Australian Capital Territory · Health Records (Privacy and Access) Act 1997

Two weeks to answer, 30 days to give access — both clocks, tracked

For ACT health service providers and every record keeper of a health record, public or private — AccessPoint runs Part 3 access on both statutory clocks, the determined fees, the nominated health service provider process, principle 7 correction, and complaints to the ACT Human Rights Commission.

Start Free Trial Request a Demo

Australia — ACT Health Records Act at a glance

First response: Within 2 weeks — written notice of a refusal or of the fee, or access itself (s.13(2))
Access deadline: No later than 30 days after the request, or 1 week after the fee is paid if that is later (s.13B)
Extensions: Only a longer period agreed with the consumer (s.9); a missed step is taken to be a refusal (s.13D)
Fees: Set by ministerial determination — $18.95 to inspect, $52.10 for a hard copy of up to 50 pages
Breach duty: None in the Act
Review: ACT Human Rights Commission complaint; Magistrates Court orders

Governing legislation

Health Records (Privacy and Access) Act 1997

A1997-125 (ACT)

Gives the Schedule 1 privacy principles the force of law (s.5) and a consumer a right of access to health records (Part 3), binding every record keeper — any entity with possession or control of a health record

Health Records (Privacy and Access) (Fees) Determination 2025 (No 1)

DI2025-302, in force from 1 January 2026

The fees for inspecting, copying and summarising a health record, with waiver for hardship and a 50% discount for health card holders

Declarations and orders

HRPA s.31

The Magistrates Court may declare a person's status under the Act, whether something was validly done, or make any other order on a matter arising under it

Oversight

ACT Human Rights Commission

Complaints that a record keeper contravened the privacy principles or refused access go to the ACT Human Rights Commission (s.18), whose Health Services Commissioner deals with health-records complaints and usually seeks to resolve them by conciliation. Binding declarations and orders on matters arising under the Act come from the Magistrates Court (s.31), with an appeal to the Supreme Court as of right (s.32).

Built for Australia — ACT Health Records Act

One platform for the whole access-and-privacy mandate, pre-configured for this regime and running in your own Microsoft 365 tenant.

Two clocks, not one

Within 2 weeks the record keeper must refuse in writing, state the fee, or give access; access itself is due within 30 days. AccessPoint computes both dates on receipt and tracks the 2-week notice as closely as the access date.

Determined fees, stated up front

A fee can be charged only by stating it in the 2-week notice, and it cannot exceed the determined fee. The pack carries the current determination's fees, the hardship waiver and the health card discount, and moves the access date to 1 week after a late payment.

Grounds and prohibitions, kept apart

Section 14 sets the grounds for nonproduction; sections 14A, 15 and 17 prohibit access outright. Each notice must state the ground or the section relied on, and give access to the rest of the record. The catalogue keeps the two kinds distinct and citable.

Nominated health service providers

After a refusal for significant risk to the consumer's own health, the consumer may nominate a health service provider, who must receive the record within 2 weeks unless the record keeper objects in writing. The consultation is a dated stage on the case.

Principle 7 correction

Information is never deleted outside a program of archival destruction. Make reasonable corrections and additions, include the consumer's written statement where you will not amend, and move harmful incorrect entries to a restricted record.

In your own tenant

Health records, requests and audit history stay inside your own Microsoft 365 and Azure tenant — no third-party cloud and no vendor access.

Agreement is the only extension

The ACT gives a record keeper no power to take longer — only a longer period the consumer agrees to.

The Health Records (Privacy and Access) Act sets two short deadlines and almost no way around them. A written answer is due within 2 weeks and access within 30 days, and a record keeper that misses either is taken to have refused access — which is itself a ground of complaint to the ACT Human Rights Commission. The one flexibility the Act allows is an agreement with the consumer to do something within a longer period (s.9); done in accordance with that agreement, the step is taken to have been done on time. That makes the agreement part of the legal record, not a courtesy email. AccessPoint records the agreed date on the case as the extension, keeps the 2-week notice and the fee on the same timeline, and shows the commission exactly what was promised and when it was met.

2 weeks, then 30 days Both statutory clocks, computed on receipt.

Agreed, in writing The s.9 longer period, recorded as the extension.

Complaint-ready What was asked, answered and given, in order.

Configured out of the box

Installing the au-act-hrpa jurisdiction pack seeds your tenant with everything this regime needs. It is a starting point built from public information about the legislation, not legal advice — your legal counsel validates and adjusts it for your tenant.

Pack content last reviewed: 2026-10-20

The Health Records (Privacy and Access) Act 1997 as the legal-authority spine, with the Schedule 1 privacy principles
Part 3 access on the 2-week response and 30-day access clocks, with ACT public holidays
The s.14 grounds for nonproduction and the ss.14A, 15 and 17 prohibitions, colour-coded for redaction
A clock pause while evidence of identity or authority is outstanding
The s.9 agreed longer period and the 1-week-after-payment rule as extension reasons
The determined access fees, with the hardship waiver and the health card discount
The nominated health service provider process after a risk-to-health refusal
Principle 7 correction, with the consumer's statement where you decline to amend
Human Rights Commission complaints and Magistrates Court applications
Letters for acknowledgement, fee notice, access given or not given, correction decisions and an agreed longer period

A jurisdiction pack's detail panel in AccessPoint settings, showing the pack description, version, what's new, and the checklist of items it imports: legal authorities, calendars, request statuses, request types, extension reasons, requestor categories and consultation types — What a pack looks like in Settings (the Ontario municipal pack shown): the description, the version and what changed in it, and every item it imports with its statutory basis. Anything you have customized is never overwritten on update.

Australia — ACT Health Records Act Questions

Who does the Act apply to?

Every record keeper of a health record in the ACT — an entity with possession or control of a health record — and the health service providers and collectors the Act names, in the public and private sectors alike. The privacy principles in Schedule 1 have the force of law, and a person to whom one applies must not contravene it without lawful authority (ss.5–6).

What are the deadlines for an access request?

Within 2 weeks after receiving the request, the record keeper gives written notice that it will not give access (stating the ground or the prohibiting section), gives notice of the fee payable, or gives access (s.13(2)). Access is due no later than 30 days after the request, or 1 week after a notified fee is paid if that is later (s.13B). A longer period is possible only by agreement with the consumer (s.9), and a missed step is taken to be a refusal (s.13D).

What can we charge for access?

Only the fees the Minister determines under s.34. Under the determination in force from 1 January 2026 (DI2025-302): $18.95 to view a record, $52.10 for a hard copy of up to 50 pages plus 45 cents a page beyond that, $18.95 for electronic delivery, $108.40 for a summary, and no fee for a copy needed for continued treatment. Fees may be waived for hardship, and health card holders pay 50%.

Does the Act require us to notify data breaches?

No — the Health Records (Privacy and Access) Act has no breach-notification duty. A private sector provider that is an APP entity under the Privacy Act 1988 (Cth) notifies eligible data breaches under the Commonwealth Notifiable Data Breaches scheme — see Australia — Privacy (APPs). Every record keeper still owes the security safeguards in principle 4.1, so AccessPoint records each incident and the assessment behind it.

How does this pack relate to the ACT FOI pack?

The ACT pack (au-act, at /solutions/australia-act) runs Freedom of Information Act 2016 requests and Information Privacy Act 2014 matters for ACT public sector agencies. This pack adds the Health Records (Privacy and Access) Act's own request types, fees, refusal grounds, letters and complaint routes, for public and private record keepers. An agency that holds health records can install both.

Where does health information reside?

Entirely within your own Microsoft 365 and Azure tenant, in the Australian region you choose. Requests, records, decisions and audit history never leave your control — no third-party cloud and no cross-border data transfers.

Go deeper

Flat annual pricing, published in full. Every feature in every size — access requests, privacy impact assessments, breach response, complaints, video & audio redaction, the public portal, repository connectors, and AI Assist. No per-user or per-module fees.

Under 500 employees$2,990/yr
500–1,999 employees$7,990/yr
2,000–9,999 employees$14,990/yr
10,000+ employees$29,990/yr

See full pricing Build the business case

Run the ACT Health Records Act in Your Own Tenant

Try AccessPoint free for 30 days, configured for ACT health records. No credit card required.

Start Free Trial Request a Demo