When someone asks for
the record

A subpoena is an order of a court. Patient consent is irrelevant to it, and a patient's objection does not excuse you from complying, because Australian Privacy Principle 6 permits a disclosure that is required or authorised by an Australian law or by a court order. You produce what the schedule describes, you produce it to the address stated on the subpoena rather than to whoever asked, and any argument about whether the material should be seen at all goes to the court.

An access request from the patient runs on Australian Privacy Principle 12 and, depending on where you practise, on state or territory health records legislation as well. A private practice must respond within a reasonable period, and the OAIC's guidance treats 30 calendar days as the outer edge of what is reasonable. The grounds for refusing are set out in the legislation and they are narrow, and a refusal has to be in writing, with reasons and with the ways the patient can complain.

A third-party authority attracts the least scrutiny of the three. The authority is the patient's consent, so its wording sets the scope, and one drawn around a knee injury does not release the mental health notes. Check that the patient signed it rather than the requesting organisation, that it is current, and that it is addressed to your practice. Where a statutory scheme such as workers compensation compels provision, that power operates alongside the authority and brings timeframes of its own.

Two questions apply to all three. The first is whether the person asking is entitled to ask: a parent's request for the records of a child old enough to consent to their own treatment is not automatically one you can grant, and a guardian or attorney acts only within the scope of the instrument appointing them. The second is whether the patient is alive, because the federal privacy principles apply to living individuals, so a request about a deceased patient falls to state or territory health records legislation, to an executor's entitlements, or to the court.

• Subpoena: the schedule sets the scope, and the court decides who is allowed to see what you produce.
• Access request: the legislation sets the scope, and the statutory grounds are the only basis for holding anything back.
• Third-party authority: the wording the patient signed sets the scope, and anything outside it stays in the file.

What you have to provide is written on the document itself. A subpoena to produce carries a schedule, and that schedule is the specification. One asking for clinical records relating to the treatment of a named person between two dates is bounded by those dates. One asking for all documents relating to that person, including correspondence, imaging, referrals, accounts and recordings, reaches well past the progress notes.

Both directions of error carry a cost. Producing less than the schedule describes is non-compliance with an order of a court and is punishable as contempt. Producing more is a disclosure of health information that no court ordered and no patient consented to, which is a privacy problem of the practice's own making. Anything genuinely doubtful is better produced under a covering letter that identifies it than quietly left out of the bundle.

Scope is not limited to what is inside your practice software. A subpoena reaches documents in your possession, and in most Australian courts possession extends to documents you have a present right to obtain from somebody else, which can take in material a supplier holds under a contract that entitles you to call for it. If an ambient scribe, a transcription service or a backup provider holds material that answers the schedule, work out whether you can obtain it before you certify what you have produced.

The mechanics of production are set by the court's rules rather than by the party who issued the subpoena, and they catch practices out more often than the scope does. Most of what you need is on the front page rather than in the schedule.

• Australian courts generally let you produce copies rather than originals unless the subpoena requires the original, so the file itself stays with the practice. The notes on the subpoena say which applies.
• Produce to the address for production stated on the subpoena, usually the court registry, by the date for production. Emailing the file to the solicitor who issued it because that is more convenient is not compliance.
• Check that the subpoena names the right legal entity. Records held by a practice company are not answered by a subpoena addressed to a doctor personally, and a wrong addressee is better raised early than on the return date.
• Check the last date for service on the front page. A subpoena served after that date generally does not have to be complied with, and the rules generally allow you to ask the issuing party for the reasonable cost of complying.
• You can produce material to the court and object to a party inspecting it at the same time. The court then decides who gets access and on what terms.

An ambient tool creates objects that previously existed only in the clinician's memory: audio of the consultation, a transcript of that audio, one or more drafts, the signed note in the clinical software, and an audit log recording who did what to each and when. A schedule worded as it was five years ago now reaches a much larger set of material than the progress notes, letters, results and accounts it was drawn to cover.

There is no exemption for working material. The uniform evidence legislation defines a document broadly enough to include anything from which sounds or images can be reproduced, which puts audio and transcripts inside the definition. Under privacy law the same material is health information about the patient whatever form it takes. Neither an unsigned draft nor a recording that was only ever an input falls outside those definitions.

The working test is whether the practice can state, in a sentence each, what exists and for how long: whether audio is retained and for what window, whether the transcript is held separately and on a different window, whether superseded drafts are kept or overwritten, where the signed note lives and who else holds a copy, and what the audit log records and how long it is kept. Those five answers are the substance of a schedule of documents, and a solicitor will probe them if the content of a note is contested.

Inconsistency about what exists does more damage than the material itself. One answer goes out in a covering letter and a different one emerges six months later, because nobody checked the supplier's side before the first answer was given.

Clinical notes contain information about people who are not the patient. There is the collateral history given by a spouse, the family history naming a sibling's diagnosis, the account of an assault that identifies an alleged perpetrator, the line recording that a child protection notification was made. Each is information about a third party inside a record about to leave the practice, and each request treats it differently.

Under an access request, privacy law allows you to refuse where giving access would have an unreasonable impact on the privacy of other individuals. Refusing the whole record on that basis is usually the wrong call, because the workable response is to redact the third-party content and release the rest. The legislation also asks you to consider access through a mutually agreed intermediary, which in a health setting often means another treating practitioner going through the record with the patient.

Under a subpoena you do not redact on your own judgement. Several Australian jurisdictions protect counselling and other confidential communications through statutory privileges, and those are raised with the court rather than asserted by leaving pages out of the bundle. Child protection legislation in the states and territories protects the identity of a person who makes a notification, which is worth flagging in your covering letter where the record refers to one.

Under a third-party authority the position is the simplest of the three. The patient cannot consent for anyone else, so third-party content is redacted before the record goes out. Ambient notes make that more work rather than less, because a drafted note captures who was in the room and what they said with more fidelity than a clinician writing a summary at the end of the day would have recorded.

What practices get wrong is rarely the decision about what to send. A request is handled by a staff member who exports a PDF, attaches it to an email and moves on, leaving no copy of the export, no record of the date range searched and no note in the file. When the records are contested a year later, the practice cannot prove what it produced.

Produce a paginated bundle with an index, numbered continuously from first page to last, and keep an identical copy. Store it with the request itself, the subpoena or authority that prompted it, and the covering letter that went with it. Where material was withheld or redacted, the covering letter says so and says on what basis, which turns a silent omission into a stated position you can defend.

Make a file note covering the date, who asked, under what authority, what was searched, what was produced and who authorised the release. Where a disclosure is made to police or another enforcement body in reliance on the enforcement exception in the privacy principles, a written note of the disclosure is required.

Record the systems that were searched as well as the records that were found. If the scribe holds audio and drafts and the search covered the clinical software alone, the bundle is incomplete against a broad schedule, and saying in the covering letter which systems were searched makes the gap visible while it can still be fixed.

Medical defence organisations ask to be called before anything is produced, and practices routinely skip it because a records request looks like administration. Your MDO will read the subpoena, tell you whether the scope is objectionable, whether your own interests are engaged and whether you should be separately represented, and will often run the objection for you. Timing decides whether that help is available, because an objection has to be on foot before the date for production.

One refusal ground is worth knowing before you need it. The privacy principles allow an organisation to refuse access where the information relates to existing or anticipated legal proceedings between the practice and the patient and would not be accessible through discovery in those proceedings. It is narrower than it sounds and is not a general shield against a patient who has engaged a solicitor, which is why it is a question for your MDO.

Some requests warrant that call without anyone at the practice weighing it up first. Write the triggers into the practice's procedure so the decision is not made on the day.

• A subpoena issued in proceedings where you or the practice could become a party.
• Any request that follows an adverse outcome, a complaint, or a consultation where the patient mentioned lawyers.
• A request from a solicitor for the complete file, particularly one that names drafts, recordings, metadata or audit logs.
• A coronial request, an AHPRA notification, or a request from a health complaints body.
• Any request where you are considering refusing, redacting, or producing material you think may be privileged.

A broad schedule will often reach material that has already aged out, and that is a complete answer provided it is given properly. Say in the covering letter what the retention period is, what it applies to, and the date the material expired. Silence about a category the schedule plainly covers reads as an omission and tends to produce a second subpoena. The windows chosen when the product was configured decide what exists two years later, so they belong in the records management policy rather than in a settings screen nobody revisits.

The obligation runs the other way once the practice knows of a claim, a complaint or a likely proceeding, and routine deletion has to stop for anything connected to it. The difficulty with a scribe is that deletion runs on a timer inside a product. Somebody has to know how to suspend that timer and who to ask if the setting is not theirs to change, and to know it before a request arrives rather than on the afternoon it does.

Do not alter a retention setting once a request is in sight. The change will usually appear in the system's own logs, and it will be read as an attempt to destroy material whatever the intention behind it was. Freeze what exists, tell your MDO, and let the retention position stand or fall on what it was when the request landed.