My Health Records Act 2012

14 Identity of the System Operator

The System Operator is:

the Secretary of the Department; or

if a body established by a law of the Commonwealth is prescribed by the regulations to be the System Operator—that body.

Before regulations are made for the purposes of paragraph (1)(b), the Minister must be satisfied that the Ministerial Council has been consulted in relation to the proposed regulations.

15 Functions of the System Operator

The System Operator has the following functions:

to establish and maintain an index service, for the purposes of the My Health Record system, that:

allows information in different repositories to be connected to registered healthcare recipients; and

facilitates the retrieval of such information when required, and ensures that registered healthcare recipients, and participants in the My Health Record system who are authorised to collect, use and disclose information, are able to do so readily;

(b) to establish and maintain mechanisms (access control mechanisms) that, subject to any requirements specified in the My Health Records Rules:

enable each registered healthcare recipient to set controls on the healthcare provider organisations and nominated representatives who may obtain access to the healthcare recipient’s My Health Record; and

specify default access controls that apply if a registered healthcare recipient has not set such controls; and

specify circumstances in which access to a healthcare recipient’s My Health Record is to be automatically suspended or cancelled;

without limiting paragraph (b), to ensure that the access control mechanisms enable each registered healthcare recipient to specify that access to a healthcare recipient’s My Health Record is only to be:

by healthcare provider organisations and nominated representatives specified by the healthcare recipient; and

in accordance with any limitations specified by the healthcare recipient, including limitations on the kind of health information to be collected, used or disclosed by such healthcare provider organisations and nominated representatives;

to establish and maintain a reporting service that allows assessment of the performance of the system against performance indicators;

to establish and maintain the Register (see section 56);

to register healthcare recipients and participants in the My Health Record system (see Part 3) and to manage and monitor, on an ongoing basis, the system of registration;

to establish and maintain an audit service that records activity in respect of information in relation to the My Health Record system;

without limiting paragraph (g)—to establish and maintain mechanisms:

that enable each registered healthcare recipient to obtain electronic access to a summary of the flows of information in relation to his or her My Health Record; and

that enable each registered healthcare recipient to obtain a complete record of the flows of information in relation to his or her My Health Record, on application to the System Operator;

to operate a National Repositories Service that stores key records that form part of a registered healthcare recipient’s My Health Record (including the healthcare recipient’s shared health summary);

to establish and operate a test environment for the My Health Record system, and other electronic systems that interact directly with the My Health Record system, in accordance with the requirements (if any) in the My Health Records Rules;

to establish a mechanism for handling complaints about the operation of the My Health Record system;

to ensure that the My Health Record system is administered so that problems relating to the administration of the system can be resolved;

to advise the Minister on matters relating to the My Health Record system, including in relation to the matters to be included in the My Health Records Rules (see section 109);

to educate healthcare recipients, participants in the My Health Record system and members of the public about the My Health Record system;

in accordance with the guidance and direction of the Board established under section 82, to prepare and provide de-identified data, and, with the consent of the healthcare recipient, health information, for research or public health purposes;

such other functions as are conferred on the System Operator by this Act or any other Act;

to do anything incidental to or conducive to the performance of any of the above functions.

16 Research or public health purposes

The System Operator’s function under paragraph 15(ma) does not include providing de-identified data or health information to a private health insurer (within the meaning of the Private Health Insurance Act 2007) or any other insurer.

17 Retention and destruction of records uploaded to National Repositories Service

Records

This section applies to a record if:

the record is uploaded to the National Repositories Service; and

the record includes health information that is included in the My Health Record of a healthcare recipient.

Retention of records

The System Operator must ensure that the record is retained for the period:

beginning when the record is first uploaded to the National Repositories Service; and

ending:

30 years after the death of the healthcare recipient; or

if the System Operator does not know the date of death of the healthcare recipient—130 years after the date of birth of the healthcare recipient; or

if, under subsection (3), the record is required to be destroyed because of the cancellation of registration of the healthcare recipient—when the System Operator is required to destroy the record under subsection (4).

Destruction of records after cancellation on request

If the System Operator is required to cancel the registration of the healthcare recipient under subsection 51(1) (cancellation on request), the System Operator must destroy any record that includes health information that is included in the My Health Record of the healthcare recipient, other than the following information:

the name and healthcare identifier of the healthcare recipient;

the name and healthcare identifier of the person who requested the cancellation, if different from the healthcare recipient;

the day the cancellation decision takes effect under subsection 51(7).

The System Operator must comply with subsection (3):

as soon as practicable after the cancellation decision takes effect under subsection 51(7); or

if any of the following requirements apply before the records are destroyed under paragraph (a)—as soon as practicable after the conclusion of the matter to which the requirement relates:

a court order requires the System Operator not to destroy records of the healthcare recipient;

the System Operator is required to disclose records of the healthcare recipient under section 69 or 69A;

the System Operator is required to disclose records of the healthcare recipient under a law covered by subsection 65(3).

To avoid doubt, if the System Operator is required under subsection (3) to destroy a record that includes health information, the System Operator must also destroy the following:

any copy of the record;

any previous version of the record;

any back-up version of the record.

38 Registered repository operator

It is a function of the Chief Executive Medicare to seek to become a registered repository operator and, if registered, to operate a repository for the purposes of the My Health Record system in accordance with subsection (2).

Without limiting the way in which the repository is to be operated, at any time when the Chief Executive Medicare is a registered repository operator, the Chief Executive Medicare:

may at his or her discretion upload health information held by the Chief Executive Medicare about a registered healthcare recipient to the repository operated by the Chief Executive Medicare; and

with the consent of a registered healthcare recipient—may at his or her discretion make available to the System Operator health information held by the Chief Executive Medicare about the healthcare recipient.

Note: Section 58 authorises the Chief Executive Medicare to disclose identifying information to the System Operator.

The health information referred to in subsection (2) in relation to a healthcare recipient may include the name of one or more healthcare providers that have provided healthcare to the healthcare recipient.

39 Healthcare recipients may apply for registration

A healthcare recipient may apply to the System Operator for registration of the healthcare recipient.

The application must:

be in the approved form; and

include, or be accompanied by, the information and documents required by the form; and

be lodged at a place, or by a means, specified in the form.

40 When a healthcare recipient is eligible for registration

A healthcare recipient is eligible for registration if:

(a) a healthcare identifier has been assigned to the healthcare recipient under paragraph 9(1)(b) of the Healthcare Identifiers Act 2010; and

the following information has been provided to the System Operator in relation to the healthcare recipient:

full name;

date of birth;

healthcare identifier, Medicare card number or Department of Veterans’ Affairs file number;

sex;

such other information as is prescribed by the regulations.

41 Registration of a healthcare recipient by the System Operator

The System Operator must decide to register a healthcare recipient if:

an application has been made under section 39 in relation to the healthcare recipient; and

the healthcare recipient is eligible for registration under section 40; and

the System Operator is satisfied, having regard to the matters (if any) specified in the My Health Records Rules, that the identity of the healthcare recipient has been appropriately verified.

Note: The System Operator is not permitted to register a healthcare recipient in any other circumstances.

Despite subsection (1), the System Operator is not required to register a healthcare recipient if the System Operator is satisfied that registering the healthcare recipient may compromise the security or integrity of the My Health Record system, having regard to the matters (if any) prescribed by the My Health Records Rules.

The System Operator is not required to register a healthcare recipient if the healthcare recipient does not consent to a registered healthcare provider organisation uploading to the My Health Record system any record that includes health information about the healthcare recipient, subject to the following:

express advice given by the healthcare recipient to the registered healthcare provider organisation that a particular record, all records or a specified class of records must not be uploaded;

a law of a State or Territory that is prescribed by the regulations for the purposes of subsection (4).

(3A) A registered healthcare provider organisation is authorised to upload to the My Health Record system a record in relation to a healthcare recipient (the patient) that includes health information about another healthcare recipient (the third party), if the health information about the third party is directly relevant to the healthcare of the patient, subject to a law of a State or Territory that is prescribed by the regulations for the purposes of subsection (4).

A consent referred to in subsection (3), and an authorisation given under subsection (3A), have effect despite a law of a State or Territory that requires consent to the disclosure of particular health information:

to be given expressly; or

to be given in a particular way;

other than a law of a State or Territory prescribed by the regulations for the purposes of this subsection.

A decision under subsection (1) takes effect when it is made.

41A Prescribed healthcare provider organisations must be registered

A prescribed healthcare provider organisation contravenes this subsection if the healthcare provider organisation is not a registered healthcare provider organisation and is not an approved registered repository operator.

Civil penalty: 250 penalty units.

However, subsection (1) does not apply:

during any period starting when the healthcare provider organisation applies to the System Operator under section 41B or 42 and ending when the application is finally determined; or

during any period approved by the System Operator under section 41B in relation to the healthcare provider organisation.

Note: A person who wishes to rely on subsection (2) in proceedings for a civil penalty order bears an evidential burden in relation to the matters in that subsection: see section 96 of the Regulatory Powers Act.

41B System Operator may approve a period during which registration is not required

Application

A healthcare provider organisation may apply to the System Operator to approve a period during which subsection 41A(1) does not apply to the healthcare provider organisation.

The application must:

be in the approved form; and

include, or be accompanied by, the information and documents required by the form; and

be lodged at a place, or by a means, specified in the form.

Further information may be required

If a healthcare provider organisation makes an application under subsection (1), the System Operator may, by notice in writing, require the healthcare provider organisation to give the System Operator, within the period specified in the notice, such further information in relation to the application as the System Operator requires.

The System Operator is not required to decide the application, and may cease considering the application, if the healthcare provider organisation does not provide the required information within the period specified in the notice.

Approval by System Operator

On application under subsection (1) or on the System Operator’s initiative, the System Operator may, by written notice to a healthcare provider organisation, approve a period during which subsection 41A(1) does not apply to the healthcare provider organisation.

In deciding whether to approve the period, the System Operator must take into account the following:

the healthcare provider organisation’s size and technological readiness;

the potential disruption (if any) to the provision of healthcare if the healthcare provider organisation is not a registered healthcare provider organisation;

any other matter the System Operator considers relevant.

An approval under subsection (5) is not a legislative instrument.

42 Healthcare provider organisation may apply for registration

A healthcare provider organisation may apply to the System Operator for registration of the healthcare provider organisation.

The application must:

be in the approved form; and

include, or be accompanied by, the information and documents required by the form; and

be lodged at a place, or by a means, specified in the form.

43 When a healthcare provider organisation is eligible for registration

A healthcare provider organisation is eligible for registration if:

(a) the healthcare provider organisation is an identified healthcare provider organisation within the meaning of the Healthcare Identifiers Act 2010; and

the healthcare provider organisation complies with such requirements as are specified in the My Health Records Rules.

44 Registration of a healthcare provider organisation

The System Operator must decide to register a healthcare provider organisation if:

the healthcare provider organisation has made an application under section 42; and

the healthcare provider organisation is eligible for registration under section 43.

Despite subsection (1), the System Operator is not required to register a healthcare provider organisation if the System Operator is satisfied that registering the healthcare provider organisation may compromise the security or integrity of the My Health Record system, having regard to the matters (if any) prescribed by the My Health Records Rules.

The System Operator may impose conditions on the registration.

A decision under subsection (1) takes effect when it is made.

45 Condition of registration—uploading of records, etc.

It is a condition of registration of a healthcare provider organisation that the healthcare provider organisation does not, for the purposes of the My Health Record system:

upload a record that includes health information about a registered healthcare recipient to a repository other than:

a repository that forms part of the National Repositories Service; or

a repository to which a registered repository operator’s registration relates; or

upload to a repository a record:

that purports to be the shared health summary of a registered healthcare recipient, unless the record would, when uploaded, be the shared health summary of the registered healthcare recipient; or

(ii) that is a record of a kind specified in the My Health Records Rules for the purposes of this paragraph, unless the record has been prepared by an individual healthcare provider to whom a healthcare identifier has been assigned under paragraph 9(1)(a) of the Healthcare Identifiers Act 2010; or

upload to a repository a record of a kind specified in the My Health Records Rules for the purposes of subparagraph (b)(ii) unless the record is prepared by a person who, at the time the record is prepared, is:

(i) an individual who is registered by a registration authority within the meaning of the Healthcare Identifiers Act 2010, and whose registration is not conditional, suspended, cancelled or lapsed (other than in circumstances prescribed in the My Health Records Rules); or

(ii) an individual who is represented by a professional body described in paragraph 9A(1)(b) of the Healthcare Identifiers Act 2010, and whose credentials are not conditional, suspended, cancelled or lapsed (other than in circumstances prescribed by the My Health Records Rules); or

(c) upload a record to a repository if uploading the record would involve an infringement of a moral right of the author, within the meaning of the Copyright Act 1968; or

upload to a repository a record that includes health information about a registered consumer if the consumer has advised that the record is not to be uploaded.

45A Condition of registration—handling old records that are works subject to copyright

Old works must not be uploaded if it would be an infringement of copyright to use the work for healthcare or related purposes

(1) Subsection (2) applies to works made before Copyright Act 1968 commences.section 44BB of the

Note: Section 44BB of the Copyright Act 1968 provides that there is no infringement of copyright if an act comprised in the copyright of a work is done, or authorised to be done, for healthcare or related purposes.

A healthcare provider organisation must not, for the purposes of the My Health Record system, upload the work if it would be an infringement of the copyright in the work for the organisation or another person to do, or authorise to be done, an act comprised in the copyright of the work:

for a purpose for which the collection, use or disclosure of health information is required or authorised under this Act; or

(b) in circumstances in which a permitted general situation exists under item 1 of the table in subsection 16A(1) of the Privacy Act 1988 (serious threat to life, health or safety), or would exist if the act were done, or authorised to be done, by an entity that is an APP entity for the purposes of that Act; or

(c) in circumstances in which a permitted health situation exists under Privacy Act 1988, or would exist if the act were done, or authorised to be done, by an entity that is an organisation for the purposes of that Act; orsection 16B of the

for any other purpose relating to healthcare, or the communication or management of health information, prescribed by the regulations.

It is a condition of the registration of a healthcare provider organisation that the organisation complies with the obligation under subsection (2).

45B Condition of registration—handling old sound recordings and cinematograph films that are subject to copyright

(1) Subsection (2) applies to sound recordings and cinematograph films made before Copyright Act 1968 commences.section 104C of the

Note: Section 104C of the Copyright Act 1968 provides that there is no infringement of the copyright if an act comprised in the copyright of a sound recording or cinematograph film is done, or authorised to be done, for healthcare or related purposes.

A healthcare provider organisation must not, for the purposes of the My Health Record system, upload the sound recording or cinematograph film if it would be an infringement of the copyright in the recording or film for the organisation or another person to do an act comprised in the copyright of the recording or film:

for a purpose for which the collection, use or disclosure of health information is required or authorised under this Act; or

(b) in circumstances in which a permitted general situation exists under item 1 of the table in subsection 16A(1) of the Privacy Act 1988 (serious threat to life, health or safety), or would exist if the act were done by an entity that is an APP entity for the purposes of that Act; or

(c) in circumstances in which a permitted health situation exists under Privacy Act 1988, or would exist if the act were done by an entity that is an organisation for the purposes of that Act; orsection 16B of the

for any other purpose relating to healthcare, or the communication or management of health information, prescribed by the regulations.

It is a condition of the registration of a healthcare provider organisation that the organisation complies with the obligation under subsection (2).

45C Liability where work uploaded in breach of section 45A or 45B

If any person suffers loss or damage as a result of anything done by an entity that contravenes section 45A or 45B, the person may bring an action for the amount of the loss or damage against the entity in:

the Federal Court of Australia;

the Federal Circuit and Family Court of Australia (Division 2);

a court of a State or Territory that has jurisdiction in relation to the matter.

The action must be brought within 6 years after the loss or damage was suffered.

In determining the damage suffered by the person, the court may include costs incurred by the person as a result of legal action relating to infringement of copyright.

46 Condition of registration—non-discrimination in providing healthcare to a healthcare recipient who does not have a My Health Record etc.

Healthcare recipient who is not registered

It is a condition of registration of a healthcare provider organisation that the organisation does not:

refuse to provide healthcare to a healthcare recipient because the healthcare recipient is not registered under this Part; or

otherwise discriminate against a healthcare recipient in relation to the provision of healthcare because the healthcare recipient is not registered under this Part.

Registered healthcare recipient’s access controls

It is a condition of registration of a healthcare provider organisation that the organisation does not:

refuse to provide healthcare to a registered healthcare recipient because the healthcare recipient has set particular access controls on his or her My Health Record; or

otherwise discriminate against a healthcare recipient in relation to the provision of healthcare because the healthcare recipient has set particular access controls on his or her My Health Record.

47 Persons may apply for registration as a repository operator, a portal operator or a contracted service provider

A person may apply to the System Operator for registration as any of the following:

a repository operator;

a portal operator;

a contracted service provider.

An application for registration as a repository operator must specify each repository to which the registration is proposed to relate.

48 When a person is eligible for registration as a repository operator, a portal operator or a contracted service provider

A person is eligible for registration as a repository operator, a portal operator or a contracted service provider if the System Operator is satisfied that:

the person complies with any My Health Records Rules that apply in relation to registration of the particular kind; and

the person has agreed to be bound by the conditions imposed by the System Operator on the person’s registration; and

in the case of a repository operator or a portal operator—the central management and control of the repository operator or portal operator will be located in Australia at all times when the repository operator or portal operator is registered; and

in the case of a repository operator or a portal operator that:

is a State or Territory authority, or an instrumentality of a State or Territory; and

is not bound by a designated privacy law of the State or Territory;

the repository operator or portal operator is prescribed under Privacy Act 1988.section 6F of the

49 Registration of a repository operator, a portal operator or a contracted service provider

The System Operator must decide to register a person as a repository operator, a portal operator or a contracted service provider if:

the person has made an application under section 47 for registration of that kind; and

the person is eligible for registration of that kind under section 48.

Despite subsection (1), the System Operator is not required to register a person as a repository operator, a portal operator or a contracted service provider if the System Operator is satisfied that registering the person may compromise the security or integrity of the My Health Record system, having regard to the matters (if any) prescribed by the My Health Records Rules.

The System Operator may impose conditions on the registration.

If the System Operator decides to register a person as a repository operator, the decision must specify the repositories to which the registration relates.

A decision under subsection (1) takes effect when it is made.

50 Condition about provision of information to System Operator

It is a condition of registration of a registered repository operator, a registered portal operator or a registered contracted service provider that it must provide to the System Operator information included in the My Health Record of a healthcare recipient if requested to do so by the System Operator.

50A Condition of registration—handling old records that are works subject to copyright

(1) Subsection (2) applies to works made before Copyright Act 1968 commences.section 44BB of the

Note: Section 44BB of the Copyright Act 1968 provides that there is no infringement of copyright if an act comprised in the copyright of a work is done, or authorised to be done, for healthcare or related purposes.

A registered repository operator must not make the work available for the purposes of the My Health Record system, if it would be an infringement of the copyright in the work for the operator or another person to do, or authorise to be done, an act comprised in the copyright of the work:

for a purpose for which the collection, use or disclosure of health information is required or authorised under this Act; or

(b) in circumstances in which a permitted general situation exists under item 1 of the table in subsection 16A(1) of the Privacy Act 1988 (serious threat to life, health or safety), or would exist if the act were done, or authorised to be done, by an entity that is an APP entity for the purposes of that Act; or

(c) in circumstances in which a permitted health situation exists under Privacy Act 1988, or would exist if the act were done, or authorised to be done, by an entity that is an organisation for the purposes of that Act; orsection 16B of the

for any other purpose relating to healthcare, or the communication or management of health information, prescribed by the regulations.

It is a condition of the registration of a registered repository operator that the operator complies with subsection (2).

50B Condition of registration—handling old sound recordings and cinematograph films that are subject to copyright

(1) Subsection (2) applies to sound recordings and cinematograph films made before Copyright Act 1968 commences.section 104C of the

Note: Section 104C of the Copyright Act 1968 provides that there is no infringement of the copyright if an act comprised in the copyright of a sound recording or cinematograph film is done, or authorised to be done, for healthcare or related purposes.

A registered repository operator must not, for the purposes of the My Health Record system, make the sound recording or cinematograph film available if it would be an infringement of the copyright in the recording or film for the operator or another person to do any act comprised in the copyright in the recording or film:

for a purpose for which the collection, use or disclosure of health information is required or authorised under this Act; or

(b) in circumstances in which a permitted general situation exists under item 1 of the table in subsection 16A(1) of the Privacy Act 1988 (serious threat to life, health or safety), or would exist if the act were done by an entity that is an APP entity for the purposes of that Act; or

(c) in circumstances in which a permitted health situation exists under Privacy Act 1988, or would exist if the act were done by an entity that is an organisation for the purposes of that Act; orsection 16B of the

for any other purpose relating to healthcare, or the communication or management of health information, prescribed by the regulations.

It is a condition of the registration of a registered repository operator that the operator complies with subsection (2).

50C Liability where work uploaded in breach of section 50A or 50B

If any person suffers loss or damage as a result of anything done by an entity that contravenes section 50A or 50B, the person may bring an action for the amount of the loss or damage against the entity in:

the Federal Court of Australia;

the Federal Circuit and Family Court of Australia (Division 2);

a court of a State or Territory that has jurisdiction in relation to the matter.

The action must be brought within 6 years after the loss or damage was suffered.

In determining the damage suffered by the person, the court may include costs incurred by the person as a result of legal action relating to infringement of copyright.

50D Authorisation to make health information available to the System Operator

A registered repository operator (other than the Chief Executive Medicare) is authorised to make health information about a registered healthcare recipient that is held by the operator available to the System Operator.

51 Cancellation or suspension of registration

Cancellation or suspension on request

The System Operator must, in writing, decide to cancel or suspend the registration of a healthcare recipient or other entity if the healthcare recipient or other entity requests the System Operator, in writing, to cancel or suspend the registration.

Cancellation or suspension if healthcare recipient no longer eligible, etc.

The System Operator may, in writing, decide to cancel or suspend the registration of a healthcare recipient if:

the System Operator is no longer satisfied that the healthcare recipient is eligible to be registered; or

the System Operator is no longer satisfied, having regard to the matters (if any) specified in the My Health Records Rules, that the identity of the healthcare recipient has been appropriately verified; or

the System Operator is satisfied that, unless the registration of the healthcare recipient is cancelled, the security or integrity of the My Health Record system may be compromised, having regard to the matters (if any) prescribed by the My Health Records Rules; or

the System Operator is satisfied that the consent referred to in subsection 41(3) in relation to the healthcare recipient has been withdrawn; or

the System Operator is satisfied that the consent referred to in subsection 41(3) in relation to the healthcare recipient was given by an authorised representative or nominated representative of the healthcare recipient, and:

the authorised representative or nominated representative who gave the consent ceases to be an authorised representative or nominated representative of the healthcare recipient; and

the System Operator requests the healthcare recipient to give consent of the kind referred to in subsection 41(3); and

the healthcare recipient does not, within a reasonable period, give the consent.

Cancellation or suspension if other entity no longer eligible, etc.

The System Operator may, in writing, decide to cancel or suspend the registration of an entity other than a healthcare recipient if:

the System Operator is no longer satisfied that the entity is eligible to be registered; or

the System Operator is satisfied that:

the entity has contravened this Act or a condition of the entity’s registration; or

cancellation or suspension of registration is reasonably necessary to prevent such a contravention; or

cancellation or suspension of registration is otherwise appropriate, having regard to the need to protect the security and integrity of the My Health Record system.

The System Operator may, in writing, decide to cancel or suspend the registration of a healthcare provider organisation if the System Operator is not satisfied that the healthcare provider organisation is able to comply with the conditions of the healthcare provider organisation’s registration.

Suspension while investigating action in relation to healthcare recipient’s registration

The System Operator may, in writing, decide to suspend the registration of a healthcare recipient while the System Operator investigates whether to take action under subsection (2) in relation to the healthcare recipient’s registration.

Suspension while investigating action in relation to entity’s registration

The System Operator may, in writing, decide to suspend the registration of an entity other than a healthcare recipient while the System Operator investigates whether to take action under subsection (3) or (3A) in relation to the entity’s registration.

Cancellation of registration of healthcare recipient on death

The System Operator must decide to cancel the registration of a healthcare recipient if the System Operator is satisfied that the healthcare recipient has died.

When cancellation or suspension takes effect

A decision under this section takes effect:

when it is made; or

if the decision is made at the request of the healthcare recipient or other entity, and the request states that the healthcare recipient or other entity wishes the cancellation or suspension to occur at a specified future time—at that future time.

Note: Under section 53, the System Operator must give the healthcare recipient or other entity notice before cancelling, suspending or varying registration (except in urgent circumstances). The decision to cancel, suspend or vary registration cannot be made before the end of the period specified in the notice.

52 Variation of registration

The System Operator may decide, on the System Operator’s initiative or on the request of a healthcare recipient or other entity, to vary the registration of the healthcare recipient or other entity:

to impose conditions, or additional conditions, on the registration; or

to vary or revoke conditions imposed on the registration; or

in the case of a registered repository operator—to vary the repositories to which the registration relates; or

to correct an error or omission in the registration.

A decision under this section takes effect:

when it is made; or

if the decision is made at the request of the healthcare recipient or other entity, and the request states that the healthcare recipient or other entity wishes the variation to occur at a specified future time—at that future time.

Note: Under section 53, the System Operator must give the healthcare recipient or other entity notice before cancelling, suspending or varying registration (except in urgent circumstances). The decision to cancel, suspend or vary registration cannot be made before the end of the period specified in the notice.

53 Notice of cancellation, suspension or variation of registration etc.

Written notice before cancellation etc. other than in urgent circumstances

The System Operator must give written notice to a healthcare recipient or other entity before:

cancelling or suspending the registration of the healthcare recipient or entity under subsection 51(2), (3), (3A), (4) or (5); or

varying the entity’s registration under section 52;

other than as mentioned in subsection (4) of this section (urgency).

The notice:

must state that the System Operator proposes to cancel, suspend or vary the registration and the reasons why; and

in the case of an entity that the System Operator is satisfied has contravened or may contravene this Act or a condition of the entity’s registration—may specify steps that the entity must take in order to address the contravention or possible contravention; and

must invite the healthcare recipient or other entity to make a written submission, within the period specified in the notice, to the System Operator in relation to the proposed cancellation, suspension or variation.

If the System Operator gives written notice to a healthcare recipient or other entity under subsection (1), the System Operator must not decide to cancel, suspend or vary the registration until after the end of the period referred to in paragraph (2)(c).

Cancellation etc. in urgent circumstances

If the System Operator is satisfied that it is necessary, because of the urgency of the circumstances, to cancel, suspend or vary the registration of a healthcare recipient or other entity without following the process outlined in subsections (1) to (3), the System Operator must give written notice to the healthcare recipient or other entity:

cancelling or suspending the registration of the healthcare recipient or entity under subsection 51(2), (3), (3A), (4) or (5); or

varying the entity’s registration under section 52.

A decision under subsection (4) takes effect:

when notice of the decision is given under that subsection; or

if a later time is specified in the notice under that subsection—at that later time.

54 Effect of suspension

During any period when the registration of a healthcare recipient or other entity is suspended:

the healthcare recipient or other entity is taken not to be registered for the purposes of Division 2 of Part 4 (authorised collection, use and disclosure of health information), other than:

paragraph 63(b) (collection, use or disclosure on request of the System Operator); and

subsection 64(1) (serious threat); and

(ab) if the entity is a registered healthcare provider organisation or registered repository operator—the entity is taken not to be registered for the purposes of paragraph (a) of the definition of approved registered repository operator in section 5 and sections 10A, 41A, 78A, 78C and 78D; and

if the entity is a registered repository operator, a registered portal operator or a registered contracted service provider—the entity is taken to be registered for the purposes of the remaining provisions of this Act.

55 My Health Records Rules may specify requirements after registration is cancelled or suspended

The My Health Records Rules may specify the requirements to which the System Operator or another entity is subject after the registration of a healthcare recipient or other entity is cancelled or suspended.

The My Health Records Rules cannot modify the effect of section 54.

The requirements specified in the My Health Records Rules may include requirements relating to the following:

retention, transfer or disposal of My Health Records;

retention, transfer or disposal of other records.

56 The Register

The System Operator must establish and maintain a Register.

The Register may be maintained in electronic form and may be divided into separate parts.

The Register is not a legislative instrument.

57 Entries to be made in Register

If the System Operator decides under this Part to register a healthcare recipient or other entity or to cancel, suspend or vary such a registration, the System Operator must, as soon as practicable after making the decision, ensure that the following information is entered in the Register in relation to the healthcare recipient or other entity:

such administrative information as is necessary for the purposes of the proper operation of the My Health Record system;

such information (if any) as is specified in the My Health Records Rules for the purposes of this paragraph.

58 Collection, use and disclosure of health information by the System Operator

The System Operator may collect, use and disclose health information about a healthcare recipient for the purposes of including the health information in the My Health Record of a registered healthcare recipient.

58A Collection, use and disclosure of healthcare identifiers, identifying information and information identifying authorised representatives and nominated representatives

An entity mentioned in column 1 of an item of the following table, is authorised to take action of the kind described in column 2 of that item with information of the kind described in column 3 of that item in the circumstances described in column 4 of that item.

Note: Under Healthcare Identifiers Act 2010, the service operator under that Act is authorised to collect, use and disclose healthcare identifiers of, and identifying information about, healthcare recipients and their representatives for the purposes of the My Health Record system. The service operator is also authorised to collect, use and disclose healthcare identifiers of, and identifying information about, healthcare providers under section 24 of that Act.section 15 of the

If:

any of the following entities discloses information to the System Operator in circumstances in which the information is authorised to be disclosed under subsection (1):

the Chief Executive Medicare;

the Veterans’ Affairs Department;

the Defence Department;

(iv) the service operator for the purposes of the Healthcare Identifiers Act 2010;

an entity prescribed for the purposes of item 10 of the table in subsection (1); and

the entity that disclosed the information becomes aware that the information has changed;

that entity must, as soon as practicable after becoming aware of the change, inform the System Operator of the change.

59 Unauthorised collection, use and disclosure of health information included in a healthcare recipient’s My Health Record

A person must not collect from the My Health Record system health information included in a healthcare recipient’s My Health Record if the collection by the person is not authorised under Division 2, and the person knows or is reckless as to that fact.

A person must not use or disclose health information included in a healthcare recipient’s My Health Record if:

the person obtained the information by using or gaining access to the My Health Record system; and

the use or disclosure is not authorised under Division 2, and the person knows or is reckless as to that fact.

Fault-based offence

A person commits an offence if the person contravenes subsection (1) or (2).

Penalty: Imprisonment for 5 years or 300 penalty units, or both.

Civil penalty

A person is liable to a civil penalty if the person contravenes subsection (1) or (2).

Civil penalty: 1,500 penalty units.

59A Unauthorised use of information included in a healthcare recipient’s My Health Record for prohibited purpose

A person must not use health information included in a healthcare recipient’s My Health Record for a prohibited purpose, if the person obtained the information by using or gaining access to the My Health Record system.

Note: For prohibited purpose, see section 70A.

Civil penalty: 1,500 penalty units.

A person must not use health information included in a healthcare recipient’s My Health Record for a prohibited purpose, if the person obtained the information in the following way:

the health information was originally obtained by a participant in the My Health Record system by means of the My Health Record system in accordance with this Act;

after the health information was so obtained, it was stored in such a way that it could be obtained other than by means of the My Health Record system;

the person subsequently obtained the health information by those other means.

Civil penalty: 1,500 penalty units.

Subsection (1) or (1A) does not apply if the person is the healthcare recipient, but does apply if the person is the nominated representative of the healthcare recipient (despite subsection 7(2)).

60 Secondary disclosure

A person must not use or disclose health information included in a healthcare recipient’s My Health Record if:

the information was disclosed to the person in contravention of subsection 59(2); and

the person knows that, or is reckless as to whether, the disclosure of the information to the person contravened that subsection.

Subsection (1) does not apply if the person discloses the information for the purpose of an appropriate authority investigating the contravention mentioned in paragraph (1)(a).

Fault-based offence

A person commits an offence if the person contravenes subsection (1).

Penalty: Imprisonment for 5 years or 300 penalty units, or both.

Civil penalty

A person is liable to a civil penalty if the person contravenes subsection (1).

Civil penalty: 1,500 penalty units.

61 Collection, use and disclosure for providing healthcare

A participant in the My Health Record system is authorised to collect, use and disclose health information included in a registered healthcare recipient’s My Health Record if the collection, use or disclosure of the health information is:

for the purpose of providing healthcare to the registered healthcare recipient; and

in accordance with:

the access controls set by the registered healthcare recipient; or

if the registered healthcare recipient has not set access controls—the default access controls specified by the My Health Records Rules or, if the My Health Records Rules do not specify default access controls, by the System Operator.

Subsection (1) does not authorise a participant in the My Health Record system to collect, use or disclose health information included in healthcare recipient-only notes.

62 Collection, use and disclosure to nominated representative

A participant in the My Health Record system is authorised to disclose health information included in a registered healthcare recipient’s My Health Record for any purpose if the disclosure of the health information is:

to the registered healthcare recipient’s nominated representative; and

in accordance with:

the access controls set by the registered healthcare recipient; or

if the healthcare recipient has not set access controls—the default access controls specified by the My Health Records Rules or, if the My Health Records Rules do not specify default access controls, by the System Operator.

Subdivision B—Collection, use and disclosure other than in accordance with access controls

63 Collection, use and disclosure for management of My Health Record system

A participant in the My Health Record system is authorised to collect, use and disclose health information included in a healthcare recipient’s My Health Record if:

the collection, use or disclosure is undertaken for the purpose of the management or operation of the My Health Record system, if the healthcare recipient would reasonably expect the participant to collect, use or disclose the health information for that purpose; or

the collection, use or disclosure is undertaken in response to a request by the System Operator for the purpose of performing a function or exercising a power of the System Operator.

Note: For example, the System Operator might make a request under paragraph (b) for the purposes of section 69, 69A or 70.

64 Collection, use and disclosure in the case of a serious threat

A participant in the My Health Record system is authorised to collect, use and disclose health information included in a registered healthcare recipient’s My Health Record if:

the participant reasonably believes that:

the collection, use or disclosure is necessary to lessen or prevent a serious threat to an individual’s life, health or safety; and

it is unreasonable or impracticable to obtain the healthcare recipient’s consent to the collection, use or disclosure; and

unless the participant is the System Operator—the participant advises the System Operator of the matters in paragraph (a); and

the collection, use or disclosure occurs not later than 5 days after that advice is given.

A participant in the My Health Record system is authorised to collect, use and disclose health information included in a healthcare recipient’s My Health Record if the participant reasonably believes that the collection, use or disclosure by the participant is necessary to lessen or prevent a serious threat to public health or public safety.

Subsections (1) and (2) do not authorise a participant in the My Health Record system to collect, use or disclose healthcare recipient-only notes.

65 Collection, use and disclosure authorised by law

Subject to section 69, a participant in the My Health Record system is authorised to collect, use and disclose health information included in a healthcare recipient’s My Health Record if the collection, use or disclosure is required or authorised by a Commonwealth, State or Territory law covered by subsection (3).

Note: No State or Territory laws are covered by subsection (3).

Subsection (1) does not authorise a participant in the My Health Record system to collect, use or disclose healthcare recipient-only notes.

This subsection covers the following laws:

this Act;

(b) the Auditor-General Act 1997;

(c) the Ombudsman Act 1976;

a law of the Commonwealth to the extent that the law requires or authorises the collection, use or disclosure of information for the purposes of performing the Information Commissioner’s functions in relation to the My Health Record system.

66 Collection, use and disclosure with healthcare recipient’s consent

A participant in the My Health Record system is authorised to disclose for any purpose health information included in a healthcare recipient’s My Health Record to the healthcare recipient.

A participant in the My Health Record system is authorised to collect, use and disclose for any purpose health information included in a healthcare recipient’s My Health Record with the consent of the healthcare recipient.

67 Collection, use and disclosure by a healthcare recipient

A healthcare recipient is authorised to collect, use and disclose, for any purpose, health information included in his or her My Health Record.

Note: The information the healthcare recipient can collect through the My Health Record system after cancellation of the healthcare recipient’s registration on request may be limited because of the retention and destruction requirements under section 17.

68 Collection, use and disclosure for indemnity cover

A participant in the My Health Record system is authorised to collect, use and disclose health information included in a healthcare recipient’s My Health Record for purposes relating to the provision of indemnity cover for a healthcare provider.

Subsection (1) does not authorise a participant in the My Health Record system to collect, use or disclose healthcare recipient-only notes.

69 Disclosure to courts and tribunals

If:

a court or tribunal other than a coroner orders or directs the System Operator to disclose health information included in a healthcare recipient’s My Health Record to the court or tribunal; and

the order or direction is given in the course of proceedings relating to:

this Act; or

unauthorised access to information through the My Health Record system; or

a share by default provision; or

the provision of indemnity cover to a healthcare provider; and

apart from this Part, the System Operator would be required to comply with the order or direction;

the System Operator must comply with the order or direction.

If a coroner orders or directs the System Operator to disclose health information included in a healthcare recipient’s My Health Record to the coroner, the System Operator must comply with the order or direction.

Except as mentioned in subsection (1) or (2), a participant in the My Health Record system, or a healthcare recipient, cannot be required to disclose health information included in a healthcare recipient’s My Health Record to a court or tribunal.

Except as mentioned in subsection (1) or (2), the System Operator is not authorised to disclose health information included in a healthcare recipient’s My Health Record to a court or tribunal unless the healthcare recipient consents.

Subsections (1) and (2) do not authorise the System Operator to disclose healthcare recipient-only notes.

69A Disclosure to designated entity under order by judicial officer

Disclosure to designated entity under order by judicial officer

If an entity that is:

(a) an agency, or a State or Territory authority, within the meaning of the Privacy Act 1988; and

not a court, tribunal or coroner;

(a designated entity) presents to the System Operator an order made under this section, the System Operator must comply with the order.

Except as mentioned in subsection (1) or in accordance with a law covered by subsection 65(3), a participant in the My Health Record system, or a healthcare recipient, cannot be required to disclose health information included in a healthcare recipient’s My Health Record to a designated entity.

This section does not authorise the System Operator to use or disclose healthcare recipient-only notes.

If the System Operator uses or discloses personal information under this section, the System Operator must make a written note of the use or disclosure.

Application for and making of order

A designated entity may apply to any of the following judicial officers:

a magistrate of a State or Territory;

a judge who is eligible under subsection 69B(2);

for an order under this section in relation to the disclosure, to the entity, of health information included in a healthcare recipient’s My Health Record.

The judicial officer may make the order if:

the designated entity satisfies the judicial officer, by information on oath or affirmation, that:

the designated entity has powers or duties of the kind mentioned in subsection (7); and

if the designated entity has powers of the kind mentioned in paragraph (7)(a)—the designated entity has exercised or purported to exercise its power to require the System Operator to disclose information to which the order will relate; and

in all the circumstances, the particular disclosure of the particular information to the designated entity is reasonably necessary for the purposes of a thing done by, or on behalf of, the designated entity; and

there is no effective means for the designated entity to obtain the particular information, other than an order under this section; and

the judicial officer is satisfied that, having regard to the matter mentioned in subparagraph (a)(iii) and the privacy of the healthcare recipient, the disclosure of the information would not, on balance, unreasonably interfere with the privacy of the healthcare recipient.

A designated entity has powers or duties of the kind mentioned in this subsection if:

the designated entity has power under a law of the Commonwealth or a State or Territory (other than a law covered by subsection 65(3)) to require persons to give information to the designated entity; or

officers of the designated entity are, in the ordinary course of their duties, authorised to execute warrants to enter premises and seize things found, including documents.

The judicial officer must not make the order unless the designated entity or some other person has given the judicial officer, either orally or by affidavit, such further information (if any) as the judicial officer requires concerning the grounds on which the order is being sought.

The order must:

identify the healthcare recipient; and

specify the particular information to be disclosed; and

authorise one or more officers of the designated entity (whether or not named in the order) to obtain the information from the System Operator and require the System Operator to disclose the information to the designated entity; and

specify the day (not more than 6 months after the making of the order) on which the order ceases to have effect; and

state the purpose for which the order is made.

69B Judicial officers for orders under section 69A

Eligible judge of a court created by the Parliament

A judge of a court created by the Parliament may, by writing, consent to be nominated by the Attorney-General under subsection (2).

The Attorney-General may, by writing, nominate a judge of a court created by the Parliament in relation to whom a consent is in force under subsection (1) to be eligible for the purposes of paragraph 69A(5)(b).

A nomination under subsection (2) is not a legislative instrument.

Magistrates

A magistrate need not accept the functions conferred by section 69A.

The Governor-General may:

arrange with the Governor of a State for the performance, by all or any of the persons who from time to time hold office as magistrates of that State, of the functions of a magistrate conferred by section 69A; or

arrange with the Chief Minister of the Australian Capital Territory for the performance, by all or any of the persons who from time to time hold office as magistrates of the Australian Capital Territory, of the functions of a magistrate conferred by section 69A; or

arrange with the Administrator of the Northern Territory for the performance, by all or any of the persons who from time to time hold office as Judges of the Local Court of the Northern Territory, of the functions of a magistrate conferred by section 69A.

Judicial officers exercising powers in personal capacity

The functions conferred on a judicial officer by section 69A are conferred on the judicial officer:

in a personal capacity; and

not as a court or a member of a court.

A judicial officer performing a function conferred by section 69A has the same protection and immunity as if the judicial officer were performing the function:

as the court of which the judicial officer is a member; or

as a member of the court of which the judicial officer is a member.

70 Disclosure in relation to unlawful activity

The System Operator is authorised to use or (subject to subsection (3A)) disclose health information included in a healthcare recipient’s My Health Record if the System Operator:

has reason to suspect that unlawful activity that relates to the System Operator’s functions has been, is being or may be engaged in; and

reasonably believes that use or disclosure of the information is necessary for the purposes of an investigation of the matter or in reporting concerns to relevant persons or authorities.

The System Operator is authorised to disclose under subsection (3) only the information the relevant person or authority mentioned in paragraph (3)(b) needs to identify the matter or concerns mentioned in that paragraph with sufficient certainty to:

initiate consideration of the matter or concerns; and

if necessary, apply for an order under section 69A in relation to the matter or concerns.

If the System Operator uses or discloses personal information under this section, it must make a written note of the use or disclosure.

This section does not authorise the System Operator to use or disclose healthcare recipient-only notes.

70AA Collection, use and disclosure in relation to compliance with share by default provisions

Subject to section 69, the System Operator is authorised to collect, use and disclose to a person covered by subsection (2) information covered by subsection (3) for the purposes of monitoring, investigating or enforcing compliance with a share by default provision.

This subsection covers the following persons:

the Chief Executive Medicare;

the Secretary of the Department;

(c) a Commonwealth entity (within the meaning of the Public Governance, Performance and Accountability Act 2013) (if any) specified in the My Health Records Rules.

This subsection covers health information that is:

included in a healthcare recipient’s My Health Record; and

of a kind specified in the My Health Records Rules.

Subsection (1) does not authorise the System Operator to collect, use or disclose healthcare recipient-only notes.

Subdivision C—Unauthorised use of information included in a healthcare recipient’s My Health Record for prohibited purpose

70A Definition of prohibited purpose

(1) Information included in a healthcare recipient’s My Health Record is used for a prohibited purpose if the person who uses the information does so for any one or more of the following purposes:

the purpose of:

underwriting a contract of insurance that covers the healthcare recipient; or

determining whether to enter into a contract of insurance that covers the healthcare recipient (whether alone or as a member of a class); or

determining whether a contract of insurance covers the healthcare recipient in relation to a particular event; or

an employer employing, or continuing or ceasing to employ, the healthcare recipient;

a purpose prescribed by the regulations.

If the person uses information for purposes that include, or for a purpose that includes, a purpose mentioned in subsection (1), the person is taken to be using the information for a prohibited purpose.

(3) To avoid doubt, use of information is not for a prohibited purpose if the use is solely for:

the purpose of providing healthcare to the healthcare recipient; or

purposes relating to the provision of indemnity cover for a healthcare provider.

References in paragraph (1)(a) to insurance do not include State insurance that does not extend beyond the limits of the State concerned.

For the purposes of this section, using information for a purpose includes requesting or requiring the information for that purpose.

70B Use for prohibited purpose is unauthorised

Despite Subdivisions A and B, a person is not authorised under this Division to use health information included in a registered healthcare recipient’s My Health Record for a prohibited purpose.

Subsection (1) does not apply if the person is the healthcare recipient, but does apply if the person is the nominated representative of the healthcare recipient (despite subsection 7(2)).

71 Prohibitions and authorisations limited to health information collected by using the My Health Record system

Subject to subsection (5), the prohibitions and authorisations under Divisions 1 and 2 in respect of the collection, use and disclosure of health information included in a healthcare recipient’s My Health Record are limited to the collection, use or disclosure of health information obtained by using the My Health Record system.

If health information included in a healthcare recipient’s My Health Record can also be obtained by means other than by using the My Health Record system, such a prohibition or authorisation does not apply to health information lawfully obtained by those other means, even if the health information was originally obtained by using the My Health Record system.

Information stored for more than one purpose

Without limiting the circumstances in which health information included in a healthcare recipient’s My Health Record and obtained by a person is taken not to be obtained by using or gaining access to the My Health Record system, it is taken not to be so obtained if:

the health information is stored in a repository operated both for the purposes of the My Health Record system and other purposes; and

the person lawfully obtained the health information directly from the repository for those other purposes.

Note: For example, information that is included in a registered healthcare recipient’s My Health Record may be stored in a repository operated by a State or Territory for purposes related to the My Health Record system and other purposes. When lawfully obtained directly from the repository for those other purposes, the prohibitions and authorisations in this Part will not apply.

Information originally obtained by means of My Health Record system

Without limiting the circumstances in which health information included in a healthcare recipient’s My Health Record and obtained by a person is taken not to be obtained by using or gaining access to the My Health Record system, it is taken not to be so obtained if:

the health information was originally obtained by a participant in the My Health Record system by means of the My Health Record system in accordance with this Act; and

after the health information was so obtained, it was stored in such a way that it could be obtained other than by means of the My Health Record system; and

the person subsequently obtained the health information by those other means.

Note: For example, information that is included in a registered healthcare recipient’s My Health Record may be downloaded into the clinical health records of a healthcare provider and later obtained from those records.

This section does not apply to the prohibition in subsection 59A(1A).

71AA Definitions

In this Division:

My Health Record of a healthcare recipient includes a My Health Record of the healthcare recipient that has been cancelled or suspended.

use information for a purpose includes request or require the information for that purpose.

71A Offence for use of My Health Record-derived information for prohibited purpose

A person commits an offence if:

the person uses information; and

the person does so for a prohibited purpose, and the person knows or is reckless as to that fact; and

the information is health information; and

the information is or was included in a healthcare recipient’s My Health Record; and

the person is not the healthcare recipient.

Penalty: Imprisonment for 5 years or 300 penalty units, or both.

Subsection (1) does not apply if the information was not collected from, and is not derived from a disclosure that was made by, a person who obtained the information by using or gaining access to the My Health Record system. For this purpose, it does not matter whether or not any collection or disclosure of the information was authorised under this Act or any other law.

Note: A defendant bears an evidential burden in relation to the matter in subsection (2): see subsection 13.3(3) of the Criminal Code.

Strict liability applies to paragraphs (1)(d) and (e).

Note: For strict liability, see Criminal Code.section 6.1 of the

Despite paragraph (1)(e) and subsection 7(2), subsection (1) of this section applies to a person who is the nominated representative of the healthcare recipient.

71B Civil penalty for use of My Health Record-derived information for prohibited purpose

A person must not use health information that is or was included in a healthcare recipient’s My Health Record for a prohibited purpose.

Civil penalty: 1,500 penalty units.

Subsection (1) does not apply if the information was not collected from, and is not derived from a disclosure that was made by, a person who obtained the information by using or gaining access to the My Health Record system. For this purpose, it does not matter whether or not any collection or disclosure of the information was authorised under this Act or any other law.

Note: A person bears an evidential burden in relation to the matter in subsection (2): see Regulatory Powers (Standard Provisions) Act 2014.section 96 of the

Subsection (1) does not apply if the person is the healthcare recipient, but does apply if the person is the nominated representative of the healthcare recipient (despite subsection 7(2)).

72 Interaction with the Privacy Act 1988

An authorisation to collect, use or disclose health information under this Act is also an authorisation to collect, use or disclose the health information for the purposes of the Privacy Act 1988.

73 Contravention of this Act is an interference with privacy

An act or practice that contravenes this Act in connection with health information included in a healthcare recipient’s My Health Record or a provision of Part 4 or 5, or would contravene this Act but for a requirement relating to the state of mind of a person, is taken to be:

(a) for the purposes of the Privacy Act 1988, an interference with the privacy of a healthcare recipient; and

covered by section 13 of that Act.

(2) The respondent to a complaint under the Privacy Act 1988 about an act or practice, other than an act or practice of an agency or organisation, is the individual who engaged in the act or practice.

(3) In addition to the Information Commissioner’s functions under the Privacy Act 1988, the Information Commissioner has the following functions in relation to the My Health Record system:

to investigate an act or practice that may be an interference with the privacy of a healthcare recipient under subsection (1) and, if the Information Commissioner considers it appropriate to do so, to attempt by conciliation to effect a settlement of the matters that gave rise to the investigation;

to do anything incidental or conducive to the performance of those functions.

The Information Commissioner has power to do all things that are necessary or convenient to be done for or in connection with the performance of his or her functions under subsection (3).

Note: An act or practice that is an interference with privacy may be the subject of a complaint under Privacy Act 1988.section 36 of the

73A Information Commissioner may disclose details of investigations to System Operator

The Information Commissioner is authorised to disclose to the System Operator any information or documents that relate to an investigation the Information Commissioner conducts because of the operation of section 73, if the Information Commissioner is satisfied that to do so will enable the System Operator to monitor or improve the operation or security of the My Health Record system.

73B Obligations of System Operator in relation to correction, etc.

(1) The System Operator may, in order to meet its obligations under the Privacy Act 1988 in relation to the correction and alteration of records:

request a participant in the My Health Record system to correct personal information contained in a record included in the My Health Record system and, if the participant does so, to upload the corrected record to the My Health Record system; and

if the participant refuses to do so—direct the participant to attach to the record a note prepared by the healthcare recipient in relation to personal information included in the record, and to upload the record and note to the My Health Record system.

A participant in the My Health Record system who is given a direction under paragraph (1)(b) must comply with the direction.

73C Collection, use and disclosure of health information in relation to compliance with share by default provisions

A person covered by subsection (2) is authorised to collect, use and disclose, for the purposes of monitoring, investigating or enforcing compliance with a share by default provision, health information disclosed to the person under section 70AA.

This subsection covers the following persons:

the Chief Executive Medicare;

the Secretary of the Department;

(c) a Commonwealth entity (within the meaning of the Public Governance, Performance and Accountability Act 2013) (if any) specified in the My Health Records Rules for the purposes of paragraph 70AA(2)(c).

73D Collection, use and disclosure of healthcare identifiers and identifying information in relation to compliance with share by default provisions

An entity mentioned in column 1 of an item of the following table is authorised to take action of the kind described in column 2 of that item with information of the kind described in column 3 of that item in the circumstances described in column 4 of that item.

79 Civil penalty provisions

Enforceable civil penalty provisions

Each civil penalty provision of this Act is enforceable under Part 4 of the Regulatory Powers Act.

Note: Part 4 of the Regulatory Powers Act allows a civil penalty provision to be enforced by obtaining an order for a person to pay a pecuniary penalty for the contravention of the provision.

Authorised applicant

For the purposes of Part 4 of the Regulatory Powers Act, each person mentioned in column 1 of an item of the following table is an authorised applicant in relation to a provision mentioned in column 2 of the item:

The Secretary of the Department may, in writing, delegate the Secretary’s powers and functions under Part 4 of the Regulatory Powers Act in relation to the provisions mentioned in item 2 of the table in subsection (2) to an SES employee, or acting SES employee, in the Department.

A person exercising powers or performing functions under a delegation under subsection (2A) must comply with any directions of the Secretary of the Department.

Relevant court

For the purposes of Part 4 of the Regulatory Powers Act, each of the following courts is a relevant court in relation to the civil penalty provisions of this Act:

the Federal Court of Australia;

the Federal Circuit and Family Court of Australia (Division 2);

a court of a State or Territory that has jurisdiction in relation to the matter.

Extension to external Territories

Part 4 of the Regulatory Powers Act, as that Part applies in relation to the civil penalty provisions of this Act, extends to every external Territory.

Liability of the Crown

Part 4 of the Regulatory Powers Act, as that Part applies in relation the civil penalty provisions of this Act, does not make the Crown liable to a pecuniary penalty.

79A Infringement notices

Provisions subject to an infringement notice

The following provisions are subject to an infringement notice under Part 5 of the Regulatory Powers Act:

subsection 41A(1);

subsection 78C(4);

subsection 78D(1).

Note: Part 5 of the Regulatory Powers Act creates a framework for using infringement notices in relation to provisions.

Infringement officer

For the purposes of Part 5 of the Regulatory Powers Act, an SES employee, or acting SES employee, in the Department authorised, in writing, by the Secretary of the Department for the purposes of this subsection is an infringement officer in relation to the provisions mentioned in subsection (1).

Relevant chief executive

For the purposes of Part 5 of the Regulatory Powers Act, the Secretary of the Department is the relevant chief executive in relation to the provisions mentioned in subsection (1).

The relevant chief executive may, in writing, delegate the relevant chief executive’s powers and functions under Part 5 of the Regulatory Powers Act in relation to the provisions mentioned in subsection (1) to an SES employee, or acting SES employee, in the Department.

A person exercising powers or performing functions under a delegation under subsection (4) must comply with any directions of the relevant chief executive.

Extension to external Territories

Part 5 of the Regulatory Powers Act, as that Part applies in relation to the provisions mentioned in subsection (1), extends to every external Territory.

80 Enforceable undertakings

Enforceable provisions

This Act is enforceable under Part 6 of the Regulatory Powers Act.

Note: Part 6 of the Regulatory Powers Act creates a framework for accepting and enforcing undertakings relating to compliance with provisions.

Authorised person

For the purposes of Part 6 of the Regulatory Powers Act, each of the following persons is an authorised person in relation to the provisions of this Act:

the System Operator;

the Information Commissioner;

the Secretary of the Department.

Relevant court

For the purposes of Part 6 of the Regulatory Powers Act, each of the following courts is a relevant court in relation to the provisions of this Act:

the Federal Court of Australia;

the Federal Circuit and Family Court of Australia (Division 2);

a court of a State or Territory that has jurisdiction in relation to the matter.

Enforceable undertaking may be published on website

An authorised person in relation to a provision of this Act may publish an undertaking given in relation to the provision on the authorised person’s website.

Extension to external Territories

Part 6 of the Regulatory Powers Act, as that Part applies in relation to the provisions of this Act, extends to every external Territory.

81 Injunctions

Enforceable provisions

This Act is enforceable under Part 7 of the Regulatory Powers Act.

Note: Part 7 of the Regulatory Powers Act creates a framework for using injunctions to enforce provisions.

Authorised person

For the purposes of Part 7 of the Regulatory Powers Act, each of the following persons is an authorised person in relation to the provisions of this Act:

the System Operator;

the Information Commissioner;

the Secretary of the Department.

Relevant court

For the purposes of Part 7 of the Regulatory Powers Act, each of the following courts is a relevant court in relation to the provisions of this Act:

the Federal Court of Australia;

the Federal Circuit and Family Court of Australia (Division 2);

a court of a State or Territory that has jurisdiction in relation to the matter.

Extension to external Territories

Part 7 of the Regulatory Powers Act, as that Part applies in relation to the provisions of this Act, extends to every external Territory.

82 Data Governance Board

The Data Governance Board is established by this section.

83 Functions of the Board

The functions of the Data Governance Board are:

to oversee the operation of the framework prescribed by My Health Records Rules made for the purposes of subsection 109(7A), including by:

assessing applications for the collection, use or disclosure of de-identified data and health information for research or public health purposes; and

guiding and directing the System Operator in the performance of its function under paragraph 15(ma) (preparing and providing de-identified data and health information); and

taking steps to ensure the ongoing protection of de-identified data and health information used by, or disclosed to, persons for research or public health purposes and that the data and information is being used and disclosed only for those purposes; and

any other functions conferred on the Board by this Act or the My Health Records Rules.

The Board does not have any functions, and must not perform any role, in relation to the day-to-day operation of the My Health Record system.

84 Membership

The Data Governance Board consists of the following members:

the Chair of the Data Governance Board;

the Deputy Chair of the Data Governance Board;

at least 7, and no more than 10, other members.

85 Appointment of members

Members are to be appointed by the Minister by written instrument, on a part-time basis.

The Minister must appoint one member to be the Chair and another member to be the Deputy Chair.

86 Qualifications and experience

The Minister must appoint the following as members:

a person who represents the System Operator;

a person who represents the data custodian;

a person who is an Aboriginal person or a Torres Strait Islander.

A person (including a person appointed in accordance with subsection (1)) is not eligible for appointment as a member of the Data Governance Board unless the person has skills or experience in, or knowledge of, one or more of the following fields:

population health and epidemiology;

medical or health research;

health services delivery;

technology;

data science;

data governance;

privacy;

consumer advocacy.

87 Acting appointments

The Minister may, by written instrument, appoint a person to act as the Chair:

during a vacancy in the office of Chair (whether or not an appointment has previously been made to the office); or

during any period, or during all periods, when the Chair:

is absent from duty or from Australia; or

is, for any reason, unable to perform the duties of the office.

Note: For rules that apply to acting appointments, see sections 33AB and 33A of the Acts Interpretation Act 1901.

The Minister may, by written instrument, appoint a person to act as the Deputy Chair:

during a vacancy in the office of Deputy Chair (whether or not an appointment has previously been made to the office); or

during any period, or during all periods, when the Deputy Chair:

is absent from duty or from Australia; or

is, for any reason, unable to perform the duties of the office.

Note: For rules that apply to acting appointments, see sections 33AB and 33A of the Acts Interpretation Act 1901.

88 Term of appointment and other terms and conditions

A member of the Data Governance Board holds office for the period specified in the instrument of appointment. The period must not exceed 5 years.

A member of the Data Governance Board holds office on the terms and conditions (if any) in relation to matters not covered by this Part that are determined by the Minister.

89 Remuneration

A member of the Data Governance Board is to be paid the remuneration that is determined by the Remuneration Tribunal. If no determination of that remuneration by the Tribunal is in operation, the member is to be paid the remuneration that is prescribed by an instrument made under subsection (4).

A member is to be paid the allowances that are prescribed by an instrument made under subsection (4).

(3) This section has effect subject to the Remuneration Tribunal Act 1973.

The Minister may, by legislative instrument, prescribe:

remuneration for the purposes of subsection (1); and

allowances for the purposes of subsection (2).

90 Resignation

A member of the Data Governance Board may resign the member’s appointment by giving the Minister a written resignation.

The resignation takes effect on the day it is received by the Minister or, if a later day is specified in the resignation, on that later day.

91 Termination of appointment

The Minister may terminate the appointment of a member of the Data Governance Board:

for misbehaviour; or

if the member is unable to perform the duties of the member’s office because of physical or mental incapacity.

The Minister may terminate the appointment of a member of the Data Governance Board if:

the member:

becomes bankrupt; or

applies to take the benefit of any law for the relief of bankrupt or insolvent debtors; or

compounds with the member’s creditors; or

makes an assignment of the member’s remuneration for the benefit of the member’s creditors; or

the member is absent, except on leave of absence, from 3 consecutive meetings of the Board; or

the member engages in paid work (the Minister’s opinion, conflicts or could conflict with the proper performance of the member’s duties (see section 93); orwithin the meaning of section 93) that, in

(d) the member fails, without reasonable excuse, to comply with Public Governance, Performance and Accountability Act 2013 (which deals with the duty to disclose interests) or rules made for the purposes of that section.section 29 of the

92 Leave of absence

The Minister may grant leave of absence to any member of the Data Governance Board on the terms and conditions that the Minister determines.

93 Other paid work

A member of the Data Governance Board must not engage in any paid work that, in the Minister’s opinion, conflicts or could conflict with the proper performance of the member’s duties.

In subsection (1):

paid work means work for financial gain or reward (whether as an employee, a self-employed person or otherwise).

94 Convening meetings

The Data Governance Board must hold such meetings as are necessary for the efficient performance of its functions.

The Chair of the Data Governance Board:

may convene a meeting at any time; and

must convene a meeting within 30 days after receiving a written request to do so from another member of the Board.

95 Presiding at meetings

(1) The Chair of the Data Governance Board must preside at all meetings at which the Chair is present.

(2) If the Chair is not present at a meeting at which the Deputy Chair is present, the Deputy Chair must preside.

If neither the Chair nor the Deputy Chair is present at a meeting, the other members present must appoint one of themselves to preside.

96 Quorum

At a meeting of the Data Governance Board, a quorum is constituted by a majority of members of the Board.

However, if:

(a) a member of the Board is required by rules made for the purposes of Public Governance, Performance and Accountability Act 2013 not to be present during the deliberations, or to take part in any decision, of the Board with respect to a particular matter; andsection 29 of the

when the member leaves the meeting concerned there is no longer a quorum present;

the remaining members at the meeting constitute a quorum for the purpose of any deliberation or decision at that meeting with respect to that matter.

96A Voting at meetings

A question arising at a meeting of the Data Governance Board is to be determined by a majority of the votes of the members of the Board present and voting.

The person presiding at a meeting of the Board has a deliberative vote and, if the votes are equal, a casting vote.

96B Conduct of meetings

The Data Governance Board may, subject to this Division, regulate proceedings at its meetings as it considers appropriate.

Note: Section 33B of the Acts Interpretation Act 1901 contains further information about the ways in which members of the Board may participate in meetings.

96C Minutes

The Data Governance Board must keep minutes of its meetings.

96D Decisions without meetings

The Data Governance Board is taken to have made a decision at a meeting if:

without meeting, a majority of the members of the Board entitled to vote on the proposed decision indicate agreement with the decision; and

that agreement is indicated in accordance with the method determined by the Board under subsection (2); and

(c) all the members were informed of the proposed decision, or reasonable efforts were made to inform all the members of the proposed decision.

Subsection (1) applies only if the Board:

has determined that it may make decisions of that kind without meeting; and

has determined the method by which members are to indicate agreement with proposed decisions.

(3) For the purposes of paragraph (1)(a), a member is not entitled to vote on a proposed decision if the member would not have been entitled to vote on that proposal if the matter had been considered at a meeting of the Board.

The Board must keep a record of decisions made in accordance with this section.

Note: Section 33B of the Acts Interpretation Act 1901 contains further information about the ways in which members of the Board may participate in meetings.

96E Relationship between System Operator and Data Governance Board in relation to data for research or public health purposes

In performing the function mentioned in paragraph 15(ma), the System Operator must comply with a direction from, and follow the guidance of, the Data Governance Board.

If rules made for the purposes of subsection 109(7A) require the Data Governance Board to take steps to ensure that de-identified data and health information disclosed to persons for research or public health purposes is being used only for those purposes, the System Operator must not take any steps of its own to ensure that the data and information is being used only for those purposes.

Subsection (2) does not imply that the System Operator has a duty to take steps in relation to use of data and information at a time when there are no rules of the kind mentioned in subsection (2).

96F Board committees

The Data Governance Board may establish a committee or committees to assist in carrying out the functions of the Board.

The Board may dissolve a committee at any time.

The functions of a committee are as determined by the Board.

In performing its functions, a committee must comply with any directions given to the committee by the Board.

A question arising at a meeting of a committee is to be determined by a majority of the votes of committee members present.

A committee must inform the other members of the Board of its decisions.

A committee may regulate proceedings at its meetings as it considers appropriate.

A committee must ensure that minutes of its meetings are kept.

96G Delegation of functions

If the Secretary of the Department consents to the Data Governance Board delegating functions to APS employees in the Department, the Board may delegate any or all of its functions to such an APS employee.

Note: Sections 34AA to 34A of the Acts Interpretation Act 1901 contain provisions relating to delegations.

(2) If the chief executive officer (however described) of the data custodian consents to the Board delegating functions to members of the staff mentioned in subsection 19(1) of the Australian Institute of Health and Welfare Act 1987, the Board may delegate all or any of its functions to such a member of staff.

Note: Sections 34AA to 34A of the Acts Interpretation Act 1901 contain provisions relating to delegations.

In performing a delegated function or exercising a delegated power, the delegate must comply with any written directions of the Board.

The delegation continues in force despite a change in the membership of the Board.

The delegation may be varied or revoked by the Board (whether or not there has been a change in the membership of the Board).

96H Annual report

As soon as practicable after the end of each financial year, the Data Governance Board must prepare and give a report to the Minister, for presentation to the Parliament, on the Board’s activities during the financial year.

Note: See also Acts Interpretation Act 1901, which contains extra rules about annual reports.section 34C of the

(2) A report on the Department’s activities given under Public Governance, Performance and Accountability Act 2013 does not need to include a report on the activities of the Board.section 46 of the

96J Board is part of the Department

For the purposes of paragraph (a) of the definition of Department of State in section 8 of the Public Governance, Performance and Accountability Act 2013, the Data Governance Board is prescribed in relation to the Department.

97 Review of decisions

This section applies to the following decisions of the System Operator:

a decision under section 6 that a person is or is not the authorised representative of a healthcare recipient;

a decision under section 41 to refuse to register a healthcare recipient;

a decision under section 41B to refuse an application to approve a period;

a decision under section 44 to refuse to register a healthcare provider organisation or to impose a condition on such a registration;

a decision under section 49 to refuse to register a person as:

a repository operator; or

a portal operator; or

a contracted service provider;

or to impose a condition on such a registration;

a decision under section 49 to refuse to specify a repository as a repository to which the registration of a repository operator relates;

a decision under section 51 to cancel or suspend the registration of a healthcare recipient or other entity;

a decision under section 51 to refuse to cancel or suspend the registration of a healthcare recipient or other entity on request;

a decision under section 52 to vary the registration of a healthcare recipient or other entity on request;

a decision under section 52 to refuse to vary the registration of a healthcare recipient or other entity;

a decision under section 78B to refuse an application to approve a period.

The System Operator must take such steps as are reasonably necessary in the circumstances to give written notice of the decision to each person affected by the decision, including a statement:

that the person may apply to the System Operator to reconsider the decision; and

of the person’s rights to seek review under subsection (8) of a reconsidered decision.

However, the System Operator is not required to give notice of the decision to a person if the System Operator is satisfied that doing so would put at risk the life, health or safety of a person.

A failure of the System Operator to comply with subsection (2) does not affect the validity of the decision.

A person who is given a written notice under subsection (2) may, by written notice given to the System Operator within 28 days after receiving the notice, ask the System Operator to reconsider the decision.

A request under subsection (4) must mention the reasons for making the request.

The System Operator must:

reconsider the decision within 28 days after receiving the request; and

give to the person who requested the reconsideration written notice of the result of the reconsideration and of the grounds for the result.

The notice must include a statement that the person may apply to the Administrative Review Tribunal for review of the reconsideration.

A person may apply to the Administrative Review Tribunal for review of a decision of the System Operator made under subsection (6).

98 Delegations by the System Operator

The System Operator may, by writing, delegate one or more of his or her functions and powers to any of the following:

an APS employee in the Department;

the Chief Executive Medicare.

Despite subsection (1), the System Operator must not delegate the function referred to in paragraph 15(l) (advising the Minister).

If the System Operator is not the Secretary, the System Operator may only delegate a function or power of the System Operator:

to an APS employee in the Department—with the agreement of the Secretary; and

to the Chief Executive Medicare—with the agreement of the Chief Executive Medicare.

Each of the following must comply with any written directions of the System Operator:

a delegate;

(b) if the Chief Executive Medicare delegates under subsection 8AC(3) of the Human Services (Medicare) Act 1973 a function delegated to him or her under this section—a subdelegate.

99 Authorisations extend to employees etc.

An authorisation under this Act to an entity (the first entity) is also an authorisation of:

an individual:

who is an employee of the first entity; and

whose duties involve doing an act that is authorised in relation to the first entity; or

an individual healthcare provider, if:

the first entity is a registered healthcare provider organisation; and

the first entity provides services or facilities to the individual healthcare provider, to facilitate the provision of healthcare by the individual healthcare provider; or

a contracted service provider of a healthcare provider whose duties under a contract with a healthcare provider involve providing information technology services relating to the communication of health information, or health information management services, to the healthcare provider; or

(c) a person (the contractor) performing services under a contract between the contractor and the first entity, if:

the first entity is a participant in the My Health Record system, other than a registered healthcare provider organisation or a registered contracted service provider; and

the contract relates to the My Health Record system; or

(ca) a person (the subcontractor) performing services under a contract between the subcontractor and another person (the contractor), if:

the first entity is the System Operator or the operator of the National Repositories Service; and

the first entity has a contract with the contractor; and

the contract between the subcontractor and the contractor relates to the My Health Record system; or

an individual:

who is an employee of a contracted service provider to which paragraph (b) applies or a person to whom paragraph (c) or (ca) applies; and

whose duties relate to the relevant contract mentioned in whichever of those paragraphs applies.

100 Treatment of partnerships

This Act applies to a partnership as if it were a person, but with the changes set out in this section.

An obligation that would otherwise be imposed on the partnership by this Act is imposed on each partner instead, but may be discharged by any of the partners.

An offence against this Act that would otherwise have been committed by the partnership is taken to have been committed by each partner in the partnership, at the time the offence was committed, who:

did the relevant act or made the relevant omission; or

aided, abetted, counselled or procured the relevant act or omission; or

was in any way knowingly concerned in, or party to, the relevant act or omission (whether directly or indirectly and whether by any act or omission of the partner).

This section applies to a contravention of a civil penalty provision in a corresponding way to the way in which it applies to an offence.

101 Treatment of unincorporated associations

This Act applies to an unincorporated association as if it were a person, but with the changes set out in this section.

An obligation that would otherwise be imposed on the unincorporated association by this Act is imposed on each member of the association’s committee of management instead, but may be discharged by any of the members.

An offence against this Act that would otherwise have been committed by the unincorporated association is taken to have been committed by each member of the association’s committee of management, at the time the offence was committed, who:

did the relevant act or made the relevant omission; or

aided, abetted, counselled or procured the relevant act or omission; or

was in any way knowingly concerned in, or party to, the relevant act or omission (whether directly or indirectly and whether by any act or omission of the member).

This section applies to a contravention of a civil penalty provision in a corresponding way to the way in which it applies to an offence.

102 Treatment of trusts with multiple trustees

If a trust has 2 or more trustees, this Act applies to the trust as if it were a person, but with the changes set out in this section.

An obligation that would otherwise be imposed on the trust by this Act is imposed on each trustee instead, but may be discharged by any of the trustees.

An offence against this Act that would otherwise have been committed by the trust is taken to have been committed by each trustee of the trust, at the time the offence was committed, who:

did the relevant act or made the relevant omission; or

aided, abetted, counselled or procured the relevant act or omission; or

was in any way knowingly concerned in, or party to, the relevant act or omission (whether directly or indirectly and whether by any act or omission of the trustee).

This section applies to a contravention of a civil penalty provision in a corresponding way to the way in which it applies to an offence.

104 Division does not apply to Division 3 of Part 3

This Division does not have effect for the purposes of Division 3 of Part 3.

Note: An applicant for registration under that Division must be a legal person.

105 Alternative constitutional bases

Without limiting its effect apart from each of the following subsections of this section, this Act also has effect as provided by that subsection.

This Act also has the effect it would have if the System Operator, Data Governance Board and data custodian were expressly permitted to perform functions and duties, and exercise powers, under this Act only:

in connection with:

the provision of pharmaceutical, sickness or hospital benefits; or

the provision of medical services or dental services (without any form of civil conscription); or

for purposes relating to census or statistics; or

in relation to a Territory or a place acquired by the Commonwealth for a public purpose.

This Act also has the effect it would have if each reference to collection, use or disclosure of de-identified data or health information were expressly confined to collection, use or disclosure of de-identified data or health information:

in connection with trade or commerce:

between Australia and other countries; or

among the States; or

between a Territory and a State or another Territory; or

by means of a postal, telegraphic, telephonic or other like service; or

in connection with insurance, other than State insurance that does not extend beyond the limits of the State concerned; or

in connection with:

the provision of pharmaceutical, sickness or hospital benefits; or

the provision of medical services or dental services (without any form of civil conscription); or

for purposes relating to census or statistics; or

in a Territory or a place acquired by the Commonwealth for a public purpose; or

in relation to a matter that is of international concern.

This Act also has the effect it would have if each reference to collection, use or disclosure of de-identified data or health information were expressly confined to collection from or by, use by or disclosure by or to:

a corporation to which paragraph 51(xx) of the Constitution applies; or

the Commonwealth; or

an authority of the Commonwealth.

This Act also has the effect it would have if each reference to a registered healthcare provider organisation, registered repository operator, registered portal provider or contracted service provider were expressly confined to a reference to a registered healthcare provider organisation, registered repository operator, registered portal provider or contracted service provider that:

is a corporation to which paragraph 51(xx) of the Constitution applies; or

is the Commonwealth; or

is an authority of the Commonwealth; or

is operating in a Territory or a place acquired by the Commonwealth for a public purpose.

This Act also has the effect it would have if its operation in relation to each of the following were expressly confined to an operation for the purposes of giving effect to Australia’s obligations under an agreement between 2 or more countries:

the System Operator;

the Data Governance Board;

the data custodian;

the Chief Executive Medicare;

the Chief Executive Officer of Services Australia;

the Secretary of the Veterans’ Affairs Department or the Defence Department;

a registered healthcare provider organisation;

a registered repository operator;

a registered portal provider;

a contracted service provider;

a healthcare recipient.

This Act also has the effect it would have if each reference to a healthcare recipient were expressly confined to a reference to a healthcare recipient who is:

an alien; or

a resident of a Territory.

Definitions

A term used in this section and the Constitution has the same meaning in this section as it has in the Constitution.

106 Annual reports by Information Commissioner

The Information Commissioner must, as soon as practicable after the end of each financial year, prepare a report on the Commissioner’s activities during the financial year relating to the My Health Record system.

The report must include:

statistics of the following:

complaints received by the Commissioner in relation to the My Health Record system;

investigations made by the Commissioner in relation to My Health Records or the My Health Record system;

enforceable undertakings accepted by the Commissioner under this Act;

proceedings taken by the Commissioner in relation to civil penalty provisions, enforceable undertakings or injunctions; and

any other matter prescribed by the regulations.

The Information Commissioner must give a copy of the report to the Minister, and to the Ministerial Council, no later than 30 September after the end of the financial year to which the report relates.

The Minister must table a copy of the report in each House of the Parliament within 15 sitting days after the Information Commissioner gives a copy of the report to the Minister.

107 Annual reports by the System Operator

The System Operator must include in any annual report prepared by the System Operator and given to the Minister under Public Governance, Performance and Accountability Act 2013:section 46 of the

statistics of the following:

registrations, and cancellations and suspensions of registrations, under this Act;

use of the My Health Record system by healthcare providers and healthcare recipients;

complaints received, and investigations undertaken, in relation to the My Health Record system;

occurrences compromising the integrity or security of the My Health Record system;

enforceable undertakings accepted by the System Operator under this Act;

proceedings taken by the System Operator in relation to enforceable undertakings or injunctions; and

any other matter prescribed by the regulations.

108 Review of the operation of the Act

The Minister must, after consulting the Ministerial Council, appoint an individual to review the operation of this Act.

The individual appointed must give a report to the Minister within the later of:

(a) 3 years after the commencement of Schedule 1 to the Health Legislation Amendment (eHealth) Act 2015; or

(b) if the Minister makes My Health Records Rules under clause 2 of Schedule 1 to this Act within 3 years after the commencement of Schedule 1 to the Health Legislation Amendment (eHealth) Act 2015—3 years after the day on which the Rules are made.

The Minister must:

provide a copy of the report to the Ministerial Council; and

table a copy of the report in each House of Parliament within 15 sitting days after the report is given to the Minister.

109 Minister may make My Health Records Rules

(1) The Minister may, by legislative instrument, make rules called the My Health Records Rules about matters required or permitted by this Act to be dealt with in the My Health Records Rules.

Consultation

Before the Minister makes My Health Records Rules, the Minister must consult:

the System Operator; and

the Health Chief Executives Forum.

A failure to consult does not affect the validity of the Rules.

My Health Records Rules may relate to registration etc.

The My Health Records Rules may specify the following:

requirements that a healthcare provider organisation must meet in order to be registered;

requirements that a person, or a repository or other facility (however described) owned or operated by the person, must meet for the person to be registered as a repository operator, a portal operator or a contracted service provider;

conditions on the registration of participants in the My Health Record system;

other requirements relating to the My Health Record system that apply to healthcare recipients or participants in the My Health Record system;

requirements relating to the establishment and the operation of a test environment for the My Health Record system, or another electronic system that interacts directly with the My Health Record system.

Requirements referred to in subsection (3) include technical specifications and other requirements in relation to the following:

storage of data and records;

records management;

administration and day-to-day operations;

physical and information security;

uploading specified kinds of records.

My Health Records Rules may relate to agreements

The My Health Records Rules may specify that a person must enter into a specified kind of agreement in order to be, and remain, a registered healthcare provider organisation, registered repository operator, registered portal operator or registered contracted service provider.

The My Health Records Rules may specify requirements relating to registration of healthcare recipients, including requirements relating to registering a healthcare recipient who has been issued with a healthcare identifier under a pseudonym, and for that purpose may specify such modifications of this Act as are necessary to facilitate such registration.

My Health Records Rules may relate to access control mechanisms

The My Health Records Rules may specify matters relating to access control mechanisms, including the following:

the circumstances in which a nominated representative may set access controls;

the circumstances in which access to a healthcare recipient’s My Health Record is to be automatically suspended or cancelled;

default access controls.

My Health Records Rules may relate to authorised representatives and nominated representatives

The My Health Records Rules may specify matters relating to authorised representatives and nominated representatives, including the following:

methods of establishing that an individual is an authorised representative or a nominated representative of a healthcare recipient;

requiring a healthcare recipient to verify his or her identity when the healthcare recipient ceases to have an authorised representative;

(c) specifying circumstances in which an authorised representative or a nominated representative is not required to have been assigned a healthcare identifier under paragraph 9(1)(b) of the Healthcare Identifiers Act 2010.

My Health Records Rules may relate to research or public health purposes

The My Health Records Rules may, in accordance with section 109A, prescribe a framework to guide the collection, use and disclosure of de-identified data and, with the consent of healthcare recipients, health information, for research or public health purposes.

My Health Records Rules may apply to specified classes of participants

The My Health Records Rules may specify the classes of participants in the My Health Record system to whom, or to which, a particular My Health Records Rule applies.

Incorporation of other instruments

(9) Despite subsection 14(2) of the Legislation Act 2003, My Health Records Rules made for purposes other than subsection (7A) may make provision in relation to a matter by applying, adopting or incorporating any matter contained in an instrument or other writing as in force or existing from time to time.

Scope of the My Health Records Rules rule-making power

To avoid doubt, the My Health Records Rules may not do the following:

create an offence or civil penalty;

provide powers of:

arrest or detention; or

entry, search or seizure;

impose a tax;

set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in this Act;

directly amend the text of this Act.

My Health Records Rules that are inconsistent with the regulations have no effect to the extent of the inconsistency, but My Health Records Rules are taken to be consistent with the regulations to the extent that the Rules are capable of operating concurrently with the regulations.

109A My Health Records Rules relating to data for research or public health purposes

Examples of what the rules may do

(1) Without limiting subsection 109(7A), My Health Records Rules made for the purposes of that subsection (the rules) may do any or all of the following:

impose requirements on the System Operator, the Data Governance Board established by section 82, the data custodian and other entities, including procedures that must be followed, in relation to preparing, providing, collecting, accessing, using and disclosing health information and de-identified data;

provide that any or all such requirements are enforceable for the purposes of paragraph 77A(1)(c) or subsection 78(2);

make provision in relation to the performance of the Board’s functions set out in paragraph 83(1)(a);

authorise the Board to make written policies and guidelines to be followed by other entities for the purposes of giving effect to the prescribed framework.

Functions of data custodian

The data custodian has the following functions, and the rules may make provision in relation to the performance of those functions:

under the direction of the Data Governance Board and in accordance with this Act—helping to implement the prescribed framework by:

receiving de-identified data and health information from the My Health Record system; and

as necessary—de-identifying health information; and

as necessary—providing data linkage services (within the meaning of the rules); and

preparing and providing de-identified data and health information to users of data and information whose use has been approved by the Data Governance Board; and

ensuring that users of de-identified data and health information are subject to conditions of use;

any other functions conferred on the data custodian by this Act or the rules.

Limits on rules

The rules:

must not allow the health information of a healthcare recipient to be collected, used or disclosed otherwise than with the consent of the healthcare recipient; and

(b) must not allow de-identified data or health information to be provided to a private health insurer (within the meaning of the Private Health Insurance Act 2007) or any other insurer (with or without the consent of the healthcare recipient); and

must not provide that any of the following is enforceable for the purposes of paragraph 77A(1)(c) or subsection 78(2):

a provision of a policy, guideline or other instrument made under the rules;

a provision of the rules that requires an entity to comply with such a policy, guideline or instrument.

Constitutional limits on rules

If the rules make provision for the disclosure of de-identified data or health information obtained by using or gaining access to the My Health Record system, the rules must have the effect that the data or information is to be disclosed only:

by means of a postal, telegraphic, telephonic or other like service; or

by or to a corporation to which paragraph 51(xx) of the Constitution applies; or

by or to a person within a Territory or a place acquired by the Commonwealth for a public purpose; or

by or to the Commonwealth or an authority of the Commonwealth.

The rules may make other provision in relation to de-identified data or health information only:

to ensure that collection, use and disclosure of data or information does not result in an interference with privacy of the kind the Commonwealth has international obligations to protect against, including under the International Covenant on Civil and Political Rights (in particular Article 17 of the Covenant); or

Note: The text of the Covenant is set out in Australian Treaty Series 1980 No. 23 ([1980] ATS 23). In 2018, a text of a Covenant in the Australian Treaties Series was accessible through the Australian Treaties Library on the AustLII website (http://www.austlii.edu.au).

for purposes related to collecting, preparing, analysing or publishing statistics; or

by providing for data or information to be collected from or by, used by or disclosed by or to, any of the following:

a corporation to which paragraph 51(xx) of the Constitution applies;

a person within a Territory or a place acquired by the Commonwealth for a public purpose;

the Commonwealth or an authority of the Commonwealth.

110 Minister may determine a law of a State or Territory to be a designated privacy law

(1) The Minister may, by legislative instrument, determine that a law of a State or Territory is a designated privacy law for the purposes of this Act.

A determination made under subsection (1) is a legislative instrument.

111 Guidelines relating to the Information Commissioner’s enforcement powers etc.

In exercising a power conferred on the Information Commissioner by this Act, or a power under another Act that is related to such a power, the Information Commissioner must have regard to any relevant guidelines in force under subsection (2).

The Information Commissioner must, by legislative instrument, formulate guidelines for the purposes of subsection (1).

Note: For consultation requirements, see Legislation Act 2003.section 17 of the

112 Regulations

The Governor-General may make regulations prescribing matters:

required or permitted by this Act to be prescribed; or

necessary or convenient to be prescribed for carrying out or giving effect to this Act.

Without limiting subsection (1), the Governor-General may make regulations on any matter about which the Minister may make My Health Records Rules.

Before the Governor-General makes regulations, the Minister must consult the Ministerial Council.

The regulations may prescribe penalties of not more than 50 penalty units for offences against the regulations.

The regulations may provide for civil penalties for contraventions of the regulations, which must not be more than:

50 penalty units for an individual; or

250 penalty units for a body corporate.