Health Records

Please find below responses to questions Speech Pathology Australia (SPA) members frequently ask about health records.

Please note: The Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Privacy Amendment Act) made many significant changes to the Privacy Act 1988 (Privacy Act). These changes commenced on 12 March 2014.

The Privacy Act now includes a set of 13 new privacy principles that regulate the handling of personal information by Australian and Norfolk Island Government agencies and some private sector organisations. These principles are called the Australian Privacy Principles (APPs). For more information about the Privacy Amendment Act (2012) go to The Privacy Act (2012) and SPA's Private Speech Pathology Practice Privacy Guide (2014).

Please note: for the purpose of this document the term “health information” is used to describe the information you record in a client’s file and the term “health record” is used instead of “client file”.

What constitutes health information?

Health information includes any information collected by a health service provider during the course of assessing, treating or caring for an individual, including:

  • medical information;
  • personal details, such as a name, address, admission and discharge dates, billing information and Medicare number; and
  • information generated by a health service provider, such as notes and observations about an individual and their health and the service to be provided to the individual.

Should “working notes” be included in the health record?

Technically all notes should be included in the health record, however, the speech pathologist needs to be aware that if the information is written in the record (and it is not exempt under APP12) then the person to whom the information relates would be able to access the information. This information would also be required to be produced in a court if a subpoena is issued for the health record. Working notes containing subjective comments or observations or information provided to the speech pathologist by a third party (e.g., parent/carer or other health professional) that is not actioned by the speech pathologist or relevant to the care provided to the client should not be included in the health record.

Should I record any other information in my notes?

It is recommended that the following information is also recorded in a client’s progress notes:

  • date of therapy (and date when you wrote the client notes if it is different from the date you saw the client).
  • Where the session was held.
  • Who attended the session and for how long they were in that session e.g. parent might have been in the waiting room for part of the session.

This information is particularly helpful if you have to provide evidence in legal proceedings e.g. custody matter before the Family Court about a parent’s level of involvement in speech therapy.  

What legislation governs the collection, storage, use and disclosure of personal health information in Australia?

The Privacy Amendment ((Enhancing Privacy Protection) Act 2012 amends the Commonwealth Privacy Act 1988 (‘the Privacy Act’) to establish minimum privacy standards that will apply to both organisations and Australian Government agencies. The Privacy Act creates a single, nationally consistent framework for protecting privacy. See further information about Privacy law reform on the Office of the Australian Information Commissioner (OAIC) website. Thirteen Australian Privacy Principles (APPs) from the Privacy Amendment Act (2012) set the minimum standards for privacy that organisations must meet. See the attached Fact Sheet from the OAIC about the Australian Privacy Principles (March 2014).

The Privacy Act regulates how personal information is handled. For example, it covers:

  • how personal information is collected (e.g. the personal information a client provides when they fill in a form) and managed
  • how it is then used and disclosed
  • its quality
  • how securely it is kept
  • a client’s general right to access that information.

Should I have a Privacy Policy that provides information to the client about collection of, access to, disclosure of and retention of their health record?

Yes. Please see SPA's Private Speech Pathology Practice Privacy Guide (2014) for information about how to develop a Privacy Policy.

Who “owns” the health record?

The Privacy Act (1988) does not affect ownership of health information but gives the individual about whom the information relates the right to access to that information. Therefore, the private practitioner retains the information in the health record and provides information to the individual upon request.

Who retains/stores the health record if the private practitioner is employed/contracted by a third party (e.g., a school)?

This would be decided by the contractual arrangements between the employer and the contractor/employee. In practice it is usually the speech pathologist.

What happens if a report has been commissioned /paid for by a third party?

The speech pathologist should provide an original copy of the report to the third party and should retain a copy for their records.

Can a health record include (or consist solely of) scanned or electronic information?

Yes. A health record may be kept in electronic form, but only if it is capable of being printed on paper if required.

Can I dispose of assessment record forms or notes if I have scanned them and saved them electronically?

Yes. As long as the assessment record forms or notes can be reproduced in hard-copy if required. Blank assessment forms may not be stored electronically All information must be stored on pass word protected sites. APP 11 requires any person who holds personal information to take reasonable steps to protect the information from misuse, interference and loss and from unauthorised access.

If I’m seeing a child whose parents are divorced or separated who am I able to provide information to?

Under current law both parents have equal rights to information about a child who is a minor, unless the right has been legally removed from one parent*. If a speech pathologist is unsure whether there are orders against one parent they can contact the Family Court for assistance.

*Upon intake it should be standard practice to ascertain if there are any Court Orders related to the child. If the parents are separated or divorced the speech pathologist should explain to the parent bringing the child that information can be provided to the other parent upon request from that parent (regardless of who is bringing the child or paying for the service).

For more information see the Family Law Courts of Australia’s information about Parenting orders – obligations, consequences and who can help.

If requested, do I have to provide a client access to the health information in their health record?

Yes. If a speech pathologist holds health information about an individual, she/he must provide the individual with access to the information on request by the individual. APP sets out a number of circumstances where access to a client’s personal information or records may be denied. One exception to giving access is if you reasonably believe that giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety. Please note: this only applies to information which has been collected, used or disclosed after 21 December 2001 and any information collected before that date that is currently still in use.

See APP 12 for more information about how a client can access their records.

Do I have to provide information to the individual if it comes from another health service provider or if it is marked confidential?

Yes, unless one of the exceptions under “APP 12.3 – Access to, and correction of, personal information” applies.

How do I provide access to the health information?

Access may be provided in a number of different ways.

For example, an individual may:

  • look at the information and talk through the contents with their health service provider;
  • obtain a copy of the information (for example, a photocopy in the case of paper records) or take notes on the content;
  • listen to or view the contents of an audio or video recording; or
  • obtain a print-out of the information if it is stored electronically; or
  • be given an electronic copy of the information.

In the health sector, often it may be helpful to provide the individual with an opportunity to discuss their health information when access is sought. This may prevent the information being misunderstood or taken out of context. It may also save unnecessary hurt or distress for the individual if the information is potentially upsetting.

The Privacy Act provides that clients can access their information without cost. However, reasonable copying expenses can be passed on so long as the amount charged is not perceived as discouraging the client’s access. It is a good idea to let your client know about these costs at the time of outlining your practice’s Privacy Policy.

I am a contractor, who is responsible for retaining the health record?

This arrangement is typically included in the contract between the business owner and contractor. The business owner is usually responsible for storing and retaining a client’s health record. Clients then know that they can access their records through the business and do not have to “find” the independent contractor.

I am selling (or closing) my business. What happens to the health record?

Please refer to SPA’s FAQs document - Closing or Selling a Speech Pathology Practice for more information.

How long do I need to retain the health record for?

Please refer to SPA’s Information Sheet – Health Records: retention of client files for more information.

How do I need to store the health record?

Health records must be stored in a secure place which can only be accessed by authorised personnel. APP 11 requires any person who holds personal information to take reasonable steps to protect the information from misuse, interference and loss and from unauthorised access, modification or disclosure.

How do I dispose of a health record?

It is important to ensure that information that is no longer needed for any purpose is destroyed or de-identified properly. Health records are disposed of in such a manner that will preserve the confidentiality of any information they contain relating to any person.

Please note: If you delete or dispose of health information you must keep a record of the name of the individual to whom the health information related, the period covered by it and the date on which it was deleted or disposed of.


Original August 2011

Updated February 2013, March 2014, June 2016, September 2016

Disclaimer: To the best of the Speech Pathology Association of Australia Limited’s (“the Association”) knowledge, this information is valid at the time of publication. The Association makes no warranty or representation in relation to the content or accuracy of the material in this publication. The Association expressly disclaims any and all liability (including liability for negligence) in respect of the use of the information provided. The Association recommends you seek independent professional advice prior to making any decision involving matters outlined in this publication.


Download a PDF version below. This graphic is associated with the hyperlink that precedes it and indicates the document is in PDF.

Health Records
(Adobe PDF File)