(1) Information included in a healthcare recipient's My Health Record is used for a prohibited purpose if the person who uses the information does so for any one or more of the following purposes:
(a) the purpose of:
(i) underwriting a contract of insurance that covers the healthcare recipient; or
(ii) determining whether to enter into a contract of insurance that covers the healthcare recipient (whether alone or as a member of a class); or
(iii) determining whether a contract of insurance covers the healthcare recipient in relation to a particular event; or
(iv) an employer employing, or continuing or ceasing to employ, the healthcare recipient;
(b) a purpose prescribed by the regulations.
(2) If the person uses information for purposes that include, or for a purpose that includes, a purpose mentioned in subsection (1), the person is taken to be using the information for a prohibited purpose.
(3) To avoid doubt, use of information is not for a prohibited purpose if the use is solely for:
(a) the purpose of providing healthcare to the healthcare recipient; or
(b) purposes relating to the provision of indemnity cover for a healthcare provider.
(5) References in paragraph (1)(a) to insurance do not include State insurance that does not extend beyond the limits of the State concerned.
(6) For the purposes of this section, using information for a purpose includes requesting or requiring the information for that purpose.