A participant in the My Health Record system is authorised to disclose health information included in a registered healthcare recipient's My Health Record for any purpose if the disclosure of the health information is:
(a) to the registered healthcare recipient's nominated representative; and
(b) in accordance with:
(i) the access controls set by the registered healthcare recipient; or
(ii) if the healthcare recipient has not set access controls--the default access controls specified by the My Health Records Rules or, if the My Health Records Rules do not specify default access controls, by the System Operator.