Request the patient's health records from each service that treated them
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- From the list of services the lawyer has named, draft the request to each holder for the date range the lawyer has set, naming the access path the lawyer has chosen and the response time that path states. Do not collect anything from a My Health Record system, and leave the request as a draft for the lawyer to send.
- What the lawyer must review
- The lawyer chooses the holder, the path, the date range and the authority to ask, and sends the request.
- Do not collect from a My Health Record system unless an authorisation in Division 2 has been opened.
- Health information stays in a firm-controlled tool, not a public one.
- Rule 9.1 and APP 11 apply to the records once they arrive.
Open a jurisdiction version of this task to see which instruments apply: NSWVICQLD
Who does what
| Role | What they do |
|---|---|
| Assistance | From the list of services the lawyer has named, draft the request to each holder for the date range the lawyer has set, naming the access path the lawyer has chosen and the response time that path states. Do not collect anything from a My Health Record system, and leave the request as a draft for the lawyer to send. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Name the path the lawyer has chosen. Do not send a private-sector Victorian request down the public-sector freedom-of-information path, or the reverse.
- Put 45 days on a Victorian private-sector access request and 30 days on a correction request, as the Commissioner states them. Do not invent a day count for New South Wales.
- In Queensland, use administrative access for the patient's own records where Queensland Health offers it, and a Right to Information application where consent for someone else's records is missing.
- Do not collect from a My Health Record system. Section 59 prohibits a collection that is not authorised under Division 2 where the person knows or is reckless as to that fact. Division 2 was not opened.
Forms and precedents for this task
| Form or precedent | Kind | AI use | Summary |
|---|---|---|---|
| Complaint notification to a health provider (Health Complaints Commissioner) | Form | AI use Yellow | Link to the Commissioner's short complaint notification, sent to the provider, which asks for a response within 30 working days. |
Signed-in accounts can read the full text of each one. All precedents.
Sources
- Health Complaints Commissioner: access to health records · 2026-10-23
- Health Records and Information Privacy Act 2002 (NSW) Schedule 1, Health Privacy Principles 7 and 8 · 2026-10-23
- Queensland Health: Right to Information request for medical records · 2026-10-23
- OAIC: APP 12 access to personal information · 2026-10-23
- My Health Records Act 2012 (Cth) s 59 · 2026-10-23
- OAIC: APP 11 security of personal information · 2026-10-23
- Victorian Legal Services Board and Commissioner: confidentiality, rule 9.1 · 2026-10-23
These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.
Health information stays in a firm-controlled tool. Rule 9.1 of the Legal Profession Uniform Law Australian Solicitors' Conduct Rules 2015, as described by the Victorian Legal Services Board and Commissioner, and APP 11, apply. The lawyer decides whether any loss is notifiable under the Privacy Act 1988 (Cth).
APP 12.4, as the OAIC guidelines describe it, gives an organisation a reasonable period to respond. The guidelines say that, as a general guide, a reasonable period should not exceed 30 calendar days. The lawyer decides whether the holder is an APP entity. APP 12 does not replace the State access path.