New South Wales · Health Records and Information Privacy Act 2002
Health records access in NSW, answered before silence becomes a refusal
For NSW private hospitals, practices and allied health providers, and for the public sector agencies that hold health information — AccessPoint runs Part 4 access and amendment on the 45-day clock, HPP 7 and HPP 8 for agencies, and complaints through the Privacy Commissioner, internal review and NCAT.
Australia — NSW Health Records (HRIP Act) at a glance
- Access deadline (private sector)
- 45 calendar days to give or refuse access; no response is taken to be a refusal
- Agencies
- HPP 7 access without excessive delay or expense — the IPC recommends a response within 28 calendar days
- Amendment
- 45 days for private sector persons, with a notation added on request where amendment is refused
- Fees
- No application fee; a charge for access is allowed but must not be excessive
- Breach duty
- None in the HRIP Act — agencies notify under PPIP Part 6A, APP entities under the Commonwealth scheme
- Review
- Privacy Commissioner, then NCAT; agencies by internal review, then NCAT
Built for Australia — NSW Health Records (HRIP Act)
One platform for the whole access-and-privacy mandate, pre-configured for this regime and running in your own Microsoft 365 tenant.
45 days, and silence is a refusal
A private sector person has 45 calendar days to give or refuse access. A holding letter is not a response under the Act, so AccessPoint tracks the one event that stops the clock — the decision — against a due date computed on receipt.
Two routes on one register
Private providers answer under Part 4; agencies answer under HPP 7 and HPP 8, where an applicant can also choose a GIPA application. Each request runs on the right route, with its own clock, from the same intake.
Serious-threat refusals, handled properly
Where access would pose a serious threat to the patient's life or health, the refusal must offer access through a registered medical practitioner they nominate within 21 days. The letter and the follow-through are part of the case, not an afterthought.
Amendment, notation and statement
Record whether information was amended or the request refused with written reasons. Where it was refused, track the notation the individual can require to be added, so it travels with the record to later recipients.
Complaints that can end at NCAT
Run Privacy Commissioner complaints, agency internal reviews and NCAT proceedings with their filing windows. The decision record, the refusal ground and the evidence behind it are already assembled when a tribunal asks for them.
In your own tenant
Health information, requests and audit history stay inside your own Microsoft 365 and Azure tenant — no third-party cloud and no vendor access.
One Act, two kinds of organisation
The HRIP Act binds a suburban practice and a government agency alike — on different access rules.
Many privacy laws pick a sector. The HRIP Act covers every organisation in New South Wales that provides health services or holds health information, and then splits the machinery. A private hospital or general practice answers access and amendment requests under Part 4, on a fixed 45-day clock that treats silence as a refusal. A public sector agency answers under HPP 7 and HPP 8, where the Act sets no period and the IPC recommends 28 days, and where the applicant can choose a GIPA application instead. Complaints split the same way — the Privacy Commissioner for private sector persons, internal review for agencies — and so do data breaches, because the HRIP Act has no notification duty of its own. AccessPoint keeps both routes on one platform, each with its own request type, clock, refusal grounds and letters.
Configured out of the box
Installing the au-nsw-hrip jurisdiction pack seeds your tenant with everything this regime needs. It is a starting point built from public information about the legislation, not legal advice — your legal counsel validates and adjusts it for your tenant.
Pack content last reviewed: 2026-10-20
Related guide: Business Days vs. Calendar Days: Deadline Math- The HRIP Act as the legal-authority spine, with the 15 Health Privacy Principles
- Part 4 access and amendment request types on the 45-calendar-day clock with NSW public holidays
- HPP 7 access for agencies on a 28-day target, and HPP 8 amendment with an internal target you set
- The s.29 grounds for refusing access, colour-coded for redaction and citable line by line
- The s.27(4) fee notice, with access due 7 days after payment
- The serious-threat refusal letter offering access through a nominated medical practitioner
- Privacy Commissioner complaints, PPIP internal reviews and NCAT inquiries and reviews, with their tribunal filing windows
- Letters for acknowledgement, fee notice, access given or refused, and amendment made or refused
- A playbook on retention, the 15 HPPs and which breach-notification scheme applies
Australia — NSW Health Records (HRIP Act) Questions
Who does the HRIP Act apply to?
How long does a private provider have to answer an access request?
Does the HRIP Act require us to notify data breaches?
How does this pack relate to the New South Wales GIPA pack?
Where does health information reside?
Go deeper
Flat annual pricing, published in full. Every feature in every size — access requests, privacy impact assessments, breach response, complaints, video & audio redaction, the public portal, repository connectors, and AI Assist. No per-user or per-module fees.
- Under 500 employees$2,990/yr
- 500–1,999 employees$7,990/yr
- 2,000–9,999 employees$14,990/yr
- 10,000+ employees$29,990/yr
Run the HRIP Act in Your Own Tenant
Try AccessPoint free for 30 days, configured for New South Wales health records. No credit card required.