Victoria · Health Records Act 2001
Victoria's Health Records Act, on a 45-day clock with no extension
For Victorian health service providers, private practices and other organisations holding health information — AccessPoint runs Part 5 access on the 45-day clock, HPP 6 correction within 30 days, the nominated-provider process for serious-threat refusals, and Health Complaints Commissioner complaints through to VCAT.
Australia — Victoria Health Records Act at a glance
- Access deadline
- 45 days to give access, a fee notice or written reasons — a missed deadline is taken to be a refusal
- Extensions
- None — the Act has no extension provision for access requests
- Fees
- None for lodging; access fees optional and capped by the Health Records Regulations 2023
- Correction
- A decision within 30 days (HPP 6.9), with written reasons for any refusal
- Breach duty
- None in the Health Records Act
- Review
- Health Complaints Commissioner, then VCAT
Built for Australia — Victoria Health Records Act
One platform for the whole access-and-privacy mandate, pre-configured for this regime and running in your own Microsoft 365 tenant.
45 days, no extension
Within 45 days the organisation gives access, a fee notice or written reasons for refusal. Where a fee is charged, access is due 7 days after payment or 45 days after the request, whichever is later. AccessPoint computes both dates and records which one applied.
Only the fees the regulations allow
No fee for lodging a request, no obligation to charge at all, and no fee above the prescribed maximum for the manner of access. A mental health and wellbeing service provider cannot charge for access to information from that service. The fee categories reflect each rule.
Serious-threat refusals and nominated providers
Where access is refused because it would seriously threaten the individual's own life or health, they may nominate a health service provider within 21 days, and the organisation gives the information to the nominee within 14 days unless it objects. Each step is a dated stage on the case.
HPP 6 correction in 30 days
Decide a correction request within 30 days and give written reasons for any refusal. Where correction is refused, associate the individual's statement with the information; where it is made, record who made it and when, and notify the providers who relied on the earlier version.
FOI routing for the public sector
Where a document is held by an FOI Act agency, access and correction run under the FOI Act instead. The pack's guidance points those requests to the Victorian FOI configuration, while the other Health Privacy Principles still apply to the agency.
In your own tenant
Health information, requests and audit history stay inside your own Microsoft 365 and Azure tenant — no third-party cloud and no vendor access.
A clock that only runs one way
In Victoria, a health records request still open on day 46 has already been refused.
The Health Records Act gives an organisation 45 days to give access, issue a fee notice or give written reasons for refusing — and no power to take longer. If it misses the deadline, the Act treats access as refused, and the individual can take that refusal to the Health Complaints Commissioner. From there a complaint can be referred to VCAT, which can order access and correction and award compensation of up to $100,000. For a busy practice or hospital records team, the risk is rarely a hard decision; it is a request that sat in an inbox while copies were gathered. AccessPoint starts the clock on receipt, keeps the fee notice and the refusal reasons on the case, and gives the team one view of every request against its date.
Configured out of the box
Installing the au-vic-hra jurisdiction pack seeds your tenant with everything this regime needs. It is a starting point built from public information about the legislation, not legal advice — your legal counsel validates and adjusts it for your tenant.
Pack content last reviewed: 2026-10-20
Related guide: Business Days vs. Calendar Days: Deadline Math- The Health Records Act 2001 as the legal-authority spine, with the 11 Health Privacy Principles
- Part 5 access on the 45-day clock over the Victorian public-holiday calendar, including the Friday before the AFL Grand Final
- HPP 6 correction on its 30-day decision period
- The access refusal grounds in ss.26 and 27 and HPP 6.1, colour-coded for redaction and citable line by line
- Fee categories reflecting the Health Records Regulations 2023 maximums, with no lodgement fee and the mental health service exemption
- The serious-threat refusal letter and the nominated health service provider process
- Health Complaints Commissioner complaints and VCAT hearings, with the 60-day referral window
- Letters for acknowledgement, a written request, fee notice, access, refusal and correction decisions
- A playbook on transfers between providers, retention, practice closure and which breach-notification arrangements apply
Australia — Victoria Health Records Act Questions
Who does the Health Records Act apply to?
How long do we have to respond to an access request?
Can we charge for access to health information?
Does the Act require us to notify data breaches?
We are a Victorian public sector body. Which pack do we use?
Where does health information reside?
Go deeper
Flat annual pricing, published in full. Every feature in every size — access requests, privacy impact assessments, breach response, complaints, video & audio redaction, the public portal, repository connectors, and AI Assist. No per-user or per-module fees.
- Under 500 employees$2,990/yr
- 500–1,999 employees$7,990/yr
- 2,000–9,999 employees$14,990/yr
- 10,000+ employees$29,990/yr
Run the Health Records Act in Your Own Tenant
Try AccessPoint free for 30 days, configured for Victorian health records. No credit card required.