Medical records are among the most private information a person shares. But in Australia, private health insurers can access clinical records during audits — raising difficult questions about where legitimate financial oversight ends and patient privacy begins.

Private health insurers manage around A$27 billion in healthcare payments each year, according to Private Healthcare Australia. Insurers argue that auditing claims is necessary to detect fraud, billing errors and inappropriate claims, with the industry estimating that up to 3 per cent of claims may be over-billed.

But concerns are growing over how far some audits go.

Healthcare providers have reported cases where insurers requested patients’ broader clinical histories rather than information directly related to a particular treatment episode. The Australian Private Hospitals Association described some practices as “aggressive”, while healthcare professionals have raised concerns about the pressure placed on them to release sensitive information.

One physiotherapist told ABC News that when Bupa requested the full clinical histories of some patients, two-thirds refused permission when asked by the practitioner. The physiotherapist said the insurer subsequently sought the information despite those refusals and threatened potential financial consequences.

The issue is complicated by the terms patients agree to when purchasing private health insurance. Those agreements can allow insurers to obtain medical information for auditing funded services. However, legal experts argue that contractual terms do not override broader obligations surrounding patient confidentiality and privacy.

The debate highlights a growing tension in modern healthcare: insurers need enough information to protect billions of dollars in payments, but patients also need confidence that their most sensitive information will not be examined unnecessarily.

For hospitals, doctors and allied health professionals, the challenge is equally significant. They must balance cooperation with insurers against their professional and legal responsibilities to protect patients.

The question

now is not simply whether insurers should audit claims  but how much of a patient’s medical history should be considered necessary to prove one claim is legitimate?

Because when it comes to health data, “access” can carry consequences far beyond a balance sheet.