How to Access Medical Records in Victoria: HR Act and FOI Explained

In Victoria, which Act applies depends on which sector holds your record: the Health Records Act 2001 covers private providers directly with a 45 day response deadline, while public hospital records generally go through the Freedom of Information Act 1982.

Which Law Covers Your Records in Victoria

Victoria is a genuine dual-sector state. The Health Records Act 2001 (Vic) covers the health, disability and aged care information handled by a wide range of public and private sector organisations, including health service providers, companies, incorporated associations, local government, Victorian Government agencies and departments, public hospitals and other public bodies, and the Victorian Department of Health states plainly that "there is no small business exemption." That is the single biggest difference from the federal-only default other states rely on for their private sector.

What makes Victoria distinctive is that the access route is not simply "public sector versus private sector," it is which Act you invoke. Private sector requests, and informally handled public sector requests, go through the Health Records Act 2001 directly, under Health Privacy Principle 6, and are administered by the Health Complaints Commissioner (HCC). Formal public sector requests, public hospitals, WorkSafe, maternal and child health services, public schools, are instead subject to the Freedom of Information Act 1982 (Vic). This is not an absolute wall, though: Victoria's privacy regulator, OVIC, confirms in its own practice note that public hospitals can and are encouraged to release records informally under Health Privacy Principle 2.2(b), where a patient's request is treated as implied consent, rather than forcing every request through formal FOI, and agencies can waive the application fee and access charges when they do.

The regulator split is confirmed and worth knowing before you complain to the wrong body: the HCC administers the Health Records Act 2001 and handles all health information complaints, public and private. OVIC administers the Privacy and Data Protection Act 2014, which covers non-health personal information for the Victorian public sector, plus FOI generally, but OVIC has no jurisdiction over private sector health information, that stays with the HCC.

Victoria's Health Records Act does not replace the federal layer either. The Office of the Australian Information Commissioner confirms that "in NSW, Victoria and the Australian Capital Territory (ACT) private sector health service providers must comply with both Australian and state or territory privacy laws when handling health information," meaning the Health Privacy Principles apply on top of Australian Privacy Principle 12, not instead of it. See our guide to the Australian Privacy Principles for how that federal layer works on its own.

Who Can Request Access

The patient can request directly under Health Privacy Principle 6. A lawyer or other authorised representative can request on the patient's behalf with written evidence of their authority. For deceased patients in the private sector, the Act's definition of "legal representative" is narrow, either an executor with probate already granted, or an estate administrator; next of kin alone has no automatic right, a gap significant enough that a reform petition on exactly this point has been before the Parliament of Victoria. Rules for minors and guardians exist under the Act but the exact statutory wording could not be independently confirmed this session; treat any specific age threshold you see elsewhere as a general medical consent convention rather than confirmed Health Records Act text.

How to Request Your Records

For a private sector or informal Health Records Act request, an informal approach by phone, in person, or by letter is accepted, though you may be asked to put it in writing. Include your name, address, date of birth, a description of the information sought, and whether you want to inspect it, receive a copy, get a summary, or have it explained to you. There is no prescribed statutory form. A formal public sector FOI request must be written and clearly describe the documents you are seeking.

Timeframes

For the private sector under the Health Records Act 2001, the deadline is confirmed directly from the Health Complaints Commissioner's own official fee-determination document: "the HR Act requires an organisation to respond to a request for access not later than 45 days from the date it received the request." Once you are notified in writing of any fee, access must then be given within 7 days of payment. A separate, less strict rule applies to record transfers between providers (Health Privacy Principle 11), a 30 day "reasonable time" standard rather than a hard day count, this is a different situation from a patient requesting their own copy.

For the public sector under the Freedom of Information Act 1982, the deadline is 30 days, extendable to 45 days with the applicant's consent, or longer where third parties must be consulted. A missed deadline is treated as a deemed refusal, which you can take to VCAT or complain about to OVIC.

Fees

Two Health Complaints Commissioner fee schedules exist, an official FY2023-24 PDF and the current live web pages, and their year-over-year progression is internally consistent with the state's standard fee-unit indexation. As of the FY2023-24 published rates: a black and white A4 copy cost 20 cents a page; assessing and collating a file up to 2.5 fee units cost $39.70; retrieving information not at the usual place of business cost 1.2 fee units, or $19.10, per half hour; a summary sent to another provider ranged from 2.9 fee units per quarter hour, $46.10, up to 9.4 fee units, $149.50, with a 30 minute minimum charge. The most recent live HCC pages show higher figures, copying still 20 cents a page flat, assessment and collation now $42.00 to $50.10, supervision of inspection $20.20 to $20.70 per half hour, and a summary $48.70 to $50.10 per quarter hour up to $158.00 to $162.30. There is no fee for a correction request, in any year. Because the live HCC pages do not carry an explicit financial year label, always check the current HCC fee page directly and cite the year you are relying on rather than a bare dollar figure. The public sector FOI fee amount was not independently confirmed this session.

Grounds for Refusal

Under Health Complaints Commissioner guidance on the Health Privacy Principles, a provider may refuse access where it would pose a serious threat to the individual's life or health, was given in confidence by a third party who is not the individual or a provider, would unreasonably affect another person's privacy, would reveal the organisation's negotiating intentions, would be unlawful, or would prejudice an investigation, a law enforcement function, or current or anticipated legal proceedings. If refused on serious threat grounds, you can nominate another health service provider to review the decision instead, a safeguard confirmed on two separate HCC pages.

Complaints and Review

Victoria runs a three tier system. First, complain to the HCC, which is free and confidential for private sector and informally handled public sector complaints (phone 1300 582 113). Second, VCAT, but only reachable through an HCC referral, not a direct application; you must ask for that referral within 60 days of the HCC's notice, and there are no fees. Third, OVIC handles public sector FOI delay or refusal complaints and non-health public sector personal information complaints, but has no jurisdiction over private sector health information.

FOI Alternative for Public Hospital Records

The Freedom of Information Act 1982 (Vic) is the mandatory formal route for public hospital records per HCC guidance, carrying the 30 day statutory deadline described above, extendable to 45 days with consent, with VCAT reviewing a deemed refusal and OVIC handling delay complaints. In practice, informal release under the Health Privacy Principles runs in parallel and is actively encouraged by the regulator, so many public hospital requests are resolved without ever becoming a formal FOI application. For the national picture across every state and territory, see the Australia medical records hub.