My Health Records Act 2012

No. 63, 2012

Compilation No. 17

Compilation date: 5 December 2025

Includes amendments: Act No. 73, 2025

About this compilation

This compilation

This is a compilation of the My Health Records Act 2012 that shows the text of the law as amended and in force on 5 December 2025 (the compilation date).

The notes at the end of this compilation (the endnotes) include information about amending laws and the amendment history of provisions of the compiled law.

Uncommenced amendments

The effect of uncommenced amendments is not shown in the text of the compiled law. The details of amendments made up to, but not commenced at, the compilation date are underlined in the endnotes. Any uncommenced amendments affecting the law are accessible on the Register (www.legislation.gov.au).

Application, saving and transitional provisions

If the operation of a provision or amendment of the compiled law is affected by an application, saving or transitional provision that is not included in this compilation, details are included in the endnotes.

Editorial changes

For more information about any editorial changes made in this compilation, see the endnotes.

Presentational changes

The Legislation Act 2003 provides for First Parliamentary Counsel to make presentational changes to a compilation. Presentational changes are applied to give a more consistent look and feel to legislation published on the Register, and enable the user to more easily navigate those documents.

Modifications

If the compiled law is modified by another law, the compiled law operates as modified but the modification does not amend the text of the law. Accordingly, this compilation does not show the text of the compiled law as modified. Any modifications affecting the law are accessible on the Register.

Self - repealing provisions

If a provision of the compiled law has been repealed in accordance with a provision of the law, details are included in the endnotes.

Contents

Part 1—Preliminary 1

1 Short title 1

2 Commencement 1

3 Object of Act 2

4 Simplified outline of this Act 2

4A Schedule 1 3

5 Definitions 4

6 Definition of authorised representative of a healthcare recipient 13

7 Definition of nominated representative of a healthcare recipient 15

7A Duties of authorised representative or nominated representative 17

8 Things done etc. under provisions of other Acts 18

9 Definition of identifying information 18

10 Definition of shared health summary 19

10A Sharing information with the My Health Record system 20

10B When an upload exception applies 20

10C When an application is finally determined 21

11 Act to bind the Crown 22

12 Concurrent operation of State laws 23

13 External Territories 23

13A System Operator may arrange for use of computer programs to make decisions 23

13B System Operator may use electronic communications 23

Part 2—The System Operator and the functions of the Chief Executive Medicare 24

Division 1—System Operator 24

14 Identity of the System Operator 24

15 Functions of the System Operator 24

16 Research or public health purposes 26

17 Retention and destruction of records uploaded to National Repositories Service 27

Division 4—Functions of Chief Executive Medicare 29

38 Registered repository operator 29

Part 3—Registration 30

Division 1—Registering healthcare recipients 30

39 Healthcare recipients may apply for registration 30

40 When a healthcare recipient is eligible for registration 30

41 Registration of a healthcare recipient by the System Operator 31

Division 1A—Healthcare provider organisations that are required to be registered 33

41A Prescribed healthcare provider organisations must be registered 33

41B System Operator may approve a period during which registration is not required 33

Division 2—Registering healthcare provider organisations 35

42 Healthcare provider organisation may apply for registration 35

43 When a healthcare provider organisation is eligible for registration 35

44 Registration of a healthcare provider organisation 35

45 Condition of registration—uploading of records, etc. 36

45A Condition of registration—handling old records that are works subject to copyright 37

45B Condition of registration—handling old sound recordings and cinematograph films that are subject to copyright 38

45C Liability where work uploaded in breach of section 45A or 45B 39

46 Condition of registration—non-discrimination in providing healthcare to a healthcare recipient who does not have a My Health Record etc. 40

Division 3—Registering repository operators, portal operators and contracted service providers 41

47 Persons may apply for registration as a repository operator, a portal operator or a contracted service provider 41

48 When a person is eligible for registration as a repository operator, a portal operator or a contracted service provider 41

49 Registration of a repository operator, a portal operator or a contracted service provider 42

50 Condition about provision of information to System Operator 42

50A Condition of registration—handling old records that are works subject to copyright 43

50B Condition of registration—handling old sound recordings and cinematograph films that are subject to copyright 44

50C Liability where work uploaded in breach of section 50A or 50B 45

50D Authorisation to make health information available to the System Operator 45

Division 4—Cancellation, suspension and variation of registration 46

51 Cancellation or suspension of registration 46

52 Variation of registration 48

53 Notice of cancellation, suspension or variation of registration etc. 49

54 Effect of suspension 50

55 My Health Records Rules may specify requirements after registration is cancelled or suspended 51

Division 5—The Register 52

56 The Register 52

57 Entries to be made in Register 52

Division 6—Collection, use and disclosure of information for the purposes of the My Health Record System 53

58 Collection, use and disclosure of health information by the System Operator 53

58A Collection, use and disclosure of healthcare identifiers, identifying information and information identifying authorised representatives and nominated representatives 53

Part 4—Collection, use and disclosure of health information included in a healthcare recipient’s My Health Record 60

Division 1—Unauthorised collection, use and disclosure of health information included in a healthcare recipient’s My Health Record 60

59 Unauthorised collection, use and disclosure of health information included in a healthcare recipient’s My Health Record 60

59A Unauthorised use of information included in a healthcare recipient’s My Health Record for prohibited purpose 61

60 Secondary disclosure 62

Division 2—Authorised collection, use and disclosure 63

Subdivision A—Collection, use and disclosure in accordance with access controls 63

61 Collection, use and disclosure for providing healthcare 63

62 Collection, use and disclosure to nominated representative 63

Subdivision B—Collection, use and disclosure other than in accordance with access controls 64

63 Collection, use and disclosure for management of My Health Record system 64

64 Collection, use and disclosure in the case of a serious threat 64

65 Collection, use and disclosure authorised by law 65

66 Collection, use and disclosure with healthcare recipient’s consent 66

67 Collection, use and disclosure by a healthcare recipient 66

68 Collection, use and disclosure for indemnity cover 66

69 Disclosure to courts and tribunals 67

69A Disclosure to designated entity under order by judicial officer 68

69B Judicial officers for orders under section 69A 70

70 Disclosure in relation to unlawful activity 71

70AA Collection, use and disclosure in relation to compliance with share by default provisions 72

Subdivision C—Unauthorised use of information included in a healthcare recipient’s My Health Record for prohibited purpose 73

70A Definition of prohibited purpose 73

70B Use for prohibited purpose is unauthorised 74

Division 3—Prohibitions and authorisations limited to My Health Record system 75

71 Prohibitions and authorisations limited to health information collected by using the My Health Record system 75

Division 3A—Offences and penalties in relation to use of My Health Record-derived information for prohibited purpose 77

71AA Definitions 77

71A Offence for use of My Health Record-derived information for prohibited purpose 77

71B Civil penalty for use of My Health Record-derived information for prohibited purpose 78

Division 4—Interaction with the Privacy Act 1988 79

72 Interaction with the Privacy Act 1988 79

73 Contravention of this Act is an interference with privacy 79

73A Information Commissioner may disclose details of investigations to System Operator 80

73B Obligations of System Operator in relation to correction, etc. 80

Division 5—Authorised collection, use and disclosure for compliance purposes 81

73C Collection, use and disclosure of health information in relation to compliance with share by default provisions 81

73D Collection, use and disclosure of healthcare identifiers and identifying information in relation to compliance with share by default provisions 81

Part 5—Other offences and civil penalty provisions 85

74 Registered healthcare provider organisations must ensure certain information is given to System Operator 85

75 Data breaches 85

76 Requirement to notify if cease to be eligible to be registered 89

76A Requirement to notify if healthcare provider organisation ceases to be able to meet conditions on registration 89

77 Requirement not to hold or take records outside Australia 89

77A Enforceable requirements in My Health Records Rules must not be contravened: offence 90

78 My Health Records Rules must not be contravened: civil penalty 91

78A Some information must be shared with the My Health Record system unless exception applies 92

78B System Operator may approve a period during which sharing with the My Health Record system is not required 94

78C Record keeping requirements in relation to sharing information with the My Health Record system 95

78D Prescribed healthcare provider organisations must display notice when not sharing information with the My Health Record system 97

Part 6—Enforcement 99

Division 1—Civil penalties 99

79 Civil penalty provisions 99

Division 1A—Infringement notices 102

79A Infringement notices 102

Division 2—Enforceable undertakings 104

80 Enforceable undertakings 104

Division 3—Injunctions 106

81 Injunctions 106

Part 7—Data Governance Board 107

Division 1—Establishment and functions 107

82 Data Governance Board 107

83 Functions of the Board 107

Division 2—Membership 108

84 Membership 108

85 Appointment of members 108

86 Qualifications and experience 108

87 Acting appointments 109

88 Term of appointment and other terms and conditions 109

89 Remuneration 110

90 Resignation 110

91 Termination of appointment 110

92 Leave of absence 111

93 Other paid work 111

Division 3—Meetings of the Data Governance Board 112

94 Convening meetings 112

95 Presiding at meetings 112

96 Quorum 112

96A Voting at meetings 113

96B Conduct of meetings 113

96C Minutes 113

96D Decisions without meetings 113

Division 4—Other matters relating to the Data Governance Board 115

96E Relationship between System Operator and Data Governance Board in relation to data for research or public health purposes 115

96F Board committees 115

96G Delegation of functions 116

96H Annual report 116

96J Board is part of the Department 117

Part 8—Other matters 118

Division 1—Review of decisions 118

97 Review of decisions 118

Division 2—Delegations 121

98 Delegations by the System Operator 121

Division 3—Authorisations of entities also cover employees 122

99 Authorisations extend to employees etc. 122

Division 4—Treatment of certain entities 124

100 Treatment of partnerships 124

101 Treatment of unincorporated associations 124

102 Treatment of trusts with multiple trustees 125

104 Division does not apply to Division 3 of Part 3 126

Division 5—Alternative constitutional bases 127

105 Alternative constitutional bases 127

Division 6—Annual reports and review of Act 130

106 Annual reports by Information Commissioner 130

107 Annual reports by the System Operator 130

108 Review of the operation of the Act 131

Division 7—My Health Records Rules, regulations and other instruments 132

109 Minister may make My Health Records Rules 132

109A My Health Records Rules relating to data for research or public health purposes 135

110 Minister may determine a law of a State or Territory to be a designated privacy law 138

111 Guidelines relating to the Information Commissioner’s enforcement powers etc. 138

112 Regulations 138

Schedule 1—My Health Records for all healthcare recipients 140

Part 1—Opt-out model for the participation of healthcare recipients in the My Health Record system 140

1 Trial of opt-out model 140

2 Minister may apply the opt-out model to all healthcare recipients after trial 140

Part 2—Registering all healthcare recipients 142

Division 1—Registering healthcare recipients 142

3 Registration of a healthcare recipient by the System Operator 142

4 When a healthcare recipient is eligible for registration 142

5 Healthcare recipient elects not to be registered 143

6 Healthcare recipients may apply for registration 144

Division 2—Information sharing for the purposes of the opt-out system 145

7 Collection, use and disclosure of health information by the System Operator 145

8 Collection, use and disclosure of healthcare identifiers, identifying information and information identifying authorised representatives and nominated representatives 145

Division 3—Handling health information for the purposes of a healthcare recipient’s My Health Record 152

Subdivision A—Healthcare provider to upload health information 152

9 Authorisation for healthcare provider to upload health information 152

Subdivision B—Functions of the Chief Executive Medicare 153

10 Registered repository operator 153

11 Uploading health information to the repository 153

12 Making health information available to the System Operator 153

13 Healthcare recipient may elect not to have health information disclosed to the System Operator 153

14 Health information uploaded or made available may include details of healthcare providers 154

15 Way in which repository operated not limited by this Division 155

Subdivision C—Other registered repository operators 155

16 Making health information available to the System Operator 155

Part 3—Other consequences of applying the opt-out rules 156

17 References to other provisions of this Act 156

Endnotes 157

Endnote 1—About the endnotes 157

Endnote 2—Abbreviation key 159

Endnote 3—Legislation history 160

Endnote 4—Amendment history 163

An Act to provide for a system of access to electronic health records, and for related purposes

1 Preliminary

1 Short title

This Act may be cited as the My Health Records Act 2012.

2 Commencement 1

Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.

Commencement information	Commencement information	Commencement information
Column 1	Column 2	Column 3
Provision(s)	Commencement	Date/Details
1. Sections 1 and 2 and anything in this Act not elsewhere covered by this table	The day this Act receives the Royal Assent.	26 June 2012
2. Sections 3 to 112	A day or days to be fixed by Proclamation. However, if any of the provision(s) do not commence by the later of: (a) 1 July 2012; and (b) the day this Act receives the Royal Assent; they commence on the day after the later of those days.	29 June 2012 (see F2012L01395)

Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.

Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.

3 Object of Act

The object of this Act is to enable the establishment and operation of a national public system for the provision of access to health information relating to recipients of healthcare that is voluntary for those recipients, to:

help overcome the fragmentation of health information; and

improve the availability and quality of health information; and

reduce the occurrence of adverse medical events and the duplication of treatment; and

improve the coordination and quality of healthcare provided to healthcare recipients by different healthcare providers.

4 Simplified outline of this Act

The My Health Record system is a national public system for making health information about a healthcare recipient available for the purposes of providing healthcare to the recipient.

A healthcare recipient will have a My Health Record if the recipient registers in the My Health Record system. The Minister may, however, provide that the opt-out model is to apply under My Health Records Rules made under Schedule 1. A healthcare recipient covered by those Rules will be registered in the My Health Record system, and have a My Health Record, unless the recipient elects to opt-out of the system.

The My Health Record system is operated by the System Operator. The System Operator operates the National Repositories Service, that stores key records that form part of a healthcare recipient’s My Health Record. Other records are stored by registered repository operators. Together these records make up a healthcare recipient’s My Health Record.

If a healthcare recipient is registered in the My Health Record system, a healthcare provider may (or, in some circumstances, must) upload health information about the recipient to the My Health Record system, unless the record is one which the healthcare recipient has advised the healthcare provider not to upload or the record is not to be uploaded under prescribed laws of a State or Territory.

Health information may be collected, used and disclosed from a healthcare recipient’s My Health Record for the purpose of providing healthcare to the recipient, subject to any access controls set by the recipient (or if none are set, default access controls). There are other limited circumstances in which health information may be collected, used or disclosed from a My Health Record. Criminal and civil penalties apply if a person collects, uses or discloses information from a My Health Record without authorisation. Enforceable undertakings and injunctions are also available to enforce the provisions of this Act.

An authorisation to collect, use or disclose information under this Act is also an authorisation to do so for the purposes of the Privacy Act 1988. A contravention of this Act is also an interference with privacy for the purposes of the Privacy Act 1988, and so can be investigated under that Act.

4A Schedule 1

Schedule 1 has effect.

Note: Schedule 1 deals with the opt-out model for registering healthcare recipients in the My Health Record system.

5 Definitions

In this Act:

approved form means a form approved by the System Operator, in writing, for the purposes of the provision in which the expression occurs.

approved registered repository operator means a healthcare provider organisation that: is a registered repository operator; and satisfies the requirements (if any) specified in the My Health Records Rules. Australia, when used in a geographical sense, includes the external Territories.

is a registered repository operator; and

satisfies the requirements (if any) specified in the My Health Records Rules.

Australia, when used in a geographical sense, includes the external Territories.

authorised representative of a healthcare recipient has the meaning given by section 6.

Chief Executive Medicare has the same meaning as in the Human Services (Medicare) Act 1973.

cinematograph film has the same meaning as in the Copyright Act 1968.

civil penalty provision has the same meaning as in the Regulatory Powers Act.

contracted service provider of a healthcare provider organisation means an entity that provides:

information technology services relating to the My Health Record system; or

health information management services relating to the My Health Record system;

to the healthcare provider organisation under a contract with the healthcare provider organisation.

data custodian means the Australian Institute of Health and Welfare.

date of birth accuracy indicator means a data element that is used to indicate how accurate a recorded date of birth is.

date of death accuracy indicator means a data element that is used to indicate how accurate a recorded date of death is.

Defence Department means the Department that: (a) deals with matters arising under Defence Act 1903; andsection 1 of the is administered by the Minister who administers that section.

(a) deals with matters arising under Defence Act 1903; andsection 1 of the

is administered by the Minister who administers that section.

designated privacy law means a law determined under section 110 to be a designated privacy law.

employee of an entity includes the following: an individual who provides services for the entity under a contract for services; an individual whose services are made available to the entity (including services made available free of charge).

an individual who provides services for the entity under a contract for services;

an individual whose services are made available to the entity (including services made available free of charge).

entity means:

a person; or

a partnership; or

any other unincorporated association or body; or

a trust; or

a part of an entity (under a previous application of this definition).

finally determined: see section 10C.

genetic relative of an individual (the first individual) means another individual who is related to the first individual by blood, including a sibling, a parent or a descendant of the first individual.

healthcare means health service within the meaning of subsection 6(1) of the Privacy Act 1988.

healthcare provider means:

an individual healthcare provider; or

a healthcare provider organisation.

healthcare provider organisation means an entity that has conducted, conducts, or will conduct, an enterprise that provides healthcare (including healthcare provided free of charge).

healthcare recipient means an individual who has received, receives, or may receive, healthcare.

healthcare recipient-only notes means health information included by the healthcare recipient in his or her My Health Record and described in the My Health Record system as healthcare recipient-only notes (whether using that expression or an equivalent expression).

Health Chief Executives Forum means a body (however described) that consists of: the Secretary of the Department; and each head (however described) of the Health Department of a State or Territory.

Note: Because of paragraph (e) of the definition of entity, a healthcare provider organisation could be a part of an entity.

the Secretary of the Department; and

each head (however described) of the Health Department of a State or Territory.

Health Department of a State or Territory means a Department of state that: deals with matters relating to health; and is administered by the State/Territory Health Minister of the State or Territory.

deals with matters relating to health; and

is administered by the State/Territory Health Minister of the State or Territory.

health information has the meaning given by subsection 6(1) of the Privacy Act 1988.

identifying information has the meaning given by section 9.

index service means the index service maintained by the System Operator for the purposes of the My Health Record system, as mentioned in paragraph 15(a).

individual healthcare provider means an individual who: has provided, provides, or is to provide, healthcare; or is registered by a registration authority as a member of a particular health profession.

has provided, provides, or is to provide, healthcare; or

is registered by a registration authority as a member of a particular health profession.

Ministerial Council means a body (however described) that consists of the Minister of the Commonwealth, and the Minister of each State and Territory, who is responsible, or principally responsible, for matters relating to health.

My Health Record of a healthcare recipient means the record of information that is created and maintained by the System Operator in relation to the healthcare recipient, and information that can be obtained by means of that record, including the following: information included in the entry in the Register that relates to the healthcare recipient; health information connected in the My Health Record system to the healthcare recipient (including information included in a record accessible through the index service); other information connected in the My Health Record system to the healthcare recipient, such as information relating to auditing access to the record; back-up records of such information.

information included in the entry in the Register that relates to the healthcare recipient;

health information connected in the My Health Record system to the healthcare recipient (including information included in a record accessible through the index service);

other information connected in the My Health Record system to the healthcare recipient, such as information relating to auditing access to the record;

back-up records of such information.

My Health Records Rules has the meaning given by section 109.

My Health Record system means a system: that is for: the collection, use and disclosure of information from many sources using telecommunications services and by other means, and the holding of that information, in accordance with the healthcare recipient’s wishes or in circumstances specified in this Act; and the assembly of that information using telecommunications services and by other means so far is it is relevant to a particular healthcare recipient, so that it can be made available, in accordance with the healthcare recipient’s wishes or in circumstances specified in this Act, to facilitate the provision of healthcare to the healthcare recipient or for purposes specified in this Act; and that involves the performance of functions under this Act by the System Operator.

that is for:

the collection, use and disclosure of information from many sources using telecommunications services and by other means, and the holding of that information, in accordance with the healthcare recipient’s wishes or in circumstances specified in this Act; and

the assembly of that information using telecommunications services and by other means so far is it is relevant to a particular healthcare recipient, so that it can be made available, in accordance with the healthcare recipient’s wishes or in circumstances specified in this Act, to facilitate the provision of healthcare to the healthcare recipient or for purposes specified in this Act; and

that involves the performance of functions under this Act by the System Operator.

National Law means:

(a) for a State or Territory other than Western Australia—the Health Practitioner Regulation National Law set out in the Schedule to the Health Practitioner Regulation National Law Act 2009 of Queensland, as it applies (with or without modification) as a law of the State or Territory; or

(b) for Western Australia—the Health Practitioner Regulation National Law (WA) Act 2010 of Western Australia, so far as that Act corresponds to the Health Practitioner Regulation National Law set out in the Schedule to the Health Practitioner Regulation National Law Act 2009 of Queensland.

National Repositories Service means the service referred to in paragraph 15(i).

nominated healthcare provider: a healthcare provider is the nominated healthcare provider of a healthcare recipient if:

(a) an agreement is in force between the healthcare provider and the healthcare recipient that the healthcare provider is the healthcare recipient’s nominated healthcare provider for the purposes of this Act; and

(b) a healthcare identifier has been assigned to the healthcare provider under paragraph 9(1)(a) of the Healthcare Identifiers Act 2010; and

the healthcare provider is an individual registered by a registration authority as one of the following:

a medical practitioner within the meaning of the National Law;

a registered nurse within the meaning of the National Law;

iii

an Aboriginal health practitioner, a Torres Strait Islander health practitioner or an Aboriginal and Torres Strait Islander health practitioner within the meaning of the National Law who is included in a class prescribed by the regulations for the purposes of this subparagraph;

an individual, or an individual included in a class, prescribed by the regulations for the purposes of this subparagraph.

nominated representative of a healthcare recipient has the meaning given by section 7.

parental responsibility: a person has parental responsibility for a healthcare recipient (the child) if, and only if:

the person:

(i) is the child’s parent (including a person who is presumed to be the child’s parent because of a presumption (other than in Family Law Act 1975); andsection 69Q) in Subdivision D of Division 12 of Part VII of the

(ii) has not ceased to have parental responsibility for the child because of an order made under the Family Law Act 1975 or a law of a State or Territory; or

(b) under a parenting order (within the meaning of the Family Law Act 1975):

the child is to live with the person; or

the child is to spend time with the person; or

iii

the person is responsible for the child’s long-term or day-to-day care, welfare and development; or

the person is entitled to guardianship or custody of, or access to, the child under a law of the Commonwealth, a State or a Territory.

Note: The presumptions in the Family Law Act 1975 include a presumption arising from a court finding that a person is the child’s parent, and a presumption arising from a man executing an instrument under law acknowledging that he is the father of the child.

participant in the My Health Record system means any of the following: the System Operator; a registered healthcare provider organisation; the operator of the National Repositories Service; a registered repository operator; a registered portal operator; a registered contracted service provider, so far as the contracted service provider provides services to a registered healthcare provider.

the System Operator;

a registered healthcare provider organisation;

the operator of the National Repositories Service;

a registered repository operator;

a registered portal operator;

a registered contracted service provider, so far as the contracted service provider provides services to a registered healthcare provider.

personal information has the same meaning as in the Privacy Act 1988.

prescribed healthcare provider organisation means a healthcare provider organisation that is: a corporation to which paragraph 51(xx) of the Constitution applies; and of a kind specified in the My Health Records Rules.

a corporation to which paragraph 51(xx) of the Constitution applies; and

of a kind specified in the My Health Records Rules.

prohibited purpose has the meaning given by section 70A.

record includes a database, register, file or document that contains information in any form (including in electronic form).

registered contracted service provider means a contracted service provider that is registered under section 49.

registered healthcare provider organisation means a healthcare provider organisation that is registered under section 44.

registered healthcare recipient means a healthcare recipient who is registered under section 41.

registered portal operator means a person that: is the operator of an electronic interface that facilitates access to the My Health Record system; and is registered as a portal operator under section 49.

is the operator of an electronic interface that facilitates access to the My Health Record system; and

is registered as a portal operator under section 49.

registered repository operator means a person that: holds, or can hold, records of information included in My Health Records for the purposes of the My Health Record system; and is registered as a repository operator under section 49.

holds, or can hold, records of information included in My Health Records for the purposes of the My Health Record system; and

is registered as a repository operator under section 49.

registration authority means an entity that is responsible under a law for registering members of a particular health profession.

Regulatory Powers Act means the Regulatory Powers (Standard Provisions) Act 2014.

share by default provision: each of the following is a share by default provision:

section 41A (prescribed healthcare provider organisations must be registered);

section 78A (some information must be shared with the My Health Record system unless exception applies);

section 78C (record keeping requirements in relation to sharing information with the My Health Record system);

section 78D (prescribed healthcare provider organisations must display notice when not sharing information with the My Health Record system);

(e) Health Insurance Act 1973;section 19AD (medicare benefits not payable in respect of certain professional services) of the

(f) Health Insurance Act 1973;section 19AF (record keeping requirement) of the

(g) Health Insurance Act 1973;section 19AG (advance payment before information is shared with the My Health Record system) of the

(h) Health Insurance Act 1973.section 19AH (recovery of payments) of the

shared health summary has the meaning given by section 10.

shares with the My Health Record system: see section 10A.

sound recording has the same meaning as in the Copyright Act 1968.

State or Territory authority has the same meaning as in the Privacy Act 1988.

State/Territory Health Minister means:

the Minister of a State; or

the Minister of the Australian Capital Territory; or

the Minister of the Northern Territory;

who is responsible, or principally responsible, for the administration of matters relating to health in the State or Territory, as the case may be.

System Operator has the meaning given by section 14.

this Act includes:

regulations made under this Act; and

the My Health Records Rules.

upload exception applies: see section 10B.

use health information included in a healthcare recipient’s My Health Record includes the following:

access the information;

view the information;

modify the information;

delete the information.

Veterans’ Affairs Department means the Department that: (a) deals with matters arising under Veterans’ Entitlements Act 1986; andsection 1 of the is administered by the Minister who administers that section.

(a) deals with matters arising under Veterans’ Entitlements Act 1986; andsection 1 of the

is administered by the Minister who administers that section.

Veterans’ Affairs Department file number means a number allocated to a healthcare recipient by the Veterans’ Affairs Department.

work has the same meaning as in the Copyright Act 1968.

6 Definition of authorised representative of a healthcare recipient

Healthcare recipients aged under 14

(1) For the purposes of this Act, each person who the System Operator is satisfied has parental responsibility for a healthcare recipient aged under 14 is the authorised representative of the healthcare recipient.

Despite subsection (1), a person who has parental responsibility for a healthcare recipient aged under 18 is not the authorised representative of the healthcare recipient if the System Operator is satisfied that:

under a court order or a law of the Commonwealth or a State or Territory, the person must be supervised while spending time with the healthcare recipient; or

the life, health or safety of the healthcare recipient or another person would be put at risk if the person were the authorised representative of the healthcare recipient.

If there is no person who the System Operator is satisfied has parental responsibility for a healthcare recipient aged under 14, or the only such persons are covered by subsection (1A), the authorised representative of the healthcare recipient is:

a person who the System Operator is satisfied is authorised to act on behalf of the healthcare recipient for the purposes of this Act under the law of the Commonwealth or a State or Territory, or a decision of an Australian court or tribunal; or

if there is no such person—a person:

who the System Operator is satisfied is otherwise an appropriate person to be the authorised representative of the healthcare recipient; or

who is prescribed by the regulations for the purposes of this paragraph.

Healthcare recipients aged between 14 and 17

(3) For the purposes of this Act, a person is the authorised representative of a healthcare recipient aged between 14 and 17 years if the healthcare recipient, by written notice given to the System Operator in the approved form, nominates the person to be his or her authorised representative.

Healthcare recipients aged at least 18

(4) For the purposes of this Act, if the System Operator is satisfied that a healthcare recipient aged at least 18 is not capable of making decisions for himself or herself, the authorised representative of the healthcare recipient is:

a person who the System Operator is satisfied is authorised to act on behalf of the healthcare recipient under the law of the Commonwealth or a State or Territory or a decision of an Australian court or tribunal; or

if there is no such person—a person:

who the System Operator is satisfied is otherwise an appropriate person to be the authorised representative of the healthcare recipient; or

who is prescribed by the regulations for the purposes of this paragraph.

An authorisation referred to in paragraph (2)(a) or (4)(a) may be conferred by specific reference to the purposes of this Act, or conferred by words of general authorisation that are broad enough to cover that purpose.

A person cannot be the authorised representative of a healthcare recipient unless:

(a) a healthcare identifier has been assigned to the person under paragraph 9(1)(b) of the Healthcare Identifiers Act 2010; or

(b) the My Health Records Rules provide that a healthcare identifier is not required to have been so assigned.

Effect of being an authorised representative

At a time when a healthcare recipient has an authorised representative:

the authorised representative is entitled to do any thing that this Act authorises or requires the healthcare recipient to do; and

the healthcare recipient is not entitled to do any thing that this Act would, apart from this subsection, authorise or require the healthcare recipient to do; and

this Act has effect for all purposes, in relation to a thing done by an authorised representative, as if the healthcare recipient had done the thing.

At a time when a healthcare recipient has one or more authorised representatives, any thing that this Act authorises or requires to be done in relation to the healthcare recipient is to be done in relation to at least one of the healthcare recipient’s authorised representatives. This Act has effect for all purposes as if the thing had been done in relation to the healthcare recipient.

7 Definition of nominated representative of a healthcare recipient 1

(1) For the purposes of this Act, an individual is the nominated representative of a healthcare recipient if:

an agreement is in force between the individual and the healthcare recipient that the individual is the healthcare recipient’s nominated representative for the purposes of this Act; and

the healthcare recipient has notified the System Operator that the individual is his or her nominated representative.

Effect of being a nominated representative

At a time when a healthcare recipient has a nominated representative:

the nominated representative is entitled to do any thing that this Act authorises or requires the healthcare recipient to do, subject to any limitations:

to which the healthcare recipient’s agreement is subject; and

that have been notified to the System Operator by the healthcare recipient; and

this Act has effect for all purposes, in relation to a thing done by a nominated representative, as if the healthcare recipient had done the thing, subject to any modifications prescribed by the regulations.

Note: Despite this subsection, a nominated representative must not use information for a prohibited purpose within the meaning of section 70A (even though a healthcare recipient may do so): see subsections 59A(2), 70B(2), 71A(4) and 71B(3).

Despite subsection (2), the System Operator must not permit a nominated representative of a healthcare recipient to set access controls in relation to the healthcare recipient’s My Health Record unless:

(a) a healthcare identifier has been assigned to the nominated representative under paragraph 9(1)(b) of the Healthcare Identifiers Act 2010; or

(b) the My Health Records Rules provide that a healthcare identifier is not required to have been so assigned.

The fact that a healthcare recipient has a nominated representative does not prevent the healthcare recipient doing any thing that this Act authorises or requires the healthcare recipient to do.

At a time when a healthcare recipient has one or more nominated representatives, any thing that this Act authorises or requires to be done in relation to the healthcare recipient may be done in relation to one of the healthcare recipient’s nominated representatives and not in relation to the healthcare recipient to the extent:

agreed between the healthcare recipient and the nominated representative; and

notified to the System Operator by the healthcare recipient.

This Act has effect for all purposes as if the thing had been done in relation to the healthcare recipient.

7A Duties of authorised representative or nominated representative

Duty to ascertain will and preferences

(1) An authorised representative or a nominated representative (a representative) of a healthcare recipient must make reasonable efforts to ascertain the recipient’s will and preferences in relation to the recipient’s My Health Record.

If it is not possible to ascertain the healthcare recipient’s will and preferences, the representative must make reasonable efforts to ascertain the recipient’s likely will and preferences in relation to the recipient’s My Health Record.

The healthcare recipient’s likely will and preferences may be ascertained from sources including the following:

if the representative is a nominated representative—the agreement appointing the representative;

to the extent legally possible, from consultation with people who may be expected to be aware of the recipient’s will and preferences.

Duty to give effect to will and preferences

The representative must give effect to the healthcare recipient’s will and preferences, or likely will and preferences, ascertained in accordance with subsection (1) or (2).

However, if to do so would pose a serious risk to the healthcare recipient’s personal and social wellbeing, the representative must instead act in a manner that promotes the personal and social wellbeing of the healthcare recipient.

Duty if will and preferences cannot be ascertained

If the healthcare recipient’s will and preferences, or likely will and preferences, cannot be ascertained, the representative must act in a manner that promotes the personal and social wellbeing of the healthcare recipient.

8 Things done etc. under provisions of other Acts 1

A reference in section 6 or 7 to any thing that this Act authorises or requires a healthcare recipient to do is taken to include a reference to any thing that a prescribed provision of another Act authorises or requires a healthcare recipient to do.

A reference in section 6 or 7 to any thing that this Act authorises or requires to be done in relation to a healthcare recipient is taken to include a reference to any thing that a prescribed provision of another Act authorises or requires to be done in relation to a healthcare recipient.

9 Definition of identifying information 1

(1) Each of the following is identifying information of a healthcare provider who is an individual:

the name of the healthcare provider;

the address of the healthcare provider;

the email address, telephone number and fax number of the healthcare provider;

the date of birth, and the date of birth accuracy indicator, of the healthcare provider;

the sex of the healthcare provider;

the type of healthcare provider that the individual is;

if the healthcare provider is registered by a registration authority—the registration authority’s identifier for the healthcare provider and the status of the registration (such as conditional, suspended or cancelled);

other information that is prescribed by the regulations for the purpose of this paragraph.

(2) Each of the following is identifying information of a healthcare provider that is not an individual:

the name of the healthcare provider;

the address of the healthcare provider;

the email address, telephone number and fax number of the healthcare provider;

(d) if applicable, the ABN (within the meaning of the A New Tax System (Australian Business Number) Act 1999) of the healthcare provider;

(e) if applicable, the ACN (within the meaning of the Corporations Act 2001) of the healthcare provider;

other information that is prescribed by the regulations for the purpose of this paragraph.

(3) Each of the following is identifying information of an individual, other than an individual in the capacity of a healthcare provider:

if applicable, the Medicare number of the individual;

if applicable, the Veterans’ Affairs Department file number of the individual;

the name of the individual;

the address of the individual;

the date of birth, and the date of birth accuracy indicator, of the individual;

the sex of the individual;

if the individual was part of a multiple birth—the order in which the individual was born;

Example: The second of twins.

if applicable, the date of death, and the date of death accuracy indicator, of the individual;

other information that is prescribed by the regulations for the purpose of this paragraph.

10 Definition of shared health summary

The shared health summary of a registered healthcare recipient, at a particular time, is a record that:

was prepared by the healthcare recipient’s nominated healthcare provider and described by him or her as the healthcare recipient’s shared health summary; and

has been uploaded to the National Repositories Service; and

at that time, is the most recent such record to have been uploaded to the National Repositories Service.

Note: This means that there is only one shared health summary for a healthcare recipient at a particular time.

10A Sharing information with the My Health Record system 1

(1) An entity other than an approved registered repository operator shares with the My Health Record system information if the entity uploads, for the purposes of the My Health Record system, the information to:

a repository that forms part of the National Repositories Service; or

a repository to which a registered repository operator’s registration relates.

(2) An approved registered repository operator shares with the My Health Record system information if the registered repository operator:

uploads, for the purposes of the My Health Record system, the information to a repository that forms part of the National Repositories Service; or

takes, in relation to the information, the action specified in the My Health Records Rules.

10B When an upload exception applies

An upload exception applies in relation to an entity sharing with the My Health Record system information about healthcare provided to an individual if:

the individual is not a registered healthcare recipient; or

either:

the individual, or an authorised representative or nominated representative of the individual, has advised the entity; or

the entity has otherwise been informed that the individual, or an authorised representative or nominated representative of the individual, has advised;

that the information must not be uploaded to the My Health Record system; or

an individual healthcare provider reasonably believes that the information should not be shared with the My Health Record system because of a serious concern for the health, safety or wellbeing of the individual; or

the information cannot be shared with the My Health Record system due to circumstances beyond the reasonable control of the entity.

10C When an application is finally determined 1

(1) An application under finally determined when the System Operator has made a decision (the original decision) on the application and:section 41B, 42 or 78B is

the original decision is to approve the application; or

no notice of the original decision is given because subsection 97(2A) applies; or

no notice asking the System Operator to reconsider the original decision is given within the period mentioned in subsection 97(4); or

all of the following apply:

a notice asking the System Operator to reconsider the original decision is given within the period mentioned in subsection 97(4);

the System Operator reconsiders the original decision;

iii

(iii) no application is made to the Administrative Review Tribunal within the period mentioned in Administrative Review Tribunal Act 2024 for review of the System Operator’s reconsideration decision; orsection 18 of the

(e) an application is made to the Administrative Review Tribunal within the period mentioned in Administrative Review Tribunal Act 2024 for review of the System Operator’s reconsideration of the original decision, the Administrative Review Tribunal decides the application and one of the following applies:section 18 of the

subsection 123(1) of that Act does not apply in relation to the Administrative Review Tribunal’s decision;

no application is made under section 123 of that Act within the period mentioned in section 125 of that Act to refer the Administrative Review Tribunal’s decision to the guidance and appeals panel;

iii

any application that is made under section 123 of that Act within the period mentioned in section 125 of that Act to refer the Administrative Review Tribunal’s decision to the guidance and appeals panel is refused; or

both of the following apply:

(i) the President of the Administrative Review Tribunal refers the Administrative Review Tribunal’s decision on the application for review of the System Operator’s reconsideration of the original decision to the guidance and appeals panel under Administrative Review Tribunal Act 2024;section 123 of the

(ii) the Administrative Review Tribunal makes a decision on the guidance and appeals panel application (within the meaning of the Administrative Review Tribunal Act 2024) taken to be made because of the referral.

(2) An application under finally determined when the System Operator ceases to consider the application under subsection 41B(4) or 78B(4).section 41B or 78B is

11 Act to bind the Crown 1

This Act binds the Crown in each of its capacities.

This Act does not make the Crown liable to be prosecuted for an offence.

Note: Subsection (2) does not limit other rights and remedies.

12 Concurrent operation of State laws

It is the intention of the Parliament that this Act is not to apply to the exclusion of a law of a State or Territory to the extent that that law is capable of operating concurrently with this Act.

13 External Territories

This Act extends to every external Territory.

13A System Operator may arrange for use of computer programs to make decisions 1

The System Operator may arrange for the use, under the System Operator’s control, of computer programs for any purposes for which the System Operator may make decisions under this Act.

A decision made by the operation of a computer program under an arrangement made under subsection (1) is taken to be a decision made by the System Operator.

13B System Operator may use electronic communications 1

(1) If under this Act the System Operator is required to give information in writing, that requirement is taken to have been met if the System Operator gives the information by means of an electronic communication, as defined in the Electronic Transactions Act 1999.

(2) If under this Act the System Operator is permitted to give information in writing, the System Operator is permitted to give the information by means of an electronic communication, as defined in the Electronic Transactions Act 1999.

2 The System Operator and the functions of the Chief Executive Medicare 1 System Operator

14 Identity of the System Operator 1

The System Operator is:

the Secretary of the Department; or

if a body established by a law of the Commonwealth is prescribed by the regulations to be the System Operator—that body.

Before regulations are made for the purposes of paragraph (1)(b), the Minister must be satisfied that the Ministerial Council has been consulted in relation to the proposed regulations.

15 Functions of the System Operator

The System Operator has the following functions:

to establish and maintain an index service, for the purposes of the My Health Record system, that:

allows information in different repositories to be connected to registered healthcare recipients; and

facilitates the retrieval of such information when required, and ensures that registered healthcare recipients, and participants in the My Health Record system who are authorised to collect, use and disclose information, are able to do so readily;

(b) to establish and maintain mechanisms (access control mechanisms) that, subject to any requirements specified in the My Health Records Rules:

enable each registered healthcare recipient to set controls on the healthcare provider organisations and nominated representatives who may obtain access to the healthcare recipient’s My Health Record; and

specify default access controls that apply if a registered healthcare recipient has not set such controls; and

iii

specify circumstances in which access to a healthcare recipient’s My Health Record is to be automatically suspended or cancelled;

without limiting paragraph (b), to ensure that the access control mechanisms enable each registered healthcare recipient to specify that access to a healthcare recipient’s My Health Record is only to be:

by healthcare provider organisations and nominated representatives specified by the healthcare recipient; and

in accordance with any limitations specified by the healthcare recipient, including limitations on the kind of health information to be collected, used or disclosed by such healthcare provider organisations and nominated representatives;

to establish and maintain a reporting service that allows assessment of the performance of the system against performance indicators;

to establish and maintain the Register (see section 56);

to register healthcare recipients and participants in the My Health Record system (see Part 3) and to manage and monitor, on an ongoing basis, the system of registration;

to establish and maintain an audit service that records activity in respect of information in relation to the My Health Record system;

without limiting paragraph (g)—to establish and maintain mechanisms:

that enable each registered healthcare recipient to obtain electronic access to a summary of the flows of information in relation to his or her My Health Record; and

that enable each registered healthcare recipient to obtain a complete record of the flows of information in relation to his or her My Health Record, on application to the System Operator;

to operate a National Repositories Service that stores key records that form part of a registered healthcare recipient’s My Health Record (including the healthcare recipient’s shared health summary);

to establish and operate a test environment for the My Health Record system, and other electronic systems that interact directly with the My Health Record system, in accordance with the requirements (if any) in the My Health Records Rules;

to establish a mechanism for handling complaints about the operation of the My Health Record system;

to ensure that the My Health Record system is administered so that problems relating to the administration of the system can be resolved;

to advise the Minister on matters relating to the My Health Record system, including in relation to the matters to be included in the My Health Records Rules (see section 109);

to educate healthcare recipients, participants in the My Health Record system and members of the public about the My Health Record system;

in accordance with the guidance and direction of the Board established under section 82, to prepare and provide de-identified data, and, with the consent of the healthcare recipient, health information, for research or public health purposes;

such other functions as are conferred on the System Operator by this Act or any other Act;

to do anything incidental to or conducive to the performance of any of the above functions.

16 Research or public health purposes

The System Operator’s function under paragraph 15(ma) does not include providing de-identified data or health information to a private health insurer (within the meaning of the Private Health Insurance Act 2007) or any other insurer.

17 Retention and destruction of records uploaded to National Repositories Service

Records

This section applies to a record if:

the record is uploaded to the National Repositories Service; and

the record includes health information that is included in the My Health Record of a healthcare recipient.

Retention of records

The System Operator must ensure that the record is retained for the period:

beginning when the record is first uploaded to the National Repositories Service; and

ending:

30 years after the death of the healthcare recipient; or

if the System Operator does not know the date of death of the healthcare recipient—130 years after the date of birth of the healthcare recipient; or

iii

if, under subsection (3), the record is required to be destroyed because of the cancellation of registration of the healthcare recipient—when the System Operator is required to destroy the record under subsection (4).

Destruction of records after cancellation on request

If the System Operator is required to cancel the registration of the healthcare recipient under subsection 51(1) (cancellation on request), the System Operator must destroy any record that includes health information that is included in the My Health Record of the healthcare recipient, other than the following information:

the name and healthcare identifier of the healthcare recipient;

the name and healthcare identifier of the person who requested the cancellation, if different from the healthcare recipient;

the day the cancellation decision takes effect under subsection 51(7).

The System Operator must comply with subsection (3):

as soon as practicable after the cancellation decision takes effect under subsection 51(7); or

if any of the following requirements apply before the records are destroyed under paragraph (a)—as soon as practicable after the conclusion of the matter to which the requirement relates:

a court order requires the System Operator not to destroy records of the healthcare recipient;

the System Operator is required to disclose records of the healthcare recipient under section 69 or 69A;

iii

the System Operator is required to disclose records of the healthcare recipient under a law covered by subsection 65(3).

To avoid doubt, if the System Operator is required under subsection (3) to destroy a record that includes health information, the System Operator must also destroy the following:

any copy of the record;

any previous version of the record;

any back-up version of the record.

4 Functions of Chief Executive Medicare

38 Registered repository operator 1

It is a function of the Chief Executive Medicare to seek to become a registered repository operator and, if registered, to operate a repository for the purposes of the My Health Record system in accordance with subsection (2).

Without limiting the way in which the repository is to be operated, at any time when the Chief Executive Medicare is a registered repository operator, the Chief Executive Medicare:

may at his or her discretion upload health information held by the Chief Executive Medicare about a registered healthcare recipient to the repository operated by the Chief Executive Medicare; and

with the consent of a registered healthcare recipient—may at his or her discretion make available to the System Operator health information held by the Chief Executive Medicare about the healthcare recipient.

Note: Section 58 authorises the Chief Executive Medicare to disclose identifying information to the System Operator.

The health information referred to in subsection (2) in relation to a healthcare recipient may include the name of one or more healthcare providers that have provided healthcare to the healthcare recipient.

3 Registration 1 Registering healthcare recipients

Note: This Division does not apply to a healthcare recipient if the opt-out model applies to the healthcare recipient because of My Health Records Rules made under Schedule 1 to this Act.

39 Healthcare recipients may apply for registration 1

A healthcare recipient may apply to the System Operator for registration of the healthcare recipient.

The application must:

be in the approved form; and

include, or be accompanied by, the information and documents required by the form; and

be lodged at a place, or by a means, specified in the form.

40 When a healthcare recipient is eligible for registration

A healthcare recipient is eligible for registration if:

(a) a healthcare identifier has been assigned to the healthcare recipient under paragraph 9(1)(b) of the Healthcare Identifiers Act 2010; and

the following information has been provided to the System Operator in relation to the healthcare recipient:

full name;

date of birth;

iii

healthcare identifier, Medicare card number or Department of Veterans’ Affairs file number;

sex;

such other information as is prescribed by the regulations.

41 Registration of a healthcare recipient by the System Operator 1

The System Operator must decide to register a healthcare recipient if:

an application has been made under section 39 in relation to the healthcare recipient; and

the healthcare recipient is eligible for registration under section 40; and

the System Operator is satisfied, having regard to the matters (if any) specified in the My Health Records Rules, that the identity of the healthcare recipient has been appropriately verified.

Note: The System Operator is not permitted to register a healthcare recipient in any other circumstances.

Despite subsection (1), the System Operator is not required to register a healthcare recipient if the System Operator is satisfied that registering the healthcare recipient may compromise the security or integrity of the My Health Record system, having regard to the matters (if any) prescribed by the My Health Records Rules.

The System Operator is not required to register a healthcare recipient if the healthcare recipient does not consent to a registered healthcare provider organisation uploading to the My Health Record system any record that includes health information about the healthcare recipient, subject to the following:

express advice given by the healthcare recipient to the registered healthcare provider organisation that a particular record, all records or a specified class of records must not be uploaded;

a law of a State or Territory that is prescribed by the regulations for the purposes of subsection (4).

(3A) A registered healthcare provider organisation is authorised to upload to the My Health Record system a record in relation to a healthcare recipient (the patient) that includes health information about another healthcare recipient (the third party), if the health information about the third party is directly relevant to the healthcare of the patient, subject to a law of a State or Territory that is prescribed by the regulations for the purposes of subsection (4).

A consent referred to in subsection (3), and an authorisation given under subsection (3A), have effect despite a law of a State or Territory that requires consent to the disclosure of particular health information:

to be given expressly; or

to be given in a particular way;

other than a law of a State or Territory prescribed by the regulations for the purposes of this subsection.

A decision under subsection (1) takes effect when it is made.

1A Healthcare provider organisations that are required to be registered

41A Prescribed healthcare provider organisations must be registered 1

A prescribed healthcare provider organisation contravenes this subsection if the healthcare provider organisation is not a registered healthcare provider organisation and is not an approved registered repository operator.

Civil penalty: 250 penalty units.

However, subsection (1) does not apply:

during any period starting when the healthcare provider organisation applies to the System Operator under section 41B or 42 and ending when the application is finally determined; or

during any period approved by the System Operator under section 41B in relation to the healthcare provider organisation.

Note: A person who wishes to rely on subsection (2) in proceedings for a civil penalty order bears an evidential burden in relation to the matters in that subsection: see section 96 of the Regulatory Powers Act.

41B System Operator may approve a period during which registration is not required

Application

A healthcare provider organisation may apply to the System Operator to approve a period during which subsection 41A(1) does not apply to the healthcare provider organisation.

The application must:

be in the approved form; and

include, or be accompanied by, the information and documents required by the form; and

be lodged at a place, or by a means, specified in the form.

Further information may be required

If a healthcare provider organisation makes an application under subsection (1), the System Operator may, by notice in writing, require the healthcare provider organisation to give the System Operator, within the period specified in the notice, such further information in relation to the application as the System Operator requires.

The System Operator is not required to decide the application, and may cease considering the application, if the healthcare provider organisation does not provide the required information within the period specified in the notice.

Approval by System Operator

On application under subsection (1) or on the System Operator’s initiative, the System Operator may, by written notice to a healthcare provider organisation, approve a period during which subsection 41A(1) does not apply to the healthcare provider organisation.

In deciding whether to approve the period, the System Operator must take into account the following:

the healthcare provider organisation’s size and technological readiness;

the potential disruption (if any) to the provision of healthcare if the healthcare provider organisation is not a registered healthcare provider organisation;

any other matter the System Operator considers relevant.

An approval under subsection (5) is not a legislative instrument.

2 Registering healthcare provider organisations

42 Healthcare provider organisation may apply for registration 1

A healthcare provider organisation may apply to the System Operator for registration of the healthcare provider organisation.

The application must:

be in the approved form; and

include, or be accompanied by, the information and documents required by the form; and

be lodged at a place, or by a means, specified in the form.

43 When a healthcare provider organisation is eligible for registration

A healthcare provider organisation is eligible for registration if:

(a) the healthcare provider organisation is an identified healthcare provider organisation within the meaning of the Healthcare Identifiers Act 2010; and

the healthcare provider organisation complies with such requirements as are specified in the My Health Records Rules.

44 Registration of a healthcare provider organisation 1

The System Operator must decide to register a healthcare provider organisation if:

the healthcare provider organisation has made an application under section 42; and

the healthcare provider organisation is eligible for registration under section 43.

Despite subsection (1), the System Operator is not required to register a healthcare provider organisation if the System Operator is satisfied that registering the healthcare provider organisation may compromise the security or integrity of the My Health Record system, having regard to the matters (if any) prescribed by the My Health Records Rules.

The System Operator may impose conditions on the registration.

A decision under subsection (1) takes effect when it is made.

45 Condition of registration—uploading of records, etc.

It is a condition of registration of a healthcare provider organisation that the healthcare provider organisation does not, for the purposes of the My Health Record system:

upload a record that includes health information about a registered healthcare recipient to a repository other than:

a repository that forms part of the National Repositories Service; or

a repository to which a registered repository operator’s registration relates; or

upload to a repository a record:

that purports to be the shared health summary of a registered healthcare recipient, unless the record would, when uploaded, be the shared health summary of the registered healthcare recipient; or

(ii) that is a record of a kind specified in the My Health Records Rules for the purposes of this paragraph, unless the record has been prepared by an individual healthcare provider to whom a healthcare identifier has been assigned under paragraph 9(1)(a) of the Healthcare Identifiers Act 2010; or

upload to a repository a record of a kind specified in the My Health Records Rules for the purposes of subparagraph (b)(ii) unless the record is prepared by a person who, at the time the record is prepared, is:

(i) an individual who is registered by a registration authority within the meaning of the Healthcare Identifiers Act 2010, and whose registration is not conditional, suspended, cancelled or lapsed (other than in circumstances prescribed in the My Health Records Rules); or

(ii) an individual who is represented by a professional body described in paragraph 9A(1)(b) of the Healthcare Identifiers Act 2010, and whose credentials are not conditional, suspended, cancelled or lapsed (other than in circumstances prescribed by the My Health Records Rules); or

(c) upload a record to a repository if uploading the record would involve an infringement of a moral right of the author, within the meaning of the Copyright Act 1968; or

upload to a repository a record that includes health information about a registered consumer if the consumer has advised that the record is not to be uploaded.

45A Condition of registration—handling old records that are works subject to copyright

Old works must not be uploaded if it would be an infringement of copyright to use the work for healthcare or related purposes

(1) Subsection (2) applies to works made before Copyright Act 1968 commences.section 44BB of the

Note: Section 44BB of the Copyright Act 1968 provides that there is no infringement of copyright if an act comprised in the copyright of a work is done, or authorised to be done, for healthcare or related purposes.

A healthcare provider organisation must not, for the purposes of the My Health Record system, upload the work if it would be an infringement of the copyright in the work for the organisation or another person to do, or authorise to be done, an act comprised in the copyright of the work:

for a purpose for which the collection, use or disclosure of health information is required or authorised under this Act; or

(b) in circumstances in which a permitted general situation exists under item 1 of the table in subsection 16A(1) of the Privacy Act 1988 (serious threat to life, health or safety), or would exist if the act were done, or authorised to be done, by an entity that is an APP entity for the purposes of that Act; or

(c) in circumstances in which a permitted health situation exists under Privacy Act 1988, or would exist if the act were done, or authorised to be done, by an entity that is an organisation for the purposes of that Act; orsection 16B of the

for any other purpose relating to healthcare, or the communication or management of health information, prescribed by the regulations.

It is a condition of the registration of a healthcare provider organisation that the organisation complies with the obligation under subsection (2).

45B Condition of registration—handling old sound recordings and cinematograph films that are subject to copyright 1

(1) Subsection (2) applies to sound recordings and cinematograph films made before Copyright Act 1968 commences.section 104C of the

Note: Section 104C of the Copyright Act 1968 provides that there is no infringement of the copyright if an act comprised in the copyright of a sound recording or cinematograph film is done, or authorised to be done, for healthcare or related purposes.

A healthcare provider organisation must not, for the purposes of the My Health Record system, upload the sound recording or cinematograph film if it would be an infringement of the copyright in the recording or film for the organisation or another person to do an act comprised in the copyright of the recording or film:

for a purpose for which the collection, use or disclosure of health information is required or authorised under this Act; or

(b) in circumstances in which a permitted general situation exists under item 1 of the table in subsection 16A(1) of the Privacy Act 1988 (serious threat to life, health or safety), or would exist if the act were done by an entity that is an APP entity for the purposes of that Act; or

(c) in circumstances in which a permitted health situation exists under Privacy Act 1988, or would exist if the act were done by an entity that is an organisation for the purposes of that Act; orsection 16B of the

for any other purpose relating to healthcare, or the communication or management of health information, prescribed by the regulations.

It is a condition of the registration of a healthcare provider organisation that the organisation complies with the obligation under subsection (2).

45C Liability where work uploaded in breach of section 45A or 45B 1

If any person suffers loss or damage as a result of anything done by an entity that contravenes section 45A or 45B, the person may bring an action for the amount of the loss or damage against the entity in:

the Federal Court of Australia;

the Federal Circuit and Family Court of Australia (Division 2);

a court of a State or Territory that has jurisdiction in relation to the matter.

The action must be brought within 6 years after the loss or damage was suffered.

In determining the damage suffered by the person, the court may include costs incurred by the person as a result of legal action relating to infringement of copyright.

46 Condition of registration—non-discrimination in providing healthcare to a healthcare recipient who does not have a My Health Record etc.

Healthcare recipient who is not registered

It is a condition of registration of a healthcare provider organisation that the organisation does not:

refuse to provide healthcare to a healthcare recipient because the healthcare recipient is not registered under this Part; or

otherwise discriminate against a healthcare recipient in relation to the provision of healthcare because the healthcare recipient is not registered under this Part.

Registered healthcare recipient’s access controls

It is a condition of registration of a healthcare provider organisation that the organisation does not:

refuse to provide healthcare to a registered healthcare recipient because the healthcare recipient has set particular access controls on his or her My Health Record; or

otherwise discriminate against a healthcare recipient in relation to the provision of healthcare because the healthcare recipient has set particular access controls on his or her My Health Record.

3 Registering repository operators, portal operators and contracted service providers

47 Persons may apply for registration as a repository operator, a portal operator or a contracted service provider 1

A person may apply to the System Operator for registration as any of the following:

a repository operator;

a portal operator;

a contracted service provider.

An application for registration as a repository operator must specify each repository to which the registration is proposed to relate.

48 When a person is eligible for registration as a repository operator, a portal operator or a contracted service provider

A person is eligible for registration as a repository operator, a portal operator or a contracted service provider if the System Operator is satisfied that:

the person complies with any My Health Records Rules that apply in relation to registration of the particular kind; and

the person has agreed to be bound by the conditions imposed by the System Operator on the person’s registration; and

in the case of a repository operator or a portal operator—the central management and control of the repository operator or portal operator will be located in Australia at all times when the repository operator or portal operator is registered; and

in the case of a repository operator or a portal operator that:

is a State or Territory authority, or an instrumentality of a State or Territory; and

is not bound by a designated privacy law of the State or Territory;

the repository operator or portal operator is prescribed under Privacy Act 1988.section 6F of the

49 Registration of a repository operator, a portal operator or a contracted service provider 1

The System Operator must decide to register a person as a repository operator, a portal operator or a contracted service provider if:

the person has made an application under section 47 for registration of that kind; and

the person is eligible for registration of that kind under section 48.

Despite subsection (1), the System Operator is not required to register a person as a repository operator, a portal operator or a contracted service provider if the System Operator is satisfied that registering the person may compromise the security or integrity of the My Health Record system, having regard to the matters (if any) prescribed by the My Health Records Rules.

The System Operator may impose conditions on the registration.

If the System Operator decides to register a person as a repository operator, the decision must specify the repositories to which the registration relates.

A decision under subsection (1) takes effect when it is made.

50 Condition about provision of information to System Operator

It is a condition of registration of a registered repository operator, a registered portal operator or a registered contracted service provider that it must provide to the System Operator information included in the My Health Record of a healthcare recipient if requested to do so by the System Operator.

50A Condition of registration—handling old records that are works subject to copyright 1

(1) Subsection (2) applies to works made before Copyright Act 1968 commences.section 44BB of the

A registered repository operator must not make the work available for the purposes of the My Health Record system, if it would be an infringement of the copyright in the work for the operator or another person to do, or authorise to be done, an act comprised in the copyright of the work:

for a purpose for which the collection, use or disclosure of health information is required or authorised under this Act; or

for any other purpose relating to healthcare, or the communication or management of health information, prescribed by the regulations.

It is a condition of the registration of a registered repository operator that the operator complies with subsection (2).

50B Condition of registration—handling old sound recordings and cinematograph films that are subject to copyright 1

(1) Subsection (2) applies to sound recordings and cinematograph films made before Copyright Act 1968 commences.section 104C of the

A registered repository operator must not, for the purposes of the My Health Record system, make the sound recording or cinematograph film available if it would be an infringement of the copyright in the recording or film for the operator or another person to do any act comprised in the copyright in the recording or film:

for a purpose for which the collection, use or disclosure of health information is required or authorised under this Act; or

(b) in circumstances in which a permitted general situation exists under item 1 of the table in subsection 16A(1) of the Privacy Act 1988 (serious threat to life, health or safety), or would exist if the act were done by an entity that is an APP entity for the purposes of that Act; or

for any other purpose relating to healthcare, or the communication or management of health information, prescribed by the regulations.

It is a condition of the registration of a registered repository operator that the operator complies with subsection (2).

50C Liability where work uploaded in breach of section 50A or 50B 1

If any person suffers loss or damage as a result of anything done by an entity that contravenes section 50A or 50B, the person may bring an action for the amount of the loss or damage against the entity in:

the Federal Court of Australia;

the Federal Circuit and Family Court of Australia (Division 2);

a court of a State or Territory that has jurisdiction in relation to the matter.

The action must be brought within 6 years after the loss or damage was suffered.

In determining the damage suffered by the person, the court may include costs incurred by the person as a result of legal action relating to infringement of copyright.

50D Authorisation to make health information available to the System Operator

A registered repository operator (other than the Chief Executive Medicare) is authorised to make health information about a registered healthcare recipient that is held by the operator available to the System Operator.

4 Cancellation, suspension and variation of registration

51 Cancellation or suspension of registration

Cancellation or suspension on request

The System Operator must, in writing, decide to cancel or suspend the registration of a healthcare recipient or other entity if the healthcare recipient or other entity requests the System Operator, in writing, to cancel or suspend the registration.

Cancellation or suspension if healthcare recipient no longer eligible, etc.

The System Operator may, in writing, decide to cancel or suspend the registration of a healthcare recipient if:

the System Operator is no longer satisfied that the healthcare recipient is eligible to be registered; or

the System Operator is no longer satisfied, having regard to the matters (if any) specified in the My Health Records Rules, that the identity of the healthcare recipient has been appropriately verified; or

the System Operator is satisfied that, unless the registration of the healthcare recipient is cancelled, the security or integrity of the My Health Record system may be compromised, having regard to the matters (if any) prescribed by the My Health Records Rules; or

the System Operator is satisfied that the consent referred to in subsection 41(3) in relation to the healthcare recipient has been withdrawn; or

the System Operator is satisfied that the consent referred to in subsection 41(3) in relation to the healthcare recipient was given by an authorised representative or nominated representative of the healthcare recipient, and:

the authorised representative or nominated representative who gave the consent ceases to be an authorised representative or nominated representative of the healthcare recipient; and

the System Operator requests the healthcare recipient to give consent of the kind referred to in subsection 41(3); and

iii

the healthcare recipient does not, within a reasonable period, give the consent.

Cancellation or suspension if other entity no longer eligible, etc.

The System Operator may, in writing, decide to cancel or suspend the registration of an entity other than a healthcare recipient if:

the System Operator is no longer satisfied that the entity is eligible to be registered; or

the System Operator is satisfied that:

the entity has contravened this Act or a condition of the entity’s registration; or

cancellation or suspension of registration is reasonably necessary to prevent such a contravention; or

iii

cancellation or suspension of registration is otherwise appropriate, having regard to the need to protect the security and integrity of the My Health Record system.

The System Operator may, in writing, decide to cancel or suspend the registration of a healthcare provider organisation if the System Operator is not satisfied that the healthcare provider organisation is able to comply with the conditions of the healthcare provider organisation’s registration.

Suspension while investigating action in relation to healthcare recipient’s registration

The System Operator may, in writing, decide to suspend the registration of a healthcare recipient while the System Operator investigates whether to take action under subsection (2) in relation to the healthcare recipient’s registration.

Suspension while investigating action in relation to entity’s registration

The System Operator may, in writing, decide to suspend the registration of an entity other than a healthcare recipient while the System Operator investigates whether to take action under subsection (3) or (3A) in relation to the entity’s registration.

Cancellation of registration of healthcare recipient on death

The System Operator must decide to cancel the registration of a healthcare recipient if the System Operator is satisfied that the healthcare recipient has died.

When cancellation or suspension takes effect

A decision under this section takes effect:

when it is made; or

if the decision is made at the request of the healthcare recipient or other entity, and the request states that the healthcare recipient or other entity wishes the cancellation or suspension to occur at a specified future time—at that future time.

Note: Under section 53, the System Operator must give the healthcare recipient or other entity notice before cancelling, suspending or varying registration (except in urgent circumstances). The decision to cancel, suspend or vary registration cannot be made before the end of the period specified in the notice.

52 Variation of registration 1

The System Operator may decide, on the System Operator’s initiative or on the request of a healthcare recipient or other entity, to vary the registration of the healthcare recipient or other entity:

to impose conditions, or additional conditions, on the registration; or

to vary or revoke conditions imposed on the registration; or

in the case of a registered repository operator—to vary the repositories to which the registration relates; or

to correct an error or omission in the registration.

A decision under this section takes effect:

when it is made; or

if the decision is made at the request of the healthcare recipient or other entity, and the request states that the healthcare recipient or other entity wishes the variation to occur at a specified future time—at that future time.

53 Notice of cancellation, suspension or variation of registration etc.

Written notice before cancellation etc. other than in urgent circumstances

The System Operator must give written notice to a healthcare recipient or other entity before:

cancelling or suspending the registration of the healthcare recipient or entity under subsection 51(2), (3), (3A), (4) or (5); or

varying the entity’s registration under section 52;

other than as mentioned in subsection (4) of this section (urgency).

The notice:

must state that the System Operator proposes to cancel, suspend or vary the registration and the reasons why; and

in the case of an entity that the System Operator is satisfied has contravened or may contravene this Act or a condition of the entity’s registration—may specify steps that the entity must take in order to address the contravention or possible contravention; and

must invite the healthcare recipient or other entity to make a written submission, within the period specified in the notice, to the System Operator in relation to the proposed cancellation, suspension or variation.

If the System Operator gives written notice to a healthcare recipient or other entity under subsection (1), the System Operator must not decide to cancel, suspend or vary the registration until after the end of the period referred to in paragraph (2)(c).

Cancellation etc. in urgent circumstances

If the System Operator is satisfied that it is necessary, because of the urgency of the circumstances, to cancel, suspend or vary the registration of a healthcare recipient or other entity without following the process outlined in subsections (1) to (3), the System Operator must give written notice to the healthcare recipient or other entity:

cancelling or suspending the registration of the healthcare recipient or entity under subsection 51(2), (3), (3A), (4) or (5); or

varying the entity’s registration under section 52.

A decision under subsection (4) takes effect:

when notice of the decision is given under that subsection; or

if a later time is specified in the notice under that subsection—at that later time.

54 Effect of suspension

During any period when the registration of a healthcare recipient or other entity is suspended:

the healthcare recipient or other entity is taken not to be registered for the purposes of Division 2 of Part 4 (authorised collection, use and disclosure of health information), other than:

paragraph 63(b) (collection, use or disclosure on request of the System Operator); and

subsection 64(1) (serious threat); and

(ab) if the entity is a registered healthcare provider organisation or registered repository operator—the entity is taken not to be registered for the purposes of paragraph (a) of the definition of approved registered repository operator in section 5 and sections 10A, 41A, 78A, 78C and 78D; and

if the entity is a registered repository operator, a registered portal operator or a registered contracted service provider—the entity is taken to be registered for the purposes of the remaining provisions of this Act.

55 My Health Records Rules may specify requirements after registration is cancelled or suspended 1

The My Health Records Rules may specify the requirements to which the System Operator or another entity is subject after the registration of a healthcare recipient or other entity is cancelled or suspended.

The My Health Records Rules cannot modify the effect of section 54.

The requirements specified in the My Health Records Rules may include requirements relating to the following:

retention, transfer or disposal of My Health Records;

retention, transfer or disposal of other records.

5 The Register

56 The Register 1

The System Operator must establish and maintain a Register.

The Register may be maintained in electronic form and may be divided into separate parts.

The Register is not a legislative instrument.

57 Entries to be made in Register

If the System Operator decides under this Part to register a healthcare recipient or other entity or to cancel, suspend or vary such a registration, the System Operator must, as soon as practicable after making the decision, ensure that the following information is entered in the Register in relation to the healthcare recipient or other entity:

such administrative information as is necessary for the purposes of the proper operation of the My Health Record system;

such information (if any) as is specified in the My Health Records Rules for the purposes of this paragraph.

6 Collection, use and disclosure of information for the purposes of the My Health Record System

58 Collection, use and disclosure of health information by the System Operator

The System Operator may collect, use and disclose health information about a healthcare recipient for the purposes of including the health information in the My Health Record of a registered healthcare recipient.

58A Collection, use and disclosure of healthcare identifiers, identifying information and information identifying authorised representatives and nominated representatives 1

An entity mentioned in column 1 of an item of the following table, is authorised to take action of the kind described in column 2 of that item with information of the kind described in column 3 of that item in the circumstances described in column 4 of that item.

Collection, use and disclosure for the purpose of the My Health Record system	Collection, use and disclosure for the purpose of the My Health Record system	Collection, use and disclosure for the purpose of the My Health Record system	Collection, use and disclosure for the purpose of the My Health Record system	Collection, use and disclosure for the purpose of the My Health Record system
Item	Column 1 Entity	Column 2 Permitted action	Column 3 Information	Column 4 Circumstances
1	System Operator	collect use disclose	identifying information about any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient; (d) a healthcare provider the healthcare identifier of any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient; (d) a healthcare provider	the collection, use or disclosure is for the purposes of the My Health Record system
2	System Operator	collect use disclose	information relevant to whether a person is an authorised representative, or nominated representative, of another person	the collection, use or disclosure is for the purposes of determining whether a person is an authorised representative, or a nominated representative, of another person
3	registered repository operator registered portal operator	collect use disclose to a participant in the My Health Record System	the healthcare identifier of any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient; (d) a healthcare provider	the collection, use or disclosure is for the purposes of the My Health Record system
4	service operator for the purposes of the Healthcare Identifiers Act 2010	collect from the System Operator use disclose to the System Operator	information relevant to whether a person is an authorised representative, or nominated representative, of another person	the collection, use or disclosure is for the purposes of assisting the System Operator to determine whether a person is an authorised representative, or a nominated representative, of another person
5	Chief Executive Medicare	collect from the System Operator use disclose to the System Operator	identifying information about any person who is, or may be, any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient	the collection, use or disclosure is: (a) for the purposes of assisting the System Operator to verify the identity of the person; or (b) otherwise for the purposes of the My Health Record system
6	Chief Executive Medicare	collect from the System Operator use disclose to the System Operator	information relevant to whether a person is an authorised representative, or nominated representative, of another person	the collection, use or disclosure is for the purposes of assisting the System Operator to determine whether a person is an authorised representative, or a nominated representative, of another person
7	Chief Executive Medicare	collect use disclose to a participant in the My Health Record system	identifying information about any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient healthcare identifier of any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient	the collection, use or disclosure is for the purpose of including health information in the healthcare recipient’s My Health Record
8	Veterans’ Affairs Department Defence Department	use disclose to the System Operator	identifying information about any person who is, or may be, any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient	the use or disclosure is for the purposes of assisting the System Operator to verify the identity of the person
9	Veterans’ Affairs Department Defence Department	collect from the service operator under the Healthcare Identifiers Act 2010 use disclose to a participant in the My Health Record system	identifying information about any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient healthcare identifier of any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient	the collection, use or disclosure is for the purpose of including prescribed information in the healthcare recipient’s My Health Record
10	a prescribed entity	collect use disclose to another prescribed entity	identifying information about any person who is, or may be, any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient	the collection, use or disclosure is for the purposes of assisting the System Operator to verify the identity of the person

Note: Under Healthcare Identifiers Act 2010, the service operator under that Act is authorised to collect, use and disclose healthcare identifiers of, and identifying information about, healthcare recipients and their representatives for the purposes of the My Health Record system. The service operator is also authorised to collect, use and disclose healthcare identifiers of, and identifying information about, healthcare providers under section 24 of that Act.section 15 of the

If:

any of the following entities discloses information to the System Operator in circumstances in which the information is authorised to be disclosed under subsection (1):

the Chief Executive Medicare;

the Veterans’ Affairs Department;

iii

the Defence Department;

(iv) the service operator for the purposes of the Healthcare Identifiers Act 2010;

an entity prescribed for the purposes of item 10 of the table in subsection (1); and

the entity that disclosed the information becomes aware that the information has changed;

that entity must, as soon as practicable after becoming aware of the change, inform the System Operator of the change.

4 Collection, use and disclosure of health information included in a healthcare recipient’s My Health Record 1 Unauthorised collection, use and disclosure of health information included in a healthcare recipient’s My Health Record

59 Unauthorised collection, use and disclosure of health information included in a healthcare recipient’s My Health Record 1

A person must not collect from the My Health Record system health information included in a healthcare recipient’s My Health Record if the collection by the person is not authorised under Division 2, and the person knows or is reckless as to that fact.

A person must not use or disclose health information included in a healthcare recipient’s My Health Record if:

the person obtained the information by using or gaining access to the My Health Record system; and

the use or disclosure is not authorised under Division 2, and the person knows or is reckless as to that fact.

Fault-based offence

A person commits an offence if the person contravenes subsection (1) or (2).

Penalty: Imprisonment for 5 years or 300 penalty units, or both.

Civil penalty

A person is liable to a civil penalty if the person contravenes subsection (1) or (2).

Civil penalty: 1,500 penalty units.

59A Unauthorised use of information included in a healthcare recipient’s My Health Record for prohibited purpose 1

A person must not use health information included in a healthcare recipient’s My Health Record for a prohibited purpose, if the person obtained the information by using or gaining access to the My Health Record system.

Note: For prohibited purpose, see section 70A.

Civil penalty: 1,500 penalty units.

A person must not use health information included in a healthcare recipient’s My Health Record for a prohibited purpose, if the person obtained the information in the following way:

the health information was originally obtained by a participant in the My Health Record system by means of the My Health Record system in accordance with this Act;

after the health information was so obtained, it was stored in such a way that it could be obtained other than by means of the My Health Record system;

the person subsequently obtained the health information by those other means.

Civil penalty: 1,500 penalty units.

Subsection (1) or (1A) does not apply if the person is the healthcare recipient, but does apply if the person is the nominated representative of the healthcare recipient (despite subsection 7(2)).

60 Secondary disclosure 1

A person must not use or disclose health information included in a healthcare recipient’s My Health Record if:

the information was disclosed to the person in contravention of subsection 59(2); and

the person knows that, or is reckless as to whether, the disclosure of the information to the person contravened that subsection.

Subsection (1) does not apply if the person discloses the information for the purpose of an appropriate authority investigating the contravention mentioned in paragraph (1)(a).

Fault-based offence

A person commits an offence if the person contravenes subsection (1).

Penalty: Imprisonment for 5 years or 300 penalty units, or both.

Civil penalty

A person is liable to a civil penalty if the person contravenes subsection (1).

Civil penalty: 1,500 penalty units.

2 Authorised collection, use and disclosure

Subdivision A—Collection, use and disclosure in accordance with access controls

61 Collection, use and disclosure for providing healthcare 1

A participant in the My Health Record system is authorised to collect, use and disclose health information included in a registered healthcare recipient’s My Health Record if the collection, use or disclosure of the health information is:

for the purpose of providing healthcare to the registered healthcare recipient; and

in accordance with:

the access controls set by the registered healthcare recipient; or

if the registered healthcare recipient has not set access controls—the default access controls specified by the My Health Records Rules or, if the My Health Records Rules do not specify default access controls, by the System Operator.

Subsection (1) does not authorise a participant in the My Health Record system to collect, use or disclose health information included in healthcare recipient-only notes.

62 Collection, use and disclosure to nominated representative

A participant in the My Health Record system is authorised to disclose health information included in a registered healthcare recipient’s My Health Record for any purpose if the disclosure of the health information is:

to the registered healthcare recipient’s nominated representative; and

in accordance with:

the access controls set by the registered healthcare recipient; or

if the healthcare recipient has not set access controls—the default access controls specified by the My Health Records Rules or, if the My Health Records Rules do not specify default access controls, by the System Operator.

Subdivision B—Collection, use and disclosure other than in accordance with access controls

63 Collection, use and disclosure for management of My Health Record system

A participant in the My Health Record system is authorised to collect, use and disclose health information included in a healthcare recipient’s My Health Record if:

the collection, use or disclosure is undertaken for the purpose of the management or operation of the My Health Record system, if the healthcare recipient would reasonably expect the participant to collect, use or disclose the health information for that purpose; or

the collection, use or disclosure is undertaken in response to a request by the System Operator for the purpose of performing a function or exercising a power of the System Operator.

Note: For example, the System Operator might make a request under paragraph (b) for the purposes of section 69, 69A or 70.

64 Collection, use and disclosure in the case of a serious threat 1

A participant in the My Health Record system is authorised to collect, use and disclose health information included in a registered healthcare recipient’s My Health Record if:

the participant reasonably believes that:

the collection, use or disclosure is necessary to lessen or prevent a serious threat to an individual’s life, health or safety; and

it is unreasonable or impracticable to obtain the healthcare recipient’s consent to the collection, use or disclosure; and

unless the participant is the System Operator—the participant advises the System Operator of the matters in paragraph (a); and

the collection, use or disclosure occurs not later than 5 days after that advice is given.

A participant in the My Health Record system is authorised to collect, use and disclose health information included in a healthcare recipient’s My Health Record if the participant reasonably believes that the collection, use or disclosure by the participant is necessary to lessen or prevent a serious threat to public health or public safety.

Subsections (1) and (2) do not authorise a participant in the My Health Record system to collect, use or disclose healthcare recipient-only notes.

65 Collection, use and disclosure authorised by law 1

Subject to section 69, a participant in the My Health Record system is authorised to collect, use and disclose health information included in a healthcare recipient’s My Health Record if the collection, use or disclosure is required or authorised by a Commonwealth, State or Territory law covered by subsection (3).

Note: No State or Territory laws are covered by subsection (3).

Subsection (1) does not authorise a participant in the My Health Record system to collect, use or disclose healthcare recipient-only notes.

This subsection covers the following laws:

this Act;

(b) the Auditor-General Act 1997;

a law of the Commonwealth to the extent that the law requires or authorises the collection, use or disclosure of information for the purposes of performing the Information Commissioner’s functions in relation to the My Health Record system.

66 Collection, use and disclosure with healthcare recipient’s consent 1

A participant in the My Health Record system is authorised to disclose for any purpose health information included in a healthcare recipient’s My Health Record to the healthcare recipient.

A participant in the My Health Record system is authorised to collect, use and disclose for any purpose health information included in a healthcare recipient’s My Health Record with the consent of the healthcare recipient.

67 Collection, use and disclosure by a healthcare recipient

A healthcare recipient is authorised to collect, use and disclose, for any purpose, health information included in his or her My Health Record.

Note: The information the healthcare recipient can collect through the My Health Record system after cancellation of the healthcare recipient’s registration on request may be limited because of the retention and destruction requirements under section 17.

68 Collection, use and disclosure for indemnity cover 1

A participant in the My Health Record system is authorised to collect, use and disclose health information included in a healthcare recipient’s My Health Record for purposes relating to the provision of indemnity cover for a healthcare provider.

Subsection (1) does not authorise a participant in the My Health Record system to collect, use or disclose healthcare recipient-only notes.

69 Disclosure to courts and tribunals 1

If:

a court or tribunal other than a coroner orders or directs the System Operator to disclose health information included in a healthcare recipient’s My Health Record to the court or tribunal; and

the order or direction is given in the course of proceedings relating to:

this Act; or

unauthorised access to information through the My Health Record system; or

iia

a share by default provision; or

iii

the provision of indemnity cover to a healthcare provider; and

apart from this Part, the System Operator would be required to comply with the order or direction;

the System Operator must comply with the order or direction.

If a coroner orders or directs the System Operator to disclose health information included in a healthcare recipient’s My Health Record to the coroner, the System Operator must comply with the order or direction.

Except as mentioned in subsection (1) or (2), a participant in the My Health Record system, or a healthcare recipient, cannot be required to disclose health information included in a healthcare recipient’s My Health Record to a court or tribunal.

Except as mentioned in subsection (1) or (2), the System Operator is not authorised to disclose health information included in a healthcare recipient’s My Health Record to a court or tribunal unless the healthcare recipient consents.

Subsections (1) and (2) do not authorise the System Operator to disclose healthcare recipient-only notes.

69A Disclosure to designated entity under order by judicial officer

Disclosure to designated entity under order by judicial officer

If an entity that is:

(a) an agency, or a State or Territory authority, within the meaning of the Privacy Act 1988; and

not a court, tribunal or coroner;

(a designated entity) presents to the System Operator an order made under this section, the System Operator must comply with the order.

Except as mentioned in subsection (1) or in accordance with a law covered by subsection 65(3), a participant in the My Health Record system, or a healthcare recipient, cannot be required to disclose health information included in a healthcare recipient’s My Health Record to a designated entity.

This section does not authorise the System Operator to use or disclose healthcare recipient-only notes.

If the System Operator uses or discloses personal information under this section, the System Operator must make a written note of the use or disclosure.

Application for and making of order

A designated entity may apply to any of the following judicial officers:

a magistrate of a State or Territory;

a judge who is eligible under subsection 69B(2);

for an order under this section in relation to the disclosure, to the entity, of health information included in a healthcare recipient’s My Health Record.

The judicial officer may make the order if:

the designated entity satisfies the judicial officer, by information on oath or affirmation, that:

the designated entity has powers or duties of the kind mentioned in subsection (7); and

if the designated entity has powers of the kind mentioned in paragraph (7)(a)—the designated entity has exercised or purported to exercise its power to require the System Operator to disclose information to which the order will relate; and

iii

in all the circumstances, the particular disclosure of the particular information to the designated entity is reasonably necessary for the purposes of a thing done by, or on behalf of, the designated entity; and

there is no effective means for the designated entity to obtain the particular information, other than an order under this section; and

the judicial officer is satisfied that, having regard to the matter mentioned in subparagraph (a)(iii) and the privacy of the healthcare recipient, the disclosure of the information would not, on balance, unreasonably interfere with the privacy of the healthcare recipient.

A designated entity has powers or duties of the kind mentioned in this subsection if:

the designated entity has power under a law of the Commonwealth or a State or Territory (other than a law covered by subsection 65(3)) to require persons to give information to the designated entity; or

officers of the designated entity are, in the ordinary course of their duties, authorised to execute warrants to enter premises and seize things found, including documents.

The judicial officer must not make the order unless the designated entity or some other person has given the judicial officer, either orally or by affidavit, such further information (if any) as the judicial officer requires concerning the grounds on which the order is being sought.

The order must:

identify the healthcare recipient; and

specify the particular information to be disclosed; and

authorise one or more officers of the designated entity (whether or not named in the order) to obtain the information from the System Operator and require the System Operator to disclose the information to the designated entity; and

specify the day (not more than 6 months after the making of the order) on which the order ceases to have effect; and

state the purpose for which the order is made.

69B Judicial officers for orders under section 69A

Eligible judge of a court created by the Parliament

A judge of a court created by the Parliament may, by writing, consent to be nominated by the Attorney-General under subsection (2).

The Attorney-General may, by writing, nominate a judge of a court created by the Parliament in relation to whom a consent is in force under subsection (1) to be eligible for the purposes of paragraph 69A(5)(b).

A nomination under subsection (2) is not a legislative instrument.

Magistrates

A magistrate need not accept the functions conferred by section 69A.

The Governor-General may:

arrange with the Governor of a State for the performance, by all or any of the persons who from time to time hold office as magistrates of that State, of the functions of a magistrate conferred by section 69A; or

arrange with the Chief Minister of the Australian Capital Territory for the performance, by all or any of the persons who from time to time hold office as magistrates of the Australian Capital Territory, of the functions of a magistrate conferred by section 69A; or

arrange with the Administrator of the Northern Territory for the performance, by all or any of the persons who from time to time hold office as Judges of the Local Court of the Northern Territory, of the functions of a magistrate conferred by section 69A.

Judicial officers exercising powers in personal capacity

The functions conferred on a judicial officer by section 69A are conferred on the judicial officer:

in a personal capacity; and

not as a court or a member of a court.

A judicial officer performing a function conferred by section 69A has the same protection and immunity as if the judicial officer were performing the function:

as the court of which the judicial officer is a member; or

as a member of the court of which the judicial officer is a member.

70 Disclosure in relation to unlawful activity 3

The System Operator is authorised to use or (subject to subsection (3A)) disclose health information included in a healthcare recipient’s My Health Record if the System Operator:

has reason to suspect that unlawful activity that relates to the System Operator’s functions has been, is being or may be engaged in; and

reasonably believes that use or disclosure of the information is necessary for the purposes of an investigation of the matter or in reporting concerns to relevant persons or authorities.

The System Operator is authorised to disclose under subsection (3) only the information the relevant person or authority mentioned in paragraph (3)(b) needs to identify the matter or concerns mentioned in that paragraph with sufficient certainty to:

initiate consideration of the matter or concerns; and

if necessary, apply for an order under section 69A in relation to the matter or concerns.

If the System Operator uses or discloses personal information under this section, it must make a written note of the use or disclosure.

This section does not authorise the System Operator to use or disclose healthcare recipient-only notes.

70AA Collection, use and disclosure in relation to compliance with share by default provisions 1

Subject to section 69, the System Operator is authorised to collect, use and disclose to a person covered by subsection (2) information covered by subsection (3) for the purposes of monitoring, investigating or enforcing compliance with a share by default provision.

This subsection covers the following persons:

the Chief Executive Medicare;

the Secretary of the Department;

(c) a Commonwealth entity (within the meaning of the Public Governance, Performance and Accountability Act 2013) (if any) specified in the My Health Records Rules.

This subsection covers health information that is:

included in a healthcare recipient’s My Health Record; and

of a kind specified in the My Health Records Rules.

Subsection (1) does not authorise the System Operator to collect, use or disclose healthcare recipient-only notes.

Subdivision C—Unauthorised use of information included in a healthcare recipient’s My Health Record for prohibited purpose

70A Definition of prohibited purpose 1

(1) Information included in a healthcare recipient’s My Health Record is used for a prohibited purpose if the person who uses the information does so for any one or more of the following purposes:

the purpose of:

underwriting a contract of insurance that covers the healthcare recipient; or

determining whether to enter into a contract of insurance that covers the healthcare recipient (whether alone or as a member of a class); or

iii

determining whether a contract of insurance covers the healthcare recipient in relation to a particular event; or

an employer employing, or continuing or ceasing to employ, the healthcare recipient;

a purpose prescribed by the regulations.

If the person uses information for purposes that include, or for a purpose that includes, a purpose mentioned in subsection (1), the person is taken to be using the information for a prohibited purpose.

(3) To avoid doubt, use of information is not for a prohibited purpose if the use is solely for:

the purpose of providing healthcare to the healthcare recipient; or

purposes relating to the provision of indemnity cover for a healthcare provider.

References in paragraph (1)(a) to insurance do not include State insurance that does not extend beyond the limits of the State concerned.

For the purposes of this section, using information for a purpose includes requesting or requiring the information for that purpose.

70B Use for prohibited purpose is unauthorised 1

Despite Subdivisions A and B, a person is not authorised under this Division to use health information included in a registered healthcare recipient’s My Health Record for a prohibited purpose.

Subsection (1) does not apply if the person is the healthcare recipient, but does apply if the person is the nominated representative of the healthcare recipient (despite subsection 7(2)).

3 Prohibitions and authorisations limited to My Health Record system

71 Prohibitions and authorisations limited to health information collected by using the My Health Record system 1

Subject to subsection (5), the prohibitions and authorisations under Divisions 1 and 2 in respect of the collection, use and disclosure of health information included in a healthcare recipient’s My Health Record are limited to the collection, use or disclosure of health information obtained by using the My Health Record system.

If health information included in a healthcare recipient’s My Health Record can also be obtained by means other than by using the My Health Record system, such a prohibition or authorisation does not apply to health information lawfully obtained by those other means, even if the health information was originally obtained by using the My Health Record system.

Information stored for more than one purpose

Without limiting the circumstances in which health information included in a healthcare recipient’s My Health Record and obtained by a person is taken not to be obtained by using or gaining access to the My Health Record system, it is taken not to be so obtained if:

the health information is stored in a repository operated both for the purposes of the My Health Record system and other purposes; and

the person lawfully obtained the health information directly from the repository for those other purposes.

Note: For example, information that is included in a registered healthcare recipient’s My Health Record may be stored in a repository operated by a State or Territory for purposes related to the My Health Record system and other purposes. When lawfully obtained directly from the repository for those other purposes, the prohibitions and authorisations in this Part will not apply.

Information originally obtained by means of My Health Record system

the health information was originally obtained by a participant in the My Health Record system by means of the My Health Record system in accordance with this Act; and

after the health information was so obtained, it was stored in such a way that it could be obtained other than by means of the My Health Record system; and

the person subsequently obtained the health information by those other means.

Note: For example, information that is included in a registered healthcare recipient’s My Health Record may be downloaded into the clinical health records of a healthcare provider and later obtained from those records.

This section does not apply to the prohibition in subsection 59A(1A).

3A Offences and penalties in relation to use of My Health Record-derived information for prohibited purpose

71AA Definitions

In this Division:

My Health Record of a healthcare recipient includes a My Health Record of the healthcare recipient that has been cancelled or suspended.

use information for a purpose includes request or require the information for that purpose.

71A Offence for use of My Health Record-derived information for prohibited purpose 1

A person commits an offence if:

the person uses information; and

the person does so for a prohibited purpose, and the person knows or is reckless as to that fact; and

the information is health information; and

the information is or was included in a healthcare recipient’s My Health Record; and

the person is not the healthcare recipient.

Penalty: Imprisonment for 5 years or 300 penalty units, or both.

Subsection (1) does not apply if the information was not collected from, and is not derived from a disclosure that was made by, a person who obtained the information by using or gaining access to the My Health Record system. For this purpose, it does not matter whether or not any collection or disclosure of the information was authorised under this Act or any other law.

Note: A defendant bears an evidential burden in relation to the matter in subsection (2): see subsection 13.3(3) of the Criminal Code.

Strict liability applies to paragraphs (1)(d) and (e).

Note: For strict liability, see Criminal Code.section 6.1 of the

Despite paragraph (1)(e) and subsection 7(2), subsection (1) of this section applies to a person who is the nominated representative of the healthcare recipient.

71B Civil penalty for use of My Health Record-derived information for prohibited purpose 1

A person must not use health information that is or was included in a healthcare recipient’s My Health Record for a prohibited purpose.

Civil penalty: 1,500 penalty units.

Note: A person bears an evidential burden in relation to the matter in subsection (2): see Regulatory Powers (Standard Provisions) Act 2014.section 96 of the

Subsection (1) does not apply if the person is the healthcare recipient, but does apply if the person is the nominated representative of the healthcare recipient (despite subsection 7(2)).

4 Interaction with the Privacy Act 1988

72 Interaction with the Privacy Act 1988

An authorisation to collect, use or disclose health information under this Act is also an authorisation to collect, use or disclose the health information for the purposes of the Privacy Act 1988.

73 Contravention of this Act is an interference with privacy 1

An act or practice that contravenes this Act in connection with health information included in a healthcare recipient’s My Health Record or a provision of Part 4 or 5, or would contravene this Act but for a requirement relating to the state of mind of a person, is taken to be:

(a) for the purposes of the Privacy Act 1988, an interference with the privacy of a healthcare recipient; and

covered by section 13 of that Act.

(2) The respondent to a complaint under the Privacy Act 1988 about an act or practice, other than an act or practice of an agency or organisation, is the individual who engaged in the act or practice.

(3) In addition to the Information Commissioner’s functions under the Privacy Act 1988, the Information Commissioner has the following functions in relation to the My Health Record system:

to investigate an act or practice that may be an interference with the privacy of a healthcare recipient under subsection (1) and, if the Information Commissioner considers it appropriate to do so, to attempt by conciliation to effect a settlement of the matters that gave rise to the investigation;

to do anything incidental or conducive to the performance of those functions.

The Information Commissioner has power to do all things that are necessary or convenient to be done for or in connection with the performance of his or her functions under subsection (3).

Note: An act or practice that is an interference with privacy may be the subject of a complaint under Privacy Act 1988.section 36 of the

73A Information Commissioner may disclose details of investigations to System Operator

The Information Commissioner is authorised to disclose to the System Operator any information or documents that relate to an investigation the Information Commissioner conducts because of the operation of section 73, if the Information Commissioner is satisfied that to do so will enable the System Operator to monitor or improve the operation or security of the My Health Record system.

73B Obligations of System Operator in relation to correction, etc. 1

(1) The System Operator may, in order to meet its obligations under the Privacy Act 1988 in relation to the correction and alteration of records:

request a participant in the My Health Record system to correct personal information contained in a record included in the My Health Record system and, if the participant does so, to upload the corrected record to the My Health Record system; and

if the participant refuses to do so—direct the participant to attach to the record a note prepared by the healthcare recipient in relation to personal information included in the record, and to upload the record and note to the My Health Record system.

A participant in the My Health Record system who is given a direction under paragraph (1)(b) must comply with the direction.

5 Authorised collection, use and disclosure for compliance purposes

73C Collection, use and disclosure of health information in relation to compliance with share by default provisions 1

A person covered by subsection (2) is authorised to collect, use and disclose, for the purposes of monitoring, investigating or enforcing compliance with a share by default provision, health information disclosed to the person under section 70AA.

This subsection covers the following persons:

the Chief Executive Medicare;

the Secretary of the Department;

(c) a Commonwealth entity (within the meaning of the Public Governance, Performance and Accountability Act 2013) (if any) specified in the My Health Records Rules for the purposes of paragraph 70AA(2)(c).

73D Collection, use and disclosure of healthcare identifiers and identifying information in relation to compliance with share by default provisions 1

An entity mentioned in column 1 of an item of the following table is authorised to take action of the kind described in column 2 of that item with information of the kind described in column 3 of that item in the circumstances described in column 4 of that item.

Collection, use and disclosure in relation to compliance with share by default provisions	Collection, use and disclosure in relation to compliance with share by default provisions	Collection, use and disclosure in relation to compliance with share by default provisions	Collection, use and disclosure in relation to compliance with share by default provisions	Collection, use and disclosure in relation to compliance with share by default provisions
Item	Column 1 Entity	Column 2 Permitted action	Column 3 Information	Column 4 Circumstances
1	participant in the My Health Record system	use disclose	identifying information about any of the following: (a) a healthcare recipient; (b) a healthcare provider the healthcare identifier of any of the following: (a) a healthcare recipient; (b) a healthcare provider	the use or disclosure is for the purposes of compliance with a share by default provision
2	Secretary of the Department	collect use disclose	identifying information about any of the following: (a) a healthcare recipient; (b) a healthcare provider the healthcare identifier of any of the following: (a) a healthcare recipient; (b) a healthcare provider	the collection, use or disclosure is for the purposes of monitoring, investigating or enforcing compliance with a share by default provision
3	Chief Executive Medicare	collect use disclose	identifying information about any of the following: (a) a healthcare recipient; (b) a healthcare provider the healthcare identifier of any of the following: (a) a healthcare recipient; (b) a healthcare provider	the collection, use or disclosure is for the purposes of monitoring, investigating or enforcing compliance with a share by default provision
4	service operator for the purposes of the Healthcare identifiers Act 2010	collect use disclose	identifying information about any of the following: (a) a healthcare recipient; (b) a healthcare provider the healthcare identifier of any of the following: (a) a healthcare recipient; (b) a healthcare provider	the collection, use or disclosure is for the purposes of monitoring, investigating or enforcing compliance with a share by default provision
5	any Commonwealth entity (within the meaning of the Public Governance, Performance and Accountability Act 2013) specified in the My Health Records Rules	collect use disclose	identifying information about any of the following: (a) a healthcare recipient; (b) a healthcare provider the healthcare identifier of any of the following: (a) a healthcare recipient; (b) a healthcare provider	the collection, use or disclosure is for the purposes of monitoring, investigating or enforcing compliance with a share by default provision

5 Other offences and civil penalty provisions

74 Registered healthcare provider organisations must ensure certain information is given to System Operator 1

A registered healthcare provider organisation is liable for a civil penalty if:

an individual requests access to a healthcare recipient’s My Health Record on behalf or purportedly on behalf of the registered healthcare provider organisation; and

the individual does not give enough information to the System Operator to enable the System Operator to identify the individual who made the request without seeking further information from another person.

Civil penalty: 100 penalty units.

Subsection (1) does not require an individual to give more than the minimum information necessary to identify the individual by name.

75 Data breaches 1

This section applies to an entity if:

the entity is, or has at any time been, the System Operator, a registered healthcare provider organisation, a registered repository operator, a registered portal operator or a registered contracted service provider; and

the entity becomes aware that:

a person has, or may have, contravened this Act in a manner involving an unauthorised collection, use or disclosure of health information included in a healthcare recipient’s My Health Record; or

an event has, or may have, occurred (whether or not involving a contravention of this Act) that compromises, may compromise, has compromised or may have compromised, the security or integrity of the My Health Record system; or

iii

circumstances have, or may have, arisen (whether or not involving a contravention of this Act) that compromise, may compromise, have compromised or may have compromised, the security or integrity of the My Health Record system; and

the contravention, event or circumstances directly involved, may have involved or may involve the entity.

Note: This section applies to an entity when the entity becomes aware of a matter referred to in paragraph (b) regardless of when that matter arose or occurred or if the matter is ongoing at the time the entity became aware of the matter.

Notifying the System Operator or Information Commissioner

If:

the entity is a registered healthcare provider organisation, a registered repository operator, a registered portal operator or a registered contracted service provider; and

the entity becomes aware that:

the contravention or event referred to in subsection (1) has or may have occurred; or

the circumstances referred to in subsection (1) have or may have arisen;

then, as soon as practicable after becoming aware, the entity must notify:

in the case of an entity that is a State or Territory authority or an instrumentality of a State or Territory—the System Operator; or

otherwise—both the System Operator and the Information Commissioner.

Civil penalty: 1,500 penalty units.

If:

the entity is the System Operator; and

the entity becomes aware that:

the contravention or event referred to in subsection (1) has or may have occurred; or

the circumstances referred to in subsection (1) have or may have arisen;

then, as soon as practicable after becoming aware, the entity must notify the Information Commissioner.

If an entity has given notice under subsection (2) or (3) on becoming aware that the contravention, event or circumstances may have occurred or arisen then, despite subsection (2) or (3), the entity need not give notice again on becoming aware that the contravention, event or circumstances has occurred or arisen.

Steps to be taken if contravention, event or circumstances may have occurred or arisen

The entity must, as soon as practicable after becoming aware that the contravention, event or circumstances may have occurred or arisen, do the following things:

so far as is reasonably practicable contain the potential contravention, event or circumstances;

evaluate any risks that, if the contravention, event or circumstances has occurred or arisen, may be related to or arise out of the contravention, event or circumstances;

if there is a reasonable likelihood that the contravention, event or circumstance has occurred or arisen and the effects of the contravention, event or circumstances might be serious for at least one healthcare recipient:

if the entity is not the System Operator—ask the System Operator to notify all healthcare recipients that would be affected; or

if the entity is the System Operator—notify all healthcare recipients that would be affected.

Note: A contravention of this subsection is not a civil penalty provision. However, contraventions of this Act may have other consequences (for example, cancellation of registration).

Steps to be taken if contravention or event has occurred or the circumstances have arisen

The entity must, as soon as practicable after becoming aware that the contravention or event has occurred or the circumstances have arisen, do the following things:

so far as is reasonably practicable, contain the contravention, event or circumstances and undertake a preliminary assessment of the causes;

evaluate any risks that may be related to or arise out of the contravention, event or circumstances;

if the entity is the System Operator:

notify all affected healthcare recipients; and

if a significant number of healthcare recipients are affected, notify the general public;

if the entity is not the System Operator—ask the System Operator:

to notify all affected healthcare recipients; and

if a significant number of healthcare recipients are affected, to notify the general public;

take steps to prevent or mitigate the effects of further contraventions, events or circumstances described in paragraph (1)(b).

Note: A contravention of this subsection is not a civil penalty provision. However, contraventions of this Act may have other consequences (for example, cancellation of registration).

If an entity has given notice, or requested that the System Operator give notice, under paragraph (5)(c) then, despite paragraphs (6)(c) and (d), the entity need not give notice or request the System Operator to give notice under paragraphs (6)(c) and (d).

The System Operator must comply with a request under paragraph (5)(c) or (6)(d).

76 Requirement to notify if cease to be eligible to be registered

A registered healthcare provider organisation, a registered repository operator, a registered portal operator or a registered contracted service provider must give written notice to the System Operator within 14 days of ceasing to be eligible to be so registered.

Civil penalty: 1,500 penalty units.

76A Requirement to notify if healthcare provider organisation ceases to be able to meet conditions on registration

A registered healthcare provider organisation must give written notice to the System Operator within 14 days of ceasing to be able to comply with the conditions of the healthcare provider organisation’s registration.

Civil penalty: 1,500 penalty units.

77 Requirement not to hold or take records outside Australia 1

The System Operator, a registered repository operator, a registered portal operator or a registered contracted service provider that holds records for the purposes of the My Health Record system (whether or not the records are also held for other purposes) or has access to information relating to such records, must not:

hold the records, or take the records, outside Australia; or

process or handle the information relating to the records outside Australia; or

cause or permit another person:

to hold the records, or take the records, outside Australia; or

to process or handle the information relating to the records outside Australia.

Despite subsection (1), the System Operator is authorised, for the purposes of the operation or administration of the My Health Record system:

to hold and take such records outside Australia, provided that the records do not include:

personal information in relation to a healthcare recipient or a participant in the My Health Record system; or

identifying information of an individual or entity; and

to process and handle such information outside Australia, provided that the information is neither of the following:

personal information in relation to a healthcare recipient or a participant in the My Health Record system;

identifying information of an individual or entity.

Fault-based offence

A person commits an offence if the person contravenes subsection (1).

Penalty: Imprisonment for 5 years or 300 penalty units, or both.

Note: Where a fault element for a physical element of an offence is not stated, see Criminal Code for the appropriate fault element.section 5.6 of the

Civil penalty

A person is liable to a civil penalty if the person contravenes subsection (1).

Civil penalty: 1,500 penalty units.

This section does not limit the operation of section 99.

77A Enforceable requirements in My Health Records Rules must not be contravened: offence 1

An entity commits an offence if:

the entity does an act or omits to do an act; and

the result is that the entity contravenes a requirement imposed on the entity by My Health Records Rules made for the purposes of subsection 109(7A) and the entity is reckless as to that result; and

the My Health Records Rules provide that the requirement is enforceable for the purposes of this paragraph; and

the entity is not the System Operator, the Data Governance Board established by section 82 or the data custodian.

Penalty: 100 penalty units.

Strict liability applies to paragraphs (1)(c) and (d).

Note: For strict liability, see Criminal Code.section 6.1 of the

78 My Health Records Rules must not be contravened: civil penalty 1

A person that is, or has at any time been:

a registered healthcare provider organisation; or

a registered repository operator; or

a registered portal operator; or

a registered contracted service provider;

must not contravene a My Health Records Rule that applies to the person.

Civil penalty: 100 penalty units.

An entity (other than the System Operator, the Data Governance Board established by section 82 or the data custodian) must not contravene a requirement imposed on the entity by My Health Records Rules made for the purposes of subsection 109(7A), if the My Health Records Rules provide that the requirement is enforceable for the purposes of this subsection.

Civil penalty: 100 penalty units.

78A Some information must be shared with the My Health Record system unless exception applies

Civil penalties

If:

a prescribed healthcare provider organisation is:

a registered healthcare provider organisation; or

an approved registered repository operator; and

healthcare of a kind specified in the My Health Records Rules for the healthcare provider organisation is provided to a healthcare recipient;

the healthcare provider organisation must share with the My Health Record system within the period specified in the My Health Records Rules the information specified in the My Health Records Rules for the kind of healthcare.

Civil penalty: 30 penalty units.

If:

a prescribed healthcare provider organisation is:

a registered healthcare provider organisation; or

an approved registered repository operator; and

a record of a kind specified in the My Health Records Rules for the healthcare provider organisation is created in relation to healthcare provided to a healthcare recipient;

Exceptions

Civil penalty: 30 penalty units.

Subsections (1) and (2) do not apply if:

an upload exception applies in relation to the healthcare provider organisation sharing the information with the My Health Record system; or

another entity has shared the information with the My Health Record system; or

a law of a State or Territory prescribed by the regulations for the purposes of subsection 41(4) or subclause 9(3) of Schedule 1 prevents the healthcare provider organisation from sharing the information with the My Health Record system; or

the information is specified in the My Health Records Rules; or

the healthcare provider organisation is specified in the My Health Records Rules; or

the period within which the information is required to be shared with the My Health Record system ends:

during any upload suspension period determined under subsection (4); or

during the period starting when the healthcare provider organisation applies to the System Operator under section 78B and ending when the application is finally determined; or

iii

during a period approved by the System Operator under section 78B in relation to the healthcare provider organisation; or

(iv) during the period starting when the healthcare provider organisation applies to the System Operator under Health Insurance Act 1973 and ending when the application is resolved (within the meaning of that Act); orsection 19AE of the

(v) during a period approved by the System Operator under Health Insurance Act 1973 in relation to the healthcare provider organisation.section 19AE of the

Note 1: For when an upload exception applies, see section 10B.

Note 2: A person who wishes to rely on subsection (3) in proceedings for a civil penalty order bears an evidential burden in relation to the matters in that subsection: see section 96 of the Regulatory Powers Act.

The Secretary of the Department may, by legislative instrument, determine that a period is an upload suspension period.

(5) Without limiting this section or subsection 33(3A) of the Acts Interpretation Act 1901, the My Health Records Rules made for the purposes of subsections (1) and (2) may specify different periods for different healthcare provider organisations or different kinds of healthcare or record.

78B System Operator may approve a period during which sharing with the My Health Record system is not required

Application

A prescribed healthcare provider organisation may apply to the System Operator to approve a period during which the healthcare provider organisation is not required to share information with the My Health Record system.

The application must:

be in the approved form; and

include, or be accompanied by, the information and documents required by the form; and

be lodged at a place, or by a means, specified in the form.

Further information may be required

If a prescribed healthcare provider organisation makes an application under subsection (1), the System Operator may, by notice in writing, require the healthcare provider organisation to give the System Operator, within the period specified in the notice, such further information in relation to the application as the System Operator requires.

Approval by System Operator

On application under subsection (1) or on the System Operator’s initiative, the System Operator may, by written notice to a prescribed healthcare provider organisation, approve a period during which the healthcare provider organisation is not required to share information with the My Health Record system.

In deciding whether to approve the period, the System Operator must take into account the following:

the healthcare provider organisation’s size and technological readiness;

the potential disruption (if any) to the provision of healthcare if the healthcare provider organisation does not share information with the My Health Record system;

any other matter the System Operator considers relevant.

An approval under subsection (5) is not a legislative instrument.

78C Record keeping requirements in relation to sharing information with the My Health Record system

Requirement to keep evidence of upload exceptions

If:

a prescribed healthcare provider organisation is:

a registered healthcare provider organisation; or

an approved registered repository operator; and

either:

healthcare of a kind specified in the My Health Records Rules for the purposes of subsection 78A(1) for the healthcare provider organisation is provided to a healthcare recipient; or

a record of a kind specified in the My Health Records Rules for the purposes of subsection 78A(2) for the healthcare provider organisation is created in relation to healthcare provided to a healthcare recipient; and

an upload exception applies in relation to the healthcare provider organisation sharing information about the healthcare with the My Health Record system;

the healthcare provider organisation must keep for a period of 2 years starting on the date the healthcare is provided evidence that an upload exception applied that meets the requirements (if any) specified in the My Health Records Rules.

Civil penalty: 10 penalty units.

Subsection (1) does not apply if the healthcare provider organisation has a reasonable excuse.

Note: A person who wishes to rely on subsection (2) in proceedings for a civil penalty order bears an evidential burden in relation to the matter in that subsection: see section 96 of the Regulatory Powers Act.

Requirement to produce evidence when required

The System Operator or the Secretary of the Department may, by written notice given to a healthcare provider organisation, require the healthcare provider organisation to produce to the System Operator or the Secretary of the Department, within the period and in the manner specified in the notice, evidence kept by the healthcare provider organisation under subsection (1).

A healthcare provider organisation must comply with a requirement under subsection (3).

Civil penalty: 10 penalty units.

Handling of evidence produced

The System Operator or the Secretary of the Department may make and retain copies of, or take and retain extracts from, any evidence produced under this section.

The System Operator or the Secretary of the Department may take, and retain for as long as is necessary, possession of evidence produced under this section.

The person otherwise entitled to possession of the evidence is entitled to be supplied, as soon as practicable, with a copy certified by the System Operator or the Secretary of the Department to be a true copy.

The certified copy must be received in all courts and tribunals as evidence as if it were the original.

Until a certified copy is supplied, the System Operator or the Secretary of the Department must, at such times and places as the System Operator or the Secretary of the Department thinks appropriate, permit the person otherwise entitled to possession of the evidence, or a person authorised by that person, to inspect and make copies of, or take extracts from, the evidence.

78D Prescribed healthcare provider organisations must display notice when not sharing information with the My Health Record system 1

A prescribed healthcare provider organisation must display a notice in accordance with subsection (2) during the following periods:

a period for which the healthcare provider organisation is not a registered healthcare provider organisation and is not an approved registered repository operator;

a period starting when the healthcare provider organisation applies to the System Operator under section 78B and ending when the application is finally determined;

a period approved by the System Operator under section 78B in relation to the healthcare provider organisation;

(d) a period starting when the healthcare provider organisation applies to the System Operator under Health Insurance Act 1973 and ending when the application is resolved (within the meaning of that Act);section 19AE of the

(e) a period approved by the System Operator under Health Insurance Act 1973 in relation to the healthcare provider organisation.section 19AE of the

Civil penalty: 10 penalty units.

The notice must:

indicate that the healthcare provider organisation is not currently sharing information with the My Health Record system; and

if paragraph (1)(a) applies—indicate that medicare benefits will not be payable in respect of healthcare covered by subsection (3); and

be displayed in a prominent place:

at each of the healthcare provider organisation’s premises where healthcare covered by subsection (3) is provided; and

on the healthcare provider organisation’s website; and

iii

on any online facility the healthcare provider organisation uses to allow healthcare recipients to arrange bookings for healthcare covered by subsection (3).

For the purposes of subsection (2), this subsection covers:

healthcare of a kind (if any) specified for the purposes of subsection 78A(1) for the healthcare provider organisation; and

healthcare to which records of a kind (if any) specified for the purposes of subsection 78A(2) for the healthcare provider organisation relate.

6 Enforcement 1 Civil penalties

79 Civil penalty provisions

Enforceable civil penalty provisions

Each civil penalty provision of this Act is enforceable under Part 4 of the Regulatory Powers Act.

Note: Part 4 of the Regulatory Powers Act allows a civil penalty provision to be enforced by obtaining an order for a person to pay a pecuniary penalty for the contravention of the provision.

Authorised applicant

For the purposes of Part 4 of the Regulatory Powers Act, each person mentioned in column 1 of an item of the following table is an authorised applicant in relation to a provision mentioned in column 2 of the item:

Authorised applicants	Authorised applicants	Authorised applicants
Item	Column 1 Authorised applicant	Column 2 Provisions
1	Information Commissioner	(a) subsection 59(1); (b) subsection 59(2); (c) subsection 59(4); (d) subsection 59A(1); (da) subsection 59A(1A); (e) subsection 60(1); (f) subsection 60(4); (g) subsection 71B(1); (h) subsection 74(1); (i) subsection 75(2); (j) subsection 77(1); (k) subsection 77(2B); (l) subsection 78(1); (m) subsection 78(2); (n) a civil penalty provision of the regulations.
2	Secretary of the Department	(a) subsection 41A(1); (b) section 76; (c) section 76A; (d) subsection 78A(1); (e) subsection 78A(2); (f) subsection 78C(1); (g) subsection 78C(4); (h) subsection 78D(1).

The Secretary of the Department may, in writing, delegate the Secretary’s powers and functions under Part 4 of the Regulatory Powers Act in relation to the provisions mentioned in item 2 of the table in subsection (2) to an SES employee, or acting SES employee, in the Department.

A person exercising powers or performing functions under a delegation under subsection (2A) must comply with any directions of the Secretary of the Department.

Relevant court

For the purposes of Part 4 of the Regulatory Powers Act, each of the following courts is a relevant court in relation to the civil penalty provisions of this Act:

the Federal Court of Australia;

the Federal Circuit and Family Court of Australia (Division 2);

a court of a State or Territory that has jurisdiction in relation to the matter.

Extension to external Territories

Part 4 of the Regulatory Powers Act, as that Part applies in relation to the civil penalty provisions of this Act, extends to every external Territory.

Liability of the Crown

Part 4 of the Regulatory Powers Act, as that Part applies in relation the civil penalty provisions of this Act, does not make the Crown liable to a pecuniary penalty.

1A Infringement notices

79A Infringement notices

Provisions subject to an infringement notice

The following provisions are subject to an infringement notice under Part 5 of the Regulatory Powers Act:

subsection 41A(1);

subsection 78C(4);

subsection 78D(1).

Note: Part 5 of the Regulatory Powers Act creates a framework for using infringement notices in relation to provisions.

Infringement officer

For the purposes of Part 5 of the Regulatory Powers Act, an SES employee, or acting SES employee, in the Department authorised, in writing, by the Secretary of the Department for the purposes of this subsection is an infringement officer in relation to the provisions mentioned in subsection (1).

Relevant chief executive

For the purposes of Part 5 of the Regulatory Powers Act, the Secretary of the Department is the relevant chief executive in relation to the provisions mentioned in subsection (1).

The relevant chief executive may, in writing, delegate the relevant chief executive’s powers and functions under Part 5 of the Regulatory Powers Act in relation to the provisions mentioned in subsection (1) to an SES employee, or acting SES employee, in the Department.

A person exercising powers or performing functions under a delegation under subsection (4) must comply with any directions of the relevant chief executive.

Extension to external Territories

Part 5 of the Regulatory Powers Act, as that Part applies in relation to the provisions mentioned in subsection (1), extends to every external Territory.

2 Enforceable undertakings

80 Enforceable undertakings

Enforceable provisions

This Act is enforceable under Part 6 of the Regulatory Powers Act.

Note: Part 6 of the Regulatory Powers Act creates a framework for accepting and enforcing undertakings relating to compliance with provisions.

Authorised person

For the purposes of Part 6 of the Regulatory Powers Act, each of the following persons is an authorised person in relation to the provisions of this Act:

the System Operator;

the Information Commissioner;

the Secretary of the Department.

Relevant court

For the purposes of Part 6 of the Regulatory Powers Act, each of the following courts is a relevant court in relation to the provisions of this Act:

the Federal Court of Australia;

the Federal Circuit and Family Court of Australia (Division 2);

a court of a State or Territory that has jurisdiction in relation to the matter.

Enforceable undertaking may be published on website

An authorised person in relation to a provision of this Act may publish an undertaking given in relation to the provision on the authorised person’s website.

Extension to external Territories

Part 6 of the Regulatory Powers Act, as that Part applies in relation to the provisions of this Act, extends to every external Territory.

3 Injunctions

81 Injunctions

Enforceable provisions

This Act is enforceable under Part 7 of the Regulatory Powers Act.

Note: Part 7 of the Regulatory Powers Act creates a framework for using injunctions to enforce provisions.

Authorised person

For the purposes of Part 7 of the Regulatory Powers Act, each of the following persons is an authorised person in relation to the provisions of this Act:

the System Operator;

the Information Commissioner;

the Secretary of the Department.

Relevant court

For the purposes of Part 7 of the Regulatory Powers Act, each of the following courts is a relevant court in relation to the provisions of this Act:

the Federal Court of Australia;

the Federal Circuit and Family Court of Australia (Division 2);

a court of a State or Territory that has jurisdiction in relation to the matter.

Extension to external Territories

Part 7 of the Regulatory Powers Act, as that Part applies in relation to the provisions of this Act, extends to every external Territory.

7 Data Governance Board 1 Establishment and functions

82 Data Governance Board

The Data Governance Board is established by this section.

83 Functions of the Board 1

The functions of the Data Governance Board are:

to oversee the operation of the framework prescribed by My Health Records Rules made for the purposes of subsection 109(7A), including by:

assessing applications for the collection, use or disclosure of de-identified data and health information for research or public health purposes; and

guiding and directing the System Operator in the performance of its function under paragraph 15(ma) (preparing and providing de-identified data and health information); and

iii

taking steps to ensure the ongoing protection of de-identified data and health information used by, or disclosed to, persons for research or public health purposes and that the data and information is being used and disclosed only for those purposes; and

any other functions conferred on the Board by this Act or the My Health Records Rules.

The Board does not have any functions, and must not perform any role, in relation to the day-to-day operation of the My Health Record system.

2 Membership

84 Membership

The Data Governance Board consists of the following members:

the Chair of the Data Governance Board;

the Deputy Chair of the Data Governance Board;

at least 7, and no more than 10, other members.

85 Appointment of members 1

Members are to be appointed by the Minister by written instrument, on a part-time basis.

The Minister must appoint one member to be the Chair and another member to be the Deputy Chair.

86 Qualifications and experience 1

The Minister must appoint the following as members:

a person who represents the System Operator;

a person who represents the data custodian;

a person who is an Aboriginal person or a Torres Strait Islander.

A person (including a person appointed in accordance with subsection (1)) is not eligible for appointment as a member of the Data Governance Board unless the person has skills or experience in, or knowledge of, one or more of the following fields:

population health and epidemiology;

medical or health research;

health services delivery;

technology;

data science;

data governance;

privacy;

consumer advocacy.

87 Acting appointments 1

The Minister may, by written instrument, appoint a person to act as the Chair:

during a vacancy in the office of Chair (whether or not an appointment has previously been made to the office); or

during any period, or during all periods, when the Chair:

is absent from duty or from Australia; or

is, for any reason, unable to perform the duties of the office.

Note: For rules that apply to acting appointments, see sections 33AB and 33A of the Acts Interpretation Act 1901.

The Minister may, by written instrument, appoint a person to act as the Deputy Chair:

during a vacancy in the office of Deputy Chair (whether or not an appointment has previously been made to the office); or

during any period, or during all periods, when the Deputy Chair:

is absent from duty or from Australia; or

is, for any reason, unable to perform the duties of the office.

Note: For rules that apply to acting appointments, see sections 33AB and 33A of the Acts Interpretation Act 1901.

88 Term of appointment and other terms and conditions 1

A member of the Data Governance Board holds office for the period specified in the instrument of appointment. The period must not exceed 5 years.

A member of the Data Governance Board holds office on the terms and conditions (if any) in relation to matters not covered by this Part that are determined by the Minister.

89 Remuneration 1

A member of the Data Governance Board is to be paid the remuneration that is determined by the Remuneration Tribunal. If no determination of that remuneration by the Tribunal is in operation, the member is to be paid the remuneration that is prescribed by an instrument made under subsection (4).

A member is to be paid the allowances that are prescribed by an instrument made under subsection (4).

(3) This section has effect subject to the Remuneration Tribunal Act 1973.

The Minister may, by legislative instrument, prescribe:

remuneration for the purposes of subsection (1); and

allowances for the purposes of subsection (2).

90 Resignation 1

A member of the Data Governance Board may resign the member’s appointment by giving the Minister a written resignation.

The resignation takes effect on the day it is received by the Minister or, if a later day is specified in the resignation, on that later day.

91 Termination of appointment 1

The Minister may terminate the appointment of a member of the Data Governance Board:

for misbehaviour; or

if the member is unable to perform the duties of the member’s office because of physical or mental incapacity.

The Minister may terminate the appointment of a member of the Data Governance Board if:

the member:

becomes bankrupt; or

applies to take the benefit of any law for the relief of bankrupt or insolvent debtors; or

iii

compounds with the member’s creditors; or

makes an assignment of the member’s remuneration for the benefit of the member’s creditors; or

the member is absent, except on leave of absence, from 3 consecutive meetings of the Board; or

the member engages in paid work (the Minister’s opinion, conflicts or could conflict with the proper performance of the member’s duties (see section 93); orwithin the meaning of section 93) that, in

(d) the member fails, without reasonable excuse, to comply with Public Governance, Performance and Accountability Act 2013 (which deals with the duty to disclose interests) or rules made for the purposes of that section.section 29 of the

92 Leave of absence

The Minister may grant leave of absence to any member of the Data Governance Board on the terms and conditions that the Minister determines.

93 Other paid work 1

A member of the Data Governance Board must not engage in any paid work that, in the Minister’s opinion, conflicts or could conflict with the proper performance of the member’s duties.

In subsection (1):

paid work means work for financial gain or reward (whether as an employee, a self-employed person or otherwise).

3 Meetings of the Data Governance Board

94 Convening meetings 1

The Data Governance Board must hold such meetings as are necessary for the efficient performance of its functions.

The Chair of the Data Governance Board:

may convene a meeting at any time; and

must convene a meeting within 30 days after receiving a written request to do so from another member of the Board.

95 Presiding at meetings 1

(1) The Chair of the Data Governance Board must preside at all meetings at which the Chair is present.

(2) If the Chair is not present at a meeting at which the Deputy Chair is present, the Deputy Chair must preside.

If neither the Chair nor the Deputy Chair is present at a meeting, the other members present must appoint one of themselves to preside.

96 Quorum 1

At a meeting of the Data Governance Board, a quorum is constituted by a majority of members of the Board.

However, if:

(a) a member of the Board is required by rules made for the purposes of Public Governance, Performance and Accountability Act 2013 not to be present during the deliberations, or to take part in any decision, of the Board with respect to a particular matter; andsection 29 of the

when the member leaves the meeting concerned there is no longer a quorum present;

the remaining members at the meeting constitute a quorum for the purpose of any deliberation or decision at that meeting with respect to that matter.

96A Voting at meetings 1

A question arising at a meeting of the Data Governance Board is to be determined by a majority of the votes of the members of the Board present and voting.

The person presiding at a meeting of the Board has a deliberative vote and, if the votes are equal, a casting vote.

96B Conduct of meetings

The Data Governance Board may, subject to this Division, regulate proceedings at its meetings as it considers appropriate.

Note: Section 33B of the Acts Interpretation Act 1901 contains further information about the ways in which members of the Board may participate in meetings.

96C Minutes

The Data Governance Board must keep minutes of its meetings.

96D Decisions without meetings 1

The Data Governance Board is taken to have made a decision at a meeting if:

without meeting, a majority of the members of the Board entitled to vote on the proposed decision indicate agreement with the decision; and

that agreement is indicated in accordance with the method determined by the Board under subsection (2); and

(c) all the members were informed of the proposed decision, or reasonable efforts were made to inform all the members of the proposed decision.

Subsection (1) applies only if the Board:

has determined that it may make decisions of that kind without meeting; and

has determined the method by which members are to indicate agreement with proposed decisions.

(3) For the purposes of paragraph (1)(a), a member is not entitled to vote on a proposed decision if the member would not have been entitled to vote on that proposal if the matter had been considered at a meeting of the Board.

The Board must keep a record of decisions made in accordance with this section.

Note: Section 33B of the Acts Interpretation Act 1901 contains further information about the ways in which members of the Board may participate in meetings.

4 Other matters relating to the Data Governance Board

96E Relationship between System Operator and Data Governance Board in relation to data for research or public health purposes 1

In performing the function mentioned in paragraph 15(ma), the System Operator must comply with a direction from, and follow the guidance of, the Data Governance Board.

If rules made for the purposes of subsection 109(7A) require the Data Governance Board to take steps to ensure that de-identified data and health information disclosed to persons for research or public health purposes is being used only for those purposes, the System Operator must not take any steps of its own to ensure that the data and information is being used only for those purposes.

Subsection (2) does not imply that the System Operator has a duty to take steps in relation to use of data and information at a time when there are no rules of the kind mentioned in subsection (2).

96F Board committees 1

The Data Governance Board may establish a committee or committees to assist in carrying out the functions of the Board.

The Board may dissolve a committee at any time.

The functions of a committee are as determined by the Board.

In performing its functions, a committee must comply with any directions given to the committee by the Board.

A question arising at a meeting of a committee is to be determined by a majority of the votes of committee members present.

A committee must inform the other members of the Board of its decisions.

A committee may regulate proceedings at its meetings as it considers appropriate.

A committee must ensure that minutes of its meetings are kept.

96G Delegation of functions 1

If the Secretary of the Department consents to the Data Governance Board delegating functions to APS employees in the Department, the Board may delegate any or all of its functions to such an APS employee.

Note: Sections 34AA to 34A of the Acts Interpretation Act 1901 contain provisions relating to delegations.

(2) If the chief executive officer (however described) of the data custodian consents to the Board delegating functions to members of the staff mentioned in subsection 19(1) of the Australian Institute of Health and Welfare Act 1987, the Board may delegate all or any of its functions to such a member of staff.

Note: Sections 34AA to 34A of the Acts Interpretation Act 1901 contain provisions relating to delegations.

In performing a delegated function or exercising a delegated power, the delegate must comply with any written directions of the Board.

The delegation continues in force despite a change in the membership of the Board.

The delegation may be varied or revoked by the Board (whether or not there has been a change in the membership of the Board).

96H Annual report 1

As soon as practicable after the end of each financial year, the Data Governance Board must prepare and give a report to the Minister, for presentation to the Parliament, on the Board’s activities during the financial year.

Note: See also Acts Interpretation Act 1901, which contains extra rules about annual reports.section 34C of the

(2) A report on the Department’s activities given under Public Governance, Performance and Accountability Act 2013 does not need to include a report on the activities of the Board.section 46 of the

96J Board is part of the Department

For the purposes of paragraph (a) of the definition of Department of State in section 8 of the Public Governance, Performance and Accountability Act 2013, the Data Governance Board is prescribed in relation to the Department.

8 Other matters 1 Review of decisions

97 Review of decisions 1

This section applies to the following decisions of the System Operator:

a decision under section 6 that a person is or is not the authorised representative of a healthcare recipient;

a decision under section 41 to refuse to register a healthcare recipient;

a decision under section 41B to refuse an application to approve a period;

a decision under section 44 to refuse to register a healthcare provider organisation or to impose a condition on such a registration;

a decision under section 49 to refuse to register a person as:

a repository operator; or

a portal operator; or

iii

a contracted service provider;

or to impose a condition on such a registration;

a decision under section 49 to refuse to specify a repository as a repository to which the registration of a repository operator relates;

a decision under section 51 to cancel or suspend the registration of a healthcare recipient or other entity;

a decision under section 51 to refuse to cancel or suspend the registration of a healthcare recipient or other entity on request;

a decision under section 52 to vary the registration of a healthcare recipient or other entity on request;

a decision under section 52 to refuse to vary the registration of a healthcare recipient or other entity;

a decision under section 78B to refuse an application to approve a period.

The System Operator must take such steps as are reasonably necessary in the circumstances to give written notice of the decision to each person affected by the decision, including a statement:

that the person may apply to the System Operator to reconsider the decision; and

of the person’s rights to seek review under subsection (8) of a reconsidered decision.

However, the System Operator is not required to give notice of the decision to a person if the System Operator is satisfied that doing so would put at risk the life, health or safety of a person.

A failure of the System Operator to comply with subsection (2) does not affect the validity of the decision.

A person who is given a written notice under subsection (2) may, by written notice given to the System Operator within 28 days after receiving the notice, ask the System Operator to reconsider the decision.

A request under subsection (4) must mention the reasons for making the request.

The System Operator must:

reconsider the decision within 28 days after receiving the request; and

give to the person who requested the reconsideration written notice of the result of the reconsideration and of the grounds for the result.

The notice must include a statement that the person may apply to the Administrative Review Tribunal for review of the reconsideration.

A person may apply to the Administrative Review Tribunal for review of a decision of the System Operator made under subsection (6).

2 Delegations

98 Delegations by the System Operator 1

The System Operator may, by writing, delegate one or more of his or her functions and powers to any of the following:

an APS employee in the Department;

the Chief Executive Medicare.

Despite subsection (1), the System Operator must not delegate the function referred to in paragraph 15(l) (advising the Minister).

If the System Operator is not the Secretary, the System Operator may only delegate a function or power of the System Operator:

to an APS employee in the Department—with the agreement of the Secretary; and

to the Chief Executive Medicare—with the agreement of the Chief Executive Medicare.

Each of the following must comply with any written directions of the System Operator:

a delegate;

(b) if the Chief Executive Medicare delegates under subsection 8AC(3) of the Human Services (Medicare) Act 1973 a function delegated to him or her under this section—a subdelegate.

3 Authorisations of entities also cover employees

99 Authorisations extend to employees etc.

An authorisation under this Act to an entity (the first entity) is also an authorisation of:

an individual:

who is an employee of the first entity; and

whose duties involve doing an act that is authorised in relation to the first entity; or

an individual healthcare provider, if:

the first entity is a registered healthcare provider organisation; and

the first entity provides services or facilities to the individual healthcare provider, to facilitate the provision of healthcare by the individual healthcare provider; or

a contracted service provider of a healthcare provider whose duties under a contract with a healthcare provider involve providing information technology services relating to the communication of health information, or health information management services, to the healthcare provider; or

(c) a person (the contractor) performing services under a contract between the contractor and the first entity, if:

the first entity is a participant in the My Health Record system, other than a registered healthcare provider organisation or a registered contracted service provider; and

the contract relates to the My Health Record system; or

(ca) a person (the subcontractor) performing services under a contract between the subcontractor and another person (the contractor), if:

the first entity is the System Operator or the operator of the National Repositories Service; and

the first entity has a contract with the contractor; and

iii

the contract between the subcontractor and the contractor relates to the My Health Record system; or

an individual:

who is an employee of a contracted service provider to which paragraph (b) applies or a person to whom paragraph (c) or (ca) applies; and

whose duties relate to the relevant contract mentioned in whichever of those paragraphs applies.

4 Treatment of certain entities

100 Treatment of partnerships 1

This Act applies to a partnership as if it were a person, but with the changes set out in this section.

An obligation that would otherwise be imposed on the partnership by this Act is imposed on each partner instead, but may be discharged by any of the partners.

An offence against this Act that would otherwise have been committed by the partnership is taken to have been committed by each partner in the partnership, at the time the offence was committed, who:

did the relevant act or made the relevant omission; or

aided, abetted, counselled or procured the relevant act or omission; or

was in any way knowingly concerned in, or party to, the relevant act or omission (whether directly or indirectly and whether by any act or omission of the partner).

This section applies to a contravention of a civil penalty provision in a corresponding way to the way in which it applies to an offence.

101 Treatment of unincorporated associations 1

This Act applies to an unincorporated association as if it were a person, but with the changes set out in this section.

An obligation that would otherwise be imposed on the unincorporated association by this Act is imposed on each member of the association’s committee of management instead, but may be discharged by any of the members.

An offence against this Act that would otherwise have been committed by the unincorporated association is taken to have been committed by each member of the association’s committee of management, at the time the offence was committed, who:

did the relevant act or made the relevant omission; or

aided, abetted, counselled or procured the relevant act or omission; or

was in any way knowingly concerned in, or party to, the relevant act or omission (whether directly or indirectly and whether by any act or omission of the member).

This section applies to a contravention of a civil penalty provision in a corresponding way to the way in which it applies to an offence.

102 Treatment of trusts with multiple trustees 1

If a trust has 2 or more trustees, this Act applies to the trust as if it were a person, but with the changes set out in this section.

An obligation that would otherwise be imposed on the trust by this Act is imposed on each trustee instead, but may be discharged by any of the trustees.

An offence against this Act that would otherwise have been committed by the trust is taken to have been committed by each trustee of the trust, at the time the offence was committed, who:

did the relevant act or made the relevant omission; or

aided, abetted, counselled or procured the relevant act or omission; or

was in any way knowingly concerned in, or party to, the relevant act or omission (whether directly or indirectly and whether by any act or omission of the trustee).

This section applies to a contravention of a civil penalty provision in a corresponding way to the way in which it applies to an offence.

104 Division does not apply to Division 3 of Part 3

This Division does not have effect for the purposes of Division 3 of Part 3.

Note: An applicant for registration under that Division must be a legal person.

5 Alternative constitutional bases

105 Alternative constitutional bases 1

Without limiting its effect apart from each of the following subsections of this section, this Act also has effect as provided by that subsection.

This Act also has the effect it would have if the System Operator, Data Governance Board and data custodian were expressly permitted to perform functions and duties, and exercise powers, under this Act only:

in connection with:

the provision of pharmaceutical, sickness or hospital benefits; or

the provision of medical services or dental services (without any form of civil conscription); or

for purposes relating to census or statistics; or

in relation to a Territory or a place acquired by the Commonwealth for a public purpose.

This Act also has the effect it would have if each reference to collection, use or disclosure of de-identified data or health information were expressly confined to collection, use or disclosure of de-identified data or health information:

in connection with trade or commerce:

between Australia and other countries; or

among the States; or

iii

between a Territory and a State or another Territory; or

by means of a postal, telegraphic, telephonic or other like service; or

in connection with insurance, other than State insurance that does not extend beyond the limits of the State concerned; or

in connection with:

the provision of pharmaceutical, sickness or hospital benefits; or

the provision of medical services or dental services (without any form of civil conscription); or

for purposes relating to census or statistics; or

in a Territory or a place acquired by the Commonwealth for a public purpose; or

in relation to a matter that is of international concern.

This Act also has the effect it would have if each reference to collection, use or disclosure of de-identified data or health information were expressly confined to collection from or by, use by or disclosure by or to:

a corporation to which paragraph 51(xx) of the Constitution applies; or

the Commonwealth; or

an authority of the Commonwealth.

This Act also has the effect it would have if each reference to a registered healthcare provider organisation, registered repository operator, registered portal provider or contracted service provider were expressly confined to a reference to a registered healthcare provider organisation, registered repository operator, registered portal provider or contracted service provider that:

is a corporation to which paragraph 51(xx) of the Constitution applies; or

is the Commonwealth; or

is an authority of the Commonwealth; or

is operating in a Territory or a place acquired by the Commonwealth for a public purpose.

This Act also has the effect it would have if its operation in relation to each of the following were expressly confined to an operation for the purposes of giving effect to Australia’s obligations under an agreement between 2 or more countries:

the System Operator;

the Data Governance Board;

the data custodian;

the Chief Executive Medicare;

the Chief Executive Officer of Services Australia;

the Secretary of the Veterans’ Affairs Department or the Defence Department;

a registered healthcare provider organisation;

a registered repository operator;

a registered portal provider;

a contracted service provider;

a healthcare recipient.

This Act also has the effect it would have if each reference to a healthcare recipient were expressly confined to a reference to a healthcare recipient who is:

an alien; or

a resident of a Territory.

Definitions

A term used in this section and the Constitution has the same meaning in this section as it has in the Constitution.

6 Annual reports and review of Act

106 Annual reports by Information Commissioner 1

The Information Commissioner must, as soon as practicable after the end of each financial year, prepare a report on the Commissioner’s activities during the financial year relating to the My Health Record system.

The report must include:

statistics of the following:

complaints received by the Commissioner in relation to the My Health Record system;

investigations made by the Commissioner in relation to My Health Records or the My Health Record system;

iii

enforceable undertakings accepted by the Commissioner under this Act;

proceedings taken by the Commissioner in relation to civil penalty provisions, enforceable undertakings or injunctions; and

any other matter prescribed by the regulations.

The Information Commissioner must give a copy of the report to the Minister, and to the Ministerial Council, no later than 30 September after the end of the financial year to which the report relates.

The Minister must table a copy of the report in each House of the Parliament within 15 sitting days after the Information Commissioner gives a copy of the report to the Minister.

107 Annual reports by the System Operator

The System Operator must include in any annual report prepared by the System Operator and given to the Minister under Public Governance, Performance and Accountability Act 2013:section 46 of the

statistics of the following:

registrations, and cancellations and suspensions of registrations, under this Act;

use of the My Health Record system by healthcare providers and healthcare recipients;

iii

complaints received, and investigations undertaken, in relation to the My Health Record system;

occurrences compromising the integrity or security of the My Health Record system;

enforceable undertakings accepted by the System Operator under this Act;

proceedings taken by the System Operator in relation to enforceable undertakings or injunctions; and

any other matter prescribed by the regulations.

108 Review of the operation of the Act 1

The Minister must, after consulting the Ministerial Council, appoint an individual to review the operation of this Act.

The individual appointed must give a report to the Minister within the later of:

(a) 3 years after the commencement of Schedule 1 to the Health Legislation Amendment (eHealth) Act 2015; or

(b) if the Minister makes My Health Records Rules under clause 2 of Schedule 1 to this Act within 3 years after the commencement of Schedule 1 to the Health Legislation Amendment (eHealth) Act 2015—3 years after the day on which the Rules are made.

The Minister must:

provide a copy of the report to the Ministerial Council; and

table a copy of the report in each House of Parliament within 15 sitting days after the report is given to the Minister.

7 My Health Records Rules, regulations and other instruments

109 Minister may make My Health Records Rules 1

(1) The Minister may, by legislative instrument, make rules called the My Health Records Rules about matters required or permitted by this Act to be dealt with in the My Health Records Rules.

Consultation

Before the Minister makes My Health Records Rules, the Minister must consult:

the System Operator; and

the Health Chief Executives Forum.

A failure to consult does not affect the validity of the Rules.

My Health Records Rules may relate to registration etc.

The My Health Records Rules may specify the following:

requirements that a healthcare provider organisation must meet in order to be registered;

requirements that a person, or a repository or other facility (however described) owned or operated by the person, must meet for the person to be registered as a repository operator, a portal operator or a contracted service provider;

conditions on the registration of participants in the My Health Record system;

other requirements relating to the My Health Record system that apply to healthcare recipients or participants in the My Health Record system;

requirements relating to the establishment and the operation of a test environment for the My Health Record system, or another electronic system that interacts directly with the My Health Record system.

Requirements referred to in subsection (3) include technical specifications and other requirements in relation to the following:

storage of data and records;

records management;

administration and day-to-day operations;

physical and information security;

uploading specified kinds of records.

My Health Records Rules may relate to agreements

The My Health Records Rules may specify that a person must enter into a specified kind of agreement in order to be, and remain, a registered healthcare provider organisation, registered repository operator, registered portal operator or registered contracted service provider.

The My Health Records Rules may specify requirements relating to registration of healthcare recipients, including requirements relating to registering a healthcare recipient who has been issued with a healthcare identifier under a pseudonym, and for that purpose may specify such modifications of this Act as are necessary to facilitate such registration.

My Health Records Rules may relate to access control mechanisms

The My Health Records Rules may specify matters relating to access control mechanisms, including the following:

the circumstances in which a nominated representative may set access controls;

the circumstances in which access to a healthcare recipient’s My Health Record is to be automatically suspended or cancelled;

default access controls.

My Health Records Rules may relate to authorised representatives and nominated representatives

The My Health Records Rules may specify matters relating to authorised representatives and nominated representatives, including the following:

methods of establishing that an individual is an authorised representative or a nominated representative of a healthcare recipient;

requiring a healthcare recipient to verify his or her identity when the healthcare recipient ceases to have an authorised representative;

(c) specifying circumstances in which an authorised representative or a nominated representative is not required to have been assigned a healthcare identifier under paragraph 9(1)(b) of the Healthcare Identifiers Act 2010.

My Health Records Rules may relate to research or public health purposes

The My Health Records Rules may, in accordance with section 109A, prescribe a framework to guide the collection, use and disclosure of de-identified data and, with the consent of healthcare recipients, health information, for research or public health purposes.

My Health Records Rules may apply to specified classes of participants

The My Health Records Rules may specify the classes of participants in the My Health Record system to whom, or to which, a particular My Health Records Rule applies.

Incorporation of other instruments

(9) Despite subsection 14(2) of the Legislation Act 2003, My Health Records Rules made for purposes other than subsection (7A) may make provision in relation to a matter by applying, adopting or incorporating any matter contained in an instrument or other writing as in force or existing from time to time.

Scope of the My Health Records Rules rule-making power

To avoid doubt, the My Health Records Rules may not do the following:

create an offence or civil penalty;

provide powers of:

arrest or detention; or

entry, search or seizure;

impose a tax;

set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in this Act;

directly amend the text of this Act.

My Health Records Rules that are inconsistent with the regulations have no effect to the extent of the inconsistency, but My Health Records Rules are taken to be consistent with the regulations to the extent that the Rules are capable of operating concurrently with the regulations.

109A My Health Records Rules relating to data for research or public health purposes

Examples of what the rules may do

(1) Without limiting subsection 109(7A), My Health Records Rules made for the purposes of that subsection (the rules) may do any or all of the following:

impose requirements on the System Operator, the Data Governance Board established by section 82, the data custodian and other entities, including procedures that must be followed, in relation to preparing, providing, collecting, accessing, using and disclosing health information and de-identified data;

provide that any or all such requirements are enforceable for the purposes of paragraph 77A(1)(c) or subsection 78(2);

make provision in relation to the performance of the Board’s functions set out in paragraph 83(1)(a);

authorise the Board to make written policies and guidelines to be followed by other entities for the purposes of giving effect to the prescribed framework.

Functions of data custodian

The data custodian has the following functions, and the rules may make provision in relation to the performance of those functions:

under the direction of the Data Governance Board and in accordance with this Act—helping to implement the prescribed framework by:

receiving de-identified data and health information from the My Health Record system; and

as necessary—de-identifying health information; and

iii

as necessary—providing data linkage services (within the meaning of the rules); and

preparing and providing de-identified data and health information to users of data and information whose use has been approved by the Data Governance Board; and

ensuring that users of de-identified data and health information are subject to conditions of use;

any other functions conferred on the data custodian by this Act or the rules.

Limits on rules

The rules:

must not allow the health information of a healthcare recipient to be collected, used or disclosed otherwise than with the consent of the healthcare recipient; and

(b) must not allow de-identified data or health information to be provided to a private health insurer (within the meaning of the Private Health Insurance Act 2007) or any other insurer (with or without the consent of the healthcare recipient); and

must not provide that any of the following is enforceable for the purposes of paragraph 77A(1)(c) or subsection 78(2):

a provision of a policy, guideline or other instrument made under the rules;

a provision of the rules that requires an entity to comply with such a policy, guideline or instrument.

Constitutional limits on rules

If the rules make provision for the disclosure of de-identified data or health information obtained by using or gaining access to the My Health Record system, the rules must have the effect that the data or information is to be disclosed only:

by means of a postal, telegraphic, telephonic or other like service; or

by or to a corporation to which paragraph 51(xx) of the Constitution applies; or

by or to a person within a Territory or a place acquired by the Commonwealth for a public purpose; or

by or to the Commonwealth or an authority of the Commonwealth.

The rules may make other provision in relation to de-identified data or health information only:

to ensure that collection, use and disclosure of data or information does not result in an interference with privacy of the kind the Commonwealth has international obligations to protect against, including under the International Covenant on Civil and Political Rights (in particular Article 17 of the Covenant); or

Note: The text of the Covenant is set out in Australian Treaty Series 1980 No. 23 ([1980] ATS 23). In 2018, a text of a Covenant in the Australian Treaties Series was accessible through the Australian Treaties Library on the AustLII website (http://www.austlii.edu.au).

for purposes related to collecting, preparing, analysing or publishing statistics; or

by providing for data or information to be collected from or by, used by or disclosed by or to, any of the following:

a corporation to which paragraph 51(xx) of the Constitution applies;

a person within a Territory or a place acquired by the Commonwealth for a public purpose;

iii

the Commonwealth or an authority of the Commonwealth.

110 Minister may determine a law of a State or Territory to be a designated privacy law 1

(1) The Minister may, by legislative instrument, determine that a law of a State or Territory is a designated privacy law for the purposes of this Act.

A determination made under subsection (1) is a legislative instrument.

111 Guidelines relating to the Information Commissioner’s enforcement powers etc. 1

In exercising a power conferred on the Information Commissioner by this Act, or a power under another Act that is related to such a power, the Information Commissioner must have regard to any relevant guidelines in force under subsection (2).

The Information Commissioner must, by legislative instrument, formulate guidelines for the purposes of subsection (1).

Note: For consultation requirements, see Legislation Act 2003.section 17 of the

112 Regulations 1

The Governor-General may make regulations prescribing matters:

required or permitted by this Act to be prescribed; or

necessary or convenient to be prescribed for carrying out or giving effect to this Act.

Without limiting subsection (1), the Governor-General may make regulations on any matter about which the Minister may make My Health Records Rules.

Before the Governor-General makes regulations, the Minister must consult the Ministerial Council.

The regulations may prescribe penalties of not more than 50 penalty units for offences against the regulations.

The regulations may provide for civil penalties for contraventions of the regulations, which must not be more than:

50 penalty units for an individual; or

250 penalty units for a body corporate.

My Health Records for all healthcare recipients

Note: See section 4A.

1 Trial of opt-out model 1

(1) The Minister may make My Health Records Rules applying opt-out model) to a class, or classes, of healthcare recipients.Part 2 of this Schedule (the

The Minister must not make rules under subclause (1), unless the Minister is satisfied that applying the opt-out model to that class, or those classes, of healthcare recipients would provide evidence of whether the opt-out model results in participation in the My Health Record system at a level that provides value for those using the My Health Record system.

Before the Minister makes My Health Records Rules under this clause, the Minister must consult the Health Chief Executives Forum.

2 Minister may apply the opt-out model to all healthcare recipients after trial 1

If, having applied the opt-out model under clause 1, the Minister decides that the opt-out model results in participation in the My Health Record system at a level that provides value for those using the My Health Record system, the Minister may make My Health Records Rules applying the opt-out model to all healthcare recipients in Australia.

In making the decision, the Minister may take into account:

the evidence obtained in applying the opt-out model under clause 1; and

any other matter relevant to the decision.

Before the Minister makes My Health Records Rules under this clause, the Minister must consult the Ministerial Council.

3 Registration of a healthcare recipient by the System Operator 1

The System Operator may register a healthcare recipient if:

the healthcare recipient is eligible for registration under clause 4; and

the System Operator is satisfied, having regard to the matters (if any) specified in the My Health Records Rules, that the identity of the healthcare recipient has been appropriately verified; and

the System Operator is satisfied that:

the healthcare recipient has been given the opportunity, in accordance with clause 5, to make an election not to be registered; and

no such election is in force.

Despite subclause (1), the System Operator must not register a healthcare recipient:

if the System Operator is satisfied that registering the healthcare recipient may compromise the security or integrity of the My Health Record system, having regard to the matters (if any) prescribed by the My Health Records Rules; or

in other circumstances prescribed by the My Health Records Rules.

4 When a healthcare recipient is eligible for registration

A healthcare recipient is eligible for registration if:

(a) a healthcare identifier has been assigned to the healthcare recipient under paragraph 9(1)(b) of the Healthcare Identifiers Act 2010; and

the System Operator has collected the following information in relation to the healthcare recipient:

full name;

date of birth;

iii

healthcare identifier, Medicare card number or Department of Veterans’ Affairs file number;

sex;

such other information as is prescribed by the regulations.

5 Healthcare recipient elects not to be registered 1

A healthcare recipient may, by notice to the System Operator, elect not to be registered.

The notice:

must be in the approved form; and

be lodged at a place, or by a means, specified in the form; and

if:

under the My Health Records Rules, it is provided that the election by a member of a class of healthcare recipients must be given within a period, or on the occurrence of an event, specified in those rules; and

the healthcare recipient is a member of that class;

the notice of the election must be given to the System Operator within that period, or on the occurrence of that event.

The election begins to be in force on the day on which the healthcare recipient gives notice of the election to the System Operator.

The election ceases to be in force on the day on which an application is made under clause 6 to be registered.

6 Healthcare recipients may apply for registration 1

A healthcare recipient may apply to the System Operator for registration of the healthcare recipient.

The application must:

be in the approved form; and

include, or be accompanied by, the information and documents required by the form; and

be lodged at a place, or by a means, specified in the form.

If:

a healthcare recipient makes an application in accordance with this clause; and

the healthcare recipient is eligible for registration under clause 4; and

the System Operator is satisfied, having regard to the matters (if any) specified in the My Health Records Rules, that the identity of the healthcare recipient has been appropriately verified;

the System Operator must register the healthcare recipient.

Despite subclause (3), the System Operator must not register a healthcare recipient:

in other circumstances prescribed by the My Health Records Rules.

7 Collection, use and disclosure of health information by the System Operator

8 Collection, use and disclosure of healthcare identifiers, identifying information and information identifying authorised representatives and nominated representatives 1

that entity must, as soon as practicable after becoming aware of the change, inform the System Operator of the change.

Subdivision A—Healthcare provider to upload health information

If:

any of the following entities discloses information to the System Operator in circumstances in which the information is authorised to be disclosed under subclause (1):

the Chief Executive Medicare;

the Veterans’ Affairs Department;

iii

the Defence Department;

(iv) the service operator for the purposes of the Healthcare Identifiers Act 2010;

an entity prescribed for the purposes of item 10 of the table in subclause (1); and

the entity that disclosed the information becomes aware that the information has changed;

9 Authorisation for healthcare provider to upload health information 1

(1) A registered healthcare provider organisation is authorised to upload to the My Health Record system any record that includes health information about a registered healthcare recipient, subject to the following:

express advice given by the healthcare recipient to the registered healthcare provider organisation that a particular record, all records or a specified class of records must not be uploaded;

a law of a State or Territory that is prescribed by the regulations for the purposes of subclause (3).

(2) A registered healthcare provider organisation is authorised to upload to the My Health Record system a record in relation to a healthcare recipient (the patient) that includes health information about another healthcare recipient (the third party), if the health information about the third party is directly relevant to the healthcare of the patient, subject to a law of a State or Territory that is prescribed by the regulations for the purposes of subclause (3).

An authorisation referred to in subclause (1) or (2) has effect despite a law of a State or Territory that requires consent to the disclosure of particular health information:

given expressly; or

given in a particular way;

other than a law of a State or Territory prescribed by the regulations for the purposes of this subclause.

Subdivision B—Functions of the Chief Executive Medicare

10 Registered repository operator

11 Uploading health information to the repository

At any time when the Chief Executive Medicare is a registered repository operator, the Chief Executive Medicare may, at his or her discretion, upload health information held by the Chief Executive Medicare about a registered healthcare recipient to the repository operated by the Chief Executive Medicare.

12 Making health information available to the System Operator 1

At any time when the Chief Executive Medicare is a registered repository operator, the Chief Executive Medicare may, at his or her discretion, make available to the System Operator health information held by the Chief Executive Medicare about a registered healthcare recipient.

Despite subclause (1), the Chief Executive Medicare must not make health information about a healthcare recipient available to the System Operator, if the healthcare recipient has elected under clause 13 not to have the information made available, and that election is in force.

13 Healthcare recipient may elect not to have health information disclosed to the System Operator 1

A healthcare recipient may, by notice to the System Operator, elect not to have health information about the healthcare recipient held by the Chief Executive Medicare made available to the System Operator.

The notice under subclause (1):

must be in the approved form; and

be lodged at a place, or by a means, specified in the form; and

if:

the healthcare recipient is a member of that class;

the notice of the election must be given to the System Operator within that period, or on the occurrence of that event.

The election begins to be in force from the day on which the healthcare recipient gives notice of the election to the System Operator.

The election ceases to be in force:

(a) if the healthcare recipient notifies the System Operator that the healthcare recipient withdraws the election—from the day on which the notice is given; and

if another time is prescribed by the My Health Records Rules—at that time.

The notice under subclause (4):

must be in the approved form; and

be lodged at a place, or by a means, specified in the form.

14 Health information uploaded or made available may include details of healthcare providers

The health information about a healthcare recipient uploaded under clause 11 or made available under clause 12 may include the name of one or more healthcare providers that have provided healthcare to the healthcare recipient.

15 Way in which repository operated not limited by this Division

Nothing in this Division limits the way in which the repository is to be operated.

Subdivision C—Other registered repository operators

16 Making health information available to the System Operator

A registered repository operator (other than the Chief Executive Medicare) may make available to the System Operator health information held by the registered repository operator about a registered healthcare recipient.

17 References to other provisions of this Act

If Part 2 of this Schedule applies in relation to a healthcare recipient:

Endnotes

Endnote 1—About the endnotes

The endnotes provide information about this compilation and the compiled law.

The following endnotes are included in every compilation:

Endnote 1—About the endnotes

Endnote 2—Abbreviation key

Endnote 3—Legislation history

Endnote 4—Amendment history

Abbreviation key—Endnote 2

The abbreviation key sets out abbreviations that may be used in the endnotes.

Legislation history and amendment history—Endnotes 3 and 4

Amending laws are annotated in the legislation history and amendment history.

The legislation history in endnote 3 provides information about each law that has amended (or will amend) the compiled law. The information includes commencement details for amending laws and details of any application, saving or transitional provisions that are not included in this compilation.

The amendment history in endnote 4 provides information about amendments at the provision (generally section or equivalent) level. It also includes information about any provision of the compiled law that has been repealed in accordance with a provision of the law.

Editorial changes

The Legislation Act 2003 authorises First Parliamentary Counsel to make editorial and presentational changes to a compiled law in preparing a compilation of the law for registration. The changes must not change the effect of the law. Editorial changes take effect from the compilation registration date.

If the compilation includes editorial changes, the endnotes include a brief outline of the changes in general terms. Full details of any changes can be obtained from the Office of Parliamentary Counsel.

Misdescribed amendments

A misdescribed amendment is an amendment that does not accurately describe how an amendment is to be made. If, despite the misdescription, the amendment can be given effect as intended, then the misdescribed amendment can be incorporated through an editorial change made under Legislation Act 2003.section 15V of the

If a misdescribed amendment cannot be given effect as intended, the amendment is not incorporated and “(md not incorp)” is added to the amendment history.

Endnote 2—Abbreviation key

Endnote 3—Legislation history

Endnote 4—Amendment history

Division 4 of Part 2 of this Act does not apply in relation to the healthcare recipient; and

Division 1 of Part 3 of this Act does not apply in relation to the healthcare recipient; and

section 46 applies as if the reference to “this Part” were a reference to “Part 2 of Schedule 1 to this Act”; and

section 50D does not apply in relation to the healthcare recipient; and

paragraphs 51(2)(d) and (e) do not apply in relation to the healthcare recipient (consent to upload information to the My Health Record system); and

section 57 applies as if a reference to a decision under Part 3 to register a healthcare recipient were a reference to a decision under Part 2 of this Schedule to register the healthcare recipient; and

Division 6 of Part 3 of this Act does not apply in relation to the healthcare recipient; and

in relation to the healthcare recipient, the reference in paragraph 97(1)(b) to a decision under section 41 to refuse to register a healthcare recipient is taken to include a reference to a decision under Part 2 of this Schedule to refuse to register the healthcare recipient; and

if the healthcare recipient is registered under Part 2 of this Schedule—a reference in this Act to a registered healthcare recipient is taken to include a reference to the healthcare recipient.