Skip to main content
Skip to secondary navigation
Menu
Australian Government - Office of the Australian Information Commissioner - Home

Privacy fact sheet 23: Emergency access and your My Health Record

Under the My Health Record system, healthcare providers can obtain emergency access to your record in certain circumstances. This factsheet explains who can obtain emergency access and in what situations, what information can be accessed and how long the access lasts.

What is a My Health Record?

A My Health Record is an online summary of your health information, such as medicines you are taking, any allergies you may have and treatments you have received. It was previously known as a Personally Controlled Electronic Health Record (PCEHR) or eHealth record.

Your My Health Record allows your doctors, hospitals and other healthcare providers (such as physiotherapists) to view your health information, in accordance with your access controls. You are also able to access it online yourself.

The My Health Record system opt-out period commenced on 16 July 2018, and you now have until 15 November 2018 to advise the Australian Digital Health Agency if you do not want a My Health Record to be automatically created for you. Although the My Health Record system has previously been a self-register model, every individual with a Medicare or Department of Veterans’ Affairs card who does not already have a record will now be automatically registered to have a My Health Record, unless they choose not to have one.

For further information about the My Health Record and what to do if you don’t want a record created, visit the My Health Record website or call the My Health Record Help line on 1800 723 471. You can also read the OAIC’s opt-out FAQs.

Who can gain emergency access to your My Health Record?

Under the My Health Records Act 2012 (My Health Records Act), healthcare provider organisations, the System Operator (the Australian Digital Health Agency) and other system participants (such as registered repository operators, registered portal operators and registered contracted service providers) are permitted to collect, use and disclose information in your My Health Record under certain emergency circumstances.

The Australian Digital Health Agency’s privacy policy explains how personal information in relation to the My Health Record system will be handled.

If emergency access is granted to a healthcare provider (such as a hospital or medical practice) the organisation is responsible for determining which individual healthcare providers within the organisation have access.

When is emergency access permitted?

Registered healthcare providers are permitted to collect, use or disclose information in your My Health Record if it is unreasonable or impracticable to obtain your consent and they reasonably believe that this is necessary to lessen or prevent a serious threat to your or another individual’s life, health or safety. An example could be if you are unconscious in an emergency situation.

Healthcare providers can also collect, use and disclose the information in your My Health Record without your consent if they reasonably believe that this is necessary to lessen or prevent a serious threat to public health or safety. An example could be where a dangerous infection has been detected within a hospital and it is necessary to identify the source of the infection to prevent its spread.

If these conditions do not apply when emergency access is gained, the healthcare provider will be breaching the law and penalties may apply.

If you have chosen to suspend your My Health Record (if for example you are moving overseas for a significant period of time), emergency access could still be granted by the Australian Digital Health Agency. However, if your My Health Record has been cancelled it cannot be accessed, even during an emergency.

What information can be accessed?

Under emergency access all information in your My Health Record can be accessed, except for:

  • records that have been ‘effectively removed’[1]
  • information entered in the consumer-only notes section (which cannot be viewed by healthcare providers regardless of access settings).

When emergency access is granted, any advanced access controls[2] previously set by you are overridden. This means that any restricted information can be accessed in an emergency. The healthcare provider may also store information collected from your My Health Record during an emergency on its own local clinical records.

See the OAIC’s Privacy fact sheet 19: How to manage your My Health Record for more information on controlling access to your My Health Record.

Will I be notified?

Any emergency access to your My Health Record will be recorded by the Australian Digital Health Agency and included on your access history.[3] You can view the access history by logging in to your record online or calling the My Health Record Help line on 1800 723 471. You can choose to be notified of emergency accesses to your record via SMS or email from the Australian Digital Health Agency.

For more information on how to check your access history, please visit the My Health Record See who has viewed my record page.

How long does the emergency access last?

The Australian Digital Health Agency grants emergency access for five days. Once this period ends, all access will revert to the default access controls or your advanced access controls, if any had been set before the emergency access was granted.

If the emergency situation continues beyond the initial five day period, the healthcare provider would need to request extended emergency access from the Australian Digital Health Agency.

More information

For more information on Emergency access to My Health Record, please visit the My Health Record Emergency Access to My Health Record page.

For more information on protecting your privacy in the My Health Record system, please see the OAIC’s Privacy fact sheet 15: Tips for protecting the personal information in your My Health Record.

For more information on the OAIC’s role in the My Health Record system, please see the OAIC’s Privacy fact sheet 18: The OAIC and the My Health Record system.

Footnotes

[1] See Privacy fact sheet 19: How to manage your My Health Record for more information on effective removal of a record.

[2] Advanced access controls enable you to restrict the registered healthcare provider organisations and nominated representatives who may access your My Health Record, and the information within it.

[3] Your access history displays the activities that have happened in your My Health Record, including details of when your record has been accessed or edited, and if your record has been accessed in an emergency.