A participant in the My Health Record system is authorised to collect, use and disclose health information included in a healthcare recipient's My Health Record if:
(a) the collection, use or disclosure is undertaken for the purpose of the management or operation of the My Health Record system, if the healthcare recipient would reasonably expect the participant to collect, use or disclose the health information for that purpose; or
(b) the collection, use or disclosure is undertaken in response to a request by the System Operator for the purpose of performing a function or exercising a power of the System Operator.
Note: For example, the System Operator might make a request under paragraph (b) for the purposes of section 69, 69A or 70.