HEALTHCARE IDENTIFIERS BILL 2010

i Healthcare Identifiers Bill 2010 No. , 2010

Contents

Part 1--Preliminary

1 Short

title

...........................................................................................

2 Commencement

.................................................................................

Purpose of this Act ............................................................................. 2

Act to bind the Crown ........................................................................ 2

5 Definitions

.........................................................................................

6 Meaning

service operator .............................................................. 5

7 Meaning

identifying information ................................................... 5

8 Meaning

national registration authority ....................................... 6

Part 2--Assigning healthcare identifiers

9 Assigning

healthcare

identifiers ......................................................... 7

Service operator must keep record of healthcare identifiers

etc. ...................................................................................................... 8

Part 3--Use and disclosure of healthcare identifiers and other

information

Division 1--Use and disclosure of identifying information for

assignment of healthcare identifiers

11 Disclosure

healthcare providers .................................................... 9

12 Disclosure

data sources ................................................................. 9

13 Disclosure

national

registration authority ................................... 10

14 Maintaining

healthcare identifiers ................................................... 10

Service operator's duty of confidentiality ........................................ 10

Division 2--Disclosure of healthcare identifier by service

operator

Subdivision A--Request by healthcare provider for healthcare

recipient's healthcare identifier

Disclosure of healthcare recipient's identifying information

by healthcare provider ..................................................................... 12

Subdivision B--Disclosure of healthcare identifier by service

operator

Disclosure to healthcare provider .................................................... 12

Disclosure to healthcare recipient .................................................... 13

Disclosure to registration authority .................................................. 13

Disclosure for authentication of healthcare provider's

identity ............................................................................................. 14

21 Access

controls

................................................................................

Information about disclosures by service operator .......................... 14

Healthcare Identifiers Bill 2010 No. , 2010 ii

Division 3--Use, disclosure and adoption of healthcare identifier

by healthcare provider

Disclosure to healthcare recipient .................................................... 15

Use and disclosure for other purposes ............................................. 15

25 Adoption

healthcare provider ..................................................... 16

Division 4--Unauthorised use and disclosure of healthcare

identifiers

Unauthorised use and disclosure of healthcare identifiers

prohibited ......................................................................................... 17

Division 5--Protection of healthcare identifiers

27 Protection

healthcare identifiers .................................................. 18

Part 4--Interaction with the Privacy Act 1988

28 Interaction

with

the

Privacy Act 1988 .............................................. 19

Functions of Privacy Commissioner ................................................ 19

Annual reports by Privacy Commissioner ....................................... 19

Part 5--Healthcare Provider Directory

31 Healthcare

Provider Directory ......................................................... 21

Part 6--Oversight role of Ministerial Council

32 Directions

service operator .......................................................... 22

33 Consultation

with

Ministerial Council about regulations ................ 22

Annual reports by service operator .................................................. 22

Review of operation of Act .............................................................. 23

Part 7--Miscellaneous

36 Extent

authorisation

.....................................................................

Relationship to State and Territory laws .......................................... 24

38 Severability--additional

effect of Parts 3 and 4 .............................. 25

39 Regulations

......................................................................................

Part 1 Preliminary

Section 3

2 Healthcare Identifiers Bill 2010 No. , 2010

3 Purpose of this Act

(1) The purpose of this Act is to provide a way of ensuring that an

entity that provides, or an individual who receives, healthcare is

correctly matched to health information that is created when

healthcare is provided.

(2) This purpose is to be achieved by assigning a unique identifying

number to each healthcare provider and healthcare recipient.

4 Act to bind the Crown

(1) This Act binds the Crown in right of the Commonwealth, of the

States, of the Australian Capital Territory, of the Northern

Territory and of Norfolk Island.

Note:

The Minister must, in certain circumstances, declare that certain

provisions of this Act do not apply to the public bodies of a specified

State or Territory: see subsection 37(4).

(2) This Act does not make the Crown liable to be prosecuted for an

offence.

5 Definitions

In this Act:

data source has the meaning given by subsection 12(2).

date of birth accuracy indicator means a data element that is used

to indicate how accurate a recorded date of birth is.

date of death accuracy indicator means a data element that is used

to indicate how accurate a recorded date of death is.

employee, of an entity, includes:

(a) an individual who provides services for the entity under a

contract for services; or

(b) an individual whose services are made available to the entity

(including services made available free of charge).

entity means:

(a) a person; or

Preliminary Part 1

Section 5

Healthcare Identifiers Bill 2010 No. , 2010 3

(b) a partnership; or

(d) a trust; or

(e) a part of another entity (under a previous application of this

definition).

healthcare means health service within the meaning of subsection

6(1) of the Privacy Act 1988.

healthcare identifier has the meaning given by section 9.

healthcare provider means:

(a) an individual who:

(i) has provided, provides, or is to provide, healthcare; or

(ii) is registered by a registration authority as a member of a

particular health profession; or

(b) an entity, or a part of an entity, that has conducted, conducts,

or will conduct, an enterprise that provides healthcare

(including healthcare provided free of charge).

Example: A public hospital, or a corporation that runs a medical centre.

healthcare recipient means an individual who has received,

receives, or may receive, healthcare.

health information has the meaning given by subsection 6(1) of

the Privacy Act 1988.

Human Research Ethics Committee has the meaning given by:

(a) the National Statement on Ethical Conduct in Human

Research issued in March 2007 by the Chief Executive

Officer of the National Health and Medical Research Council

under the National Health and Medical Research Council Act

1992; or

(b) if that Statement is amended--that Statement as amended.

Note:

In 2010, the text of the Statement was accessible through the National

Health and Medical Research Council website (www.nhmrc.gov.au).

identified healthcare provider means a healthcare provider who

has been assigned a healthcare identifier under section 9.

Part 1 Preliminary

Section 5

4 Healthcare Identifiers Bill 2010 No. , 2010

identifying information has the meaning given by section 7.

law includes:

(a) an Act or legislative instrument; or

(b) an Act or legislative instrument of a State or Territory.

Ministerial Council has the meaning given by:

(a) the National Partnership Agreement on E-Health made on

7 December 2009 between the Commonwealth, the States,

the Australian Capital Territory and the Northern Territory;

(b) if that Agreement is amended--that Agreement as amended.

Note:

In 2010, the text of the Agreement was accessible through the Council

of Australian Governments website (www.coag.gov.au).

National Privacy Principle has the meaning given by the Privacy

Act 1988.

national registration authority has the meaning given by section 8.

public body, of a State or Territory, means:

(a) the Crown in right of the State or Territory; or

(b) a State or Territory authority of that State or Territory; or

State or Territory; or

(d) the Parliament of the State, or the legislature of the Territory

(whichever is applicable); or

(e) a member of the Parliament of the State, or of the legislature

of the Territory (whichever is applicable).

registration authority means an entity that is responsible under a

law for registering members of a particular health profession.

service operator has the meaning given by section 6.

State or Territory authority has the meaning given by the Privacy

Act 1988.

Veterans' Affairs Department means the Department that:

(a) deals with matters arising under:

Preliminary Part 1

Section 6

Healthcare Identifiers Bill 2010 No. , 2010 5

(i) section 1 of the Australian Participants in British

Nuclear Tests (Treatment) Act 2006; or

(ii) section 1 of the Military Rehabilitation and

Compensation Act 2004; or

(iii) section 1 of the Veterans' Entitlements Act 1986; and

(b) is administered by the Minister who administers that section.

6 Meaning of service operator

(1) The Chief Executive Officer of Medicare Australia is the service

operator.

(2) However, if the regulations prescribe another person for the

purpose of this subsection, that person is the service operator

instead.

7 Meaning of identifying information

(1) Each of the following is identifying information of a healthcare

provider who is an individual, if the service operator requires it for

the purpose of performing the service operator's functions under

this Act in relation to the healthcare provider:

(a) the name of the healthcare provider;

(b) the address of the healthcare provider;

the healthcare provider;

(d) the sex of the healthcare provider;

(e) the type of healthcare provider that the individual is;

(f) if the healthcare provider is registered by a registration

authority--the registration authority's identifier for the

healthcare provider and the status of the registration (such as

conditional, suspended or cancelled);

(g) other information that is prescribed by the regulations for the

purpose of this paragraph.

(2) Each of the following is identifying information of a healthcare

provider that is not an individual, if the service operator requires it

for the purpose of performing the service operator's functions

under this Act in relation to the healthcare provider:

Part 1 Preliminary

Section 8

6 Healthcare Identifiers Bill 2010 No. , 2010

(a) the name of the healthcare provider;

(b) the address of the healthcare provider;

System (Australian Business Number) Act 1999) of the

healthcare provider;

(d) if applicable, the ACN (within the meaning of the

Corporations Act 2001) of the healthcare provider;

(e) other information that is prescribed by the regulations for the

purpose of this paragraph.

(3) Each of the following is identifying information of a healthcare

recipient, if the service operator requires it for the purpose of

performing the service operator's functions under this Act in

relation to the healthcare recipient:

(a) if applicable, the Medicare number of the healthcare

recipient;

(b) if applicable, the Veterans' Affairs Department file number

of the healthcare recipient;

(d) the address of the healthcare recipient;

(e) the date of birth, and the date of birth accuracy indicator, of

the healthcare recipient;

(f) the sex of the healthcare recipient;

(g) for a healthcare recipient who was part of a multiple birth--

the order in which the healthcare recipient was born;

Example: The 2nd of twins.

(h) if applicable, the date of death, and the date of death accuracy

indicator, of the healthcare recipient.

8 Meaning of national registration authority

national registration authority is a registration authority that is

prescribed by the regulations for the purposes of this section.

Assigning healthcare identifiers Part 2

Section 9

Healthcare Identifiers Bill 2010 No. , 2010 7

Part 2--Assigning healthcare identifiers

9 Assigning healthcare identifiers

(1) The service operator is authorised to assign a number (a healthcare

identifier) to uniquely identify:

(a) a healthcare provider included in a class prescribed by the

regulations for the purpose of this paragraph; or

(b)

healthcare

recipient.

(2) A national registration authority is authorised to assign a number (a

healthcare identifier) to uniquely identify a healthcare provider, if:

(a) the healthcare provider is an individual who is a member of a

particular health profession; and

(b) the national registration authority is responsible under a law

for registering members of that health profession.

(3) The types of healthcare identifiers include:

(a) an identifier that is assigned to a healthcare provider who is

an individual who:

(i) has provided, provides, or is to provide, healthcare; or

(ii) is registered by a registration authority as a member of a

particular health profession; and

(b) an identifier that is assigned to a healthcare provider who has

conducted, conducts, or will conduct, an enterprise that

provides healthcare (including healthcare provided free of

charge); and

Note:

A healthcare provider who is an individual and who is covered by

both paragraphs of the definition of healthcare provider in section 5

(for example, a sole practitioner) may be assigned:

(a) a healthcare identifier of the type mentioned in paragraph (3)(a);

and

(b) a different healthcare identifier of the type mentioned in

paragraph (3)(b).

(4) In exercising a power under subsection (1), the service operator is

not required to consider whether a healthcare provider or

Part 2 Assigning healthcare identifiers

Section 10

8 Healthcare Identifiers Bill 2010 No. , 2010

healthcare recipient agrees to having a healthcare identifier

assigned to the healthcare provider or healthcare recipient.

(5) The regulations may prescribe requirements for assigning a

healthcare identifier to a healthcare provider or to a healthcare

recipient, including providing for review of decisions made under

this section.

(6) A healthcare identifier is an identifier for the purpose of National

Privacy Principle 7.

10 Service operator must keep record of healthcare identifiers etc.

The service operator must establish and maintain an accurate

record of:

(a) healthcare identifiers that have been assigned; and

(b) the information that the service operator has that relates to

those healthcare identifiers, including details of requests

made to the service operator for the service operator to

disclose those healthcare identifiers under Division 2 of

Part 3.

Use and disclosure of healthcare identifiers and other information Part 3

Use and disclosure of identifying information for assignment of healthcare identifiers

Division 1

Section 11

Healthcare Identifiers Bill 2010 No. , 2010 9

Part 3--Use and disclosure of healthcare identifiers

and other information

Division 1--Use and disclosure of identifying information

for assignment of healthcare identifiers

11 Disclosure by healthcare providers

(1) An identified healthcare provider is authorised to disclose

identifying information of a healthcare recipient to the service

operator for the purpose of the service operator assigning a

healthcare identifier to the healthcare recipient.

(2) The service operator is authorised:

(a) to collect the information; and

(b) to use the information for the purpose of assigning a

healthcare identifier to the healthcare recipient.

12 Disclosure by data sources

(1) A data source is authorised to disclose identifying information of a

healthcare provider, or of a healthcare recipient, to the service

operator for the purpose of the service operator assigning a

healthcare identifier to the healthcare provider or healthcare

recipient.

(2) Each of the following is a data source:

(a)

Medicare

Australia;

(b) the Veterans' Affairs Department;

this paragraph.

(3) The service operator is authorised:

(a) to collect the information; and

(b) to use the information for the purpose of assigning a

healthcare identifier to the healthcare provider or healthcare

recipient.

Part 3 Use and disclosure of healthcare identifiers and other information

Division 1 Use and disclosure of identifying information for assignment of healthcare

identifiers

Section 13

10 Healthcare Identifiers Bill 2010 No. , 2010

13 Disclosure by national registration authority

(1) A national registration authority is authorised to disclose:

(a) a healthcare identifier; or

(b) information that the national registration authority has that

relates to a healthcare identifier;

to the service operator for the purpose of the service operator

establishing or maintaining the record mentioned in section 10.

(2) The service operator is authorised:

(a) to collect the healthcare identifier or information; and

(b) to use the healthcare identifier or information for the purpose

of establishing or maintaining the record mentioned in

section 10.

14 Maintaining healthcare identifiers

The regulations may require an identified healthcare provider to

provide to the service operator information that:

(a) relates to the healthcare provider's healthcare identifier; and

(b) is prescribed by the regulations for the purposes of this

section.

15 Service operator's duty of confidentiality

(1) A person commits an offence if:

(a) information was disclosed to the person for the purpose of

Part 2 or this Division; and

(b)

the

person:

(i) uses the information; or

(ii) discloses the information.

Penalty: Imprisonment for 2 years or 120 penalty units, or both.

Note:

If a body corporate is convicted of an offence against subsection (1),

subsection 4B(3) of the Crimes Act 1914 allows a court to impose a

fine of up to 600 penalty units.

(2) Subsection (1) does not apply if the person uses or discloses the

information for:

Use and disclosure of healthcare identifiers and other information Part 3

Use and disclosure of identifying information for assignment of healthcare identifiers

Division 1

Section 15

Healthcare Identifiers Bill 2010 No. , 2010 11

(a) the purpose for which the information was disclosed to the

person; or

(b) a purpose that is authorised under another law.

Note:

A defendant bears an evidential burden in relation to the matters in

subsection (2): see subsection 13.3(3) of the Criminal Code.

(3) A person commits an offence if:

(a) information was disclosed to the person in contravention of

subsection (1); and

(b) the person knows that the disclosure of the information to the

person contravened that subsection; and

(c)

the

person:

(i) uses the information; or

(ii) discloses the information.

Penalty: Imprisonment for 2 years or 120 penalty units, or both.

Note:

If a body corporate is convicted of an offence against subsection (3),

subsection 4B(3) of the Crimes Act 1914 allows a court to impose a

fine of up to 600 penalty units.

(4) Subsection (3) does not apply if the person discloses the

information for the purpose of an appropriate authority

investigating the contravention mentioned in paragraph (3)(b).

Note:

A defendant bears an evidential burden in relation to the matter in

subsection (4): see subsection 13.3(3) of the Criminal Code.

Part 3 Use and disclosure of healthcare identifiers and other information

Division 2 Disclosure of healthcare identifier by service operator

Section 16

12 Healthcare Identifiers Bill 2010 No. , 2010

Division 2--Disclosure of healthcare identifier by service

operator

Subdivision A--Request by healthcare provider for healthcare

recipient's healthcare identifier

16 Disclosure of healthcare recipient's identifying information by

healthcare provider

(1) An identified healthcare provider is authorised to disclose

identifying information of a healthcare recipient to the service

operator for the purpose of the service operator disclosing the

healthcare recipient's healthcare identifier to the healthcare

provider under section 17.

(2) The service operator is authorised:

(a) to collect the information; and

(b) to use the information for the purpose of disclosing the

healthcare recipient's healthcare identifier to the healthcare

provider under section 17.

Subdivision B--Disclosure of healthcare identifier by service

operator

17 Disclosure to healthcare provider

(1) For the purpose of an identified healthcare provider

communicating or managing health information, as part of

providing healthcare to a healthcare recipient, the service operator

is authorised to disclose a healthcare identifier to:

(a) an identified healthcare provider (the collecting provider); or

(b) an employee (the authorised employee) of an identified

healthcare provider, if that identified healthcare provider has,

by notice to the service operator, authorised the employee to

act on behalf of that identified healthcare provider under this

section.

(2) The collecting provider or authorised employee is authorised to

collect the healthcare identifier.

Use and disclosure of healthcare identifiers and other information Part 3

Disclosure of healthcare identifier by service operator Division 2

Section 18

Healthcare Identifiers Bill 2010 No. , 2010 13

Note 1:

Section 24 authorises a healthcare provider to use, or to disclose, a

healthcare identifier:

(a) for the purpose of communicating or managing health

information, as part of the provision of healthcare to a healthcare

recipient; or

(b) for certain other purposes.

Note 2:

Section 25 authorises a healthcare provider to adopt the healthcare

identifier of a healthcare recipient as the healthcare provider's own

identifier of the healthcare recipient.

18 Disclosure to healthcare recipient

The service operator must, if asked to do so by a healthcare

recipient or a person who is responsible (within the meaning of

subclause 2.5 of National Privacy Principle 2) for a healthcare

recipient, disclose to the healthcare recipient or responsible person:

(a) the healthcare recipient's healthcare identifier (if any); or

(b)

information

that:

(i) relates to the healthcare recipient or to the healthcare

recipient's healthcare identifier; and

(ii) is included in the record the service operator maintains

under section 10.

19 Disclosure to registration authority

(1) The service operator is authorised to disclose an identified

healthcare provider's healthcare identifier to a registration

authority for the purpose of the registration authority registering

the healthcare provider.

(2) The registration authority is authorised:

(a) to collect the healthcare identifier; and

(b) to use the healthcare identifier for the purpose of the

registration authority:

(i) registering the healthcare provider; or

(ii) performing any other function of the registration

authority under a law.

Part 3 Use and disclosure of healthcare identifiers and other information

Division 2 Disclosure of healthcare identifier by service operator

Section 20

14 Healthcare Identifiers Bill 2010 No. , 2010

20 Disclosure for authentication of healthcare provider's identity

(1) The service operator is authorised to disclose an identified

healthcare provider's healthcare identifier to an entity for the

purpose of enabling the healthcare provider's identity to be

authenticated in electronic transmissions (for example, as part of a

public key infrastructure).

(2) The entity is authorised:

(a) to collect the healthcare identifier; and

(b) to use the healthcare identifier for the purpose of enabling the

healthcare provider's identity to be authenticated in

electronic transmissions.

21 Access controls

The regulations may prescribe rules about the disclosure of

healthcare identifiers by the service operator, including rules about

requests to the service operator to disclose healthcare identifiers.

22 Information about disclosures by service operator

If the service operator discloses a healthcare identifier to an entity,

the regulations may require the entity to provide prescribed

information to the service operator in relation to that disclosure.

Note:

The regulations may provide for the imposition of a penalty for

contravention of a regulation: see subsection 39(2).

Use and disclosure of healthcare identifiers and other information Part 3

Use, disclosure and adoption of healthcare identifier by healthcare provider Division 3

Section 23

Healthcare Identifiers Bill 2010 No. , 2010 15

Division 3--Use, disclosure and adoption of healthcare

identifier by healthcare provider

23 Disclosure to healthcare recipient

A healthcare provider is authorised to disclose a healthcare

recipient's healthcare identifier to:

(a) the healthcare recipient; or

(b) a person who is responsible (within the meaning of subclause

2.5 of National Privacy Principle 2) for the healthcare

recipient.

24 Use and disclosure for other purposes

Use and disclosure for other purposes

(1) A healthcare provider is authorised to use a healthcare identifier, or

to disclose a healthcare identifier to an entity, (including a

healthcare identifier disclosed to the healthcare provider for any

purpose under a previous application of this section) if:

(a) the purpose of the use or disclosure is to communicate or

manage health information as part of:

(i) the provision of healthcare to a healthcare recipient; or

(ii) the management (including the investigation or

resolution of complaints), funding, monitoring or

evaluation of healthcare; or

(iii) the provision of indemnity cover for a healthcare

provider; or

(iv) the conduct of research that has been approved by a

Human Research Ethics Committee; or

(b) the healthcare provider reasonably believes that the use or

disclosure is necessary to lessen or prevent:

(i) a serious threat to an individual's life, health or safety;

(ii) a serious threat to public health or public safety.

(2) The entity is authorised:

(a) to collect the healthcare identifier; and

Part 3 Use and disclosure of healthcare identifiers and other information

Division 3 Use, disclosure and adoption of healthcare identifier by healthcare provider

Section 25

16 Healthcare Identifiers Bill 2010 No. , 2010

(b) to use the healthcare identifier, or to disclose the healthcare

identifier to a healthcare provider, for the purpose for which

it was disclosed to the entity.

(3) A healthcare provider to which a healthcare identifier is disclosed

under paragraph (2)(b) is authorised to collect the healthcare

identifier.

Note 1:

Subsection (1) authorises the healthcare provider to use, or to disclose,

the healthcare identifier. Section 25 authorises the healthcare provider

to adopt the healthcare identifier.

Note 2:

An entity may also use, or disclose, a healthcare identifier for a

purpose that is authorised under another law: see paragraph 26(2)(b).

Certain purposes excluded

(4) This section does not authorise the use or disclosure of the

healthcare identifier of a healthcare recipient for the purpose of

communicating or managing health information as part of:

(a) underwriting a contract of insurance that covers the

healthcare recipient; or

(b) determining whether to enter into a contract of insurance that

covers the healthcare recipient (whether alone or as a

member of a class); or

healthcare recipient in relation to a particular event; or

(d) employing the healthcare recipient.

25 Adoption by healthcare provider

A healthcare provider is authorised to adopt the healthcare

identifier of a healthcare recipient (including a healthcare identifier

disclosed to the healthcare provider for any purpose under

section 24) as the healthcare provider's own identifier of the

healthcare recipient.

Note:

This Division authorises the collection, use, disclosure and adoption

of only healthcare identifiers, and information relating to healthcare

identifiers. The collection, use, disclosure or adoption of other

personal information (e.g. health information), is dealt with in other

legislation, including the Privacy Act 1988.

Use and disclosure of healthcare identifiers and other information Part 3

Unauthorised use and disclosure of healthcare identifiers Division 4

Section 26

Healthcare Identifiers Bill 2010 No. , 2010 17

Division 4--Unauthorised use and disclosure of healthcare

identifiers

26 Unauthorised use and disclosure of healthcare identifiers

prohibited

Offence

(1) A person commits an offence if:

(a) a healthcare identifier is disclosed to the person; and

(b)

the

person:

(i) uses the healthcare identifier; or

(ii) discloses the healthcare identifier.

Penalty: Imprisonment for 2 years or 120 penalty units, or both.

Note:

If a body corporate is convicted of an offence against subsection (1),

subsection 4B(3) of the Crimes Act 1914 allows a court to impose a

fine of up to 600 penalty units.

(2) However, subsection (1) does not apply if:

(a)

the

person:

(i) is authorised to use, or to disclose, the healthcare

identifier for a purpose that is authorised under this Act;

and

(ii) uses or discloses the healthcare identifier for that

purpose; or

(b) the person uses or discloses the healthcare identifier for a

purpose that is authorised under another law; or

the purpose of, or in connection with, the person's personal,

family or household affairs (within the meaning of

section 16E of the Privacy Act 1988).

Note:

A defendant bears an evidential burden in relation to the matters in

subsection (2): see subsection 13.3(3) of the Criminal Code.

Part 3 Use and disclosure of healthcare identifiers and other information

Division 5 Protection of healthcare identifiers

Section 27

18 Healthcare Identifiers Bill 2010 No. , 2010

Division 5--Protection of healthcare identifiers

27 Protection of healthcare identifiers

An entity must:

(a) take reasonable steps to protect healthcare identifiers the

entity holds from:

(i) misuse and loss; and

(ii) unauthorised access, modification or disclosure; and

(b) comply with any requirements prescribed by the regulations

for the protection of healthcare identifiers the entity holds.

Note:

The regulations may provide for the imposition of a penalty for

contravention of a regulation: see subsection 39(2).

Interaction with the Privacy Act 1988 Part 4

Section 28

Healthcare Identifiers Bill 2010 No. , 2010 19

Part 4--Interaction with the Privacy Act 1988

28 Interaction with the Privacy Act 1988

An authorisation to collect, use or disclose a healthcare identifier

or identifying information under this Act is also an authorisation to

collect, use or disclose the healthcare identifier or identifying

information for the purpose of the Privacy Act 1988.

29 Functions of Privacy Commissioner

Breach of this Act is an interference with privacy

(1) An act or practice that contravenes this Act or the regulations in

connection with the healthcare identifier of an individual is taken

to be:

(a) for the purposes of the Privacy Act 1988, an interference with

the privacy of the individual; and

(b) covered by section 13 of that Act.

Note:

The act or practice may be the subject of a complaint under section 36

of that Act.

(2) For the purpose of applying Part V of that Act (Investigations) in

relation to the act or practice, treat a State or Territory authority as

if it were an organisation (within the meaning of that Act).

Audits

(3) For the purpose of paragraph 27(1)(h) of the Privacy Act 1988

(about audits), a healthcare identifier is taken to be personal

information.

30 Annual reports by Privacy Commissioner

(1) The Privacy Commissioner must, as soon as practicable after the

end of each financial year, prepare a report on the Privacy

Commissioner's compliance and enforcement activities under this

Act during the financial year.

Healthcare Provider Directory Part 5

Section 31

Healthcare Identifiers Bill 2010 No. , 2010 21

Part 5--Healthcare Provider Directory

31 Healthcare Provider Directory

(1) The service operator must establish and maintain a record (the

Healthcare Provider Directory) of the professional and business

details of the healthcare providers who have consented to those

details being included in the Healthcare Provider Directory.

(2) The service operator may disclose the professional or business

details of a healthcare provider who is listed in the Healthcare

Provider Directory to:

(a) an identified healthcare provider; or

(b) an employee of an identified healthcare provider, if that

identified healthcare provider has, by notice to the service

operator, authorised the employee to act on behalf of that

identified healthcare provider under this section.

Part 6 Oversight role of Ministerial Council

Section 32

22 Healthcare Identifiers Bill 2010 No. , 2010

Part 6--Oversight role of Ministerial Council

32 Directions to service operator

(1) After consulting the Ministerial Council, the Minister may, by

legislative instrument, give directions to the service operator about

the performance of the service operator's functions under this Act.

Note 1:

Section 42 (disallowance) of the Legislative Instruments Act 2003

does not apply to the directions--see section 44 of that Act.

Note 2:

Part 6 (sunsetting) of the Legislative Instruments Act 2003 does not

apply to the directions--see section 54 of that Act.

(2) The service operator must comply with a direction given under

subsection (1).

33 Consultation with Ministerial Council about regulations

Before the Governor-General makes a regulation for the purpose of

this Act, the Minister must consult with the Ministerial Council.

34 Annual reports by service operator

(1) The service operator must, as soon as practicable after the end of

each financial year, prepare a report on the activities, finances and

operations of the service operator during the financial year, so far

as they relate to this Act and the regulations.

(2) The service operator must give a copy of the report to:

(a) the Minister; and

(b)

either:

(i) the Ministerial Council; or

(ii) if the Ministerial Council directs the service operator to

give the report to another entity--that other entity;

no later than on 30 September after the end of the financial year to

which the report relates.

(3) The Minister must table a copy of the report in each House of

Parliament within 15 sitting days after the service operator gives a

copy of the report to the Minister.

Part 7 Miscellaneous

Section 36

24 Healthcare Identifiers Bill 2010 No. , 2010

Part 7--Miscellaneous

36 Extent of authorisation

An authorisation under this Act to an entity for a particular purpose

is an authorisation to an individual:

(a) who is an employee of the entity; and

(b) whose duties involve the implementation of that purpose.

37 Relationship to State and Territory laws

Relationship to State and Territory laws

(1) A law of a State or Territory has effect to the extent that the law is

capable of operating concurrently with this Act or the regulations.

(2)

However,

if:

(a) a person's act or omission is both:

(i) an offence under this Act; and

(ii) an offence under the law of a State or Territory; and

(b) that person is convicted of either of those offences;

the person is not liable to be convicted of the other offence.

(3) Nothing in this Act limits, restricts or otherwise affects any right or

remedy that a person would have had if this Act had not been

enacted.

Declarations that Act does not apply

(4) A provision of this Act does not apply to the public bodies of a

State or Territory if a declaration made under subsection (5) is in

force in relation to that provision and that State or Territory.

(5) The Minister must, by legislative instrument, declare that specified

provisions of this Act do not apply to the public bodies of a

specified State or Territory if:

(a) a Minister of the State or Territory, by written notice,

requests the Minister to make the declaration; and

Miscellaneous Part 7

Section 38

Healthcare Identifiers Bill 2010 No. , 2010 25

(b) the Minister is satisfied that a law in force in the State or

Territory contains provisions that have been agreed to by the

Ministerial Council.

(6) The Minister may, by legislative instrument, revoke the declaration

if:

(a) a Minister of the State, by written notice, requests the

Minister to do so; or

(b) a provision in the State or Territory law, which had been

agreed to by the Ministerial Council, is amended without the

agreement of the Ministerial Council.

(7) Neither section 42 (disallowance) nor Part 6 (sunsetting) of the

Legislative Instruments Act 2003 applies to a declaration or

revocation made under subsection (5) or (6) of this section.

38 Severability--additional effect of Parts 3 and 4

(1) Without limiting their effect apart from each of the following

subsections of this section, Parts 3 and 4 have effect in relation to a

collection, use or disclosure of information as provided by that

subsection.

(2) Parts 3 and 4 also have the effect they would have if their operation

in relation to a collection, use or disclosure of information were

expressly confined to a collection, use or disclosure taking place in

the course of, or in relation to, trade or commerce:

(a) between Australia and places outside Australia; or

(b) among the States; or

between 2 Territories.

(3) Parts 3 and 4 also have the effect they would have if their operation

in relation to a collection, use or disclosure of information were

expressly confined to a collection, use or disclosure using a postal,

telegraphic, telephonic or other like service (within the meaning of

paragraph 51(v) of the Constitution).

(4) Parts 3 and 4 also have the effect they would have if their operation

in relation to a collection, use or disclosure of information were

expressly confined to a collection, use or disclosure in relation to

Part 7 Miscellaneous

Section 38

26 Healthcare Identifiers Bill 2010 No. , 2010

census or statistics (within the meaning of paragraph 51(xi) of the

Constitution).

(5) Parts 3 and 4 also have the effect they would have if their operation

in relation to a collection, use or disclosure of information were

expressly confined to a collection, use or disclosure in relation to

aliens (within the meaning of paragraph 51(xix) of the

Constitution).

(6) Parts 3 and 4 also have the effect they would have if their operation

in relation to a collection, use or disclosure of information were

expressly confined to a collection, use or disclosure by, or to, a

trading, foreign or financial corporation (within the meaning of

paragraph 51(xx) of the Constitution).

(7) Parts 3 and 4 also have the effect they would have if their operation

in relation to a collection, use or disclosure of information were

expressly confined to a collection, use or disclosure in relation to

the provision of:

(a) sickness or hospital benefits; or

(b) medical or dental services (but not so as to authorise any

form of civil conscription);

(within the meaning of paragraph 51(xxiiiA) of the Constitution).

(8) Parts 3 and 4 also have the effect they would have if their operation

in relation to a collection, use or disclosure of information were

expressly confined to a collection, use or disclosure:

(a) in relation to which the Commonwealth is under an

obligation under an international agreement, including, the

International Covenant on Civil and Political Rights, and in

particular Article 17 of the Covenant; or

Note:

The text of the Covenant is set out in Australian Treaty Series

1980 No. 23 ([1980] ATS 23). In 2010, a text of a Covenant in

the Australian Treaties Series was accessible through the

Australian Treaties Library on the AustLII website

(www.austlii.edu.au).

(b) that is of international concern, including the international

concern reflected by the Guidelines Governing the Protection

of Privacy and Transborder Flows of Personal Data,

recommended by the Council of the Organisation for

Miscellaneous Part 7

Section 39

Healthcare Identifiers Bill 2010 No. , 2010 27

Economic Co-operation and Development on 23 September

1980.

Note:

In 2010, the text of the Guidelines was accessible through the

Organisation for Economic Co-operation and Development

website (www.oecd.org).

(9) Parts 3 and 4 also have the effect they would have if their operation

in relation to a collection, use or disclosure of information were

expressly confined to a collection, use or disclosure by, or to, the

Commonwealth or a Commonwealth authority.

(10) Parts 3 and 4 also have the effect they would have if their operation

in relation to a collection, use or disclosure of information were

expressly confined to a collection, use or disclosure taking place in

a Territory.

39 Regulations

(1) The Governor-General may make regulations prescribing matters:

(a) required or permitted to be prescribed by this Act; or

(b) necessary or convenient to be prescribed for carrying out or

giving effect to this Act.

Note:

Before the Governor-General makes a regulation for the purpose of

this Act, the Minister must consult with the Ministerial Council: see

section 33.

(2) Without limiting subsection (1), the regulations may provide for

the imposition of a penalty of not more than 50 penalty units for

contravention of a regulation.

Commonwealth of Australia Bills

HEALTHCARE IDENTIFIERS BILL 2010