Office of the Australian Information Commissioner - Home

Australian Government - Office of the Australian Information Commissioner
Australian Government - Office of the Australian Information Commissioner

Main menu

Privacy fact sheet 23: Emergency access and your My Health Record

pdfPrintable version198.21 KB

March 2016

Under the My Health Record system, healthcare providers can obtain emergency access to your record in certain circumstances. This factsheet explains who can obtain emergency access and in what situations, what information can be accessed and how long the access lasts.

What is a My Health Record?

A My Health Record is an online summary of your health information, such as medicines you are taking, any allergies you may have and treatments you have received. It was previously known as a Personally Controlled Electronic Health Record (PCEHR) or eHealth record.

Your My Health Record allows your doctors, hospitals and other healthcare providers (such as physiotherapists) to view your health information, in accordance with your access controls. You are also able to access it online yourself.

In most parts of Australia you need to actively register for a My Health Record. However, people whose registered Medicare address is in Northern Queensland or the Nepean Blue Mountains will have a My Health Record automatically created for them by the Australian Government. If you are registered as living in either of these areas and don’t want a My Health Record, you will need to opt-out by 27 May 2016.

You can use the postcode checker on the My Health Record website to see if your registered Medicare address is in one of these areas. If it is, you should also receive a letter and brochure from the Australian Government with further information.

This fact sheet is for everyone who already has or will soon have a My Health Record and anyone else who is thinking of registering for one. This includes people whose registered Medicare address is in Northern Queensland and the Nepean Blue Mountains region.

Who can gain emergency access to your My Health Record?

Under the My Health Records Act 2012 (My Health Records Act), healthcare provider organisations, the System Operator and other system participants[1] are permitted to collect, use and disclose information in your My Health Record under certain emergency circumstances.

The System Operator’s privacy statement explains how personal information in relation to the My Health Record system will be handled.

If emergency access is granted to a healthcare provider (such as a hospital or medical practice) the organisation is responsible for determining which individual healthcare providers within the organisation have access.

When is emergency access permitted?

Registered healthcare providers are permitted to collect, use or disclose information in your My Health Record if it is unreasonable or impracticable to obtain your consent and they reasonably believe that this is necessary to lessen or prevent a serious threat to your or another individual’s life, health or safety. An example could be if you are unconscious in an emergency situation.

Healthcare providers can also collect, use and disclose the information in your My Health Record without your consent if they reasonably believe that this is necessary to lessen or prevent a serious threat to public health or safety. An example could be where a dangerous infection has been detected within a hospital and it is necessary to identify the source of the infection to prevent its spread.

If these conditions do not apply when emergency access is gained, the healthcare provider will be breaching the law and penalties may apply.

If you have chosen to suspend your My Health Record (if for example you are moving overseas for a significant period of time), emergency access could still be granted by the System Operator. However, if your My Health Record has been cancelled it cannot be accessed, even during an emergency.

What information can be accessed?

Under emergency access all information in your My Health Record can be accessed, except for:

  • records that have been ‘effectively removed’[2]
  • information entered in the consumer-only notes section (which cannot be viewed by healthcare providers regardless of access settings).

When emergency access is granted, any advanced access controls[3] previously set by you are overridden. This means that any restricted information can be accessed in an emergency. The healthcare provider may also store information collected from your My Health Record during an emergency on its own local clinical records.

See the OAIC’s Privacy fact sheet 19: How to manage your My Health Record for more information on controlling access to your My Health Record.

Will I be notified?

Any emergency access to your My Health Record will be recorded by the System Operator and included on your access history[4]. You can view the access history by logging in to your record online or calling the System Operator on 1800 723 471. You can choose to be notified of emergency accesses to your record via SMS or email from the System Operator.

How long does the emergency access last?

The System Operator grants emergency access for five days. Once this period ends, all access will revert to the default access controls or your advanced access controls if any had been set before the emergency access was granted.

If the emergency situation continues beyond the initial five day period, the healthcare provider would need to request emergency access from the System Operator again.

More information

For more information on protecting your privacy in the My Health Record system, please see the OAIC’s Privacy fact sheet 15: Ten tips for protecting the personal information in your My Health Record.

For more information on the OAIC’s role in the My Health Record system, please see the OAIC’s Privacy fact sheet 18: The OAIC and the My Health Record system

 

For further information

telephone: 1300 363 992

email: enquiries@oaic.gov.au

write: GPO Box 5218, Sydney NSW 2001

Or visit our website at www.oaic.gov.au


Footnotes

[1] Other participants include registered repository operators, registered portal operators and registered contracted service providers. For further information on these participants, see the My Health Records Registration Booklet.

[2] See Privacy fact sheet 19: How to manage your My Health Record for more information on effective removal of a record.

[3] Advanced access controls enable you to restrict the registered healthcare provider organisations and nominated representatives who may access your My Health Record, and the information within it.

[4] Your access history displays the activities that have happened in your My Health Record, including details of when your record has been accessed or edited, and if your record has been accessed in an emergency.