Whole Act
157 provisions in continuous reading order
Loading the complete Act…
This Act may be cited as the My Health Records Act 2012.
Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.
Commencement information | ||
|---|---|---|
Column 1 | Column 2 | Column 3 |
Provision(s) | Commencement | Date/Details |
1. Sections 1 and 2 and anything in this Act not elsewhere covered by this table | The day this Act receives the Royal Assent. | 26 June 2012 |
2. Sections 3 to 112 | A day or days to be fixed by Proclamation. However, if any of the provision(s) do not commence by the later of: (a) 1 July 2012; and (b) the day this Act receives the Royal Assent; they commence on the day after the later of those days. | 29 June 2012 (see F2012L01395) |
This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.
Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.
The object of this Act is to enable the establishment and operation of a national public system for the provision of access to health information relating to recipients of healthcare that is voluntary for those recipients, to:
help overcome the fragmentation of health information; and
improve the availability and quality of health information; and
reduce the occurrence of adverse medical events and the duplication of treatment; and
improve the coordination and quality of healthcare provided to healthcare recipients by different healthcare providers.
The My Health Record system is a national public system for making health information about a healthcare recipient available for the purposes of providing healthcare to the recipient.
A healthcare recipient will have a My Health Record if the recipient registers in the My Health Record system. The Minister may, however, provide that the opt‑out model is to apply under My Health Records Rules made under Schedule 1. A healthcare recipient covered by those Rules will be registered in the My Health Record system, and have a My Health Record, unless the recipient elects to opt‑out of the system.
The My Health Record system is operated by the System Operator. The System Operator operates the National Repositories Service, that stores key records that form part of a healthcare recipient’s My Health Record. Other records are stored by registered repository operators. Together these records make up a healthcare recipient’s My Health Record.
If a healthcare recipient is registered in the My Health Record system, a healthcare provider may (or, in some circumstances, must) upload health information about the recipient to the My Health Record system, unless the record is one which the healthcare recipient has advised the healthcare provider not to upload or the record is not to be uploaded under prescribed laws of a State or Territory.
Health information may be collected, used and disclosed from a healthcare recipient’s My Health Record for the purpose of providing healthcare to the recipient, subject to any access controls set by the recipient (or if none are set, default access controls). There are other limited circumstances in which health information may be collected, used or disclosed from a My Health Record. Criminal and civil penalties apply if a person collects, uses or discloses information from a My Health Record without authorisation. Enforceable undertakings and injunctions are also available to enforce the provisions of this Act.
An authorisation to collect, use or disclose information under this Act is also an authorisation to do so for the purposes of the Privacy Act 1988. A contravention of this Act is also an interference with privacy for the purposes of the Privacy Act 1988, and so can be investigated under that Act.
Schedule 1 has effect.
Schedule 1 deals with the opt‑out model for registering healthcare recipients in the My Health Record system.
In this Act:
approved form means a form approved by the System Operator, in writing, for the purposes of the provision in which the expression occurs.
approved registered repository operator means a healthcare provider organisation that:
is a registered repository operator; and
satisfies the requirements (if any) specified in the My Health Records Rules.
Australia, when used in a geographical sense, includes the external Territories.
authorised representative of a healthcare recipient has the meaning given by section 6.
Chief Executive Medicare has the same meaning as in the Human Services (Medicare) Act 1973.
cinematograph film has the same meaning as in the Copyright Act 1968.
civil penalty provision has the same meaning as in the Regulatory Powers Act.
contracted service provider of a healthcare provider organisation means an entity that provides:
information technology services relating to the My Health Record system; or
health information management services relating to the My Health Record system;
to the healthcare provider organisation under a contract with the healthcare provider organisation.
data custodian means the Australian Institute of Health and Welfare.
date of birth accuracy indicator means a data element that is used to indicate how accurate a recorded date of birth is.
date of death accuracy indicator means a data element that is used to indicate how accurate a recorded date of death is.
Defence Department means the Department that:
deals with matters arising under section 1 of the Defence Act 1903; and
is administered by the Minister who administers that section.
designated privacy law means a law determined under section 110 to be a designated privacy law.
employee of an entity includes the following:
an individual who provides services for the entity under a contract for services;
an individual whose services are made available to the entity (including services made available free of charge).
entity means:
a person; or
a partnership; or
any other unincorporated association or body; or
a trust; or
a part of an entity (under a previous application of this definition).
finally determined: see section 10C.
genetic relative of an individual (the first individual) means another individual who is related to the first individual by blood, including a sibling, a parent or a descendant of the first individual.
healthcare means health service within the meaning of subsection 6(1) of the Privacy Act 1988.
healthcare provider means:
an individual healthcare provider; or
a healthcare provider organisation.
healthcare provider organisation means an entity that has conducted, conducts, or will conduct, an enterprise that provides healthcare (including healthcare provided free of charge).
Because of paragraph (e) of the definition of entity, a healthcare provider organisation could be a part of an entity.
healthcare recipient means an individual who has received, receives, or may receive, healthcare.
healthcare recipient‑only notes, in relation to a healthcare recipient, means health information included by the healthcare recipient in his or her My Health Record and described in the My Health Record system as healthcare recipient‑only notes (whether using that expression or an equivalent expression).
Health Chief Executives Forum means a body (however described) that consists of:
the Secretary of the Department; and
each head (however described) of the Health Department of a State or Territory.
Health Department of a State or Territory means a Department of state that:
deals with matters relating to health; and
is administered by the State/Territory Health Minister of the State or Territory.
health information has the meaning given by subsection 6(1) of the Privacy Act 1988.
identifying information has the meaning given by section 9.
index service means the index service maintained by the System Operator for the purposes of the My Health Record system, as mentioned in paragraph 15(a).
individual healthcare provider means an individual who:
has provided, provides, or is to provide, healthcare; or
is registered by a registration authority as a member of a particular health profession.
Ministerial Council means a body (however described) that consists of the Minister of the Commonwealth, and the Minister of each State and Territory, who is responsible, or principally responsible, for matters relating to health.
My Health Record of a healthcare recipient means the record of information that is created and maintained by the System Operator in relation to the healthcare recipient, and information that can be obtained by means of that record, including the following:
information included in the entry in the Register that relates to the healthcare recipient;
health information connected in the My Health Record system to the healthcare recipient (including information included in a record accessible through the index service);
other information connected in the My Health Record system to the healthcare recipient, such as information relating to auditing access to the record;
back‑up records of such information.
My Health Records Rules has the meaning given by section 109.
My Health Record system means a system:
that is for:
the collection, use and disclosure of information from many sources using telecommunications services and by other means, and the holding of that information, in accordance with the healthcare recipient’s wishes or in circumstances specified in this Act; and
the assembly of that information using telecommunications services and by other means so far is it is relevant to a particular healthcare recipient, so that it can be made available, in accordance with the healthcare recipient’s wishes or in circumstances specified in this Act, to facilitate the provision of healthcare to the healthcare recipient or for purposes specified in this Act; and
that involves the performance of functions under this Act by the System Operator.
National Law means:
for a State or Territory other than Western Australia—the Health Practitioner Regulation National Law set out in the Schedule to the Health Practitioner Regulation National Law Act 2009 of Queensland, as it applies (with or without modification) as a law of the State or Territory; or
for Western Australia—the Health Practitioner Regulation National Law (WA) Act 2010 of Western Australia, so far as that Act corresponds to the Health Practitioner Regulation National Law set out in the Schedule to the Health Practitioner Regulation National Law Act 2009 of Queensland.
National Repositories Service means the service referred to in paragraph 15(i).
nominated healthcare provider: a healthcare provider is the nominated healthcare provider of a healthcare recipient if:
an agreement is in force between the healthcare provider and the healthcare recipient that the healthcare provider is the healthcare recipient’s nominated healthcare provider for the purposes of this Act; and
a healthcare identifier has been assigned to the healthcare provider under paragraph 9(1)(a) of the Healthcare Identifiers Act 2010; and
the healthcare provider is an individual registered by a registration authority as one of the following:
a medical practitioner within the meaning of the National Law;
a registered nurse within the meaning of the National Law;
an Aboriginal health practitioner, a Torres Strait Islander health practitioner or an Aboriginal and Torres Strait Islander health practitioner within the meaning of the National Law who is included in a class prescribed by the regulations for the purposes of this subparagraph;
an individual, or an individual included in a class, prescribed by the regulations for the purposes of this subparagraph.
nominated representative of a healthcare recipient has the meaning given by section 7.
parental responsibility: a person has parental responsibility for a healthcare recipient (the child) if, and only if:
the person:
is the child’s parent (including a person who is presumed to be the child’s parent because of a presumption (other than in section 69Q) in Subdivision D of Division 12 of Part VII of the Family Law Act 1975); and
has not ceased to have parental responsibility for the child because of an order made under the Family Law Act 1975 or a law of a State or Territory; or
under a parenting order (within the meaning of the Family Law Act 1975):
the child is to live with the person; or
the child is to spend time with the person; or
the person is responsible for the child’s long‑term or day‑to‑day care, welfare and development; or
the person is entitled to guardianship or custody of, or access to, the child under a law of the Commonwealth, a State or a Territory.
The presumptions in the Family Law Act 1975 include a presumption arising from a court finding that a person is the child’s parent, and a presumption arising from a man executing an instrument under law acknowledging that he is the father of the child.
participant in the My Health Record system means any of the following:
the System Operator;
a registered healthcare provider organisation;
the operator of the National Repositories Service;
a registered repository operator;
a registered portal operator;
a registered contracted service provider, so far as the contracted service provider provides services to a registered healthcare provider.
personal information has the same meaning as in the Privacy Act 1988.
prescribed healthcare provider organisation means a healthcare provider organisation that is:
a corporation to which paragraph 51(xx) of the Constitution applies; and
of a kind specified in the My Health Records Rules.
prohibited purpose has the meaning given by section 70A.
record includes a database, register, file or document that contains information in any form (including in electronic form).
Register has the meaning given by section 56.
registered contracted service provider means a contracted service provider that is registered under section 49.
registered healthcare provider organisation means a healthcare provider organisation that is registered under section 44.
registered healthcare recipient means a healthcare recipient who is registered under section 41.
registered portal operator means a person that:
is the operator of an electronic interface that facilitates access to the My Health Record system; and
is registered as a portal operator under section 49.
registered repository operator means a person that:
holds, or can hold, records of information included in My Health Records for the purposes of the My Health Record system; and
is registered as a repository operator under section 49.
registration authority means an entity that is responsible under a law for registering members of a particular health profession.
Regulatory Powers Act means the Regulatory Powers (Standard Provisions) Act 2014.
share by default provision: each of the following is a share by default provision:
section 41A (prescribed healthcare provider organisations must be registered);
section 78A (some information must be shared with the My Health Record system unless exception applies);
section 78C (record keeping requirements in relation to sharing information with the My Health Record system);
section 78D (prescribed healthcare provider organisations must display notice when not sharing information with the My Health Record system);
section 19AD (medicare benefits not payable in respect of certain professional services) of the Health Insurance Act 1973;
section 19AF (record keeping requirement) of the Health Insurance Act 1973;
section 19AG (advance payment before information is shared with the My Health Record system) of the Health Insurance Act 1973;
section 19AH (recovery of payments) of the Health Insurance Act 1973.
shared health summary has the meaning given by section 10.
shares with the My Health Record system: see section 10A.
sound recording has the same meaning as in the Copyright Act 1968.
State or Territory authority has the same meaning as in the Privacy Act 1988.
State/Territory Health Minister means:
the Minister of a State; or
the Minister of the Australian Capital Territory; or
the Minister of the Northern Territory;
who is responsible, or principally responsible, for the administration of matters relating to health in the State or Territory, as the case may be.
System Operator has the meaning given by section 14.
this Act includes:
regulations made under this Act; and
the My Health Records Rules.
upload exception applies: see section 10B.
use health information included in a healthcare recipient’s My Health Record includes the following:
access the information;
view the information;
modify the information;
delete the information.
Veterans’ Affairs Department means the Department administered by the Minister administering section 1 of the Military Rehabilitation and Compensation Act 2004.
Veterans’ Affairs Department file number means a number allocated to a healthcare recipient by the Veterans’ Affairs Department.
work has the same meaning as in the Copyright Act 1968.
Healthcare recipients aged under 14
For the purposes of this Act, each person who the System Operator is satisfied has parental responsibility for a healthcare recipient aged under 14 is the authorised representative of the healthcare recipient.
Despite subsection (1), a person who has parental responsibility for a healthcare recipient aged under 18 is not the authorised representative of the healthcare recipient if the System Operator is satisfied that:
under a court order or a law of the Commonwealth or a State or Territory, the person must be supervised while spending time with the healthcare recipient; or
the life, health or safety of the healthcare recipient or another person would be put at risk if the person were the authorised representative of the healthcare recipient.
If there is no person who the System Operator is satisfied has parental responsibility for a healthcare recipient aged under 14, or the only such persons are covered by subsection (1A), the authorised representative of the healthcare recipient is:
a person who the System Operator is satisfied is authorised to act on behalf of the healthcare recipient for the purposes of this Act under the law of the Commonwealth or a State or Territory, or a decision of an Australian court or tribunal; or
if there is no such person—a person:
who the System Operator is satisfied is otherwise an appropriate person to be the authorised representative of the healthcare recipient; or
who is prescribed by the regulations for the purposes of this paragraph.
Healthcare recipients aged between 14 and 17
For the purposes of this Act, a person is the authorised representative of a healthcare recipient aged between 14 and 17 years if the healthcare recipient, by written notice given to the System Operator in the approved form, nominates the person to be his or her authorised representative.
Healthcare recipients aged at least 18
For the purposes of this Act, if the System Operator is satisfied that a healthcare recipient aged at least 18 is not capable of making decisions for himself or herself, the authorised representative of the healthcare recipient is:
a person who the System Operator is satisfied is authorised to act on behalf of the healthcare recipient under the law of the Commonwealth or a State or Territory or a decision of an Australian court or tribunal; or
if there is no such person—a person:
who the System Operator is satisfied is otherwise an appropriate person to be the authorised representative of the healthcare recipient; or
who is prescribed by the regulations for the purposes of this paragraph.
An authorisation referred to in paragraph (2)(a) or (4)(a) may be conferred by specific reference to the purposes of this Act, or conferred by words of general authorisation that are broad enough to cover that purpose.
A person cannot be the authorised representative of a healthcare recipient unless:
a healthcare identifier has been assigned to the person under paragraph 9(1)(b) of the Healthcare Identifiers Act 2010; or
the My Health Records Rules provide that a healthcare identifier is not required to have been so assigned.
Effect of being an authorised representative
At a time when a healthcare recipient has an authorised representative:
the authorised representative is entitled to do any thing that this Act authorises or requires the healthcare recipient to do; and
the healthcare recipient is not entitled to do any thing that this Act would, apart from this subsection, authorise or require the healthcare recipient to do; and
this Act has effect for all purposes, in relation to a thing done by an authorised representative, as if the healthcare recipient had done the thing.
At a time when a healthcare recipient has one or more authorised representatives, any thing that this Act authorises or requires to be done in relation to the healthcare recipient is to be done in relation to at least one of the healthcare recipient’s authorised representatives. This Act has effect for all purposes as if the thing had been done in relation to the healthcare recipient.
For the purposes of this Act, an individual is the nominated representative of a healthcare recipient if:
an agreement is in force between the individual and the healthcare recipient that the individual is the healthcare recipient’s nominated representative for the purposes of this Act; and
the healthcare recipient has notified the System Operator that the individual is his or her nominated representative.
Effect of being a nominated representative
At a time when a healthcare recipient has a nominated representative:
the nominated representative is entitled to do any thing that this Act authorises or requires the healthcare recipient to do, subject to any limitations:
to which the healthcare recipient’s agreement is subject; and
that have been notified to the System Operator by the healthcare recipient; and
this Act has effect for all purposes, in relation to a thing done by a nominated representative, as if the healthcare recipient had done the thing, subject to any modifications prescribed by the regulations.
Despite this subsection, a nominated representative must not use information for a prohibited purpose within the meaning of section 70A (even though a healthcare recipient may do so): see subsections 59A(2), 70B(2), 71A(4) and 71B(3).
Despite subsection (2), the System Operator must not permit a nominated representative of a healthcare recipient to set access controls in relation to the healthcare recipient’s My Health Record unless:
a healthcare identifier has been assigned to the nominated representative under paragraph 9(1)(b) of the Healthcare Identifiers Act 2010; or
the My Health Records Rules provide that a healthcare identifier is not required to have been so assigned.
The fact that a healthcare recipient has a nominated representative does not prevent the healthcare recipient doing any thing that this Act authorises or requires the healthcare recipient to do.
At a time when a healthcare recipient has one or more nominated representatives, any thing that this Act authorises or requires to be done in relation to the healthcare recipient may be done in relation to one of the healthcare recipient’s nominated representatives and not in relation to the healthcare recipient to the extent:
agreed between the healthcare recipient and the nominated representative; and
notified to the System Operator by the healthcare recipient.
This Act has effect for all purposes as if the thing had been done in relation to the healthcare recipient.
Duty to ascertain will and preferences
An authorised representative or a nominated representative (a representative) of a healthcare recipient must make reasonable efforts to ascertain the recipient’s will and preferences in relation to the recipient’s My Health Record.
If it is not possible to ascertain the healthcare recipient’s will and preferences, the representative must make reasonable efforts to ascertain the recipient’s likely will and preferences in relation to the recipient’s My Health Record.
The healthcare recipient’s likely will and preferences may be ascertained from sources including the following:
if the representative is a nominated representative—the agreement appointing the representative;
to the extent legally possible, from consultation with people who may be expected to be aware of the recipient’s will and preferences.
Duty to give effect to will and preferences
The representative must give effect to the healthcare recipient’s will and preferences, or likely will and preferences, ascertained in accordance with subsection (1) or (2).
However, if to do so would pose a serious risk to the healthcare recipient’s personal and social wellbeing, the representative must instead act in a manner that promotes the personal and social wellbeing of the healthcare recipient.
Duty if will and preferences cannot be ascertained
If the healthcare recipient’s will and preferences, or likely will and preferences, cannot be ascertained, the representative must act in a manner that promotes the personal and social wellbeing of the healthcare recipient.
A reference in section 6 or 7 to any thing that this Act authorises or requires a healthcare recipient to do is taken to include a reference to any thing that a prescribed provision of another Act authorises or requires a healthcare recipient to do.
A reference in section 6 or 7 to any thing that this Act authorises or requires to be done in relation to a healthcare recipient is taken to include a reference to any thing that a prescribed provision of another Act authorises or requires to be done in relation to a healthcare recipient.
Each of the following is identifying information of a healthcare provider who is an individual:
the name of the healthcare provider;
the address of the healthcare provider;
the email address, telephone number and fax number of the healthcare provider;
the date of birth, and the date of birth accuracy indicator, of the healthcare provider;
the sex of the healthcare provider;
the type of healthcare provider that the individual is;
if the healthcare provider is registered by a registration authority—the registration authority’s identifier for the healthcare provider and the status of the registration (such as conditional, suspended or cancelled);
other information that is prescribed by the regulations for the purpose of this paragraph.
Each of the following is identifying information of a healthcare provider that is not an individual:
the name of the healthcare provider;
the address of the healthcare provider;
the email address, telephone number and fax number of the healthcare provider;
if applicable, the ABN (within the meaning of the A New Tax System (Australian Business Number) Act 1999) of the healthcare provider;
if applicable, the ACN (within the meaning of the Corporations Act 2001) of the healthcare provider;
other information that is prescribed by the regulations for the purpose of this paragraph.
Each of the following is identifying information of an individual, other than an individual in the capacity of a healthcare provider:
if applicable, the Medicare number of the individual;
if applicable, the Veterans’ Affairs Department file number of the individual;
the name of the individual;
the address of the individual;
the date of birth, and the date of birth accuracy indicator, of the individual;
the sex of the individual;
if the individual was part of a multiple birth—the order in which the individual was born;
The second of twins.
if applicable, the date of death, and the date of death accuracy indicator, of the individual;
other information that is prescribed by the regulations for the purpose of this paragraph.
The shared health summary of a registered healthcare recipient, at a particular time, is a record that:
was prepared by the healthcare recipient’s nominated healthcare provider and described by him or her as the healthcare recipient’s shared health summary; and
has been uploaded to the National Repositories Service; and
at that time, is the most recent such record to have been uploaded to the National Repositories Service.
This means that there is only one shared health summary for a healthcare recipient at a particular time.