How to Access Medical Records in NSW: The HRIP Act Explained

In New South Wales, a single state law, the Health Records and Information Privacy Act 2002 (HRIP Act), gives you a right to access your own health records from both public hospitals and private providers like GPs, and private providers must respond within 45 calendar days.

Which Law Covers Your Records in NSW

The HRIP Act is unusual among Australian states because it is a single Act that reaches both sectors at once. The NSW Information and Privacy Commission (IPC) describes its scope as applying to "organisations (public sector agencies or a private sector person) that are health service providers or that collect, hold or use health information," expressly including "hospitals both public and private, doctors, other health service providers." A private business only has to meet the general $3 million small-business turnover threshold if it merely holds health information incidentally, such as a gym; an actual health service provider, a GP, dentist, physio or optometrist, is covered regardless of size.

The HRIP Act does not replace the federal Privacy Act 1988. A NSW GP or private specialist has to comply with both regimes at the same time, the IPC's own guidance states that private providers "must also comply with the Federal Privacy Act 1988," which under Australian Privacy Principle 12 gives every patient a separate, concurrent right to request access. In practice this means a NSW patient whose private provider will not release records has two potential complaint paths open at once, the NSW Privacy Commissioner under the HRIP Act, or the federal Office of the Australian Information Commissioner (OAIC) under APP 12. See our guide to the Australian Privacy Principles for how APP 12 works on its own.

For NSW public sector agencies, health information specifically sits under the HRIP Act's 15 Health Privacy Principles, while other personal information the same agency holds is governed by the Privacy and Personal Information Protection Act 1998 (PPIP Act), which also supplies the internal review process used even for health record complaints against a public agency. The HRIP Act does not reduce the separate Government Information (Public Access) Act 2009 (GIPA Act, NSW's general freedom of information law), the IPC notes that GIPA and PPIP conditions "continue to apply as if they were provisions of the HRIP Act."

Who Can Request Access

The patient can request their own record directly. An authorised representative can request on the patient's behalf with written consent, or, where the patient cannot make their own decisions, a person authorised under the Guardianship Act, an enduring power of attorney holder, a parent with parental responsibility for a child, or another person legally empowered to act in the patient's best interests.

For minors, a parent or guardian usually requests on the child's behalf, but a young person aged 14 to 16 can seek treatment without a parent's knowledge in NSW, subject to a capacity assessment by the treating provider, and that same assessment also governs whether the resulting record is shared with a parent. There is no single bright line age rule in that band; it is assessed case by case.

Deceased patients are the sharpest, least obvious rule in the HRIP Act: neither relatives nor the executor of a deceased person's will have a right under the HRIP Act to access that person's health information, and a person who was an authorised representative during the patient's life loses that status on death. Post mortem access is possible only two ways, a provider's discretionary "compassionate reasons" disclosure to immediate family, or a formal application under the GIPA Act, which weighs the public interest in release. Privacy protection for a deceased person's health information under the HRIP Act runs for 30 years after death.

How to Request Your Records

Contact the record holder directly, the Medical Records department at a public hospital, or the Privacy Officer at a private practice. An informal request is accepted, but it should be in writing and include your name, address, date of birth, a description of the information sought, and the form of access you want, viewing, a copy, a summary, or an explanation from the clinician. If you are requesting on someone else's behalf, include their details and your written authorisation. There is no prescribed statutory form for a HRIP Act request, unlike a GIPA application, which does require a formal form.

Timeframes: Two Different Clocks

This is the point where NSW's rule is most often stated wrong. A private health provider in NSW must respond within 45 calendar days of receiving the request (HRIP Act s 27(6)); if there is no formal response within that window, the request is legally treated as refused. NSW public sector health agencies have no statutory deadline under the HRIP Act at all, only the IPC's own expectation that a response should arrive within about 28 calendar days, which is guidance, not law. Do not treat "NSW medical records" as having one universal deadline; the 45 day figure applies to private providers only.

If you go the GIPA Act route instead, for example because you are a relative seeking a deceased person's public hospital record, that application has its own timeline: the agency must decide within 20 working days, extendable by 10 more days for third-party consultation or archive retrieval, or 15 days if both apply. Note that HRIP and PPIP timeframes run in calendar days while GIPA timeframes run in working days, a genuinely different clock, not a rounding difference.

Fees

The HRIP Act itself does not set a fee schedule. It only requires access "at the lowest reasonable cost and without excessive delay," and if a fee is charged, access should follow within 7 days of payment. For NSW public hospitals, charging is governed by a NSW Health policy directive, but the specific dollar rates sit in a companion bulletin whose live document could not be located; a widely circulating figure of around $33 for the first 80 pages plus a per-page charge beyond that, with a discount for concession card holders, could not be confirmed against any current, live official source. Treat that figure as unconfirmed and contact the treating hospital's Medical Records department for its current charge before relying on any specific number.

If you use the GIPA Act route instead of HRIP, the fee structure is different and confirmed: a flat $30 application fee, plus processing charges of $30 per hour, with the first 20 hours free if the information sought is your own personal information.

Private providers may also charge under the federal APP 12.8, which allows a charge that is "not excessive" but never a charge just for making the request.

Grounds for Refusal

A private provider can refuse a HRIP Act request where access would pose a serious threat to the requester's or another person's health, would unreasonably affect another person's privacy, relates to existing or anticipated legal proceedings between the requester and the provider, would reveal negotiation intentions and disadvantage the provider, would be unlawful, is required or authorised to be denied by law, would likely prejudice an investigation or law enforcement function, or is a repeat request for information already provided with no new grounds. Where a provider refuses on the ground of serious threat to health, the requester can instead ask, within 21 calendar days, that access be given to a registered medical practitioner of their choice.

Public sector refusals under GIPA run through a "public interest" balancing test, with NSW Health's own guidance citing common scenarios such as protecting third-party personal information, avoiding an adverse effect on a child's best interests in a custody dispute, or protecting staff or witness identity.

Complaints and Review

For a private sector complaint, contact the NSW Privacy Commissioner (the IPC). If the complaint is not resolved, you have 28 calendar days to apply to the NSW Civil and Administrative Tribunal (NCAT). For a public sector complaint, an internal review runs under the PPIP Act, must be completed within 60 calendar days with the Privacy Commissioner consulted, and can then go to NCAT within 28 calendar days.

If you went the GIPA route, there is a separate review ladder: an agency internal review (20 working days to request it, $40 fee, the agency then has 15 working days to decide), followed by external review by the Information Commissioner or NCAT, within 40 working days. For how other states and territories handle medical records access, see the Australia medical records hub.