the act is done, or authorised to be done:

(i) for a purpose for which the collection, use or disclosure of health information is required or authorised under the My Health Records Act 2012; or

(ii) in circumstances in which a permitted general situation exists under item 1 of the table in subsection 16A(1) of the Privacy Act 1988 (serious threat to life, health or safety), or would exist if the act were done, or authorised to be done, by an entity that is an APP entity for the purposes of that Act; or

(iii) in circumstances in which a permitted health situation exists under Privacy Act 1988, or would exist if the act were done, or authorised to be done, by an entity that is an organisation for the purposes of that Act; orsection 16B of the

for any other purpose relating to healthcare, or the communication or management of health information, prescribed by the regulations; and

either:

the work is substantially comprised of health information; or

the work allows for the storage, retrieval or use of health information and it is reasonably necessary to do the act, or authorise it to be done, in circumstances that would otherwise infringe copyright in the work.

the act is done, or authorised to be done:

(i) for a purpose for which the collection, use or disclosure of health information is required or authorised under the My Health Records Act 2012; or

(ii) in circumstances in which a permitted general situation exists under item 1 of the table in subsection 16A(1) of the Privacy Act 1988 (serious threat to life, health or safety), or would exist if the entity doing the thing were an APP entity for the purposes of that Act; or

(iii) in circumstances in which a permitted health situation exists under Privacy Act 1988, or would exist if the entity doing the thing were an organisation for the purposes of that Act; orsection 16B of the

for any other purpose relating to healthcare, or the communication or management of health information, prescribed by the regulations; and

either:

the film or recording is substantially comprised of health information; or

the film or recording allows for the storage, retrieval or use of health information and it is reasonably necessary to do the act, or authorise it to be done, in circumstances that would otherwise infringe copyright in the work.

the verification of a person’s identity before a healthcare identifier is assigned; and

the purposes for which a healthcare identifier can be collected, used and disclosed; and

the purposes for which the identifying information of a healthcare recipient, a healthcare provider or a healthcare provider organisation can be collected, used and disclosed.

the creation of a Healthcare Provider Directory, to allow healthcare providers to check the professional and business details of healthcare providers; and

the use of authenticated electronic communications by healthcare providers.

the individual healthcare provider is an employee of the healthcare provider organisation; or

the healthcare provider organisation provides support services or facilities to the individual healthcare provider, to facilitate the provision of healthcare by the individual healthcare provider.

the Chief Executive Medicare; or

(b) if a body established by a law of the Commonwealth is prescribed by the regulations to be the service operator—that body.

the email address, telephone number and fax number of the healthcare provider;

the individual healthcare provider is registered by a registration authority as a member of a health profession; or

the individual healthcare provider is a member of a professional association that:

relates to the healthcare that has been, is, or is to be, provided by the member; and

has uniform national membership requirements, whether or not in legislation.

at least one of the employees of the organisation is an individual who:

is an identified healthcare provider; and

provides healthcare as part of his or her duties; and

one, and only one of the employees of the organisation is the responsible officer for the organisation; and

either:

the organisation has at least one other employee who is an organisation maintenance officer for the organisation; or

the responsible officer for the organisation is also the organisation maintenance officer for the organisation.

the seed organisation for the network:

has been assigned a healthcare identifier that has not been retired; and

does not object to the network organisation being assigned a healthcare identifier under this subsection; and

the responsible officer for the seed organisation for the network is also the responsible officer for every network organisation within the network; and

there is an organisation maintenance officer for the network organisation; and

the organisation maintenance officer for the network organisation is:

(i) an employee of the network organisation (the first network organisation); or

an employee of the seed organisation for the network; or

an employee of another network organisation within the network that is hierarchically superior to the first network organisation.

the healthcare provider organisation is part of, or subordinate to, another healthcare provider organisation within the group;

another healthcare provider organisation within the group is part of, or subordinate to, the healthcare provider organisation.

there is at least one other healthcare provider organisation that is part of, or subordinate to, the organisation; and

the organisation is not itself part of, or subordinate to, another healthcare provider organisation.

nominating the organisation maintenance officer or officers for the organisation to the service operator;

requesting the assignment or retirement of a healthcare identifier for the organisation;

if there is a network organisation of the organisation:

nominating the organisation maintenance officer for the network organisation to the service operator; and

requesting the assignment or retirement of a healthcare identifier for the network organisation;

if the organisation is part of a merger or acquisition—requesting the merger or reconfiguration of a healthcare identifier for the organisation.

nominating to the service operator at least one additional person to be an organisation maintenance officer of the organisation, if required;

maintaining information that is held by the service operator about the organisation;

providing current details to the service operator about the organisation for inclusion in the Healthcare Provider Directory;

providing any other information requested by the service operator about the organisation for which the organisation maintenance officer is responsible;

(e) if the organisation (the seed organisation) has a network organisation:

nominating to the service operator another person who meets the employment criteria in paragraph (3)(d) to be the organisation maintenance officer for the network organisation—either on the initiative of the seed organisation or if required by the service operator to do so;

requesting the assignment or retirement of a healthcare identifier for the network organisation;

maintaining information that is held by the service operator about the network organisation;

providing current details to the service operator about the network organisation for inclusion in the Healthcare Provider Directory;

providing any other information requested by the service operator about the network organisation for which the organisation maintenance officer is responsible;

if the network organisation is part of a merger or acquisition—requesting the merger or reconfiguration of a healthcare identifier for the organisation.

provides healthcare as part of his or her duties; and

performs the duties of a responsible officer and organisation maintenance officer.

underwriting a contract of insurance that covers the healthcare recipient; or

determining whether to enter into a contract of insurance that covers the healthcare recipient (whether alone or as a member of a class); or

determining whether a contract of insurance covers the healthcare recipient in relation to a particular event; or

employing the healthcare recipient.

identifying information of a healthcare recipient, an authorised representative of a healthcare recipient or a nominated representative of a healthcare recipient; and

the healthcare identifier of a healthcare recipient, an authorised representative of a healthcare recipient or a nominated representative of a healthcare recipient;

the service operator;

the My Health Record System Operator;

a healthcare provider.

the healthcare recipient; or

(b) a responsible person (within the meaning of the Privacy Act 1988) for the healthcare recipient.

identifying information of a healthcare recipient, authorised representative of a healthcare recipient or nominated representative of a healthcare recipient;

the healthcare identifier of a healthcare recipient, authorised representative of a healthcare recipient or nominated representative of a healthcare recipient.

providing healthcare to healthcare recipients, or a class of healthcare recipients;

determining whether adequate and appropriate healthcare is available to healthcare recipients, or a class of healthcare recipients;

facilitating the provision of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients;

assisting persons who, because of health issues (including illness, disability or injury), require support;

the My Health Record system.

identifying information of a healthcare provider; and

the healthcare identifier of a healthcare provider;

identifying information of a healthcare provider;

the healthcare identifier of a healthcare provider.

providing healthcare to healthcare recipients, or a class of healthcare recipients;

determining whether adequate and appropriate healthcare is available to healthcare recipients, or a class of healthcare recipients;

facilitating the provision of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients;

assisting persons who, because of health issues (including illness, disability or injury), require support;

the My Health Record system.

relates to the healthcare provider’s healthcare identifier; and

is prescribed by the regulations for the purposes of this section.

give the service operator, in writing, accurate, up-to-date and complete information; and

do so within 20 business days after the organisation becomes aware that the information held by the service operator is not accurate, up-to-date and complete.

the information that is no longer accurate, up-to-date and complete is personal information that the service operator was only able to lawfully obtain with the consent of the person to whom the information relates; and

instead of giving accurate, up-to-date and complete personal information within the period specified in that subsection, the healthcare provider organisation notifies the service operator within that period, in the manner and form approved by the service operator, that the person to whom the information relates has withdrawn consent for the information to be given to the service operator.

the healthcare provider organisation, or an individual healthcare provider who is linked to the healthcare provider organisation, is required by an Australian law, or by a lawful requirement of the national registration authority, to give the national registration authority the accurate, up-to-date and complete information; and

the healthcare provider organisation, or the individual healthcare provider, complies with the requirement.

the person fails to give the service operator information in the circumstances mentioned in subsection (1); and

the person knows or is reckless as to those circumstances.

the person obtains the information in response to a request under section 9B; or

the person obtains the information in the course of establishing or maintaining a record for the purposes of section 10 (a record of healthcare identifiers assigned and other matters, such as requests made to the service operator to disclose those identifiers); or

the information is identifying information and the person obtains the information in circumstances covered by a requirement or authority under this Act; or

the information is the healthcare identifier of a healthcare recipient or an individual healthcare provider.

the use or disclosure of the healthcare identifier is required or authorised under this Act; or

the use or disclosure of the healthcare identifier is required or authorised under another Commonwealth law or a court/tribunal order; or

the use or disclosure is:

by the person to whom the healthcare identifier relates; and

(ii) for the purposes of, or in connection with, the personal, family or household affairs of that person (Privacy Act 1988); orwithin the meaning of section 16 of the

(d) a permitted general situation of the kind described in item 1, 2, 4 or 5 of the table in subsection 16A(1) of the Privacy Act 1988 exists in relation to the use or disclosure, or would exist if the person were an APP entity for the purposes of that Act; or

without limiting the exceptions under this subsection, the use or disclosure is required or authorised by the Information Commissioner, or an equivalent officer or agency of a State or Territory, in exercising powers or performing functions in relation to privacy.

the use or disclosure of the information is required or authorised under this Act; or

the use or disclosure of the information is required or authorised under another Australian law or a court/tribunal order; or

(c) the information is personal information and the use or disclosure would not be an interference with the privacy of the individual for the purposes of the Privacy Act 1988, or would not be an interference with the privacy of the individual for the purposes of that Act if the person were an agency or an organisation for the purposes of that Act; or

without limiting the exceptions under this subsection, the use or disclosure is required or authorised by the Information Commissioner, or an equivalent officer or agency of a State or Territory, in exercising powers or performing functions in relation to privacy.

the person uses or discloses information in circumstances under which the use or disclosure would contravene subsection (1) or (2); and

the person knows or is reckless as to those circumstances.

the healthcare identifier of a healthcare provider; and

whether an individual healthcare provider is linked to a healthcare provider organisation; and

whether a healthcare provider is registered under the My Health Record system; and

whether a healthcare provider is registered with a registration authority and the status of that registration (such as whether it is conditional, suspended, cancelled or lapsed); and

the type of healthcare provider that an individual is.

collect and use personal information for the purposes of establishing and maintaining the Healthcare Provider Directory; and

disclose personal information on the Healthcare Provider Directory to an identified healthcare provider;

the healthcare identifier of a healthcare provider;

identifying information of a healthcare provider;

whether an individual healthcare provider is linked to a particular healthcare provider organisation;

whether a healthcare provider organisation is a registered healthcare provider organisation for the purposes of the My Health Records Act;

whether an individual healthcare provider is registered with a registration authority and the status of that registration (such as conditional, suspended, cancelled or lapsed);

the type of healthcare provider that an individual is.

for the purpose of communicating or managing health information, as part of providing healthcare to a healthcare recipient; or

in any other circumstances in which the collection, use or disclosure of the information is required or authorised by or under an Australian law or a court/tribunal order; or

(c) in any other circumstances in which the collection, use or disclosure of the information would not be an interference with privacy under the Privacy Act 1988.

identifying information of a healthcare provider; and

the healthcare identifier of a healthcare provider;

identifying information of a healthcare provider; and

the healthcare identifier of a healthcare provider;

the Federal Court of Australia;

the Federal Circuit Court of Australia;

a court of a State or Territory that has jurisdiction in relation to the matter.

the service operator;

the Information Commissioner.

the Federal Court of Australia;

the Federal Circuit Court of Australia;

a court of a State or Territory that has jurisdiction in relation to the matter.

the service operator;

the Information Commissioner.

the Federal Court of Australia;

the Federal Circuit Court of Australia;

a court of a State or Territory that has jurisdiction in relation to the matter.

provide a copy of the report to the Ministerial Council; and

table a copy of the report in each House of Parliament within 15 sitting days after the report is given to the Minister.

provides for the concurrent operation of State and Territory law; and

deals with the effect Parts 3 and 4 are to have in certain constitutionally significant circumstances.

an individual:

who is an employee of the healthcare provider; and

whose duties involve, or are reasonably connected to, implementing that purpose; or

(b) a contracted service provider of the healthcare provider, if the duties of the contracted service provider under a contract with the healthcare provider involve, or are reasonably connected with, implementing that purpose by providing information technology services relating to the communication of health information, or health information management services, to the healthcare provider; or

an individual:

who is an employee of a contracted service provider to which paragraph (b) applies; and

whose duties involve implementing that purpose as mentioned in that paragraph.

did the relevant act or made the relevant omission; or

aided, abetted, counselled or procured the relevant act or omission; or

was in any way knowingly concerned in, or party to, the relevant act or omission (whether directly or indirectly and whether by any act or omission of the partner).

did the relevant act or made the relevant omission; or

aided, abetted, counselled or procured the relevant act or omission; or

was in any way knowingly concerned in, or party to, the relevant act or omission (whether directly or indirectly and whether by any act or omission of the member).

did the relevant act or made the relevant omission; or

aided, abetted, counselled or procured the relevant act or omission; or

was in any way knowingly concerned in, or party to, the relevant act or omission (whether directly or indirectly and whether by any act or omission of the trustee).

an APS employee in the Department;

if the service operator is not the Chief Executive Medicare—the Chief Executive Medicare;

any other person with the consent of the Minister.

to an APS employee in the Department with the agreement of the Secretary; and

to the Chief Executive Medicare with the agreement of the Chief Executive Medicare.

a delegate;

(b) if the Chief Executive Medicare delegates under subsection 8AC(3) of the Human Services (Medicare) Act 1973 a function delegated to him or her under this section—a subdelegate.

if the representative is a nominated representative—the agreement appointing the representative;

to the extent legally possible, from consultation with people who may be expected to be aware of the recipient’s will and preferences.

to establish and operate a test environment for the My Health Record system, and other electronic systems that interact directly with the My Health Record system, in accordance with the requirements (if any) in the My Health Records Rules;

upload to a repository a record of a kind specified in the My Health Records Rules for the purposes of subparagraph (b)(ii) unless the record is prepared by a person who, at the time the record is prepared, is:

(i) an individual who is registered by a registration authority within the meaning of the Healthcare Identifiers Act 2010, and whose registration is not conditional, suspended, cancelled or lapsed (other than in circumstances prescribed in the My Health Records Rules); or

(ii) an individual who is a member of a professional association described in paragraph 9A(1)(b) of the Healthcare Identifiers Act 2010, and whose membership is not conditional, suspended, cancelled or lapsed (other than in circumstances prescribed by the My Health Records Rules); or

(c) upload a record to a repository if uploading the record would involve an infringement of a moral right of the author, within the meaning of the Copyright Act 1968; or

for a purpose for which the collection, use or disclosure of health information is required or authorised under this Act; or

(b) in circumstances in which a permitted general situation exists under item 1 of the table in subsection 16A(1) of the Privacy Act 1988 (serious threat to life, health or safety), or would exist if the act were done, or authorised to be done, by an entity that is an APP entity for the purposes of that Act; or

(c) in circumstances in which a permitted health situation exists under Privacy Act 1988, or would exist if the act were done, or authorised to be done, by an entity that is an organisation for the purposes of that Act; orsection 16B of the

for any other purpose relating to healthcare, or the communication or management of health information, prescribed by the regulations.

for a purpose for which the collection, use or disclosure of health information is required or authorised under this Act; or

(b) in circumstances in which a permitted general situation exists under item 1 of the table in subsection 16A(1) of the Privacy Act 1988 (serious threat to life, health or safety), or would exist if the act were done by an entity that is an APP entity for the purposes of that Act; or

(c) in circumstances in which a permitted health situation exists under Privacy Act 1988, or would exist if the act were done by an entity that is an organisation for the purposes of that Act; orsection 16B of the

for any other purpose relating to healthcare, or the communication or management of health information, prescribed by the regulations.

the Federal Court of Australia;

the Federal Circuit Court of Australia;

a court of a State or Territory that has jurisdiction in relation to the matter.

for a purpose for which the collection, use or disclosure of health information is required or authorised under this Act; or

(b) in circumstances in which a permitted general situation exists under item 1 of the table in subsection 16A(1) of the Privacy Act 1988 (serious threat to life, health or safety), or would exist if the act were done, or authorised to be done, by an entity that is an APP entity for the purposes of that Act; or

(c) in circumstances in which a permitted health situation exists under Privacy Act 1988, or would exist if the act were done, or authorised to be done, by an entity that is an organisation for the purposes of that Act; orsection 16B of the

for any other purpose relating to healthcare, or the communication or management of health information, prescribed by the regulations.

for a purpose for which the collection, use or disclosure of health information is required or authorised under this Act; or

(b) in circumstances in which a permitted general situation exists under item 1 of the table in subsection 16A(1) of the Privacy Act 1988 (serious threat to life, health or safety), or would exist if the act were done by an entity that is an APP entity for the purposes of that Act; or

(c) in circumstances in which a permitted health situation exists under Privacy Act 1988, or would exist if the act were done by an entity that is an organisation for the purposes of that Act; orsection 16B of the

for any other purpose relating to healthcare, or the communication or management of health information, prescribed by the regulations.

the Federal Court of Australia;

the Federal Circuit Court of Australia;

a court of a State or Territory that has jurisdiction in relation to the matter.

when notice of the decision is given under that subsection; or

if a later time is specified in the notice under that subsection—at that later time.

any of the following entities discloses information to the System Operator in circumstances in which the information is authorised to be disclosed under subsection (1):

the Chief Executive Medicare;

the Veterans’ Affairs Department;

the Defence Department;

(iv) the service operator for the purposes of the Healthcare Identifiers Act 2010;

an entity prescribed for the purposes of item 10 of the table in subsection (1); and

the entity that disclosed the information becomes aware that the information has changed;

the entity is, or has at any time been, the System Operator, a registered healthcare provider organisation, a registered repository operator, a registered portal operator or a registered contracted service provider; and

the entity becomes aware that:

a person has, or may have, contravened this Act in a manner involving an unauthorised collection, use or disclosure of health information included in a healthcare recipient’s My Health Record; or

an event has, or may have, occurred (whether or not involving a contravention of this Act) that compromises, may compromise, has compromised or may have compromised, the security or integrity of the My Health Record system; or

circumstances have, or may have, arisen (whether or not involving a contravention of this Act) that compromise, may compromise, have compromised or may have compromised, the security or integrity of the My Health Record system; and

the contravention, event or circumstances directly involved, may have involved or may involve the entity.

the entity is a registered healthcare provider organisation, a registered repository operator, a registered portal operator or a registered contracted service provider; and

the entity becomes aware that:

the contravention or event referred to in subsection (1) has or may have occurred; or

the circumstances referred to in subsection (1) have or may have arisen;

in the case of an entity that is a State or Territory authority or an instrumentality of a State or Territory—the System Operator; or

otherwise—both the System Operator and the Information Commissioner.

the entity is the System Operator; and

the entity becomes aware that:

the contravention or event referred to in subsection (1) has or may have occurred; or

the circumstances referred to in subsection (1) have or may have arisen;

so far as is reasonably practicable contain the potential contravention, event or circumstances;

evaluate any risks that, if the contravention, event or circumstances has occurred or arisen, may be related to or arise out of the contravention, event or circumstances;

if there is a reasonable likelihood that the contravention, event or circumstance has occurred or arisen and the effects of the contravention, event or circumstances might be serious for at least one healthcare recipient:

if the entity is not the System Operator—ask the System Operator to notify all healthcare recipients that would be affected; or

if the entity is the System Operator—notify all healthcare recipients that would be affected.

so far as is reasonably practicable, contain the contravention, event or circumstances and undertake a preliminary assessment of the causes;

evaluate any risks that may be related to or arise out of the contravention, event or circumstances;

if the entity is the System Operator:

notify all affected healthcare recipients; and

if a significant number of healthcare recipients are affected, notify the general public;

if the entity is not the System Operator—ask the System Operator:

to notify all affected healthcare recipients; and

if a significant number of healthcare recipients are affected, to notify the general public;

take steps to prevent or mitigate the effects of further contraventions, events or circumstances described in paragraph (1)(b).

a registered healthcare provider organisation; or

a registered repository operator; or

a registered portal operator; or

a registered contracted service provider;

the Federal Court of Australia;

the Federal Circuit Court of Australia;

a court of a State or Territory that has jurisdiction in relation to the matter.

the System Operator;

the Information Commissioner.

the Federal Court of Australia;

the Federal Circuit Court of Australia;

a court of a State or Territory that has jurisdiction in relation to the matter.

the System Operator;

the Information Commissioner.

the Federal Court of Australia;

the Federal Circuit Court of Australia;

a court of a State or Territory that has jurisdiction in relation to the matter.

to an APS employee in the Department—with the agreement of the Secretary; and

to the Chief Executive Medicare—with the agreement of the Chief Executive Medicare.

a delegate;

(b) if the Chief Executive Medicare delegates under subsection 8AC(3) of the Human Services (Medicare) Act 1973 a function delegated to him or her under this section—a subdelegate.

did the relevant act or made the relevant omission; or

aided, abetted, counselled or procured the relevant act or omission; or

was in any way knowingly concerned in, or party to, the relevant act or omission (whether directly or indirectly and whether by any act or omission of the partner).

did the relevant act or made the relevant omission; or

aided, abetted, counselled or procured the relevant act or omission; or

was in any way knowingly concerned in, or party to, the relevant act or omission (whether directly or indirectly and whether by any act or omission of the member).

did the relevant act or made the relevant omission; or

aided, abetted, counselled or procured the relevant act or omission; or

was in any way knowingly concerned in, or party to, the relevant act or omission (whether directly or indirectly and whether by any act or omission of the trustee).

statistics of the following:

registrations, and cancellations and suspensions of registrations, under this Act;

use of the My Health Record system by healthcare providers and healthcare recipients;

complaints received, and investigations undertaken, in relation to the My Health Record system;

occurrences compromising the integrity or security of the My Health Record system;

enforceable undertakings accepted by the System Operator under this Act;

proceedings taken by the System Operator in relation to enforceable undertakings or injunctions; and

any other matter prescribed by the regulations.

(a) 3 years after the commencement of Schedule 1 to the Health Legislation Amendment (eHealth) Act 2015; or

(b) if the Minister makes My Health Records Rules under clause 2 of Schedule 1 to this Act within 3 years after the commencement of Schedule 1 to the Health Legislation Amendment (eHealth) Act 2015—3 years after the day on which the Rules are made.

provide a copy of the report to the Ministerial Council; and

table a copy of the report in each House of Parliament within 15 sitting days after the report is given to the Minister.

the System Operator; and

a subcommittee of the Ministerial Council, prescribed by the regulations for the purposes of this paragraph.

create an offence or civil penalty;

provide powers of:

arrest or detention; or

entry, search or seizure;

impose a tax;

set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in this Act;

directly amend the text of this Act.

the evidence obtained in applying the opt-out model under clause 1; and

any other matter relevant to the decision.

the healthcare recipient is eligible for registration under clause 4; and

the System Operator is satisfied, having regard to the matters (if any) specified in the My Health Records Rules, that the identity of the healthcare recipient has been appropriately verified; and

the System Operator is satisfied that:

the healthcare recipient has been given the opportunity, in accordance with clause 5, to make an election not to be registered; and

no such election is in force.

if the System Operator is satisfied that registering the healthcare recipient may compromise the security or integrity of the My Health Record system, having regard to the matters (if any) prescribed by the My Health Records Rules; or

in other circumstances prescribed by the My Health Records Rules.

(a) a healthcare identifier has been assigned to the healthcare recipient under paragraph 9(1)(b) of the Healthcare Identifiers Act 2010; and

the System Operator has collected the following information in relation to the healthcare recipient:

full name;

date of birth;

healthcare identifier, Medicare card number or Department of Veterans’ Affairs file number;

sex;

such other information as is prescribed by the regulations.

must be in the approved form; and

be lodged at a place, or by a means, specified in the form; and

if:

under the My Health Records Rules, it is provided that the election by a member of a class of healthcare recipients must be given within a period, or on the occurrence of an event, specified in those rules; and

the healthcare recipient is a member of that class;

be in the approved form; and

include, or be accompanied by, the information and documents required by the form; and

be lodged at a place, or by a means, specified in the form.

a healthcare recipient makes an application in accordance with this clause; and

the healthcare recipient is eligible for registration under clause 4; and

the System Operator is satisfied, having regard to the matters (if any) specified in the My Health Records Rules, that the identity of the healthcare recipient has been appropriately verified;

if the System Operator is satisfied that registering the healthcare recipient may compromise the security or integrity of the My Health Record system, having regard to the matters (if any) prescribed by the My Health Records Rules; or

in other circumstances prescribed by the My Health Records Rules.

any of the following entities discloses information to the System Operator in circumstances in which the information is authorised to be disclosed under subclause (1):

the Chief Executive Medicare;

the Veterans’ Affairs Department;

the Defence Department;

(iv) the service operator for the purposes of the Healthcare Identifiers Act 2010;

an entity prescribed for the purposes of item 10 of the table in subclause (1); and

the entity that disclosed the information becomes aware that the information has changed;

express advice given by the healthcare recipient to the registered healthcare provider organisation that a particular record, all records or a specified class of records must not be uploaded;

a law of a State or Territory that is prescribed by the regulations for the purposes of subclause (3).

given expressly; or

given in a particular way;

must be in the approved form; and

be lodged at a place, or by a means, specified in the form; and

if:

under the My Health Records Rules, it is provided that the election by a member of a class of healthcare recipients must be given within a period, or on the occurrence of an event, specified in those rules; and

the healthcare recipient is a member of that class;

(a) if the healthcare recipient notifies the System Operator that the healthcare recipient withdraws the election—from the day on which the notice is given; and

if another time is prescribed by the My Health Records Rules—at that time.

must be in the approved form; and

be lodged at a place, or by a means, specified in the form.

Division 4 of Part 2 of this Act does not apply in relation to the healthcare recipient; and

Division 1 of Part 3 of this Act does not apply in relation to the healthcare recipient; and

section 46 applies as if the reference to “this Part” were a reference to “Part 2 of Schedule 1 to this Act”; and

section 50D does not apply in relation to the healthcare recipient; and

paragraphs 51(2)(d) and (e) do not apply in relation to the healthcare recipient (consent to upload information to the My Health Record system); and

section 57 applies as if a reference to a decision under Part 3 to register a healthcare recipient were a reference to a decision under Part 2 of this Schedule to register the healthcare recipient; and

Division 6 of Part 3 of this Act does not apply in relation to the healthcare recipient; and

in relation to the healthcare recipient, the reference in paragraph 97(1)(b) to a decision under section 41 to refuse to register a healthcare recipient is taken to include a reference to a decision under Part 2 of this Schedule to refuse to register the healthcare recipient; and

if the healthcare recipient is registered under Part 2 of this Schedule—a reference in this Act to a registered healthcare recipient is taken to include a reference to the healthcare recipient.

information or an opinion about:

the health, including an illness, disability or injury, (at any time) of an individual; or

an individual’s expressed wishes about the future provision of health services to the individual; or

a health service provided, or to be provided, to an individual;

other personal information collected to provide, or in providing, a health service to an individual;

other personal information collected in connection with the donation, or intended donation, by an individual of his or her body parts, organs or body substances;

genetic information about an individual in a form that is, or could be, predictive of the health of the individual or a genetic relative of the individual.

to assess, maintain or improve the individual’s health; or

where the individual’s health cannot be maintained or improved—to manage the individual’s health; or

to diagnose the individual’s illness, disability or injury; or

to treat the individual’s illness, disability or injury or suspected illness, disability or injury; or

to record the individual’s health for the purposes of assessing, maintaining, improving or managing the individual’s health.

a reference in this section to an individual’s health includes the individual’s physical or psychological health; and

(b) an activity mentioned in subsection (1) or (2) that takes place in the course of providing aged care, palliative care or care for a person with a disability is a health service.

(a) it is necessary for the organisation to collect the family, social or medical history of an individual (the patient) to provide a health service to the patient; and

the health information about the third party is part of the family, social or medical history necessary for the organisation to provide the health service to the patient; and

the health information is collected by the organisation from the patient or, if the patient is physically or legally incapable of giving the information, a responsible person for the patient.

obligations arising on or after the application day; and

offence and civil penalty provisions contravened on or after the application day.

an undertaking given before the application day;

an application for an order made, but not decided, under subsection 95(1) of that Act before the application day;

an order made under subsection 95(2) of that Act before, on or after the application day as a result of an application made before the application day.

obligations arising on or after the application day; and

offence and civil penalty provisions contravened on or after the application day.

(a) required or permitted by this Act to be prescribed by the rules; or

necessary or convenient to be prescribed for carrying out or giving effect to this Act.

the amendments or repeals made by this Act; or

the enactment of this Act.

(a) the Healthcare Identifiers Act 2010;

(b) the My Health Records Act 2012;

(c) the Privacy Act 1988.

create an offence or civil penalty;

provide powers of:

arrest or detention; or

entry, search or seizure;

impose a tax;

set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in this Act;

directly amend the text of this Act.

(a) definition of PCEHR;

(b) definition of PCEHR system;

(c) definition of PCEHR System Operator.

(a) definition of PCEHR;

(b) definition of PCEHR System Operator.

information included in the entry in the Register that relates to the healthcare recipient;

health information connected in the My Health Record system to the healthcare recipient (including information included in a record accessible through the index service);

other information connected in the My Health Record system to the healthcare recipient, such as information relating to auditing access to the record;

back-up records of such information.

that is for:

the collection, use and disclosure of information from many sources using telecommunications services and by other means, and the holding of that information, in accordance with the healthcare recipient’s wishes or in circumstances specified in this Act; and

the assembly of that information using telecommunications services and by other means so far is it is relevant to a particular healthcare recipient, so that it can be made available, in accordance with the healthcare recipient’s wishes or in circumstances specified in this Act, to facilitate the provision of healthcare to the healthcare recipient or for purposes specified in this Act; and

that involves the performance of functions under this Act by the System Operator.

the System Operator;

a registered healthcare provider organisation;

the operator of the National Repositories Service;

a registered repository operator;

a registered portal operator;

a registered contracted service provider, so far as the contracted service provider provides services to a registered healthcare provider.

(a) definition of PCEHR;

(b) definition of PCEHR Rules;

(c) definition of PCEHR system.