My Health Records Act 2012

If an entity that is:

an agency, or a State or Territory authority, within the meaning of the Privacy Act 1988; and

not a court, tribunal or coroner;

Except as mentioned in subsection (1) or in accordance with a law covered by subsection 65(3), a participant in the My Health Record system, or a healthcare recipient, cannot be required to disclose health information included in a healthcare recipient’s My Health Record to a designated entity.

This section does not authorise the System Operator to use or disclose healthcare recipient‑only notes.

If the System Operator uses or discloses personal information under this section, the System Operator must make a written note of the use or disclosure.

A designated entity may apply to any of the following judicial officers:

a magistrate of a State or Territory;

a judge who is eligible under subsection 69B(2);

The judicial officer may make the order if:

the designated entity satisfies the judicial officer, by information on oath or affirmation, that:

the designated entity has powers or duties of the kind mentioned in subsection (7); and

if the designated entity has powers of the kind mentioned in paragraph (7)(a)—the designated entity has exercised or purported to exercise its power to require the System Operator to disclose information to which the order will relate; and

in all the circumstances, the particular disclosure of the particular information to the designated entity is reasonably necessary for the purposes of a thing done by, or on behalf of, the designated entity; and

there is no effective means for the designated entity to obtain the particular information, other than an order under this section; and

the judicial officer is satisfied that, having regard to the matter mentioned in subparagraph (a)(iii) and the privacy of the healthcare recipient, the disclosure of the information would not, on balance, unreasonably interfere with the privacy of the healthcare recipient.

A designated entity has powers or duties of the kind mentioned in this subsection if:

the designated entity has power under a law of the Commonwealth or a State or Territory (other than a law covered by subsection 65(3)) to require persons to give information to the designated entity; or

officers of the designated entity are, in the ordinary course of their duties, authorised to execute warrants to enter premises and seize things found, including documents.

The judicial officer must not make the order unless the designated entity or some other person has given the judicial officer, either orally or by affidavit, such further information (if any) as the judicial officer requires concerning the grounds on which the order is being sought.

The order must:

identify the healthcare recipient; and

specify the particular information to be disclosed; and

authorise one or more officers of the designated entity (whether or not named in the order) to obtain the information from the System Operator and require the System Operator to disclose the information to the designated entity; and

specify the day (not more than 6 months after the making of the order) on which the order ceases to have effect; and

state the purpose for which the order is made.