Unauthorised collection, use and disclosure of health information included in a healthcare recipient’s My Health Record
59 Unauthorised collection, use and disclosure of health information included in a healthcare recipient’s My Health Record
A person must not collect from the My Health Record system health information included in a healthcare recipient’s My Health Record if the collection by the person is not authorised under Division 2, and the person knows or is reckless as to that fact.
A person must not use or disclose health information included in a healthcare recipient’s My Health Record if:
the person obtained the information by using or gaining access to the My Health Record system; and
the use or disclosure is not authorised under Division 2, and the person knows or is reckless as to that fact.
Fault‑based offence
A person commits an offence if the person contravenes subsection (1) or (2).
Penalty: Imprisonment for 5 years or 300 penalty units, or both.
Civil penalty
A person is liable to a civil penalty if the person contravenes subsection (1) or (2).
Civil penalty: 1,500 penalty units.
This Act’s bill:Explanatory memorandumSecond reading speech
The statute text is free to read above. View subscription options to unlock the case-law research tools for each provision.