The Office of the Privacy Commissioner of Bermuda

  In a seashell

​

• Under PIPA, individuals have the right to request access to their medical records.

• Medical records or other health-related information is sensitive personal information.

 

Section 18, Access to medical records, states:

​

(1) On the request of an individual for access to— 

(a) personal information of a medical or psychiatric nature relating to the individual; or

(b) personal information kept for the purposes of, or obtained in the course of, the carrying out of social work in relation to the individual, an organisation may refuse to provide access to personal information if disclosure of the personal information to the individual would be likely to prejudice the physical or mental health of the individual.

 

(2) Where, under subsection (1), an organisation refuses to grant a request, the organisation shall, if requested to do so by the individual, provide access to personal information referred to in that subsection to a health professional, within the meaning of section 2 of the Bermuda Health Council Act 2004, who has expertise in relation to the subject matter of the record, and the health professional shall determine whether disclosure of the personal information to the individual would be likely to prejudice the physical or mental health of the individual.

 

(3) Notwithstanding anything else in this section, in response to a request under subsection (1), an organisation—

(a) may refuse to provide access to personal information by relying on section 17(2); and

(b) shall refuse to provide access to personal information pursuant to section 17(3).

 

(4) If an organisation is reasonably able to redact information which is referred to in section 17(2)(b) or section 17(3)(b) or (c) or information which would be likely to prejudice the physical or mental health of the individual from other personal information about the individual who requested it, the organisation shall provide the individual with access to the  other personal information after redacting the former information or the information which would be likely to prejudice the physical or mental health of the individual.

​

 

 Organisations ask

​

As a health facility (organisation), do we have to always provide access to personal information/medical records when requested by the individual to whom it relates?

​

No, as an organisation, you may refuse to provide access to the individual’s medical records if disclosure of the personal information to the individual would be likely to prejudice their physical or mental health.

 

Alternatively, you may provide access to the individual’s medical record to a health professional who has expertise in relation to the subject matter of the medical records.