How to Access Medical Records in Western Australia

Western Australia's public hospitals now sit under a genuine information-privacy law for the first time, the Privacy and Responsible Information Sharing Act 2024, which commenced its access-to-personal-information right on 1 July 2026; private WA providers still have no state Act at all and rely entirely on the federal Privacy Act 1988's APP 12.

Which law covers your provider

Public WA Health hospitals and services are now covered by two overlapping regimes. The Privacy and Responsible Information Sharing Act 2024 ("PRIS Act"), which received royal assent in December 2024, commenced the bulk of its substantive provisions, including its Information Privacy Principles, on 1 July 2026. Its Information Privacy Principle 6 gives an individual a right to access personal information a public entity holds about them, and section 6 of the Act confirms WA Health Service Providers, constituted under the Health Services Act 2016, fall within its scope. The pre-existing Freedom of Information Act 1992 (WA) remains the vehicle for non-personal-information hospital documents, such as incident reports, and the two regimes are formally linked: an FOI application that meets the FOI Act's requirements for your own personal information is automatically treated as a request under the new privacy law instead, so you do not need to choose between them for your own record.

Private providers (a GP clinic, a specialist's rooms, a private hospital) fall outside the PRIS Act entirely. Section 6 of the Act defines "public entities" without any private-sector limb, and this is corroborated independently: WA has never had a state-based private-sector privacy Act, before or after the 2024 reform. Private providers in WA rely entirely on APP 12 of the federal Privacy Act 1988, unchanged by the state reform.

Separately, the Health Services Act 2016 (WA) imposes its own confidentiality duty on staff acting under the Act, backed by a flat $5,000 penalty. This is a duty on staff not to disclose your information improperly, not a mechanism you use to request your own record, and disclosure with your own consent is specifically authorised.

How to request

For your own personal information from a public WA Health entity, an FOI-style application (written, identifying the information sought, giving an Australian address) is treated as a request under the new privacy law's IPP 6, whichever Act you apply under. For non-personal-information hospital documents, apply under the Freedom of Information Act 1992 directly. No system-wide "administrative access" scheme comparable to Queensland's was located for WA Health at the time of research; individual hospital pages describe the formal FOI-style route as the primary path.

Who can request

You can request your own information directly. For a child, a guardian, or a person with custody and care and control, may apply on the child's behalf; for a person with disability, their chosen representative or, where they cannot choose one, a guardian, relative, de facto partner, or a person the agency considers has sufficient interest may apply. For a deceased patient, WA's position is notably narrower than some other states: a deceased individual's personal information is presumptively exempt from FOI Act disclosure, even to a next-of-kin applicant, unless the public interest favours release, and WA has no equivalent to Queensland's automatic "sufficient interest as if alive" rule for next-of-kin. A deceased person's nearest relative may separately apply to amend, though not access, personal information about the deceased.

Timeframes

The new privacy law sets a 45-day response period at IPP 6.8, running from the day the request is made. The Freedom of Information Act 1992 sets the same 45-day "permitted period" at section 13(3); no notice within that window is treated as a deemed refusal, triggering your review rights. Private providers, governed instead by APP 12 of the federal Privacy Act, must respond within "a reasonable period," a standard rather than a fixed number of days, since APP 12 sets a hard 30-day deadline only for federal government agencies, not for private organisations.

Fees

Accessing your own personal information from a public WA Health entity is free, direct from the Freedom of Information Act 1992 itself: section 75(2)(d) states no charge may be made for providing an applicant with access to personal information that relates to the applicant. A $30 fee is mentioned for non-personal-information FOI requests, plus possible photocopying or staff-time charges, though that $30 figure comes from hospital web pages rather than the Freedom of Information Regulations 1993 themselves, so treat it as broadly indicative rather than a guaranteed current amount. A private provider cannot charge you to make a request, and any charge for providing the record must not be excessive, under APP 12.8 of the federal Privacy Act.

Grounds for refusal

Under the new privacy law's IPP 6.1, a public entity can decline access where there is a danger to someone's life or safety, in family-violence-perpetrator situations, where release would unreasonably affect a third party's privacy, where the request is frivolous or vexatious, or where the material would not be discoverable in anticipated legal proceedings. Under the FOI Act, a deceased person's personal information is presumptively exempt, and broader exemption categories can also apply. A private provider can refuse only under the narrower list in APP 12.3 of the federal Privacy Act, covering grounds such as a serious safety threat, unreasonable impact on someone else's privacy, or a frivolous or vexatious request.

Complaints and review

For a public WA Health entity, both regimes route to the same office: internal review is free and must be sought within 30 days, and external review, for either an FOI Act refusal or a privacy complaint about how a public entity handled your information under the new Act, goes to the WA Information Commissioner. The Health and Disability Services Complaints Office (HaDSCO) handles complaints about the standard or quality of health, mental health and disability services in WA, not records-access disputes, so it is not the right destination for a refused access request. For a private provider governed by APP 12, complaints instead go to the Office of the Australian Information Commissioner (OAIC).

If you're dealing with a workplace injury, see our Western Australia workers compensation guide for how medical evidence fits into a claim, and our Western Australia enduring power of attorney guide for who can make health decisions, and request records, on someone else's behalf. For the national picture across every state and territory, see the Australia medical records hub.