Guide to PIPA: Access to medical records

Summary

This is PrivCom Bermuda guidance explaining section 18 of PIPA, which governs how organisations must handle individual requests for access to their own medical or psychiatric personal information, or personal information arising from social work carried out in relation to them. It sets out when an organisation can refuse access and what alternative steps it must take instead.

• Refusal ground: An organisation may refuse to provide an individual access to their medical or psychiatric personal information (or related social work information) if disclosure would likely prejudice the individual's physical or mental health.
• Health professional review: If access is refused on that basis and the individual requests it, the organisation must instead provide access to a health professional (as defined under the Bermuda Health Council Act 2004) with relevant expertise, who then determines whether disclosure to the individual would likely cause harm.
• Other refusal grounds: An organisation may also rely on section 17(2) to refuse access, and must refuse access where section 17(3) applies.
• Redaction and partial access: Where an organisation can reasonably redact the sensitive or harmful information from the rest of the individual's personal information, it must provide the individual access to the remaining, redacted information.

The guidance is framed as an FAQ for organisations such as health facilities, confirming they are not always obliged to give individuals direct access to their medical records but have specific alternative obligations when they refuse.

Key obligations

• Where an organisation refuses access to medical or psychiatric personal information under section 18(1) on health-prejudice grounds, it must, if the individual requests, provide access instead to a qualified health professional for a determination.
• An organisation must refuse to provide access to personal information where section 17(3) applies.
• Where an organisation can reasonably redact information covered by section 17(2)(b), 17(3)(b) or (c), or health-prejudicial information, from the rest of the individual's personal information, it must provide the individual access to the remaining information after redaction.

Applies to

organisations (data controllers under PIPA), health facilities, health professionals