A dispute over private health insurer access to patient medical records has exposed a structural fault line in Australia’s private health system: providers are being placed in direct conflict between their contractual obligations to insurers and their obligations under federal law. For insurance brokers advising businesses on health cover, the issue is not peripheral – it reaches into the preferred provider networks underpinning most group health arrangements and directly into the premium dynamics their clients are paying.
Under standard agreements, private health insurers are entitled to request clinical notes relating to a specific episode of treatment to verify that correct procedure item numbers were billed. What hospitals and allied health providers are now reporting, according to ABC News, goes further – insurers requesting patients’ complete clinical histories, well beyond any single treatment episode. One physiotherapist, speaking anonymously to ABC News, said Bupa asked him to supply the full clinical histories of all his Bupa patients during an audit. When two-thirds of those patients declined to consent, he says Bupa told him it wanted the records regardless, citing his preferred provider agreement. After the Australian Health Practitioner Regulation Agency (AHPRA) advised him that he could not release records without consent, he says Bupa threatened repayment demands of up to $300,000 in benefits – a situation only resolved after he escalated to the Commonwealth Ombudsman. “If I went ahead and released those notes I could be struck from registration. I rang a multitude of government agencies for help. I almost walked away from the industry,” he said.
This is not an isolated case. The Australian Physiotherapy Association (APA) has formally documented multiple instances of insurers threatening to exclude physiotherapists from Health Industry Claims and Payments Service (HICAPS) – Australia’s real-time health fund claiming system – if providers do not supply clinical notes even where patients have denied consent. The APA has told insurers directly that this practice “subordinates patient consent and coerces providers to break the law.” The Australian Private Hospitals Association (APHA) has made the same point to government: aggressive audits regularly go beyond the remit of insurers’ rights to patient information, with insurers insisting on patients’ full medical history rather than records limited to the relevant procedure or admission.
Under the Privacy Act 1988 (Cth), express consent is required for sensitive disclosures, including sharing records with a third-party insurer. The Office of the Australian Information Commissioner (OAIC) is explicit: if a request comes from a third party, a provider must only give access to the information if the patient has consented. AHPRA’s shared Code of Conduct reinforces this, requiring practitioners to hold patient information in confidence unless release of information is required by law or public interest considerations. University of Sydney Law School researcher Bashi Hazard told ABC News that insurers cannot include contract terms that contravene existing law, and that requesting patient notes outside an episode of care without consent should void the contract entirely. The practical consequence for providers is direct: comply with the insurer and risk deregistration; comply with the law and risk financial penalties.
The auditor qualification issue has been tested at the highest level. In Bupa HI Pty Ltd v Chang [2019] FCAFC 180, the Federal Court of Australia dismissed Bupa’s appeal against ophthalmologist Andrew Chang over a Medicare Benefits Schedule (MBS) billing dispute arising from an audit. The court upheld the finding that Bupa’s deregistration of Chang from its Medical Gap Scheme was invalid and ordered Bupa to pay costs. The court noted that Dr Chang’s lawyers had correctly identified the central flaw in Bupa’s approach – that “it does not appear that an ophthalmologist peer with vitreoretinal subspecialist expertise, has had input into BUPA’s audit” – and confirmed that point was “well made.” The Independent Dentist Network told ABC News of a comparable pre-pandemic case in which a large insurer alleged $1 million in questionable claims against a Western Australian dentist and sent in auditors the dentist alleged were dental practice managers and nurses rather than trained dentists. After legal action, the claim was reduced to $500,000 and dropped with a warning.
This audit conduct sits within a documented pattern of insurer behaviour now drawing active regulatory response. On June 30, 2025, the Australian Competition and Consumer Commission (ACCC) instituted proceedings in the Federal Court against Bupa for breaches of the Australian Consumer Law affecting thousands of consumers over more than five years, with a $35 million penalty ordered on December 11, 2025. The ACCC received 186 contacts about private health insurance in 2024-25, a 22% increase on the prior year, while the Commonwealth Ombudsman received 4,241 private health insurance complaints in 2023-24, up 23.7% on the year before.
The reform response is moving beyond individual complaints. In March 2026, APHA and Catholic Health Australia jointly called on the government to establish a mandatory code of conduct for insurer-hospital contracting, overseen by the ACCC, alongside a legislated 90% benefit-payout ratio. APHA CEO Brett Heffernan has called for greater accountability from private health insurers, arguing that high insurer profits and management fees should translate into higher benefit payments to hospitals.
Private Healthcare Australia (PHA) chief executive Rachel David defended audit activity as essential stewardship of $27 billion in annual healthcare payments, saying the majority of claims and providers are legitimate but that audits uncover fraud, inappropriate claiming, and billing errors involving substantial sums. She said health funds follow legally required privacy procedures during audits and that information obtained is used exclusively for payment integrity purposes.
For brokers, the financial stakes are quantified. In the 12 months to September 30, 2025, insurers paid out more than $26.7 billion in health, medical, and extras benefits, with hospital treatment benefits reaching $20 billion – up 6%. The government approved a 4.41% average premium increase from April 1, 2026. Key drivers of premium increases over the preceding six years were management expenses, up 51%, and net insurance profits, up 50% – both rising faster than benefits paid for hospital treatment, which grew 18%.
Whether a mandatory, ACCC-overseen code of conduct governing audit conduct and data access progresses through government will have direct implications for brokers assessing insurer conduct when placing or renewing group health cover. The Commonwealth Ombudsman remains an accessible escalation route in the meantime – but as the physiotherapist’s case demonstrated, providers should not need to reach that point before their legal rights are respected.
Insurance Business has reached out to Bupa for comment and will update this story when their response is available.
