Pharmacy Health Record Access Requests: A Practical Workflow

Pharmacy health record access requests need a clear owner, identity and authority checks, a search of held information, an appropriate decision and controlled delivery. A routine printout is only one possible outcome.

A patient may ask for information at the counter without calling it a privacy request. Staff should recognise the task and connect it to the pharmacy’s approved process.

This guide concerns information the pharmacy holds or controls. It does not assume access to every record held by another provider or by My Health Record.

Recognise pharmacy health record access requests

A request might concern a specific transaction, communication or a wider health record. Record when it arrived, what the patient seeks and how they want access.

OAIC’s health privacy guide includes pharmacists. Its access guidance applies federal privacy principles in the health service setting, while additional local requirements may also matter.

Under OAIC’s health access guidance, you may suggest a form or procedure but cannot require the patient to use that particular process.

Train counter and telephone staff to pass requests to the responsible owner. An informal question should not disappear because it arrived outside the preferred written channel.

Ask for clarification where the scope is unclear. Confirm whether the patient wants a copy, an explanation, inspection or another practicable form of access.

Record the response period from receipt

APP 12 requires organisations to respond within a reasonable period. OAIC guidance says this should generally not exceed 30 calendar days.

That is the OAIC’s general guidance on reasonableness, rather than a universal fixed statutory deadline. Check any additional state or territory requirements relevant to your pharmacy.

Record the receipt date and a review point early enough to identify delays. Give the patient a clear contact for questions about progress.

If records are difficult to locate, escalate the problem promptly. Do not assume clarification or identity enquiries automatically restart the response period.

Avoid promising a delivery date before checking scope and available records. Explain any emerging difficulty and obtain advice about the required response.

Verify identity and authority proportionately

Confirm that the request concerns the patient or an authorised representative. Treat the representative’s identity and authority as separate questions.

APP 12 guidance recommends collecting only necessary identity information. Match the check to the circumstances rather than copying identification documents by default.

A familiar telephone number does not prove who is speaking. Use the pharmacy’s approved process before disclosing patient-specific information.

Requests involving children, capacity, guardianship or unclear authority need appropriately qualified review. Do not make a family relationship the sole basis for disclosure.

For a third-party request, establish the authority and its scope. A request for one part of a record should not silently become permission for the whole file.

Record the verification outcome and restrictions in a controlled location. Avoid leaving identification details in a general task list visible to unrelated staff.

Search the information the pharmacy holds

The health access guide explains that holding information includes possession or control. That can include records stored by a third party on your behalf.

Map the likely sources before deciding the request is complete. Consider approved clinical systems, transaction records, relevant communications, paper files and authorised external storage.

Ask relevant staff or contractors where responsive information is held. A search of one convenient system may leave part of the requested record undiscovered.

Record the locations searched, the person searching and unresolved gaps. Keep the patient’s clarified scope visible to each authorised searcher.

Information received from another provider is not automatically outside the request. Consider what the pharmacy holds and any lawful refusal ground through qualified review.

Do not export a whole shared database to make the search easier. Use authorised tools and limit the working copy to the information needed for the review.

Review access and format before delivery

Review point	Question for the responsible owner	Outcome to document
Scope	Does the material answer the actual request?	Included information and unresolved gaps
Identity and authority	Is the proposed recipient entitled to this access?	Verification and authorised scope
Other people’s information	Does release raise another person’s privacy issue?	Qualified decision and any justified redaction
Requested format	Is this form reasonable and practicable?	Agreed format or explained alternative
Refusal or limitation	Does a lawful ground apply?	Reasons, alternatives considered and required notice
Delivery	Is the channel and destination suitable?	Checked recipient, method and release record

This table is an operating prompt, not a replacement for the refusal criteria. Refer uncertain decisions to the responsible privacy lead or qualified adviser.

APP 12 provides grounds and procedures for refusing or limiting access. Consider alternative access. If access is refused or not given in the requested manner, issue the required written notice with complaint mechanisms. Include reasons subject to the provision’s exception where explaining them would be unreasonable.

Avoid treating staff discomfort or an anticipated complaint as sufficient grounds to refuse access. The responsible decision-maker needs an applicable basis and a recorded explanation.

Where another person’s information raises concerns, assess the relevant scope and alternatives. Do not automatically refuse the entire request because one part needs review.

Give access through a controlled channel

Confirm the agreed format and check the destination before release. Consider accessible communication needs through the customer service guide.

Use approved delivery methods with appropriate access controls. APP 11 requires reasonable protection against unauthorised disclosure by APP entities.

Check the prepared material against the approved scope and decision. A correct identity check cannot prevent an accidental attachment of the wrong record.

Record what was released, to whom, when and through which method. Keep any working exports subject to approved retention and disposal controls.

If giving access attracts a charge, explain the proposed amount and basis before proceeding. APP 12 prohibits a request fee and excessive giving-access charges.

Do not treat payment administration as permission to ignore the required response. Obtain advice where cost, format or local rules create uncertainty.

Handle a correction as a separate recorded task

The patient may identify an incorrect detail after seeing the material. Record that correction request and route it to the responsible person.

APP 13 addresses correcting personal information, including refusal procedures and associated statements. It prohibits charges for the correction request, correction or statement association.

Preserve the distinction between correcting an inaccurate fact and disagreement with a professional opinion. Seek qualified review rather than rewriting clinical notes administratively.

Where correction is made, assess any required steps concerning previous recipients. Keep the decision, changes and communications traceable through the approved record process.

Use the callback workflow if a follow-up conversation is needed. Administrative closure should state the actual access or correction outcome.

The final record should show both the response and any continuing action. A message sent is not, by itself, proof that the request was properly resolved.