps to acknowledge receipt of a request, and in any case must notify you of its decision no later than 30 days after the request was received. That 30 day period can be extended, including by a further 30 days for third-party consultation, a further 30 days to consult a foreign government, or up to a further 30 days if you agree to it.

Critically, there is no charge at all for a request limited to your own personal information, sometimes described as a personal-affair request, which is the operative category for someone asking a federal agency for their own health or medical file. Charges apply only to non-personal document requests, covering search, retrieval, decision-making time, photocopying and similar costs, and even then the first 5 hours of decision-making time are free.

Public Hospital and State-Law Records: Compare Your State or Territory

Every public hospital pathway runs on a different statute, deadline, fee schedule and complaints body. The table below summarises each jurisdiction; open the linked page for the full request process, refusal grounds and what is and is not verified about local fees.

• Medical records access in New South Wales
• Medical records access in Victoria
• Medical records access in Queensland
• Medical records access in Western Australia
• Medical records access in South Australia
• Medical records access in Tasmania
• Medical records access in Northern Territory
• Medical records access in Australian Capital Territory

Making a Complaint

Where a complaint goes depends on the same public-versus-private split that governs the rest of this page. A complaint about a private provider's handling of a request, in any state or territory, can go to the Office of the Australian Information Commissioner, and in Victoria, New South Wales and the ACT also to the relevant state body under the state Act. A complaint about a public hospital or public agency's handling of a request goes to that jurisdiction's own review body, which is different in every state and territory and is set out in the comparison table above and on each state or territory page.

If your request touches a My Health Record concern, such as an unauthorised disclosure, that also falls within the OAIC's jurisdiction, since privacy complaints about the My Health Record system are handled under the broader federal privacy complaints framework the OAIC administers, including the framework covered on the site's notifiable data breaches page where a records system has been compromised.

If someone else, such as a family member or an appointed decision-maker, needs to request records on a patient's behalf, whether that person is legally entitled to do so depends on the state and on whether they hold a formal authority such as an enduring power of attorney or guardianship appointment. See our guide to enduring guardianship and health decisions in Australia for how that authority is established, and check your relevant state or territory page above for that jurisdiction's specific rule on representative and deceased-patient access, since these rules are not uniform and several remain only partly confirmed even within this research.