Who is able to document in a patients health record?

Start of content

Índice Show

Appropriate use of emergency access
When not to use emergency access
Additional Information
Notification provisions under section 75 of the Act
More information
What is a shared health summary?
Who can create a shared health summary?
When to create or update a shared health summary?
A GP management plan
75+ health assessment
Child health check
Flu vaccination
Do I need my patient's consent to upload a shared health summary?
Can I charge for uploading a shared health summary?
Can I edit or delete a shared health summary once it is uploaded?
How do I create and upload a shared health summary?
Clinical software simulators
Clinical software summary sheets
Clinical software demonstrations

Healthcare providers can access information within My Health Record for the purpose of lessening or preventing a serious threat.

By default, documents in an individual’s My Health Record are set to general access for registered healthcare provider organisations. This means a treating healthcare provider can view all documents within an individual’s record, except for information that has been entered in the personal health notes section of the record, and any documents that have been removed or hidden by the healthcare recipient (or their representative(s)).

Healthcare recipients (or their representative(s)) can choose to restrict access to their My Health Record (using a record access code) or to restrict access to specific documents (which they can share with selected organisations, using a limited document access code):

Where a record access code has been set, a treating healthcare provider will be prompted by their clinical information system, or the My Health Record National Provider Portal, if a record access code is required. When this occurs, the healthcare provider can ask the healthcare recipient to share the record access code.
Where a limited document access code has been set, the healthcare recipient (or their representative(s)) can choose to provide the treating healthcare provider with the limited document access code. The healthcare provider will need to enter the limited document access code into their clinical information system, or the My Health Record National Provider Portal, to gain access to the restricted document(s).

There are certain urgent situations, defined in the My Health Records Act 2012 (section 64), where it may be permissible for treating healthcare providers to access information in a person’s My Health Record without entering the relevant access code(s) using a function known as Emergency Access. This is sometimes referred to as a ‘break glass’ function. It is important to understand when this function can lawfully be used.

Appropriate use of emergency access

It is expected that the need to use Emergency Access will be rare, as Emergency Access to a healthcare recipient's My Health Record (or a restricted document within it) is only authorised under the My Health Records Act if the healthcare organisation reasonably believes that:

the access is necessary to lessen or prevent a serious threat to an individual’s life, health or safety and the healthcare recipient's consent cannot reasonably be obtained. For example, due to being unconscious; or
the access to the healthcare recipient’s My Heath Record is necessary to lessen or prevent a serious threat to public health or safety. For example, to identify the source of a serious infection and prevent its spread.

In addition, the majority of people have not set any access controls, which means information in their record is not restricted. In most cases, therefore, you will be able to see all available health information, for the purpose of providing healthcare, without needing to use Emergency Access.

When not to use emergency access

A person should not use Emergency Access:

to view their own My Health Record or a My Health Record of a family member – people can access their own record via myGov or an available mobile app
to demonstrate how to use the Emergency Access function – training resources are available on the My Health Record website for this purpose
to check whether any restricted documents exist (except, in accordance with section 64 of the My Health Records Act, where the treating healthcare provider reasonably believes that access is necessary to lessen or prevent a serious threat to the individual’s life, health or safety and it is unreasonable or impracticable to provide consent; or to lessen or prevent a serious threat to public health or safety).
when an individual has forgotten the access code they have set (except, in accordance with section 64 of the My Health Records Act, where the treating healthcare provider reasonably believes that access is necessary to lesson or prevent a serious threat to the person’s life, health or safety; or to lessen or prevent a serious threat to public health or safety) – a person can reset their access code by logging into their My Health Record, or telephoning the My Health Record helpline 1800 723 471.

Use of the Emergency Access function that is not authorised by section 64 of the My Health Records Act is subject to civil and/or criminal penalties under the My Health Records Act.

Additional Information

Once granted, emergency access to a record is available for a maximum of five days. When this period ends, the My Health Record reverts to the previous settings. If the emergency situation continues beyond the initial five-day period, you will need to request Emergency Access again.

Use of the Emergency Access function is recorded in the access history of the My Health Record, which can be viewed by the healthcare recipient and their authorised or nominated representative(s). In addition, healthcare recipients can choose to receive an SMS or email notification each time the Emergency Access function is used to view their My Health Record.

With Emergency Access, any access controls that the individual has set will be overridden. This means the treating healthcare provider who uses the Emergency Access function will have full access to the healthcare recipient’s My Health Record, except for information that has been entered in the personal health notes section of the record, and any documents that healthcare recipient (or its authorised representative(s) has previously removed or hidden.

Notification provisions under section 75 of the Act

It is important to note that registered healthcare provider organisations are subject to reporting obligations under section 75 of the Act. Consequently, unauthorised use of the Emergency Access function may be reportable to the Office of the Australian Information Commissioner (OAIC) and the Agency (as System Operator).

Learn more about managing data breaches, including section 75 notification obligations.

Note

This information is general in nature, and you should obtain your own professional legal advice relevant to your circumstances.

More information

You can find out more about the My Health Record Emergency Access function from the OAIC, including:

Online guidance
Frequently Asked Questions (FAQs) and a flowchart.

The shared health summary is a crucial part of the My Health Record system. This page presents an overview of who can create shared health summaries, when they should be created, and how to create them.

What is a shared health summary?

The shared health summary represents the patient's health status at a point in time. The Royal Australian College of General Practitioners' (RACGP's) Digital Business Kit and My Health Record position statement provides additional guidance on digital health records including shared health summaries. Shared health summaries can be created at any consultation, and may include information about a patient's medical history, including:

Medical conditions
Medicines
Allergies and adverse reactions
Immunisations

The most recently uploaded shared health summary in a patient's My Health Record is likely to be the first document accessed by any other healthcare professional viewing a patient's My Health Record.

View an example of a shared health summary.

Who can create a shared health summary?

A shared health summary can only be authored/created by a patient’s nominated healthcare provider (as defined in the My Health Records Act 2012). A nominated healthcare provider can be:

a registered medical practitioner; or
a registered nurse; or
an Aboriginal and Torres Strait Islander health practitioner with a Cert IV in Aboriginal and/or Torres Strait Islander Primary Health Care.

An agreement must be in place between the healthcare provider and the patient that the healthcare provider is the patient’s nominated healthcare provider for the purpose of authoring/creating the document. There are no constraints in regard to the form of the agreement and it can be verbal or written.

The provisions around who can be a nominated healthcare provider only relate to authoring/creating a shared health summary. Another employee in the organisation can upload the document on behalf of the author/creator.

Note: an enrolled nurse is not permitted by the Act to author/create a shared health summary. An enrolled nurse can create an event summary to share information about a significant clinical event, provided the enrolled nurse is providing healthcare to the patient.

A patient can have only one nominated healthcare provider at a time, who should be delivering coordinated and comprehensive care to the patient. A provider who is not the patient's usual provider could use an event summary instead to upload clinically relevant information to the patient's My Health Record.

When to create or update a shared health summary?

A shared health summary can be created at any consultation; however uploading a shared health summary will be particularly beneficial for patients with chronic conditions and co-morbidities. As part of putting the My Health Record system into practice, the RACGP recommends that a healthcare provider creates and uploads a shared health summary when completing a patient health assessment, because this is a time when the health summary within the local GP clinical system is being updated. For example:

A GP management plan

Patients who have one or more chronic medical conditions and need a GP management plan may also benefit from having a shared health summary uploaded to their My Health Record at the same point in time.

75+ health assessment

This structured assessment of a patient over 75 years may be a good opportunity to upload a shared health summary to their My Health Record given the in-depth review that is undertaken. It also supports ongoing management for the patient, their family and other healthcare providers.

Child health check

As with all patient health assessments, inclusion of a shared health summary after conducting a child health check would likely be a timely capture of an individual's health status. This may also increase a parent's understanding of their child's needs.

Flu vaccination

Another opportune time to upload a shared health summary is when offering the flu vaccination. Many of the high-risk patients to whom your practice offers the flu vaccination may also benefit from the creation of a shared health summary to manage their health.

Under the My Health Records Act, healthcare providers are authorised to upload information to the My Health Record system. Generally, this means that they do not need to obtain consent prior to uploading information to the system when providing services to a patient. However, patients can request that particular information is not uploaded to their record, and healthcare providers must comply with such requests. There are some other situations where documents should not be uploaded.

It may be good practice to advise a patient that you will be uploading information to their My Health Record, particularly if this information might be considered sensitive.

However, there is no requirement for the patient to review the shared health summary before it is uploaded to their My Health Record.

Can I charge for uploading a shared health summary?

In billing the Medicare Benefits Schedule (MBS), healthcare providers are able to take into account the time taken to register patients for a My Health Record, and prepare shared health summaries and event summaries if these activities are undertaken as part of providing a clinical service and the patient is present at the time. These activities are considered to be part of the documentation of treatment of the patient. See MBS Online for information on item numbers relevant to actions related to a patients' My Health Record, which can be found by searching for "PCEHR" on the MBS website.

Can I edit or delete a shared health summary once it is uploaded?

The author of a clinical document can delete a clinical document from the My Health Record system if, for instance, it has been uploaded in error or contains a mistake.

If a nominated healthcare provider wishes to change the information in their patient's shared health summary, e.g. the medicines listed, they will need to upload a new shared health summary with the updated information.

Note that there is no additional responsibility for a nominated healthcare provider to prepare a shared health summary outside of a consultation with the patient.

Sections 4.5.3 and 5.4 of the AMA's Guide to using the My Health Record system provide recommendations to medical practices in these and related areas.

How do I create and upload a shared health summary?

Clinical software simulators

There are a range of clinical software simulators or ‘sandboxes’ with which you can simulate creating and uploading a shared health summary to a fictional patient’s My Health Record. The software simulators include: Bp Premier, MedicalDirector, Zedmed, Genie, and Communicare.

Access clinical software simulators