My Health Records Amendment (Strengthening Privacy) Act 2018
An Act to amend the My Health Records Act 2012, and for related purposes
1 Short title
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.5
The Act is the My Health Records Amendment (Strengthening Privacy) Act 2018.
2 Commencement
Commencement rules for provisions in the Act.
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.6
1 Section 1
10 December
2 Section 2
Schedule 1, effective one day after Royal Assent.
11 December
3 Section 3
Note: This table relates only to the provisions of this Act as originally enacted.
3 Schedules
Legislation in schedules is amended or repealed according to its terms.
1AA Section 3
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.8
1AB Section 4
Insert 'national public' after 'system is a'
1 Section 5 (definition of enforcement body)
1A Section 5
1BA Subsection 6(1) (heading)
1BB Subsection 6(1)
1B After subsection 6(1)
Supervision required for unaccompanied minors with parental responsibility
Restricts unaccompanied minors from making decisions without supervision
Parental responsibility with age under 18
1CA Subsection 6(2)
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.9
1C Subsection 6(2)
Insertion of clause after certain condition
1DA Subsection 6(3)
Authorise a person to act on behalf of a healthcare recipient aged 14-17.
Granting authority to act on behalf of a healthcare recipient.
1D At the end of subsection 7(2)
Must not use information for a prohibited purpose
Use of information for a prohibited purpose
1E After section 15
16 Research or public health purposes
Prohibits providing de-identified data to private health insurers.
Prohibition on providing de-identified data to private health insurers.
2 Section 17 (heading)
Insert 'and destruction' after 'Retention'
3 Before subsection 17(1)
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.10
4 Before subsection 17(2)
5 At the end of paragraph 17(2)(b)
Destroy record under subsection (4) if required by subsection (3)
6 At the end of section 17
6(3) At the end of section 17
Destroy certain health information upon request for cancellation.
Identifies the healthcare recipient and requester.
name and healthcare identifier of the healthcare recipient;
name and healthcare identifier of the person who requested the cancellation, if different from the healthcare recipient;
Identifies the day the cancellation decision takes effect.
day the cancellation decision takes effect under subsection 51(7);
the day the cancellation decision takes effect;
Defines a temporal interval for the cancellation decision.
Establishes a duty to destroy certain health information.
(3) If the System Operator is required to cancel the registration of the healthcare recipient under subsection 51(1);
the System Operator must destroy any record that includes health information that is included in the My Health Record of the healthcare recipient, other than...
6(4) At the end of section 17
Comply with subsection (3) after cancellation decision takes effect or if certain requirements apply before records are destroyed.
Obligation to comply with subsection (3)
6(5) At the end of section 17
Destroy all copies, versions, and back-ups of health records.
System Operator must destroy all copies, versions, and back-ups.
Destroying records is a class inclusion of obligations.
6A Subsection 59(3) (penalty)
Repeal penalty, substitute with imprisonment or penalty units
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.11
6B Subsection 59(4) (penalty)
Repeal penalty, substitute civil penalty
6C After section 59
59A Unauthorised use of information included in a healthcare
59A(1) Unauthorised use of information included in a healthcare
Prohibition on using health information for a prohibited purpose.
Prohibits the use of health information for a prohibited purpose.
59A(2) Unauthorised use of information included in a healthcare
Healthcare recipient's nominated representative must comply with subsection (1) despite subsection 7(2).
Subsection (1) does not apply if the person is the healthcare recipient
does apply if the person is the nominated representative of the healthcare recipient
6D Subsection 60(3) (penalty)
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.12
6E Subsection 60(4) (penalty)
Repeal penalty, substitute with civil penalty of 1500 units.
7 Section 63 (note)
8 Subsection 65(1)
9 At the end of subsection 65(1)
No State or Territory laws are covered by subsection (3).
State or Territory laws are not covered by subsection (3)
Subsection (3) does not apply to State or Territory laws.
Subsection (3) excludes State or Territory laws.
State or Territory laws are excluded from subsection (3).
Inapplicability of subsection (3) to State or Territory laws
Subsection (3) is not applicable to State or Territory laws.
10 At the end of section 65
11 Section 67 (note)
Omit “may be limited”, substitute “on request may be limited because of the retention and destruction requirements under section 17”.
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.13
12 After section 69
69A Disclosure to designated entity under order by judicial officer
69A(1) Disclosure to designated entity under order by judicial officer
Comply with order made under this section
69A(2) Disclosure to designated entity under order by judicial officer
Cannot disclose health information to a designated entity
69A(3) Disclosure to designated entity under order by judicial officer
Prohibition on using or disclosing healthcare recipient-only notes
69A(4) Disclosure to designated entity under order by judicial officer
Must make a written note of use or disclosure of personal information
69A(5) Disclosure to designated entity under order by judicial officer
Application for order under section 69A(5)
Temporal relation between judicial officer and application
an order under this section in relation to the disclosure
the entity, of health information included in a healthcare recipient’s My Health Record
a designated entity may apply to any of the following judicial officers:
for an order under this section in relation to the disclosure, to the entity, of health information included in a healthcare recipient’s My Health Record.
69A(6) Disclosure to designated entity under order by judicial officer
Judicial officer may make order to disclose information to designated entity under certain conditions.
has powers or duties of the kind mentioned in subsection (7)
if the designated entity has powers of the kind mentioned in paragraph (7)(a)—the designated entity has exercised or pur
Designated entity must have exercised power before making request
is satisfied that, having regard to the matter mentioned in subparagraph (a)(iii) and the privacy of the healthcare reci
Judicial officer must be satisfied with conditions before making order
would not, on balance, unreasonably interfere with the privacy of the healthcare recipient
Disclosure would not unreasonably interfere with privacy
69A(7) Disclosure to designated entity under order by judicial officer
A designated entity has powers or duties if it can require persons to give information under a law.
(7) A designated entity has powers or duties of the kind mentioned in this subsection if:
Designated entity can require persons to give information under a law.
(a) the designated entity has power under a law of the Commonwealth or a State or Territory (other than a law covered by subsection 65(3)) to require persons to give information to the designated entity;
has duties of the kind mentioned in this subsection
Designated entity has powers or duties of the kind mentioned in this subsection.
is a law of the Commonwealth or a State or Territory
Designated entity is a law of the Commonwealth or a State or Territory.
is not a law covered by subsection 65(3)
Designated entity is not a law covered by subsection 65(3).
69A(8) Disclosure to designated entity under order by judicial officer
Must provide further information to judicial officer before making order.
69A(9) Disclosure to designated entity under order by judicial officer
Designated entity must be informed of healthcare recipient and specified information.
69B Judicial officers for orders under section 69A
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.15
69B(1) Judicial officers for orders under section 69A
A judge may consent to be nominated by the Attorney-General.
69B(2) Judicial officers for orders under section 69A
Attorney-General may nominate a judge for purposes of paragraph 69A(5)(b)
Attorney-General has the power to nominate a judge
69B(3) Judicial officers for orders under section 69A
Judges must nominate magistrates for orders under section 69A.
69B(4) Judicial officers for orders under section 69A
A magistrate need not accept the functions conferred by section 69A.
69B(5) Judicial officers for orders under section 69A
Governor-General may arrange with State or Territory officials to perform magistrate functions under section 69A.
69B(6) Judicial officers for orders under section 69A
Functions conferred on a judicial officer by section 69A are personal and not as a court or member of a court.
Section 69A confers functions on a judicial officer
The judicial officer must perform these functions
69B(7) Judicial officers for orders under section 69A
Protection and immunity for judicial officers performing functions under section 69A
Judicial officer performing a function conferred by section 69A
same protection and immunity as if the judicial officer were performing the function
Judicial officer performing a function conferred by section 69A has same protection and immunity as if the judicial officer were performing the function
13 Section 70 (heading)
Omit 'for law enforcement purposes, etc.' and substitute 'in relation to unlawful activity'.
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.16
14 Subsections 70(1) and (2)
15 Subsection 70(3)
Insertion of clause (subject to subsection (3A)) after 'to use or'
16 After subsection 70(3)
System Operator can disclose information to relevant person or authority.
16A At the end of Division 2 of Part 4
Prohibition on unauthorized use of healthcare recipient's My Health Record information
70A Definition of prohibited purpose
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.17
70A(1) Definition of prohibited purpose
Using information for underwriting insurance contracts or determining employment status is prohibited.
Prohibits using information for underwriting insurance contracts or determining employment status.
(1) Information included in a healthcare recipient’s My Health Record is used for a prohibited purpose if the person who uses the information does so for any one or more of the following purposes:
Prohibits using information for determining employment status.
(iv) an employer employing, or continuing or ceasing to employ, the healthcare recipient;
Overlaps with purposes that include underwriting insurance contracts.
(i) underwriting a contract of insurance that covers the healthcare recipient;
Overlaps with purposes that include determining employment status.
70A(2) Definition of prohibited purpose
Using information for a prohibited purpose is implied by using it for purposes that include a prohibited purpose.
(2) If the person uses information for purposes that include, or for a purpose that includes, a purpose mentioned in subsection (1),
the person is taken to be using the information for a prohibited purpose.
70A(3) Definition of prohibited purpose
Use of information is not for a prohibited purpose if solely for healthcare or indemnity purposes.
Prohibits use of information for prohibited purposes.
(3) To avoid doubt, use of information is not for a prohibited purpose
if the use is solely for: (a) the purpose of providing healthcare to the healthcare recipient; or (b) purposes relating to the provision of indemnity cover for a healthcare provider.
Identifies temporal overlap between prohibited and permitted uses.
Describes recurrent use of information as permissible.
Spreads permissible use of information through healthcare and indemnity contexts.
Identifies cognitive AI systems that can recognize permissible use of information.
70A(5) Definition of prohibited purpose
Insurance that does not extend beyond the limits of the State concerned is exempt.
Prohibits insurance that exceeds state limits.
(5) References in paragraph (1)(a) to insurance do not include State insurance that does not extend beyond the limits of the State concerned.
Insurance exceeding state limits overlaps with prohibited purpose.
Insurance exceeding state limits is a recurring trace.
CogAI classifies insurance as exempt if it exceeds state limits.
70A(6) Definition of prohibited purpose
Using information for a prohibited purpose
70B Use for prohibited purpose is unauthorised
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.18
70B(1) Use for prohibited purpose is unauthorised
Using health information for a prohibited purpose is unauthorized.
Prohibition of using health information for a prohibited purpose.
(1) Despite Subdivisions A and B, a person is not authorised under this Division to use health information included in a registered healthcare recipient’s My Health Record for a prohibited purpose.
Knowledge representation of the prohibition.
70B(2) Use for prohibited purpose is unauthorised
Exemption for nominated representative of healthcare recipient
16B After Division 3 of Part 4
71AA Definitions
Definition of My Health Record includes...
...My Health Record of a healthcare recipient.
My Health Record of a healthcare recipient is a subclass of...
...My Health Record of the healthcare recipient that has been cancelled or suspended.
The cancellation or suspension of My Health Record occurs during...
...the period during which it is in effect.
71A Offence for use of My Health Record-derived information for
71A(1) Offence for use of My Health Record-derived information for
Using My Health Record-derived information for a prohibited purpose is an offence.
Prohibition of using My Health Record-derived information for a prohibited purpose.
71A(2) Offence for use of My Health Record-derived information for
No collection or disclosure of information is authorized under this Act if it was not made by a person who obtained the information by using or gaining access to the My Health Record system.
71A(3) Offence for use of My Health Record-derived information for
Strict liability for use of My Health Record-derived information
71A(4) Offence for use of My Health Record-derived information for
Person nominated representative of healthcare recipient must comply with section.
Nominated representative of healthcare recipient
71B Civil penalty for use of My Health Record-derived information
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.19
71B(1) Civil penalty for use of My Health Record-derived information
Prohibition on using My Health Record-derived information for prohibited purposes.
71B(2) Civil penalty for use of My Health Record-derived information
No collection or disclosure of information is authorized under this Act or any other law.
No collection or disclosure of information is authorized.
71B(3) Civil penalty for use of My Health Record-derived information
Exemption for nominated representative of healthcare recipient from civil penalty
Exempts nominated representative of healthcare recipient from civil penalty
16C Subsection 75(2) (penalty)
16D Section 76 (penalty)
Repeal penalty, substitute civil penalty of 1500 units.
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.20
16E Subsection 77(2A) (penalty)
16F Subsection 77(2B) (penalty)
16G After subsection 97(2)
No notice required if doing so would put life, health or safety at risk.
System Operator has an obligation to not give notice.
16H Paragraph 98(1)(b)
16J Paragraph 98(1)(c)
16K Subsection 105(3)
16L After paragraph 105(3)(b)
Permission to insert in connection with insurance
16M Subsection 105(4)
Insertion of phrase in disclosure of data
17 Application of amendments
Application of amendments to cancellation of registration
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.21
18 Paragraph 6(3)(b)
Repeal paragraph, substitute period for Part commencement to January 31, 2019.
1 Section 5
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.22
Establishes class hierarchy for data custodian
2 Paragraph 15(ma)
Healthcare recipient must provide de-identified data and health information with consent.
Must provide de-identified data and health information.
3 Section 16
Insert 'or health information' after 'de-identified data'
4 Part 5 (heading)
5 After section 77
77A Enforceable requirements in My Health Records Rules must
77A(1) Enforceable requirements in My Health Records Rules must
Committing an act or omitting to do an act that contravenes a requirement and is reckless about the result.
(a) the entity does an act or omits to do an act;
(b) the entity is reckless as to that result;
Requires a temporal relation between the act and the result.
(c) the My Health Records Rules provide that the requirement is enforceable for the purposes of this paragraph;
77A(2) Enforceable requirements in My Health Records Rules must
Strict liability applies to paragraphs (1)(c) and (d)
6 Section 78 (at the end of the heading)
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.23
7 Section 78
8 At the end of section 78
Must not contravene a requirement imposed on the entity by My Health Records Rules.
Prohibition of contravening a requirement.
My Health Records Rules provide that the requirement is enforceable for the purposes of this subsection.
Entity must not contravene the requirement.
Requirement imposes an obligation that overlaps with the entity's obligations.
Requirement and entity's obligations overlap.
Entity must not contravene the requirement in a recurring trace.
Entity has an obligation to comply with the requirement.
Requirement prohibits entity from contravening it.
9 After Part 6
82 Data Governance Board
83 Functions of the Board
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.24
83(1) Functions of the Board
The Data Governance Board has functions to oversee the operation of the framework.
The Data Governance Board has a function.
83(2) Functions of the Board
The Board must not perform any role in relation to the day-to-day operation of the My Health Record system.
Prohibition on Board's involvement in My Health Record system operation.
(2) The Board does not have any functions, and must not perform any role...
84 Membership
Membership requirements for the Data Governance Board
The Data Governance Board consists of the following members:
85 Appointment of members
85(1) Appointment of members
Members must be appointed by the Minister.
85(2) Appointment of members
86 Qualifications and experience
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.25
86(1) Qualifications and experience
Minister must appoint members to the System Operator and data custodian.
86(2) Qualifications and experience
Eligibility requirements for Data Governance Board members
Possession of required skills or experience
87 Acting appointments
87(1) Acting appointments
The Minister may appoint a person to act as Chair under certain circumstances.
87(2) Acting appointments
88 Term of appointment and other terms and conditions
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.26
88(1) Term of appointment and other terms and conditions
Member of Data Governance Board must hold office for a specified period not exceeding 5 years.
(1) A member of the Data Governance Board holds office for the period specified in the instrument of appointment.
The member must hold office for the specified period.
(1) A member of the Data Governance Board holds office for the period specified in the instrument of appointment. The period must not exceed 5 years.
88(2) Term of appointment and other terms and conditions
Terms and conditions for Data Governance Board members determined by the Minister.
89 Remuneration
89(1) Remuneration
Member of Data Governance Board must be paid remuneration determined by Remuneration Tribunal.
89(2) Remuneration
Member must be paid allowances prescribed by an instrument.
89(3) Remuneration
Remuneration subject to the Remuneration Tribunal Act 1973.
89(4) Remuneration
90 Resignation
90(1) Resignation
Member can resign by giving written notice to the Minister.
90(2) Resignation
Resignation takes effect on specified day
91 Termination of appointment
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.27
91(1) Termination of appointment
Minister may terminate appointment for misbehaviour or incapacity
91(2) Termination of appointment
Termination of appointment under specified conditions
92 Leave of absence
Grant leave of absence on terms and conditions determined by the Minister.
93 Other paid work
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.28
93(1) Other paid work
No paid work that conflicts with duties.
(1) A member of the Data Governance Board must not engage in any paid work...
93(2) Other paid work
Definition of paid work for financial gain or reward
94 Convening meetings
94(1) Convening meetings
Must hold meetings as necessary for efficient performance of functions.
94(2) Convening meetings
Must convene a meeting within 30 days after receiving a written request.
95 Presiding at meetings
95(1) Presiding at meetings
Chair must preside at meetings where present.
95(2) Presiding at meetings
Deputy Chair must preside if Chair is not present.
95(3) Presiding at meetings
Members must appoint a presider if the Chair and Deputy Chair are absent.
96 Quorum
96(1) Quorum
A quorum is constituted by a majority of members.
96(2) Quorum
Quorum requirements when a member is absent or not present
Quorum requirement when a member is absent or not present
96A Voting at meetings
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.29
96A(1) Voting at meetings
Majority vote required for decisions at meetings
96A(2) Voting at meetings
The person presiding at a meeting of the Board must have a deliberative vote.
(2) The person presiding at a meeting of the Board has a deliberative vote.
The person presiding must have a deliberative vote.
96B Conduct of meetings
Regulate proceedings at meetings as considered appropriate.
96C Minutes
96D Decisions without meetings
96D(1) Decisions without meetings
(1) The Data Governance Board is taken to have made a decision at a meeting...
The decision was made during the meeting.
(c) all the members were informed of the proposed decision, or reasonable efforts were made to inform all the members of the proposed decision.
The members have been informed of the decision.
(a) without meeting, a majority of the members of the Board entitled to vote on the proposed decision indicate agreement with the decision;
The majority has agreed with the decision.
Reasonable efforts made to inform members
Reasonable efforts have been made to inform the members.
96D(2) Decisions without meetings
Determination of decision-making method without meetings
Authority to make decisions without meetings
96D(3) Decisions without meetings
Member not entitled to vote on proposed decision if not present at meeting.
Member would not have been entitled to vote on that proposal if the matter had been considered at a meeting of the Board.
96D(4) Decisions without meetings
Record decisions made in accordance with this section.
The Board must keep a record of decisions.
96E Relationship between System Operator and Data Governance
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.30
96E(1) Relationship between System Operator and Data Governance
Must comply with direction from Data Governance Board
96E(2) Relationship between System Operator and Data Governance
System Operator must not take steps to ensure data is used only for research or public health purposes.
Prohibition of action by System Operator.
96E(3) Relationship between System Operator and Data Governance
Clarifies no duty on System Operator regarding data use at times without relevant rules.
96F Board committees
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.31
96F(1) Board committees
Establishment of a committee or committees to assist in carrying out the functions of the Board.
96F(2) Board committees
The Board may dissolve a committee at any time.
96F(3) Board committees
Determination of committee functions by the Board.
Committee function determination is an obligation.
(3) The functions of a committee are as determined by the Board.
The Board determines the functions of a committee.
Committee function determination is a linear relationship.
Committee function determination is an event during which the Board's functions are determined.
The Board determines its functions during the committee's function determination.
Committee function determination is a dialectical relationship.
The Board determines the functions of a committee through dialectical means.
Committee function determination is a diffusion relationship.
The Board determines its functions through diffusion.
96F(4) Board committees
Committees must comply with Board directions.
96F(5) Board committees
Committee members must decide questions by majority vote.
Decisions must be made by majority vote.
96F(6) Board committees
Committees must inform other Board members of their decisions.
96F(7) Board committees
Committees may regulate proceedings at their meetings.
96F(8) Board committees
Committees must keep minutes of their meetings.
96G Delegation of functions
96G(1) Delegation of functions
Delegation of functions to APS employees
96G(2) Delegation of functions
Delegation of functions to staff members
Australian Institute of Health and Welfare Act 1987
96G(3) Delegation of functions
Delegate must comply with written directions of the Board.
96G(4) Delegation of functions
Delegation of functions continues despite change in Board membership.
96G(5) Delegation of functions
Delegation of functions may be varied or revoked by the Board.
96H Annual report
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.32
96H(1) Annual report
Annual report requirement for the Data Governance Board
96H(2) Annual report
No report on Board activities is required.
Exclusion of Board activities from annual report
(2) A report on the Department’s activities given under section 46 of the Public Governance, Performance and Accountability Act 2013 does not need to include a report on the activities of the Board.
96J Board is part of the Department
The Data Governance Board is prescribed in relation to the Department.
10 Subsection 105(2)
11 After paragraph 105(6)(a)
Establishment of Data Governance Board and data custodian
12 Subsection 109(7A)
May relate to research or public health purposes
Temporal relation to Proclamation Schedule 2
13 Subsection 109(9)
Omit 'the My Health Records Rules' and substitute with a new rule for purposes other than subsection (7A)
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.33
Prohibition of the My Health Records Rules
14 After section 109
109A My Health Records Rules relating to data for research or
109A(1) My Health Records Rules relating to data for research or
Imposes requirements on entities for preparing, providing, collecting, accessing, using and disclosing health information.
109A(2) My Health Records Rules relating to data for research or
Data custodian has functions to implement framework and provide data linkage services.
109A(3) My Health Records Rules relating to data for research or
Healthcare recipient consent required for data collection, use, and disclosure.
109A(4) My Health Records Rules relating to data for research or
Disclosure of de-identified data or health information is restricted to specific means.
109A(5) My Health Records Rules relating to data for research or
Ensure collection, use and disclosure of data or information does not result in an interference with privacy.
1980 No. 23 ([1980] ATS 23). In 2018, a text of a Covenant in
Access to data and information for specified purposes
my-health-records-amendment-strengthening-privacy-act-2018.pdf, p.35
the Australian Treaties Series was accessible through the Australian Treaties Library on the AustLII website (http://www.austlii.edu.au).
(b) for purposes related to collecting, preparing, analysing or publishing statistics;