Health Legislation Amendment (Modernising My Health Record—Sharing by Default) Act 2025

No. 8, 2025

An Act to amend the law relating to electronic health records and medicare benefits, and for other purposes

Contents

1 Short title 2

2 Commencement 2

3 Schedules 3

Schedule 1—Main amendments 4

Part 1—My Health Records 4

My Health Records Act 2012 4

Part 2—Medicare benefits 26

Division 1—Amendments 26

Health Insurance Act 1973 26

Division 2—Amendments commencing if the Health Insurance Legislation Amendment (Assignment of Medicare Benefits) Act 2024 does not commence 40

Health Insurance Act 1973 40

Division 3—Amendments commencing if the Health Insurance Legislation Amendment (Assignment of Medicare Benefits) Act 2024 commences 41

Health Insurance Act 1973 41

Division 4—Amendments commencing if the Administrative Review Tribunal (Miscellaneous Measures) Act 2025 commences 41

Health Insurance Act 1973 41

Schedule 2—Other amendments 42

A New Tax System (Goods and Services Tax) Act 1999 42

Fringe Benefits Tax Assessment Act 1986 42

Health Insurance Act 1973 42

National Health Act 1953 44

National Health Reform Act 2011 47

Private Health Insurance Act 2007 48

Health Legislation Amendment (Modernising My Health Record—Sharing by Default) Act 2025

No. 8, 2025

An Act to amend the law relating to electronic health records and medicare benefits, and for other purposes

[Assented to 14 February 2025]

The Parliament of Australia enacts:

1 Short title

This Act is the Health Legislation Amendment (Modernising My Health Record—Sharing by Default) Act 2025.

2 Commencement 1

Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.

Commencement information	Commencement information	Commencement information
Column 1	Column 2	Column 3
Provisions	Commencement	Date/Details
1. Sections 1 to 3 and anything in this Act not elsewhere covered by this table	The day this Act receives the Royal Assent.	14 February 2025
2. Schedule 1, Part 1	The day after this Act receives the Royal Assent.	15 February 2025
3. Schedule 1, Part 2, Division 1	The day after this Act receives the Royal Assent.	15 February 2025
4. Schedule 1, Part 2, Division 2	The day after this Act receives the Royal Assent. However, the provisions do not commence at all if Schedule 1 to the Health Insurance Legislation Amendment (Assignment of Medicare Benefits) Act 2024 commences on or before that day.	15 February 2025
5. Schedule 1, Part 2, Division 3	The later of: (a) the start of the day after this Act receives the Royal Assent; and (b) immediately after the commencement of Schedule 1 to the Health Insurance Legislation Amendment (Assignment of Medicare Benefits) Act 2024.
6. Schedule 1, Part 2, Division 4	The later of: (a) immediately after the commencement of the provisions covered by table item 3; and (b) the commencement of Schedule 2 to the Administrative Review Tribunal (Miscellaneous Measures) Act 2025.
7. Schedule 2	The day after this Act receives the Royal Assent.	15 February 2025

Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.

Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.

3 Schedules

Legislation that is specified in a Schedule to this Act is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this Act has effect according to its terms.

Main amendments

My Health Records Act 2012

1 Section 3

Omit “voluntary national public system for the provision of access to health information relating to recipients of healthcare”, substitute “national public system for the provision of access to health information relating to recipients of healthcare that is voluntary for those recipients”.

2 Section 4 (paragraph beginning “If a healthcare recipient is registered”)

After “a healthcare provider may”, insert “(or, in some circumstances, must)”.

3 Section 5

Insert:

approved registered repository operator means a healthcare provider organisation that:

finally determined: see section 10C.

prescribed healthcare provider organisation means a healthcare provider organisation that is:

share by default provision: each of the following is a share by default provision:

shares with the My Health Record system: see section 10A.

upload exception applies: see section 10B.

is a registered repository operator; and

satisfies the requirements (if any) specified in the My Health Records Rules.

a corporation to which paragraph 51(xx) of the Constitution applies; and

of a kind specified in the My Health Records Rules.

section 41A (prescribed healthcare provider organisations must be registered);

section 78A (some information must be shared with the My Health Record system unless exception applies);

section 78C (record keeping requirements in relation to sharing information with the My Health Record system);

section 78D (prescribed healthcare provider organisations must display notice when not sharing information with the My Health Record system);

(e) Health Insurance Act 1973;section 19AD (medicare benefits not payable in respect of certain professional services) of the

(f) Health Insurance Act 1973;section 19AF (record keeping requirement) of the

(g) Health Insurance Act 1973;section 19AG (advance payment before information is shared with the My Health Record system) of the

(h) Health Insurance Act 1973.section 19AH (recovery of payments) of the

4 After section 10

Insert:

10A Sharing information with the My Health Record system 1

(1) An entity other than an approved registered repository operator shares with the My Health Record system information if the entity uploads, for the purposes of the My Health Record system, the information to:

a repository that forms part of the National Repositories Service; or

a repository to which a registered repository operator’s registration relates.

(2) An approved registered repository operator shares with the My Health Record system information if the registered repository operator:

uploads, for the purposes of the My Health Record system, the information to a repository that forms part of the National Repositories Service; or

takes, in relation to the information, the action specified in the My Health Records Rules.

10B When an upload exception applies

An upload exception applies in relation to an entity sharing with the My Health Record system information about healthcare provided to an individual if:

that the information must not be uploaded to the My Health Record system; or

the individual is not a registered healthcare recipient; or

either:

the individual, or an authorised representative or nominated representative of the individual, has advised the entity; or

the entity has otherwise been informed that the individual, or an authorised representative or nominated representative of the individual, has advised;

an individual healthcare provider reasonably believes that the information should not be shared with the My Health Record system because of a serious concern for the health, safety or wellbeing of the individual; or

the information cannot be shared with the My Health Record system due to circumstances beyond the reasonable control of the entity.

10C When an application is finally determined 1

(1) An application under finally determined when the System Operator has made a decision (the original decision) on the application and:section 41B, 42 or 78B is

the original decision is to approve the application; or

no notice of the original decision is given because subsection 97(2A) applies; or

no notice asking the System Operator to reconsider the original decision is given within the period mentioned in subsection 97(4); or

all of the following apply:

a notice asking the System Operator to reconsider the original decision is given within the period mentioned in subsection 97(4);

the System Operator reconsiders the original decision;

iii

(iii) no application is made to the Administrative Review Tribunal within the period mentioned in Administrative Review Tribunal Act 2024 for review of the System Operator’s reconsideration decision; orsection 18 of the

(e) an application is made to the Administrative Review Tribunal within the period mentioned in Administrative Review Tribunal Act 2024 for review of the System Operator’s reconsideration of the original decision, the Administrative Review Tribunal decides the application and one of the following applies:section 18 of the

subsection 123(1) of that Act does not apply in relation to the Administrative Review Tribunal’s decision;

no application is made under section 123 of that Act within the period mentioned in section 125 of that Act to refer the Administrative Review Tribunal’s decision to the guidance and appeals panel;

iii

any application that is made under section 123 of that Act within the period mentioned in section 125 of that Act to refer the Administrative Review Tribunal’s decision to the guidance and appeals panel is refused; or

both of the following apply:

(i) the President of the Administrative Review Tribunal refers the Administrative Review Tribunal’s decision on the application for review of the System Operator’s reconsideration of the original decision to the guidance and appeals panel under Administrative Review Tribunal Act 2024;section 123 of the

(ii) the Administrative Review Tribunal makes a decision on the guidance and appeals panel application (within the meaning of the Administrative Review Tribunal Act 2024) taken to be made because of the referral.

(2) An application under finally determined when the System Operator ceases to consider the application under subsection 41B(4) or 78B(4).section 41B or 78B is

5 After Division 1 of Part 3

Insert:

41A Prescribed healthcare provider organisations must be registered 1

A prescribed healthcare provider organisation contravenes this subsection if the healthcare provider organisation is not a registered healthcare provider organisation and is not an approved registered repository operator.

Civil penalty: 250 penalty units.

Note: A person who wishes to rely on subsection (2) in proceedings for a civil penalty order bears an evidential burden in relation to the matters in that subsection: see section 96 of the Regulatory Powers Act.

However, subsection (1) does not apply:

during any period starting when the healthcare provider organisation applies to the System Operator under section 41B or 42 and ending when the application is finally determined; or

during any period approved by the System Operator under section 41B in relation to the healthcare provider organisation.

41B System Operator may approve a period during which registration is not required

Application

Further information may be required

Approval by System Operator

A healthcare provider organisation may apply to the System Operator to approve a period during which subsection 41A(1) does not apply to the healthcare provider organisation.

The application must:

be in the approved form; and

include, or be accompanied by, the information and documents required by the form; and

be lodged at a place, or by a means, specified in the form.

If a healthcare provider organisation makes an application under subsection (1), the System Operator may, by notice in writing, require the healthcare provider organisation to give the System Operator, within the period specified in the notice, such further information in relation to the application as the System Operator requires.

The System Operator is not required to decide the application, and may cease considering the application, if the healthcare provider organisation does not provide the required information within the period specified in the notice.

On application under subsection (1) or on the System Operator’s initiative, the System Operator may, by written notice to a healthcare provider organisation, approve a period during which subsection 41A(1) does not apply to the healthcare provider organisation.

In deciding whether to approve the period, the System Operator must take into account the following:

the healthcare provider organisation’s size and technological readiness;

the potential disruption (if any) to the provision of healthcare if the healthcare provider organisation is not a registered healthcare provider organisation;

any other matter the System Operator considers relevant.

An approval under subsection (5) is not a legislative instrument.

6 Paragraph 43(b)

Omit “Rules; and”, substitute “Rules.”.

7 Paragraph 43(c)

Repeal the paragraph.

8 After subsection 51(3)

Insert:

The System Operator may, in writing, decide to cancel or suspend the registration of a healthcare provider organisation if the System Operator is not satisfied that the healthcare provider organisation is able to comply with the conditions of the healthcare provider organisation’s registration.

9 Subsection 51(5)

After “(3)”, insert “or (3A)”.

10 Paragraphs 53(1)(a) and (4)(a)

After “(3),”, insert “(3A),”.

11 After paragraph 54(a)

Insert:

(ab) if the entity is a registered healthcare provider organisation or registered repository operator—the entity is taken not to be registered for the purposes of paragraph (a) of the definition of approved registered repository operator in section 5 and sections 10A, 41A, 78A, 78C and 78D; and

12 After subparagraph 69(1)(b)(ii)

Insert:

iia

a share by default provision; or

13 At the end of Subdivision B of Division 2 of Part 4

Add:

70AA Collection, use and disclosure in relation to compliance with share by default provisions 1

Subject to section 69, the System Operator is authorised to collect, use and disclose to a person covered by subsection (2) information covered by subsection (3) for the purposes of monitoring, investigating or enforcing compliance with a share by default provision.

This subsection covers the following persons:

the Chief Executive Medicare;

the Secretary of the Department;

(c) a Commonwealth entity (within the meaning of the Public Governance, Performance and Accountability Act 2013) (if any) specified in the My Health Records Rules.

This subsection covers health information that is:

included in a healthcare recipient’s My Health Record; and

of a kind specified in the My Health Records Rules.

Subsection (1) does not authorise the System Operator to collect, use or disclose healthcare recipient-only notes.

14 At the end of Part 4

Add:

73C Collection, use and disclosure of health information in relation to compliance with share by default provisions 1

A person covered by subsection (2) is authorised to collect, use and disclose, for the purposes of monitoring, investigating or enforcing compliance with a share by default provision, health information disclosed to the person under section 70AA.

This subsection covers the following persons:

the Chief Executive Medicare;

the Secretary of the Department;

(c) a Commonwealth entity (within the meaning of the Public Governance, Performance and Accountability Act 2013) (if any) specified in the My Health Records Rules for the purposes of paragraph 70AA(2)(c).

73D Collection, use and disclosure of healthcare identifiers and identifying information in relation to compliance with share by default provisions 1

An entity mentioned in column 1 of an item of the following table is authorised to take action of the kind described in column 2 of that item with information of the kind described in column 3 of that item in the circumstances described in column 4 of that item.

15 After section 76

Insert:

76A Requirement to notify if healthcare provider organisation ceases to be able to meet conditions on registration

A registered healthcare provider organisation must give written notice to the System Operator within 14 days of ceasing to be able to comply with the conditions of the healthcare provider organisation’s registration.

Civil penalty: 1,500 penalty units.

16 At the end of Part 5

Add:

78A Some information must be shared with the My Health Record system unless exception applies

Civil penalties

the healthcare provider organisation must share with the My Health Record system within the period specified in the My Health Records Rules the information specified in the My Health Records Rules for the kind of healthcare.

Civil penalty: 30 penalty units.

Exceptions

Note 1: For when an upload exception applies, see section 10B.

Note 2: A person who wishes to rely on subsection (3) in proceedings for a civil penalty order bears an evidential burden in relation to the matters in that subsection: see section 96 of the Regulatory Powers Act.

If:

a prescribed healthcare provider organisation is:

a registered healthcare provider organisation; or

an approved registered repository operator; and

healthcare of a kind specified in the My Health Records Rules for the healthcare provider organisation is provided to a healthcare recipient;

If:

a prescribed healthcare provider organisation is:

a registered healthcare provider organisation; or

an approved registered repository operator; and

a record of a kind specified in the My Health Records Rules for the healthcare provider organisation is created in relation to healthcare provided to a healthcare recipient;

Subsections (1) and (2) do not apply if:

an upload exception applies in relation to the healthcare provider organisation sharing the information with the My Health Record system; or

another entity has shared the information with the My Health Record system; or

a law of a State or Territory prescribed by the regulations for the purposes of subsection 41(4) or subclause 9(3) of Schedule 1 prevents the healthcare provider organisation from sharing the information with the My Health Record system; or

the information is specified in the My Health Records Rules; or

the healthcare provider organisation is specified in the My Health Records Rules; or

the period within which the information is required to be shared with the My Health Record system ends:

during any upload suspension period determined under subsection (4); or

during the period starting when the healthcare provider organisation applies to the System Operator under section 78B and ending when the application is finally determined; or

iii

during a period approved by the System Operator under section 78B in relation to the healthcare provider organisation; or

(iv) during the period starting when the healthcare provider organisation applies to the System Operator under Health Insurance Act 1973 and ending when the application is resolved (within the meaning of that Act); orsection 19AE of the

(v) during a period approved by the System Operator under Health Insurance Act 1973 in relation to the healthcare provider organisation.section 19AE of the

The Secretary of the Department may, by legislative instrument, determine that a period is an upload suspension period.

(5) Without limiting this section or subsection 33(3A) of the Acts Interpretation Act 1901, the My Health Records Rules made for the purposes of subsections (1) and (2) may specify different periods for different healthcare provider organisations or different kinds of healthcare or record.

78B System Operator may approve a period during which sharing with the My Health Record system is not required

Application

Further information may be required

Approval by System Operator

A prescribed healthcare provider organisation may apply to the System Operator to approve a period during which the healthcare provider organisation is not required to share information with the My Health Record system.

The application must:

be in the approved form; and

include, or be accompanied by, the information and documents required by the form; and

be lodged at a place, or by a means, specified in the form.

If a prescribed healthcare provider organisation makes an application under subsection (1), the System Operator may, by notice in writing, require the healthcare provider organisation to give the System Operator, within the period specified in the notice, such further information in relation to the application as the System Operator requires.

On application under subsection (1) or on the System Operator’s initiative, the System Operator may, by written notice to a prescribed healthcare provider organisation, approve a period during which the healthcare provider organisation is not required to share information with the My Health Record system.

In deciding whether to approve the period, the System Operator must take into account the following:

the healthcare provider organisation’s size and technological readiness;

the potential disruption (if any) to the provision of healthcare if the healthcare provider organisation does not share information with the My Health Record system;

any other matter the System Operator considers relevant.

An approval under subsection (5) is not a legislative instrument.

78C Record keeping requirements in relation to sharing information with the My Health Record system

Requirement to keep evidence of upload exceptions

the healthcare provider organisation must keep for a period of 2 years starting on the date the healthcare is provided evidence that an upload exception applied that meets the requirements (if any) specified in the My Health Records Rules.

Civil penalty: 10 penalty units.

Note: A person who wishes to rely on subsection (2) in proceedings for a civil penalty order bears an evidential burden in relation to the matter in that subsection: see section 96 of the Regulatory Powers Act.

Requirement to produce evidence when required

Civil penalty: 10 penalty units.

Handling of evidence produced

If:

a prescribed healthcare provider organisation is:

a registered healthcare provider organisation; or

an approved registered repository operator; and

either:

healthcare of a kind specified in the My Health Records Rules for the purposes of subsection 78A(1) for the healthcare provider organisation is provided to a healthcare recipient; or

a record of a kind specified in the My Health Records Rules for the purposes of subsection 78A(2) for the healthcare provider organisation is created in relation to healthcare provided to a healthcare recipient; and

an upload exception applies in relation to the healthcare provider organisation sharing information about the healthcare with the My Health Record system;

Subsection (1) does not apply if the healthcare provider organisation has a reasonable excuse.

The System Operator or the Secretary of the Department may, by written notice given to a healthcare provider organisation, require the healthcare provider organisation to produce to the System Operator or the Secretary of the Department, within the period and in the manner specified in the notice, evidence kept by the healthcare provider organisation under subsection (1).

A healthcare provider organisation must comply with a requirement under subsection (3).

The System Operator or the Secretary of the Department may make and retain copies of, or take and retain extracts from, any evidence produced under this section.

The System Operator or the Secretary of the Department may take, and retain for as long as is necessary, possession of evidence produced under this section.

The person otherwise entitled to possession of the evidence is entitled to be supplied, as soon as practicable, with a copy certified by the System Operator or the Secretary of the Department to be a true copy.

The certified copy must be received in all courts and tribunals as evidence as if it were the original.

Until a certified copy is supplied, the System Operator or the Secretary of the Department must, at such times and places as the System Operator or the Secretary of the Department thinks appropriate, permit the person otherwise entitled to possession of the evidence, or a person authorised by that person, to inspect and make copies of, or take extracts from, the evidence.

78D Prescribed healthcare provider organisations must display notice when not sharing information with the My Health Record system 1

A prescribed healthcare provider organisation must display a notice in accordance with subsection (2) during the following periods:

a period for which the healthcare provider organisation is not a registered healthcare provider organisation and is not an approved registered repository operator;

a period starting when the healthcare provider organisation applies to the System Operator under section 78B and ending when the application is finally determined;

a period approved by the System Operator under section 78B in relation to the healthcare provider organisation;

(d) a period starting when the healthcare provider organisation applies to the System Operator under Health Insurance Act 1973 and ending when the application is resolved (within the meaning of that Act);section 19AE of the

(e) a period approved by the System Operator under Health Insurance Act 1973 in relation to the healthcare provider organisation.section 19AE of the

Civil penalty: 10 penalty units.

The notice must:

indicate that the healthcare provider organisation is not currently sharing information with the My Health Record system; and

if paragraph (1)(a) applies—indicate that medicare benefits will not be payable in respect of healthcare covered by subsection (3); and

be displayed in a prominent place:

at each of the healthcare provider organisation’s premises where healthcare covered by subsection (3) is provided; and

on the healthcare provider organisation’s website; and

iii

on any online facility the healthcare provider organisation uses to allow healthcare recipients to arrange bookings for healthcare covered by subsection (3).

For the purposes of subsection (2), this subsection covers:

healthcare of a kind (if any) specified for the purposes of subsection 78A(1) for the healthcare provider organisation; and

healthcare to which records of a kind (if any) specified for the purposes of subsection 78A(2) for the healthcare provider organisation relate.

17 Subsection 79(2)

Repeal the subsection, substitute:

Authorised applicant

For the purposes of Part 4 of the Regulatory Powers Act, each person mentioned in column 1 of an item of the following table is an authorised applicant in relation to a provision mentioned in column 2 of the item:

The Secretary of the Department may, in writing, delegate the Secretary’s powers and functions under Part 4 of the Regulatory Powers Act in relation to the provisions mentioned in item 2 of the table in subsection (2) to an SES employee, or acting SES employee, in the Department.

A person exercising powers or performing functions under a delegation under subsection (2A) must comply with any directions of the Secretary of the Department.

18 After Division 1 of Part 6

Insert:

79A Infringement notices

Provisions subject to an infringement notice

Note: Part 5 of the Regulatory Powers Act creates a framework for using infringement notices in relation to provisions.

Infringement officer

Relevant chief executive

Extension to external Territories

The following provisions are subject to an infringement notice under Part 5 of the Regulatory Powers Act:

subsection 41A(1);

subsection 78C(4);

subsection 78D(1).

For the purposes of Part 5 of the Regulatory Powers Act, an SES employee, or acting SES employee, in the Department authorised, in writing, by the Secretary of the Department for the purposes of this subsection is an infringement officer in relation to the provisions mentioned in subsection (1).

For the purposes of Part 5 of the Regulatory Powers Act, the Secretary of the Department is the relevant chief executive in relation to the provisions mentioned in subsection (1).

The relevant chief executive may, in writing, delegate the relevant chief executive’s powers and functions under Part 5 of the Regulatory Powers Act in relation to the provisions mentioned in subsection (1) to an SES employee, or acting SES employee, in the Department.

A person exercising powers or performing functions under a delegation under subsection (4) must comply with any directions of the relevant chief executive.

Part 5 of the Regulatory Powers Act, as that Part applies in relation to the provisions mentioned in subsection (1), extends to every external Territory.

19 At the end of subsection 80(2)

Add:

; (c) the Secretary of the Department.

20 At the end of subsection 81(2)

Add:

; (c) the Secretary of the Department.

21 After paragraph 97(1)(b)

Insert:

a decision under section 41B to refuse an application to approve a period;

22 Paragraph 97(1)(c)

Omit “health”, substitute “healthcare”.

23 At the end of subsection 97(1)

Add:

; (j) a decision under section 78B to refuse an application to approve a period.

24 Application provisions 1

(1) The amendments of My Health Records Act 2012 made by this Schedule apply in relation to any application made after the commencement of this item.section 43 of the

(2) The amendments of sections 51, 53 and 54 of the My Health Records Act 2012 made by this Schedule apply in relation to any registration of a healthcare recipient or other entity that is in effect after the commencement of this item.

(3) Sections 70AA and 73C of the My Health Records Act 2012, as inserted by this Schedule, apply in relation to health information created after the commencement of this item.

(4) Section 76A of the My Health Records Act 2012, as inserted by this Schedule, applies in relation to any registration of a healthcare provider organisation that is in effect after the commencement of this item.

(5) Section 78A of the My Health Records Act 2012, as inserted by this Schedule, applies in relation to any information created after the commencement of this item.

(6) The amendments of My Health Records Act 2012 made by this Schedule apply in relation to any application under section 82 of the Regulatory Powers Act in relation to a civil penalty provision of the My Health Records Act 2012 made after the commencement of this item.section 79 of the

Health Insurance Act 1973

25 Subsection 3(1)

Insert:

associate, of a person in relation to a professional service: see subsection 19AD(4).

authorised representative has the same meaning as in the My Health Records Act 2012.

My Health Record system has the same meaning as in the My Health Records Act 2012.

My Health Record System Operator means the System Operator within the meaning of the My Health Records Act 2012.

nominated representative has the same meaning as in the My Health Records Act 2012.

resolved, in relation to an application under section 19AE: see subsections 19AE(10) and (11).

shares with the My Health Record system has the same meaning as in the My Health Records Act 2012.

upload exception applies: see subsection 19AD(3).

upload rules: see section 19AI.

26 After section 19AC

Insert:

19AD My Health Record—medicare benefits not payable in respect of certain professional services 1

Medicare benefit is not payable in respect of a professional service specified in the upload rules rendered by or on behalf of a person specified for the service in the upload rules unless the person shares with the My Health Record system within the period specified in the upload rules the information specified in the upload rules for the service.

Subsection (1) does not apply if:

an upload exception applies in relation to the person sharing the information with the My Health Record system; or

(b) another entity (within the meaning of the My Health Records Act 2012) has shared the information with the My Health Record system; or

(c) a law of a State or Territory prescribed by regulations for the purposes of subsection 41(4) of, or subclause 9(3) of Schedule 1 to, the My Health Records Act 2012 prevents the person or any associate of the person for the service from sharing the information with the My Health Record system; or

(d) the information is specified in My Health Records Rules made for the purposes of paragraph 78A(3)(d) of the My Health Records Act 2012; or

(e) the person or an associate of the person for the service is specified in My Health Records Rules made for the purposes of paragraph 78A(3)(e) of the My Health Records Act 2012; or

the end of the period specified in the upload rules for the purposes of subsection (1) occurs:

during the period starting when the person or an associate of the person for the service applies to the My Health Record System Operator under section 19AE and ending when the application is resolved; or

during a period approved by the My Health Record System Operator under section 19AE in relation to the person or an associate of the person for the service; or

iii

(iii) during any upload suspension period determined under subsection 78A(4) of the My Health Records Act 2012; or

during the period starting when the person or an associate of the person for the service applies to the My Health Record System Operator under section 41B, 42 or 78B of that Act and ending when the application is finally determined (within the meaning of that Act); or

during the period approved by the My Health Record System Operator under section 41B or 78B of that Act in relation to the person or an associate of the person for the service.

(3) An upload exception applies in relation to a person sharing with the My Health Record system information about a professional service rendered to an individual if:

(a) the individual is not a registered healthcare recipient (within the meaning of the My Health Records Act 2012); or

either:

the individual, or an authorised representative or nominated representative of the individual, has advised the person or an associate of the person for the service; or

the person or an associate of the person for the service has otherwise been informed that the individual, or an authorised representative or nominated representative of the individual, has advised;

that the information must not be uploaded to the My Health Record system; or

(c) an individual healthcare provider (within the meaning of the My Health Records Act 2012) reasonably believes that the information should not be shared with the My Health Record system because of a serious concern for the health, safety or wellbeing of the individual; or

the information cannot be shared with the My Health Record system due to circumstances beyond the reasonable control of the person and any associate of the person for the service.

(4) A healthcare provider organisation (within the meaning of the My Health Records Act 2012) is an associate of a person in relation to a professional service in the following circumstances:

(a) the person renders the service as an employee (within the meaning of the My Health Records Act 2012) of the healthcare provider organisation;

(b) another person, as an employee (within the meaning of the My Health Records Act 2012) of the healthcare provider organisation, renders the service on behalf of the person;

the healthcare provider organisation provides support services or facilities to facilitate the rendering of the service by or on behalf of the person;

the circumstances (if any) specified in the upload rules.

(5) Without limiting this section or subsection 33(3A) of the Acts Interpretation Act 1901, upload rules made for the purposes of subsection (1) may specify different periods for different professional services or different kinds of person.

19AE My Health Record—approval of period during which sharing with the My Health Record system is not required

Scope

Application

Note: The My Health Record System Operator may approve the same form, and use the same process, for the purposes of this section and My Health Records Act 2012.section 78B of the

Further information may be required

Approval by My Health Record System Operator

Review of decisions

(1) This section applies in relation to an entity (within the meaning of the My Health Records Act 2012) that is:

a person who renders a professional service for which the person is specified in the upload rules for the purposes of subsection 19AD(1); or

a person on whose behalf a professional service for which the person is specified in the upload rules for the purposes of subsection 19AD(1) is rendered; or

an associate of a person in relation to a professional service for which the person is specified in the upload rules for the purposes of subsection 19AD(1).

An entity may apply to the My Health Record System Operator to approve a period during which the entity is not required to share information with the My Health Record system.

The application must:

be in the form approved, in writing, by the My Health Record System Operator; and

include, or be accompanied by, the information and documents required by the form; and

be lodged at a place, or by a means, specified in the form.

If an entity makes an application under subsection (2), the My Health Record System Operator may, by notice in writing, require the entity to give the My Health Record System Operator, within the period specified in the notice, such further information in relation to the application as the My Health Record System Operator requires.

The My Health Record System Operator is not required to decide the application, and may cease considering the application, if the entity does not provide the required information within the period specified in the notice.

On application under subsection (2) or on the My Health Record System Operator’s initiative, the My Health Record System Operator may, by written notice to an entity, approve a period during which the entity is not required to share information with the My Health Record system.

In deciding whether to approve the period, the My Health Record System Operator must take into account the following:

the entity’s size and technological readiness;

the potential disruption (if any) to the provision of healthcare if the entity does not share information with the My Health Record system;

any other matter the My Health Record System Operator considers relevant.

An approval under subsection (6) is not a legislative instrument.

(9) Section 97 (review of decisions) of the My Health Records Act 2012 applies to a decision under this section to refuse an application to approve a period.

(10) An application under this section is resolved when the My Health Record System Operator has made a decision (the original decision) on the application and:

the original decision is to approve the application; or

(b) no notice of the original decision is given because subsection 97(2A) of the My Health Records Act 2012 applies; or

(c) no notice asking the My Health Record System Operator to reconsider the original decision is given within the period mentioned in subsection 97(4) of the My Health Records Act 2012; or

all of the following apply:

(i) a notice asking the My Health Record System Operator to reconsider the original decision is given within the period mentioned in subsection 97(4) of the My Health Records Act 2012;

the My Health Record System Operator reconsiders the original decision;

iii

(iii) no application is made to the Administrative Review Tribunal within the period mentioned in Administrative Review Tribunal Act 2024 for review of the My Health Record System Operator’s reconsideration decision; orsection 18 of the

(e) an application is made to the Administrative Review Tribunal within the period mentioned in Administrative Review Tribunal Act 2024 for review of the My Health Record System Operator’s reconsideration of the original decision, the Administrative Review Tribunal decides the application and one of the following applies:section 18 of the

subsection 123(1) of that Act does not apply in relation to the Administrative Review Tribunal’s decision;

no application is made under section 123 of that Act within the period mentioned in section 125 of that Act to refer the Administrative Review Tribunal’s decision to the guidance and appeals panel;

iii

both of the following apply:

(i) the President of the Administrative Review Tribunal refers the Administrative Review Tribunal’s decision on the application for review of the My Health Record System Operator’s reconsideration of the original decision to the guidance and appeals panel under Administrative Review Tribunal Act 2024;section 123 of the

(ii) the Administrative Review Tribunal makes a decision on the guidance and appeals panel application (within the meaning of the Administrative Review Tribunal Act 2024) taken to be made because of the referral.

(11) An application under this section is resolved when the My Health Record System Operator ceases to consider the application under subsection (5).

19AF My Health Record—record keeping requirement

Requirement to keep evidence of upload exceptions

the person by or on whose behalf the service was rendered must keep, or ensure another person keeps, for a period of 2 years starting on the day the service was rendered, evidence that an upload exception applied that meets the requirements (if any) specified in the upload rules.

Civil penalty: 10 penalty units.

Note: A person who wishes to rely on subsection (2) in proceedings for a civil penalty order bears an evidential burden in relation to the matter in that subsection (see section 130H).

Requirement to produce evidence when required

Civil penalty: 10 penalty units.

Handling of evidence produced

If:

medicare benefit is payable in respect of a professional service specified in the upload rules for the purposes of subsection 19AD(1); and

medicare benefit would not have been payable in respect of the service if an upload exception had not applied;

Subsection (1) does not apply if the person has a reasonable excuse.

(3) If the Chief Executive Medicare reasonably believes that a person has possession, custody or control of evidence mentioned in subsection (1) in relation to a professional service, the Chief Executive Medicare may, by written notice given to the person, require the person to produce the evidence to the Chief Executive Medicare or a Departmental employee (within the meaning of the Human Services (Medicare) Act 1973), within the period and in the manner specified in the notice.

Subsection (3) does not apply in relation to:

the person in respect of whom the service was rendered; or

the person who incurred the medical expenses in respect of the service.

A person must comply with a requirement under subsection (3).

(6) The Chief Executive Medicare or a Departmental employee (within the meaning of the Human Services (Medicare) Act 1973) may make and retain copies of, or take and retain extracts from, any evidence produced under this section.

(7) The Chief Executive Medicare or a Departmental employee (within the meaning of the Human Services (Medicare) Act 1973) may take, and retain for as long as is necessary, possession of evidence produced under this section.

(8) The person otherwise entitled to possession of the evidence is entitled to be supplied, as soon as practicable, with a copy certified by the Chief Executive Medicare or a Departmental employee (within the meaning of the Human Services (Medicare) Act 1973) to be a true copy.

The certified copy must be received in all courts and tribunals as evidence as if it were the original.

(10) Until a certified copy is supplied, the Chief Executive Medicare or Departmental employee (within the meaning of the Human Services (Medicare) Act 1973) must, at such times and places as the Chief Executive Medicare or employee thinks appropriate, permit the person otherwise entitled to possession of the evidence, or a person authorised by that person, to inspect and make copies of, or take extracts from, the evidence.

19AG My Health Record—advance payment before information is shared with the My Health Record system

Amounts that may become payable under section 10

A payment, on account of an amount that would but for section 19AD be payable under section 10 in respect of a professional service, may be made, on the terms and conditions (if any) determined under subsection (2).

The Secretary may, by legislative instrument, determine terms and conditions for payments on account of amounts that would be payable but for section 19AD.

A payment on account of an amount that would be payable but for section 19AD is to be made to the person to whom the amount would be paid if it were payable.

Making a payment under this section on account of an amount satisfies any requirement for the Chief Executive Medicare on behalf of the Commonwealth to pay the amount.

19AH My Health Record—recovery of payments

Scope

Amounts not payable

Amounts not evidenced

an amount equal to the relevant amount is recoverable as a debt due to the Commonwealth from the service provider or from the estate of the service provider.

then, to the extent that the relevant amount is not properly substantiated, that amount is recoverable as a debt due to the Commonwealth from the service provider or from the estate of the service provider.

General

This section applies in relation to:

(a) an amount (a relevant amount) paid under section 19AG on account of an amount that would but for section 19AD be payable under section 10 in respect of a professional service rendered by or on behalf of a person (the service provider); and

(b) an amount (a relevant amount) of medicare benefit paid in respect of a professional service specified in the upload rules for the purposes of subsection 19AD(1) rendered by or on behalf of a person (the service provider) specified for the service in the upload rules for the purposes of that subsection.

Subsections (3), (4), (6) and (8) apply whether the relevant amount was paid to the service provider or another person.

If, at the end of the period specified in the upload rules for the purposes of subsection 19AD(1), medicare benefit is not payable in respect of the professional service under section 19AD, an amount equal to the relevant amount is recoverable as a debt due to the Commonwealth from the service provider or from the estate of the service provider.

If:

the service provider is required, by a notice given under subsection 19AF(3), to produce evidence in relation to the professional service; and

the service provider does not comply with the requirement within the period set out in the notice;

Subsection (4) does not apply if the service provider satisfies the Chief Executive Medicare that the service provider’s non-compliance is due to circumstances beyond the service provider’s control.

If:

the service provider is required, by a notice given under subsection 19AF(3), to produce evidence in relation to the professional service; and

the service provider complies with the requirement within the period set out in the notice; and

the evidence produced does not properly substantiate (wholly or partly) that the relevant amount is payable in accordance with section 19AD;

Subsection (6) does not apply if the service provider satisfies the Chief Executive Medicare that the reason that the evidence produced does not properly substantiate that the relevant amount is payable in accordance with section 19AD is due to circumstances beyond the service provider’s control.

If:

(a) a person (the notice recipient) other than the service provider is required, by a notice given under subsection 19AF(3), to produce evidence in relation to the professional service; and

the notice recipient complies with the requirement within the period set out in the notice; and

the evidence produced does not properly substantiate (wholly or partly) that the relevant amount is payable in accordance with section 19AD;

Subsection (8) does not apply if the service provider satisfies the Chief Executive Medicare that the reason that the evidence produced does not properly substantiate that the relevant amount is payable in accordance with section 19AD is due to circumstances beyond the control of the service provider and the notice recipient.

To avoid doubt, for the purposes of this section and sections 129AAH and 129AAJ, the relevant amount is payable in accordance with section 19AD if section 19AD does not prevent payment of medicare benefit in respect of the professional service.

To avoid doubt, an amount paid purportedly by way of benefit or payment under this Act is recoverable under this section once only.

This section does not limit, and is not limited by, any other provision of this Act that relates to payment of amounts to the Commonwealth.

19AI My Health Record—upload rules 1

(1) The Minister may, by legislative instrument, make rules (the upload rules) prescribing matters required or permitted by this Act to be prescribed by the upload rules.

To avoid doubt, the upload rules may not do the following:

create an offence or civil penalty;

provide powers of:

arrest or detention; or

entry, search or seizure;

impose a tax;

set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in this Act;

directly amend the text of this Act.

Upload rules that are inconsistent with the regulations have no effect to the extent of the inconsistency, but upload rules are taken to be consistent with the regulations to the extent that the rules are capable of operating concurrently with the regulations.

27 Subsection 129AADA(1)

After “notice under subsection”, insert “19AF(3) or”.

28 Before subparagraph 129AADA(2)(b)(i)

Insert:

if a notice is given under subsection 129AAH(1A) that the amount paid, by way of benefit or payment under this Act in respect of the service is payable in accordance with section 19AD—on the day the notice is given; or

29 At the end of section 129AADA

Add:

This section does not limit, and is not limited by, subsection 19AF(1).

30 Before subsection 129AAH(1)

Insert:

Amount paid substantiated

the CEO must give the person written notice of the decision.

If:

(a) a person produces to the Chief Executive Medicare (the CEO), or to a Departmental employee (within the meaning of the Human Services (Medicare) Act 1973), evidence in relation to a professional service after being required under section 19AF to do so; and

the CEO decides that the evidence properly substantiates that the amount paid, by way of benefit or payment under this Act, in respect of the service is payable in accordance with section 19AD;

31 Subsection 129AAH(1) (heading)

Repeal the heading.

32 Paragraph 129AAH(1)(a)

Omit “Chief Executive Medicare (the CEO)”, substitute “CEO”.

33 Subsection 129AAH(2)

After “subsection”, insert “19AH(5) or (7) or”.

34 Subsection 129AAH(3)

After “subsection”, insert “19AH(9) or”.

35 Before subparagraph 129AAH(5)(a)(i)

Insert:

a notice under subsection (1A);

36 Subsection 129AAI(1)

After “recoverable under subsection”, insert “19AH(3), (4), (6) or (8) or”.

37 Subsection 129AAI(2)

After “subsection”, insert “19AH(5), (7) or (9) or”.

38 Subsection 129AAJ(2)

Omit all the words after “in respect of the”, substitute:

service:

if the decision relates to an amount recoverable under subsection 19AH(3), (4), (6) or (8)—is payable in accordance with section 19AD; or

in any other case—should have been paid.

39 Section 129AE

After “by way of benefit”, insert “or payment”.

40 Before paragraph 129AEF(1)(a)

Insert:

aaa

(aaa) an amount under subsection 19AH(3), (4), (6) or (8) where any rights of review by the Chief Executive Medicare (the CEO) under section 129AAJ have been exhausted or have expired;

41 Subparagraph 129AEF(1)(aa)(i)

Omit “Chief Executive Medicare (the CEO)”, substitute “the CEO”.

42 Subsection 129AEG(1)

Omit “paragraph 129AEF(1)(a)”, substitute “paragraph 129AEF(1)(aaa), (a)”.

43 After subsection 130(13)

Insert:

13A

(13A) Despite subsection (1), any of the following persons may divulge information about a person’s compliance with a share by default provision (within the meaning of the My Health Records Act 2012) to the Australian Commission on Safety and Quality in Health Care:

the Secretary;

(b) the Secretary of the Department administered by the Minister administering the My Health Records Act 2012;

the Chief Executive Medicare.

44 Application provisions

The amendments of Health Insurance Act 1973 made by this Schedule apply in relation to any notice given under that section after the commencement of this item.section 129AEG of the

Health Insurance Act 1973

45 Subsection 20A(1)

After “is payable”, insert “(or would be payable but for section 19AD)”.

46 Subsection 20A(2)

After “would be payable”, insert “(or would be payable but for section 19AD)”.

47 Paragraph 20A(2A)(a)

After “this section”, insert “and section 19AD”.

Health Insurance Act 1973

48 Subsection 20A(1)

After “is or will be payable”, insert “(or would be payable if section 19AD were disregarded)”.

Health Insurance Act 1973

49 Subparagraph 19AE(10)(f)(ii)

Omit “(within the meaning of the Administrative Review Tribunal Act 2024)”.

Other amendments

A New Tax System (Goods and Services Tax) Act 1999

1 At the end of paragraph 38-7(2)(b)

Add “(or for which medicare benefit would be payable under that Part if section 19AD of that Act were disregarded)”.

2 Section 195-1 (after paragraph (a) of the definition of medical service)

Insert:

Fringe Benefits Tax Assessment Act 1986

a service for which medicare benefit would be payable under that Part if section 19AD of that Act were disregarded; or

3 Subsection 58L(2) (subparagraph (b)(i) of the definition of medical treatment)

After “that Act”, insert “(or for which a medicare benefit would be payable under that Part if section 19AD of that Act were disregarded)”.

Health Insurance Act 1973

4 Subsection 8(1A) (at the end of paragraph (b) of the definition of patient contribution)

Add “, disregarding section 19AD”.

5 At the end of section 10AC

Add:

For the purposes of this section, disregard section 19AD when determining whether medicare benefit is payable. However, this section does not authorise payment of medicare benefit contrary to section 19AD.

6 At the end of section 10ACA

Add:

7 At the end of section 10AD

Add:

8 At the end of section 10ADA

Add:

9 Paragraphs 16B(10)(b) and (10A)(e)

After “payable”, insert “(or would be payable if section 19AD were disregarded)”.

10 Subsection 81(1) (after paragraph (a) of the definition of service)

Insert:

a service that has been rendered if, at the time it was rendered, medicare benefit would have been payable in respect of the service if section 19AD were disregarded; or

11 Subsection 81(1) (after paragraph (ab) of the definition of service)

Insert:

a service that has been initiated (whether or not it has been or will be rendered) if, at the time it was initiated, medicare benefit would have been payable in respect of the service if it had been rendered at that time and section 19AD were disregarded; or

12 Subsection 81(1) (subparagraph (c)(ii) of the definition of service)

Omit “of the service.”, substitute “of the service; or”.

13 Subsection 81(1) (after paragraph (c) of the definition of service)

Insert:

a service that:

has been rendered in connection with the provision of treatment under a relevant DVA law; and

is of a kind that, if the service had not been rendered in connection with the provision of treatment under the relevant DVA law, medicare benefit would have been payable in respect of the service if section 19AD were disregarded.

14 Subsection 82(1)

After “paragraph (c)”, insert “or (d)”.

15 Subsection 126(1)

After “payable”, insert “(or for which medicare benefit would be payable if section 19AD were disregarded)”.

16 At the end of subsection 126(2)

Add “(or for which medicare benefit would be payable if section 19AD were disregarded)”.

National Health Act 1953

17 Section 132A

Insert:

My Health Record information means health information (within in the meaning of the My Health Records Act 2012) disclosed by the System Operator (within the meaning of that Act) under section 70AA of that Act.

share by default service means a professional service specified in upload rules made for the purposes of subsection 19AD(1) of the Health Insurance Act 1973 rendered by or on behalf of a person specified for the service in the upload rules for the purposes of that subsection.

18 Section 132A (definition of permitted purpose)

Repeal the definition, substitute:

permitted purpose: see section 132AB.

19 After section 132A

Insert:

132AB Meaning of permitted purpose 1

(1) For the purposes of this Part, each of the following is a permitted purpose for the matching of data other than data that includes My Health Record information:

identifying whether a person may have, under a medicare program, claimed or been paid a benefit that exceeds the amount of the benefit that was payable to the person;

recovering overpayments of benefits under a medicare program;

detecting or investigating contraventions of a law of the Commonwealth relating to a medicare program;

detecting or investigating whether a person may have engaged in inappropriate practice;

analysing services, benefits, programs or facilities that are provided for under a medicare program, in connection with the purposes mentioned in paragraphs (a) to (d);

educating healthcare providers about medicare program requirements.

(2) For the purposes of this Part, each of the following is a permitted purpose for the matching of data that includes My Health Record information:

identifying whether a person may have, under a medicare program, claimed or been paid a benefit in relation to a share by default service that exceeds the amount of the benefit that was payable to the person;

recovering overpayments of benefits under a medicare program in relation to share by default services;

detecting or investigating contraventions of a law of the Commonwealth relating to share by default services;

analysing services, benefits, programs or facilities that are provided for under a medicare program, in connection with the purposes mentioned in paragraphs (a) to (c);

educating healthcare providers about requirements in relation to share by default services.

Note: The Privacy Act 1988 contains provisions relevant to the use and disclosure of information under this Act.

20 After paragraph 132B(1)(e)

Insert:

My Health Record information;

21 After subsection 135A(12)

Insert:

National Health Reform Act 2011

12A

(12A) Despite subsection (1), any of the following persons may divulge information about a person’s compliance with a share by default provision (within the meaning of the My Health Records Act 2012) to the Australian Commission on Safety and Quality in Health Care:

the Secretary;

(b) the Secretary of the Department administered by the Minister administering the My Health Records Act 2012;

the Chief Executive Medicare.

22 After section 54H

Insert:

54HA Disclosure in relation to compliance with share by default provisions

Scope

to monitor, investigate or enforce compliance with a share by default provision (within the meaning of the My Health Records Act 2012).

Disclosure

Private Health Insurance Act 2007

This section applies if the Commission Board Chair is satisfied that particular protected Commission information will enable or assist:

(a) the Secretary of the Department administered by the Minister administering the My Health Records Act 2012 (the My Health Records Secretary); or

(b) the System Operator (within the meaning of the My Health Records Act 2012);

If an official of the Commission is authorised by the Commission Board Chair, in writing, for the purposes of this section, the official may disclose that protected Commission information to the My Health Records Secretary or the System Operator.

(3) If protected Commission information is disclosed under subsection (2) to the My Health Records Secretary or the System Operator (the recipient), the recipient must not disclose or use the information for a purpose other than the purpose for which the information was given to the recipient.

23 Subsection 72-1(2) (at the end of the cell at table item 3, column headed “The amount of the benefit must be…”)

Add “(or could be claimed for the treatment but for Health Insurance Act 1973)”.section 19AD of the

24 At the end of section 72-1

Add:

(3) For the purposes of this section, disregard Health Insurance Act 1973 when determining whether medicare benefit is payable.section 19AD of the

25 Paragraph 121-10(3)(a)

After “payable”, insert “(or would be payable if Health Insurance Act 1973 were disregarded)”.section 19AD of the

26 Application provisions

The amendments of Health Insurance Act 1973 made by this Schedule apply in relation to any contract of insurance made after the commencement of this item.section 126 of the

[Minister’s second reading speech made in—

House of Representatives on 21 November 2024

Senate on 4 February 2025]

(152/24)