my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.8
1 Section 5 (definition of enforcement body)
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.12
10 At the end of section 65
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.13
Omit “may be limited”, substitute “on request may be limited because of the retention and destruction requirements under section 17”.
11 Section 67 (note)
12 After section 69
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.16
Omit 'for law enforcement purposes, etc.' and substitute 'in relation to unlawful activity'.
13 Section 70 (heading)
14 Subsections 70(1) and (2)
Insertion of clause (subject to subsection (3A)) after 'to use or'
15 Subsection 70(3)
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.9
Prohibits providing de-identified data to private health insurers.
16 Research or public health purposes
System Operator can disclose information to relevant person or authority.
16 After subsection 70(3)
Prohibition on providing de-identified data to private health insurers.
Prohibition on unauthorized use of healthcare recipient's My Health Record information
16A At the end of Division 2 of Part 4
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.18
16B After Division 3 of Part 4
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.19
Repeal penalty, substitute with civil penalty of 1500 units.
16C Subsection 75(2) (penalty)
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.20
Repeal penalty, substitute civil penalty of 1500 units.
16D Section 76 (penalty)
Repeal penalty, substitute with imprisonment or penalty units
16E Subsection 77(2A) (penalty)
16F Subsection 77(2B) (penalty)
No notice required if doing so would put life, health or safety at risk.
16G After subsection 97(2)
System Operator has an obligation to not give notice.
16H Paragraph 98(1)(b)
16J Paragraph 98(1)(c)
16K Subsection 105(3)
Permission to insert in connection with insurance
16L After paragraph 105(3)(b)
Insertion of phrase in disclosure of data
16M Subsection 105(4)
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.21
Application of amendments to cancellation of registration
17 Application of amendments
Repeal paragraph, substitute period for Part commencement to January 31, 2019.
18 Paragraph 6(3)(b)
1A Section 5
1AA Section 3
Insert 'national public' after 'system is a'
1AB Section 4
Supervision required for unaccompanied minors with parental responsibility
1B After subsection 6(1)
Restricts unaccompanied minors from making decisions without supervision
Parental responsibility with age under 18
1BA Subsection 6(1) (heading)
1BB Subsection 6(1)
Insertion of clause after certain condition
1C Subsection 6(2)
1CA Subsection 6(2)
Must not use information for a prohibited purpose
1D At the end of subsection 7(2)
Use of information for a prohibited purpose
Authorise a person to act on behalf of a healthcare recipient aged 14-17.
1DA Subsection 6(3)
Granting authority to act on behalf of a healthcare recipient.
1E After section 15
Insert 'and destruction' after 'Retention'
2 Section 17 (heading)
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.10
3 Before subsection 17(1)
4 Before subsection 17(2)
Destroy record under subsection (4) if required by subsection (3)
5 At the end of paragraph 17(2)(b)
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.11
59A Unauthorised use of information included in a healthcare
Prohibition on using health information for a prohibited purpose.
59A(1) Unauthorised use of information included in a healthcare
Prohibits the use of health information for a prohibited purpose.
Healthcare recipient's nominated representative must comply with subsection (1) despite subsection 7(2).
59A(2) Unauthorised use of information included in a healthcare
does apply if the person is the nominated representative of the healthcare recipient
Subsection (1) does not apply if the person is the healthcare recipient
6 At the end of section 17
Destroy certain health information upon request for cancellation.
6(3) At the end of section 17
the day the cancellation decision takes effect;
Defines a temporal interval for the cancellation decision.
day the cancellation decision takes effect under subsection 51(7);
the System Operator must destroy any record that includes health information that is included in the My Health Record of the healthcare recipient, other than...
Establishes a duty to destroy certain health information.
(3) If the System Operator is required to cancel the registration of the healthcare recipient under subsection 51(1);
name and healthcare identifier of the person who requested the cancellation, if different from the healthcare recipient;
Identifies the healthcare recipient and requester.
name and healthcare identifier of the healthcare recipient;
Identifies the day the cancellation decision takes effect.
Comply with subsection (3) after cancellation decision takes effect or if certain requirements apply before records are destroyed.
6(4) At the end of section 17
Obligation to comply with subsection (3)
Destroy all copies, versions, and back-ups of health records.
6(5) At the end of section 17
System Operator must destroy all copies, versions, and back-ups.
Destroying records is a class inclusion of obligations.
69A Disclosure to designated entity under order by judicial officer
Comply with order made under this section
69A(1) Disclosure to designated entity under order by judicial officer
Cannot disclose health information to a designated entity
69A(2) Disclosure to designated entity under order by judicial officer
Prohibition on using or disclosing healthcare recipient-only notes
69A(3) Disclosure to designated entity under order by judicial officer
Must make a written note of use or disclosure of personal information
69A(4) Disclosure to designated entity under order by judicial officer
Application for order under section 69A(5)
69A(5) Disclosure to designated entity under order by judicial officer
the entity, of health information included in a healthcare recipient’s My Health Record
Temporal relation between judicial officer and application
an order under this section in relation to the disclosure
for an order under this section in relation to the disclosure, to the entity, of health information included in a healthcare recipient’s My Health Record.
a designated entity may apply to any of the following judicial officers:
Judicial officer may make order to disclose information to designated entity under certain conditions.
69A(6) Disclosure to designated entity under order by judicial officer
Designated entity must have exercised power before making request
if the designated entity has powers of the kind mentioned in paragraph (7)(a)—the designated entity has exercised or pur
Judicial officer must be satisfied with conditions before making order
is satisfied that, having regard to the matter mentioned in subparagraph (a)(iii) and the privacy of the healthcare reci
Disclosure would not unreasonably interfere with privacy
would not, on balance, unreasonably interfere with the privacy of the healthcare recipient
has powers or duties of the kind mentioned in subsection (7)
A designated entity has powers or duties if it can require persons to give information under a law.
69A(7) Disclosure to designated entity under order by judicial officer
(7) A designated entity has powers or duties of the kind mentioned in this subsection if:
Designated entity can require persons to give information under a law.
(a) the designated entity has power under a law of the Commonwealth or a State or Territory (other than a law covered by subsection 65(3)) to require persons to give information to the designated entity;
Designated entity has powers or duties of the kind mentioned in this subsection.
has duties of the kind mentioned in this subsection
Designated entity is a law of the Commonwealth or a State or Territory.
is a law of the Commonwealth or a State or Territory
Designated entity is not a law covered by subsection 65(3).
is not a law covered by subsection 65(3)
Must provide further information to judicial officer before making order.
69A(8) Disclosure to designated entity under order by judicial officer
Designated entity must be informed of healthcare recipient and specified information.
69A(9) Disclosure to designated entity under order by judicial officer
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.15
69B Judicial officers for orders under section 69A
A judge may consent to be nominated by the Attorney-General.
69B(1) Judicial officers for orders under section 69A
Attorney-General may nominate a judge for purposes of paragraph 69A(5)(b)
69B(2) Judicial officers for orders under section 69A
Attorney-General has the power to nominate a judge
Judges must nominate magistrates for orders under section 69A.
69B(3) Judicial officers for orders under section 69A
A magistrate need not accept the functions conferred by section 69A.
69B(4) Judicial officers for orders under section 69A
Governor-General may arrange with State or Territory officials to perform magistrate functions under section 69A.
69B(5) Judicial officers for orders under section 69A
Functions conferred on a judicial officer by section 69A are personal and not as a court or member of a court.
69B(6) Judicial officers for orders under section 69A
The judicial officer must perform these functions
Section 69A confers functions on a judicial officer
Protection and immunity for judicial officers performing functions under section 69A
69B(7) Judicial officers for orders under section 69A
same protection and immunity as if the judicial officer were performing the function
Judicial officer performing a function conferred by section 69A
Judicial officer performing a function conferred by section 69A has same protection and immunity as if the judicial officer were performing the function
6A Subsection 59(3) (penalty)
Repeal penalty, substitute civil penalty
6B Subsection 59(4) (penalty)
6C After section 59
6D Subsection 60(3) (penalty)
6E Subsection 60(4) (penalty)
7 Section 63 (note)
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.17
70A Definition of prohibited purpose
Using information for underwriting insurance contracts or determining employment status is prohibited.
70A(1) Definition of prohibited purpose
Overlaps with purposes that include underwriting insurance contracts.
(i) underwriting a contract of insurance that covers the healthcare recipient;
Overlaps with purposes that include determining employment status.
(iv) an employer employing, or continuing or ceasing to employ, the healthcare recipient;
Prohibits using information for underwriting insurance contracts or determining employment status.
(1) Information included in a healthcare recipient’s My Health Record is used for a prohibited purpose if the person who uses the information does so for any one or more of the following purposes:
Prohibits using information for determining employment status.
Using information for a prohibited purpose is implied by using it for purposes that include a prohibited purpose.
70A(2) Definition of prohibited purpose
the person is taken to be using the information for a prohibited purpose.
(2) If the person uses information for purposes that include, or for a purpose that includes, a purpose mentioned in subsection (1),
Use of information is not for a prohibited purpose if solely for healthcare or indemnity purposes.
70A(3) Definition of prohibited purpose
if the use is solely for: (a) the purpose of providing healthcare to the healthcare recipient; or (b) purposes relating to the provision of indemnity cover for a healthcare provider.
Identifies temporal overlap between prohibited and permitted uses.
(3) To avoid doubt, use of information is not for a prohibited purpose
Identifies cognitive AI systems that can recognize permissible use of information.
Prohibits use of information for prohibited purposes.
Spreads permissible use of information through healthcare and indemnity contexts.
Describes recurrent use of information as permissible.
Insurance that does not extend beyond the limits of the State concerned is exempt.
70A(5) Definition of prohibited purpose
Insurance exceeding state limits overlaps with prohibited purpose.
(5) References in paragraph (1)(a) to insurance do not include State insurance that does not extend beyond the limits of the State concerned.
CogAI classifies insurance as exempt if it exceeds state limits.
Prohibits insurance that exceeds state limits.
Insurance exceeding state limits is a recurring trace.
Using information for a prohibited purpose
70A(6) Definition of prohibited purpose
70B Use for prohibited purpose is unauthorised
Using health information for a prohibited purpose is unauthorized.
70B(1) Use for prohibited purpose is unauthorised
(1) Despite Subdivisions A and B, a person is not authorised under this Division to use health information included in a registered healthcare recipient’s My Health Record for a prohibited purpose.
Knowledge representation of the prohibition.
Prohibition of using health information for a prohibited purpose.
Exemption for nominated representative of healthcare recipient
70B(2) Use for prohibited purpose is unauthorised
71A Offence for use of My Health Record-derived information for
Using My Health Record-derived information for a prohibited purpose is an offence.
71A(1) Offence for use of My Health Record-derived information for
Prohibition of using My Health Record-derived information for a prohibited purpose.
No collection or disclosure of information is authorized under this Act if it was not made by a person who obtained the information by using or gaining access to the My Health Record system.
71A(2) Offence for use of My Health Record-derived information for
Strict liability for use of My Health Record-derived information
71A(3) Offence for use of My Health Record-derived information for
Person nominated representative of healthcare recipient must comply with section.
71A(4) Offence for use of My Health Record-derived information for
Nominated representative of healthcare recipient
71AA Definitions
...the period during which it is in effect.
The cancellation or suspension of My Health Record occurs during...
...My Health Record of a healthcare recipient.
Definition of My Health Record includes...
...My Health Record of the healthcare recipient that has been cancelled or suspended.
My Health Record of a healthcare recipient is a subclass of...
71B Civil penalty for use of My Health Record-derived information
Prohibition on using My Health Record-derived information for prohibited purposes.
71B(1) Civil penalty for use of My Health Record-derived information
No collection or disclosure of information is authorized under this Act or any other law.
71B(2) Civil penalty for use of My Health Record-derived information
No collection or disclosure of information is authorized.
Exemption for nominated representative of healthcare recipient from civil penalty
71B(3) Civil penalty for use of My Health Record-derived information
Exempts nominated representative of healthcare recipient from civil penalty
8 Subsection 65(1)
No State or Territory laws are covered by subsection (3).
9 At the end of subsection 65(1)
Subsection (3) does not apply to State or Territory laws.
State or Territory laws are not covered by subsection (3)
State or Territory laws are excluded from subsection (3).
Subsection (3) excludes State or Territory laws.
Subsection (3) is not applicable to State or Territory laws.
Inapplicability of subsection (3) to State or Territory laws
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.22
1 Section 5
Establishes class hierarchy for data custodian
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.32
10 Subsection 105(2)
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.33
109A My Health Records Rules relating to data for research or
Imposes requirements on entities for preparing, providing, collecting, accessing, using and disclosing health information.
109A(1) My Health Records Rules relating to data for research or
Data custodian has functions to implement framework and provide data linkage services.
109A(2) My Health Records Rules relating to data for research or
Healthcare recipient consent required for data collection, use, and disclosure.
109A(3) My Health Records Rules relating to data for research or
Disclosure of de-identified data or health information is restricted to specific means.
109A(4) My Health Records Rules relating to data for research or
Ensure collection, use and disclosure of data or information does not result in an interference with privacy.
109A(5) My Health Records Rules relating to data for research or
Establishment of Data Governance Board and data custodian
11 After paragraph 105(6)(a)
May relate to research or public health purposes
12 Subsection 109(7A)
Temporal relation to Proclamation Schedule 2
Omit 'the My Health Records Rules' and substitute with a new rule for purposes other than subsection (7A)
13 Subsection 109(9)
Prohibition of the My Health Records Rules
14 After section 109
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.35
Access to data and information for specified purposes
1980 No. 23 ([1980] ATS 23). In 2018, a text of a Covenant in
the Australian Treaties Series was accessible through the Australian Treaties Library on the AustLII website (http://www.austlii.edu.au).
(b) for purposes related to collecting, preparing, analysing or publishing statistics;
Healthcare recipient must provide de-identified data and health information with consent.
2 Paragraph 15(ma)
Must provide de-identified data and health information.
Insert 'or health information' after 'de-identified data'
3 Section 16
4 Part 5 (heading)
5 After section 77
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.23
6 Section 78 (at the end of the heading)
7 Section 78
77A Enforceable requirements in My Health Records Rules must
Committing an act or omitting to do an act that contravenes a requirement and is reckless about the result.
77A(1) Enforceable requirements in My Health Records Rules must
Requires a temporal relation between the act and the result.
(a) the entity does an act or omits to do an act;
(b) the entity is reckless as to that result;
(c) the My Health Records Rules provide that the requirement is enforceable for the purposes of this paragraph;
Strict liability applies to paragraphs (1)(c) and (d)
77A(2) Enforceable requirements in My Health Records Rules must
Must not contravene a requirement imposed on the entity by My Health Records Rules.
8 At the end of section 78
Requirement and entity's obligations overlap.
Requirement imposes an obligation that overlaps with the entity's obligations.
My Health Records Rules provide that the requirement is enforceable for the purposes of this subsection.
Entity must not contravene the requirement.
Prohibition of contravening a requirement.
Entity has an obligation to comply with the requirement.
Requirement prohibits entity from contravening it.
Entity must not contravene the requirement in a recurring trace.
82 Data Governance Board
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.24
83 Functions of the Board
The Data Governance Board has functions to oversee the operation of the framework.
83(1) Functions of the Board
The Data Governance Board has a function.
The Board must not perform any role in relation to the day-to-day operation of the My Health Record system.
83(2) Functions of the Board
Prohibition on Board's involvement in My Health Record system operation.
(2) The Board does not have any functions, and must not perform any role...
Membership requirements for the Data Governance Board
84 Membership
The Data Governance Board consists of the following members:
85 Appointment of members
Members must be appointed by the Minister.
85(1) Appointment of members
85(2) Appointment of members
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.25
86 Qualifications and experience
Minister must appoint members to the System Operator and data custodian.
86(1) Qualifications and experience
Eligibility requirements for Data Governance Board members
86(2) Qualifications and experience
Possession of required skills or experience
87 Acting appointments
The Minister may appoint a person to act as Chair under certain circumstances.
87(1) Acting appointments
87(2) Acting appointments
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.26
88 Term of appointment and other terms and conditions
Member of Data Governance Board must hold office for a specified period not exceeding 5 years.
88(1) Term of appointment and other terms and conditions
(1) A member of the Data Governance Board holds office for the period specified in the instrument of appointment. The period must not exceed 5 years.
The member must hold office for the specified period.
(1) A member of the Data Governance Board holds office for the period specified in the instrument of appointment.
Terms and conditions for Data Governance Board members determined by the Minister.
88(2) Term of appointment and other terms and conditions
89 Remuneration
Member of Data Governance Board must be paid remuneration determined by Remuneration Tribunal.
89(1) Remuneration
Member must be paid allowances prescribed by an instrument.
89(2) Remuneration
Remuneration subject to the Remuneration Tribunal Act 1973.
89(3) Remuneration
89(4) Remuneration
9 After Part 6
90 Resignation
Member can resign by giving written notice to the Minister.
90(1) Resignation
Resignation takes effect on specified day
90(2) Resignation
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.27
91 Termination of appointment
Minister may terminate appointment for misbehaviour or incapacity
91(1) Termination of appointment
Termination of appointment under specified conditions
91(2) Termination of appointment
Grant leave of absence on terms and conditions determined by the Minister.
92 Leave of absence
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.28
93 Other paid work
No paid work that conflicts with duties.
93(1) Other paid work
(1) A member of the Data Governance Board must not engage in any paid work...
Definition of paid work for financial gain or reward
93(2) Other paid work
94 Convening meetings
Must hold meetings as necessary for efficient performance of functions.
94(1) Convening meetings
Must convene a meeting within 30 days after receiving a written request.
94(2) Convening meetings
95 Presiding at meetings
Chair must preside at meetings where present.
95(1) Presiding at meetings
Deputy Chair must preside if Chair is not present.
95(2) Presiding at meetings
Members must appoint a presider if the Chair and Deputy Chair are absent.
95(3) Presiding at meetings
96 Quorum
A quorum is constituted by a majority of members.
96(1) Quorum
Quorum requirements when a member is absent or not present
96(2) Quorum
Quorum requirement when a member is absent or not present
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.29
96A Voting at meetings
Majority vote required for decisions at meetings
96A(1) Voting at meetings
The person presiding at a meeting of the Board must have a deliberative vote.
96A(2) Voting at meetings
The person presiding must have a deliberative vote.
(2) The person presiding at a meeting of the Board has a deliberative vote.
Regulate proceedings at meetings as considered appropriate.
96B Conduct of meetings
96C Minutes
96D Decisions without meetings
96D(1) Decisions without meetings
The decision was made during the meeting.
(1) The Data Governance Board is taken to have made a decision at a meeting...
The members have been informed of the decision.
(c) all the members were informed of the proposed decision, or reasonable efforts were made to inform all the members of the proposed decision.
The majority has agreed with the decision.
(a) without meeting, a majority of the members of the Board entitled to vote on the proposed decision indicate agreement with the decision;
Reasonable efforts have been made to inform the members.
Reasonable efforts made to inform members
Determination of decision-making method without meetings
96D(2) Decisions without meetings
Authority to make decisions without meetings
Member not entitled to vote on proposed decision if not present at meeting.
96D(3) Decisions without meetings
Member would not have been entitled to vote on that proposal if the matter had been considered at a meeting of the Board.
Record decisions made in accordance with this section.
96D(4) Decisions without meetings
The Board must keep a record of decisions.
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.30
96E Relationship between System Operator and Data Governance
Must comply with direction from Data Governance Board
96E(1) Relationship between System Operator and Data Governance
System Operator must not take steps to ensure data is used only for research or public health purposes.
96E(2) Relationship between System Operator and Data Governance
Prohibition of action by System Operator.
Clarifies no duty on System Operator regarding data use at times without relevant rules.
96E(3) Relationship between System Operator and Data Governance
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.31
96F Board committees
Establishment of a committee or committees to assist in carrying out the functions of the Board.
96F(1) Board committees
The Board may dissolve a committee at any time.
96F(2) Board committees
Determination of committee functions by the Board.
96F(3) Board committees
The Board determines its functions during the committee's function determination.
Committee function determination is an event during which the Board's functions are determined.
(3) The functions of a committee are as determined by the Board.
The Board determines the functions of a committee.
Committee function determination is an obligation.
The Board determines the functions of a committee through dialectical means.
Committee function determination is a dialectical relationship.
The Board determines its functions through diffusion.
Committee function determination is a diffusion relationship.
Committee function determination is a linear relationship.
Committees must comply with Board directions.
96F(4) Board committees
Committee members must decide questions by majority vote.
96F(5) Board committees
Decisions must be made by majority vote.
Committees must inform other Board members of their decisions.
96F(6) Board committees
Committees may regulate proceedings at their meetings.
96F(7) Board committees
Committees must keep minutes of their meetings.
96F(8) Board committees
96G Delegation of functions
Delegation of functions to APS employees
96G(1) Delegation of functions
Australian Institute of Health and Welfare Act 1987
Delegation of functions to staff members
96G(2) Delegation of functions
Delegate must comply with written directions of the Board.
96G(3) Delegation of functions
Delegation of functions continues despite change in Board membership.
96G(4) Delegation of functions
Delegation of functions may be varied or revoked by the Board.
96G(5) Delegation of functions
96H Annual report
Annual report requirement for the Data Governance Board
96H(1) Annual report
No report on Board activities is required.
96H(2) Annual report
Exclusion of Board activities from annual report
(2) A report on the Department’s activities given under section 46 of the Public Governance, Performance and Accountability Act 2013 does not need to include a report on the activities of the Board.
The Data Governance Board is prescribed in relation to the Department.
96J Board is part of the Department
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.5
1 Short title
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.6
1 Section 1
The Act is the My Health Records Amendment (Strengthening Privacy) Act 2018.
10 December
Note: This table relates only to the provisions of this Act as originally enacted.
11 December
Commencement rules for provisions in the Act.
2 Commencement
Schedule 1, effective one day after Royal Assent.
2 Section 2
3 Section 3
Legislation in schedules is amended or repealed according to its terms.
3 Schedules
An Act to amend the My Health Records Act 2012, and for related purposes
My Health Records Amendment (Strengthening Privacy) Act 2018