Telehealth Medical Records in Australia

A telehealth consultation should create a medical record. That record is not a marketing file, a simple booking note, or a customer-support ticket. It is the clinical trail showing what information was provided, what the doctor considered, what advice or outcome followed, and what should happen next.

For patients, the record matters for two reasons. First, it protects continuity of care. A later doctor needs to understand what was assessed and what was not. Second, it protects privacy. Health information is sensitive information, so it should be collected for a clear purpose, handled securely, shared only where appropriate, retained under the right rules, and made available for access or correction where the law allows.

A medical record is the professional account of the consultation. In telehealth, it may be created from a form, secure messages, a phone or video consultation, uploaded documents, file notes, clinical templates, eScript details, certificate details, or follow-up communications.

The important point is not the format. The important point is whether the record is clear enough to explain the clinical decision later.

This applies even when a consultation is simple. A short record can still be a good record if it captures the relevant history, assessment, advice, decision, and follow-up.

The Medical Board of Australia's code of conduct says maintaining clear and accurate medical records is essential for continuing good care. It describes records as needing to be accurate, up to date, legible, and sufficient to facilitate continuity of care.

In practice, a telehealth record commonly needs to capture:

Good telehealth record-keeping does not mean broad sharing. It means the right information is available to the right person for the right purpose.

A doctor involved in the consultation may need the full clinical context. Support staff may need narrower information for identity follow-up, delivery issues, refunds, technical help, or complaint handling. A pharmacy may need valid prescription information. A usual GP may receive a summary if that is part of the care plan and the patient agrees or the disclosure is otherwise lawful.

Other people sit outside that care boundary. An employer may be given a certificate or other document the patient chooses to provide, but that is different from the clinical record. A family member should not become the default contact unless the patient has authorised that arrangement. An insurer, workplace, school, or third-party app should not receive sensitive clinical detail just because it is convenient.

Patients can usually request access to health information held by a healthcare provider. The OAIC explains that a provider should respond within a reasonable period, generally 30 days, and that patients can ask for access in a particular form. There are exceptions, but refusal should not be unexplained.

You can also ask for a correction if health information is inaccurate, out of date, incomplete, irrelevant, or misleading. Correction does not always mean deleting the original clinical note. Sometimes it means adding an amendment or note so the record is accurate and complete without erasing what was recorded at the time.

Practical steps:

• use the provider's privacy or records contact, not a public social media channel
• be specific about the consultation date, service, and information requested
• explain what you believe is inaccurate if asking for correction
• keep a copy of your request and the response
• ask for written reasons if access or correction is refused
• escalate to the OAIC or an appropriate health complaints body if the issue is unresolved

Medical records are not normally deleted immediately after a consultation. Providers may need to retain them for legal, clinical, professional, insurance, audit, complaint, or continuity-of-care reasons.

The risky mistake is to state one retention period as if it applies to every Australian telehealth record. RACGP guidance notes that some state and territory laws set specific retention periods. For example, ACT, NSW, and Victoria requirements include keeping adult records for seven years from the last service and records for children and young people until age 25. Other contexts can have different rules, and unresolved complaints or legal matters can affect retention.

Sharing boundary

View larger image

The clinical record, a patient document, a GP summary, and My Health Record are different sharing pathways.

Secure disposal matters as much as secure storage. If records are no longer needed and the law does not require retention, the provider should take reasonable steps to destroy or de-identify the information. Patients should also clean up copies on shared devices, email inboxes, downloads folders, and cloud drives.

My Health Record is Australia's national shared digital health record system. It is not the same as the telehealth provider's own medical record.

The Australian Digital Health Agency explains that patients can manage privacy and access settings in My Health Record, including seeing who has accessed the record, restricting access to documents, and changing access controls. That does not mean every telehealth consultation automatically appears there.

If continuity of care matters, ask how information will be shared with your usual GP. A concise clinical summary can be more useful than assuming every system will automatically stay in sync.

A record is only useful if it is accurate, available, and connected to the next step. Before relying on a telehealth consultation for ongoing care, check the basics.

A good medical record supports care, but it does not replace care. If symptoms change, a record from an earlier online consultation may be out of date. If a problem needs examination, vital signs, imaging, pathology, wound assessment, or urgent observation, the safest next step may be local or emergency care rather than trying to solve the issue by editing the old record.

Patients and providers can both create avoidable record problems.

Common patient-side mistakes include using someone else's email or phone number, sending sensitive documents through ordinary email when a secure upload is available, leaving downloaded certificates or scripts on shared computers, uploading more documents than requested, or forgetting to tell a usual GP about an online consultation that affects ongoing care.

Common service-side problems include vague privacy policies, no clear records contact, unsupported deletion promises, broad support-staff access, missing safety-netting advice, unclear GP-sharing processes, and records that only document the outcome without the clinical reasoning.

The goal is not to make every record long. The goal is to make it clear enough that the patient, the treating doctor, and any future clinician can understand what happened.

Does a telehealth consultation create a medical record?

Yes. A telehealth consultation should create a clinical record just like an in-person consultation. The record may include the information you provided, the doctor's assessment, advice, outcome, prescriptions or certificates where relevant, follow-up instructions, and consent or communication history.

Can my employer see my telehealth medical record?

No, not without a lawful basis or your consent. An employer may see a certificate or document you choose to provide, but that is different from the provider's clinical record. The clinical record should not be sent to an employer just because the consultation related to work.

How long are telehealth records kept in Australia?

Retention rules depend on the provider, record type, and state or territory law. Some jurisdictions set minimum periods such as seven years from the last service for adult records and longer rules for records created for children or young people. Ask the provider for its retention policy if timing matters.

Can I ask for a copy or correction of my telehealth record?

Usually yes. The OAIC explains that patients can request access to health information held by a provider and can ask for incorrect information to be corrected. Providers can refuse in limited circumstances, but they should explain the reason and complaint options.

Is My Health Record the same as the telehealth provider's own record?

No. My Health Record is the national shared digital health record system. A telehealth provider may also keep its own clinical record. Not every telehealth consultation is automatically uploaded to My Health Record, and patients can manage access settings within My Health Record.

• Medical Board of Australia: Good medical practice, a code of conduct for doctors in Australia
• Medical Board of Australia: Telehealth consultations with patients
• OAIC: Access your health information
• OAIC: Health information
• OAIC: Australian Privacy Principles
• OAIC: Guide to securing personal information
• RACGP: Medical records
• Australian Digital Health Agency: My Health Record privacy and access