Records access and management on closure of a medical practice

In July 2014, a Melbourne general practice made headlines when the Australian Privacy Commissioner found that it had breached the Privacy Act 1988 (Cwlth) by failing to properly secure patient medical records.1 The practice had relocated, leaving its records behind in a garden shed; when a thief broke in, the records became accessible to the public. The case raises the question of how patient medical records should be stored and transferred at the time of a practice closure or other change in operations, such as physical relocation or retirement of a practitioner. Significant changes to practice operations occur frequently in Australia due to corporatisation, relocation or retirement. This article outlines the legal and regulatory requirements that govern how patient records are to be managed in such circumstances.

Overlapping requirements

When a practice closes, its medical records are subject to enforceable legal, regulatory and professional standards and rules. In the Australian Capital Territory, New South Wales and Victoria, specific laws govern the management of medical and other practice records.2-5 In other jurisdictions, there are privacy and information management laws of general application, including the federal Australian Privacy Principles (which replaced the former National Privacy Principles on 12 March 2014). These overlapping laws necessitate compliance with the Australian Privacy Principles, as well as the relevant requirements of state or territory law. Relevant non-legislative regulation includes the code of conduct of the Medical Board of Australia (the Code),6 and the Royal Australian College of General Practitioners' accreditation standards (notably, standard 4.2)7 and Handbook for the management of health information in private medical practice.8 Other sources that are outside the scope of this article include practices' private contracts and contractual terms of service, such as for indemnity insurance and with medical centre service providers.

Regulations and laws

The definitions of medical records and patient health information are somewhat fluid. They can include consultation notes, correspondence, diagnostic referrals and results, patient-directed correspondence or information, financial and appointment records, as well as policies and procedures. Ambiguous or undocumented ownership of medical records and patient health information can create significant risk for practice owners and practitioners.

Professional standards regulation

Requirements for the disposal, transfer and access of records on closure or relocation of a medical practice place personal responsibilities on individual medical practitioners and duties on corporate medical practice entities. A recent high-profile case was clear in its finding that the practice's administrative services provider was responsible for the maintenance and control of up-to-date records.9

The Code advises careful health information management at all times, particularly at practice closure. Its provisions guide the assessment of medical practice in cases of disciplinary action against registered medical practitioners.6 According to Skene, “provisions of the Code may have legal effect, despite not being legislation or case law”, because they provide normative standards by which good medical practice is defined and against which accusations of questionable medical practice might be judged by the relevant disciplinary tribunal or admitted as evidence in court proceedings.10

Three statements in the Code are relevant here. At 8.4, it states that “[m]aintaining clear and accurate medical records is essential” to prevent unauthorised access, facilitate patients' right to access information contained in their records, and prompt facilitation of patient-initiated requests of health information transfer. Second, the Code at 3.13 stipulates that medical practitioners adequately inform patients of a decision to end a professional relationship; arrangements to ensure continuing care of the patient ought to “include passing on relevant clinical information”. This statement applies equally to the ending of a professional relationship in the context of the closure or transfer of a practice as to the end of a professional relationship that has become ineffective or compromised. The Code states at 3.15 that advance notice should be given with facilitation of continuity of care via the transfer of records at practice closure. In addition to these three requirements, medical practitioners must follow applicable health information law in their own jurisdictions, with the law taking precedence when the two conflict. In short, medical practitioners are obliged to comply with the Code's stipulations that medical practitioners are personally responsible for their patients' records.6

Privacy and practice management law

The ACT, NSW and Victoria each have specific laws that govern the closure of practices.2,4,5 The ACT's requirements are the most stringent, stipulating in Principle 11 that health practices which close, merge or relocate must inform ACT Health, publish a notice in a daily newspaper and give each consumer at least 30 days' notice.2 This requirement applies to each health service practice in the ACT, including the premises and operators where or through which a person provides health services.

In NSW, individual practitioners are personally responsible for breaches of the Health Practitioner Regulation (New South Wales) Regulation, while for medical corporations, a medical practitioner must be appointed personally responsible for the corporation's record keeping. In Victoria, the Health Records Act requires health service providers to publish a notice of closure and an explanation of their records management in a locally circulating newspaper. No advance warning of closure is required, but practices must comply with guidelines issues by the Health Services Commissioner.11

Where a practice closes without an identified practice to which records will be transferred, the requirements for record retention that apply in each jurisdiction remain, as do requirements of the Code while a medical practitioner remains registered and thus subject to the Code.

In short, despite the overlapping and complex nature of requirements for medical record storage, management and disposal at times of practice closure or major business disruption, the implications for patient continuity of care and practitioner responsibility are significant. Primary Health Networks might be well placed to facilitate record transfer or custody in similar cases of practice closure without transfer arrangements in place.