Consumers

Healthcare consumers can choose to:

• Cancel their My Health Record
• Direct healthcare providers to not upload specific information
• Remove documents from view by anyone. See ‘patient access controls’.
• Restrict healthcare organisations’ access to particular documents
• Restrict healthcare organisations’ access to the whole record
• Track access and updates to their record through an audit log
• Receive notifications when their record has been accessed
• Upload health information such as personal health summaries, emergency contact details etc.
• Nominate representatives who can access their record on their behalf, with varying degrees of access levels

Healthcare consumers cannot:

• Edit/alter the content of a clinical document created by a healthcare provider
• Restrict access by particular healthcare providers within a particular healthcare organisation
• Restrict access to Shared Health Summaries, Personal Health Summaries, or Advance Care Planning information. Note it is possible for patients to hide or remove these documents. 

Patient access controls

An individual’s My Health Record may contain various types of content from the consumer, their healthcare providers, and Medicare. Healthcare providers can still upload to a My Health Record regardless of any type of access controls put in place.  Consumers have the option to restrict access to some or all of the documents in their My Health Record using two different methods:

Record access code (RAC)

A record access code can be used if the patient wants to restrict access to their entire record. In a consultation, they will need to give you this code in order to see their record. In an emergency situation, you can use the emergency access function which overrides any access codes or restrictions the patient may have set so you can access their record. Just remember that all instances of emergency access will be audited by the system operator. See here for more information on the appropriate circumstances for using the emergency access function. 

Limited document access code (LDAC)

Patients can restrict access to any document in their My Health Record using a limited document access code (LDAC). A patient can choose to your practice access to their restricted documents. Once your practice has used the LDAC, the practice will be listed in the patient’s provider access list. This means you will be able to view their restricted documents.

Access restrictions applied to a general practice

A patient can also restrict specific practices (and therefore, all GPs linked to that practice) from having access to documents or their entire record. This is different to applying an access code. When this is applied to a document, you will not have any indication that a document has been removed from view.

Emergency access 

There are certain urgent situations, defined in the My Health Records Act 2012 (section 64), where it may be permissible for you to bypass the access code(s) using an emergency access function available through your clinical information system. This is sometimes referred to as a ‘break glass’ function. It is important to understand when this function can lawfully be used. More information on emergency access can be found here.

Cancelling a My Health Record

This change was introduced with the legislative changes to strengthen the My Health Record Act in late 2018 following the Senate inquiry into My Health Record.