My Health Records Act 2012

Without limiting subsection 109(7A), My Health Records Rules made for the purposes of that subsection (the rules) may do any or all of the following:

impose requirements on the System Operator, the Data Governance Board established by section 82, the data custodian and other entities, including procedures that must be followed, in relation to preparing, providing, collecting, accessing, using and disclosing health information and de‑identified data;

provide that any or all such requirements are enforceable for the purposes of paragraph 77A(1)(c) or subsection 78(2);

make provision in relation to the performance of the Board’s functions set out in paragraph 83(1)(a);

authorise the Board to make written policies and guidelines to be followed by other entities for the purposes of giving effect to the prescribed framework.

The data custodian has the following functions, and the rules may make provision in relation to the performance of those functions:

under the direction of the Data Governance Board and in accordance with this Act—helping to implement the prescribed framework by:

receiving de‑identified data and health information from the My Health Record system; and

as necessary—de‑identifying health information; and

as necessary—providing data linkage services (within the meaning of the rules); and

preparing and providing de‑identified data and health information to users of data and information whose use has been approved by the Data Governance Board; and

ensuring that users of de‑identified data and health information are subject to conditions of use;

any other functions conferred on the data custodian by this Act or the rules.

The rules:

must not allow the health information of a healthcare recipient to be collected, used or disclosed otherwise than with the consent of the healthcare recipient; and

must not allow de‑identified data or health information to be provided to a private health insurer (within the meaning of the Private Health Insurance Act 2007) or any other insurer (with or without the consent of the healthcare recipient); and

must not provide that any of the following is enforceable for the purposes of paragraph 77A(1)(c) or subsection 78(2):

a provision of a policy, guideline or other instrument made under the rules;

a provision of the rules that requires an entity to comply with such a policy, guideline or instrument.

If the rules make provision for the disclosure of de‑identified data or health information obtained by using or gaining access to the My Health Record system, the rules must have the effect that the data or information is to be disclosed only:

by means of a postal, telegraphic, telephonic or other like service; or

by or to a corporation to which paragraph 51(xx) of the Constitution applies; or

by or to a person within a Territory or a place acquired by the Commonwealth for a public purpose; or

by or to the Commonwealth or an authority of the Commonwealth.

The rules may make other provision in relation to de‑identified data or health information only:

to ensure that collection, use and disclosure of data or information does not result in an interference with privacy of the kind the Commonwealth has international obligations to protect against, including under the International Covenant on Civil and Political Rights (in particular Article 17 of the Covenant); or

The text of the Covenant is set out in Australian Treaty Series 1980 No. 23 ([1980] ATS 23). In 2018, a text of a Covenant in the Australian Treaties Series was accessible through the Australian Treaties Library on the AustLII website (http://www.austlii.edu.au).

for purposes related to collecting, preparing, analysing or publishing statistics; or

by providing for data or information to be collected from or by, used by or disclosed by or to, any of the following:

a corporation to which paragraph 51(xx) of the Constitution applies;

a person within a Territory or a place acquired by the Commonwealth for a public purpose;

the Commonwealth or an authority of the Commonwealth.