Membership information 0800 225 677
Medicolegal advice 0800 014 780

Requests for access

The Promotion of Access to Information Act 2000 gives everyone the right of access to records held by either public or private bodies for legitimate purposes. In the latter case, people should be allowed access to “any information that is held by another person and that is required for the exercise or protection of any rights”.9 This includes access to health records.

Either the patient him/herself, or someone authorised to act on the patient’s behalf, can request access; ordinarily the request itself is made in writing and should be responded to within 30 calendar days.

The only ground for refusing access is if disclosure “to the relevant person” (ie, the patient or the person requesting access on the patient’s behalf) “might cause serious harm to his or her physical or mental health, or well-being”.10

The Act sets out detailed conditions in this section. Essentially, it states that if the person tasked with deciding whether to grant access or not (the “information officer”) thinks that disclosure might result in serious harm to the relevant person, he/she must consult with a healthcare practitioner nominated by the relevant person. If the relevant person is under the age of 16, the nomination must be made by a person with parental responsibility. If the patient lacks capacity, the nomination must be made by a person appointed by the court to manage the patient’s affairs.11

If the nominated healthcare practitioner, after viewing the records, agrees that disclosure would be likely to cause serious harm to the relevant person as outlined above, the information officer may still allow access to the records if he/she is satisfied that adequate counselling arrangements have been made “to limit, alleviate or avoid” such harm. The appointed counsellor must be given access to the record before access is allowed to the requester.12


Relatives have no automatic right of access to an adult patient’s records. If the patient lacks the mental capacity to consent to disclosure, a relative may apply for access to the medical records under the Promotion of Access to Information Act.

Parents and guardians

The parents of a child under the age of 12 should be given access to the child’s medical records if they request it, but bear in mind that if the child has had a termination of pregnancy, this information should remain confidential unless the child consents to its disclosure.

If a child is aged 12 or more, and has the maturity to understand the implications, you will need to secure the child’s consent before disclosing his or her medical record.

Deceased patients

The principle of confidentiality extends beyond a patient’s death. Generally speaking, information should only be disclosed to third parties with the consent of the deceased’s next of kin or executors, but there are exceptions to this rule – information can be disclosed if it is required by an inquest magistrate, for example.

In addition to obtaining the authority of the deceased's next of kin or executor, the HPCSA’s advice is to consider the circumstances when deciding whether to accede to a request for information and to consider the effect that disclosure is likely to have on the deceased patient’s partner or family.13

Court orders

You should comply with a court order to disclose health records. Even if you have concerns about disclosing the records, you should still comply with the order and attach a covering letter to the judge or the registrar of the court describing your concerns. Generally, compliance with a court order should be considered mandatory, but in exceptional circumstances, if you have concerns, it may be appropriate to seek advice from MPS. The mere threat of a court order is not sufficient authority to disclose.

The police

In general, the police have no more right of access to confidential information than anybody else, except in the following circumstances:

  • The patient has given consent to the release of information.
  • The information is needed in compliance with a court order.
  • A written directive has been issued by a judge or a magistrate in terms of section 205(1) of the Criminal Procedure Act 51 of 1977 to disclose information.
  • The public interest in disclosing information outweighs the public interest in preserving patient confidentiality. This is not a decision to be taken lightly, so it is best to consult with an MPS medicolegal adviser or a colleague when weighing these competing interests.


Solicitors may request a copy of a patient’s medical records in relation to a claim. If the solicitor is acting for the patient, you should not release the records without the patient’s (or a legally recognised proxy’s) consent. If the solicitor is acting for a third party, you should not release the records unless the request is made in terms of the Promotion of Access to Information Act and the information requested is:

  • About an individual who has given written consent to the requestor or you for the disclosure to be made;
  • Already publically available;
  • Information which belongs to a class of information that would or might be made available to the public in any event;
  • About an individual's physical or mental health, or wellbeing who is under the care of the requester and who is under the age of 18 or is incapable of understanding the nature of the request and giving access would be in the individual's best interests;
  • About an individual who is deceased and the requester is the next of kin or the solicitor is making the request with the consent of the deceased's next of kin.

(see Chapter 4 section 63(1) and (2) to the Promotion of Access to Information Act 2 of 2000.)

ICD-10 Coding

Previously the HPCSA “strongly recommends” getting a patient’s written consent before disclosing information to a medical scheme. Such written consent can be a “once-off” applying to patient contact concerning the same or a similar clinical condition, but subject to verbal reminders and confirmation (which should be documented in the patient’s records). When the patient presents with a new condition, it will be necessary to obtain new written consent. The 2008 booklet makes no such recommendation.

The patient’s consent must be fully informed, based on a full and frank discussion about who will be accessing the information and for what purpose, and the implications of disclosure versus non-disclosure. The patient should be informed that the medical scheme has the discretion to reject claims with a U 98.0 code (Patient refused to disclose clinical information).14

Doctors who provide services that do not involve direct contact with the patient (pathologists, for example) should confirm with the commissioning doctor that the patient has consented to his/her medical information being accessed and to clinical information being disclosed to his/her medical scheme.