How to Access Medical Records in the ACT: HRPA Act Explained

In the Australian Capital Territory, the Health Records (Privacy and Access) Act 1997 covers every health record in the territory, public or private, with no size threshold, and it sets a hard 2 week deadline for the record keeper to notify you of the outcome, though the record itself can take up to 30 days to actually arrive.

Which Law Covers Your Records in the ACT

The Health Records (Privacy and Access) Act 1997 (HRPA Act) governs both public sector records, held by ACT Health and Canberra Health Services, and private sector records, held by private GPs, specialists and allied health providers, with no size or turnover threshold at all. That is broader than NSW's version of the same idea, which exempts businesses that only incidentally hold health information below a $3 million turnover. The ACT's Act defines a "health service provider" as any entity that provides a health service, and a "record keeper" as any entity with possession or control of a health record, neither qualified by sector or size. The access duty applies to any health record "kept or located in the ACT," reaching a public hospital and a private GP equally.

Private ACT providers are not covered by the HRPA Act alone. They also answer to the federal Privacy Act 1988's Australian Privacy Principle 12, the same as private providers anywhere else in Australia, so an ACT patient effectively has two potential avenues if a private provider refuses a request. See our guide to the Australian Privacy Principles for how APP 12 works.

Who Can Request Access

The consumer can request their own record directly. A legally incompetent person's rights are exercised by a guardian. A child's rights are exercised by whoever holds parental responsibility for them. The Act also recognises a distinct "young person" category: someone with sufficient maturity and developmental capacity to understand both the nature of the request and the nature of the record can exercise the access right personally, a pure capacity test rather than a fixed age.

The ACT stands out from NSW here: a legal representative of a deceased consumer can request access to that person's health record, subject to confidentiality carve-outs that specifically protect anything a third party, or the consumer themselves while competent, asked to be kept confidential even from that representative. A consumer can also nominate another person or entity to stand in their place for access purposes with consent.

How to Request Your Records

A request must state the consumer's name, and address if not already known, sufficiently identify the record, and specify the form of access wanted, inspection, a copy, or a viewing with explanation. An ordinary request from the consumer can be made orally. Three categories must be in writing instead: a person with parental responsibility (unless they consented to the underlying treatment within the past 12 months), a guardian of a legally incompetent person, and a deceased consumer's legal representative. Where the ACT Health Services Commissioner formally holds the record but a treating provider actually prepared it, the Commissioner can refer your request to that provider instead.

Timeframes: A 2 Week Notification, Up to 30 Days for Access

The ACT actually runs two deadlines, not one. Section 13(2) of the HRPA Act gives a record keeper 2 weeks from receiving your request to notify you of the outcome, whether that is a referral, a refusal with grounds, a confidentiality-related prohibition, or an undertaking to give access, with or without a fee condition. If access is going ahead, section 13B then gives the record keeper up to a further 30 days after the original request to actually hand over the record, or, if a fee applies, the later of 1 week after you pay or 30 days after the request. So the fastest thing in the ACT is finding out what will happen, 2 weeks, not receiving the record itself, which can take up to 30 days total, comparable to South Australia's and the Northern Territory's 30 day deadlines rather than the tightest deadline in the country. The Act does allow regulations to extend statutory deadlines by up to 21 days, but nothing confirms that power has actually been used against either deadline, so treat 2 weeks for notification and 30 days for the record itself as the default position unless you are told otherwise.

Fees: Current DI2025-302 Schedule

ACT health record fees are set by the Minister through a disallowable instrument that is remade roughly annually. The current instrument is the Health Records (Privacy and Access) (Fees) Determination 2025 (No 1), known as DI2025-302, in force from 1 January 2026 and therefore the correct figures to use. Under DI2025-302: viewing a record costs $18.95; a copy up to 50 pages costs $52.10, plus 45 cents per page beyond that; electronic delivery through secure messaging or the MyDHR Portal costs $18.95; delivery by encrypted USB costs $36.70; a written summary costs $108.40; a view with explanation or discussion by the provider is charged at the provider's usual consultation fee; and a copy needed for your own continued treatment or future care is free. All figures are GST exempt, carry a 50% discount for health care card holders, and can be waived for hardship.

An older figure, $17.75 to view and $48.75 to copy, still circulates online. It comes from a determination that has since been repealed. Do not use it; the current, in-force figures are $18.95 and $52.10.

Grounds for Refusal

A record keeper can refuse access where the record is not in their possession or control, does not relate to the consumer, or where production would contravene ACT or Commonwealth law or a court order. Access is also refused where the record relates to a child protection report and disclosure would identify the reporter. Where disclosure would pose a significant risk to the life, or the physical, mental or emotional health, of the consumer or any other person, the consumer or their representative can instead nominate an alternative suitably qualified health service provider to receive the record, a mirror of the equivalent NSW safeguard. Separately, information given in confidence by someone other than the consumer, their guardian, parent, or treating provider is protected, including specifically from a deceased consumer's own legal representative.

Complaints and Review

Complaints go to the ACT Human Rights Commission, on grounds including a breach of a privacy principle or refusal of access; a complaint about a deceased consumer's treatment can be made regardless of whether the conduct happened before or after death. The detailed conciliation and referral mechanics for these complaints sit in the Human Rights Commission Act 2005, not the HRPA Act itself, and this session could not independently verify those mechanics against the primary text of that Act, so treat the process as "complaints are handled by the ACT Human Rights Commission" without relying on any specific conciliation timeframe until that is confirmed.

Why FOI Does Not Apply

Unlike NSW, where the GIPA Act remains a genuine alternative route for health records, especially for a deceased relative's records, the ACT's Freedom of Information Act 2016 explicitly carves out health records: "this Act does not apply to information in a health record under the Health Records (Privacy and Access) Act 1997." The HRPA Act is the exclusive access statute for ACT health records; there is no parallel FOI pathway to fall back on, though for how every other state and territory handles medical records access, see the Australia medical records hub. For general ACT FOI matters unrelated to health records, the standard decision timeframe is 30 working days, extendable for third party consultation, with Ombudsman review also decided within 30 working days.