Commonwealth Consolidated Acts

MY HEALTH RECORDS ACT 2012 - SCHEDULE 1

Note:   See section   4A.

Part   1 -- Opt - out model for the participation of healthcare recipients in the My Health Record system

1   Trial of opt - out model

  (1)   The Minister may make My Health Records Rules applying Part   2 of this Schedule (the opt - out model ) to a class, or classes, of healthcare recipients.

  (2)   The Minister must not make rules under subclause   (1), unless the Minister is satisfied that applying the opt - out model to that class, or those classes, of healthcare recipients would provide evidence of whether the opt - out model results in participation in the My Health Record system at a level that provides value for those using the My Health Record system.

  (3)   Before the Minister makes My Health Records Rules under this clause, the Minister must consult a subcommittee of the Ministerial Council, prescribed by the regulations for the purposes of this subclause.

2   Minister may apply the opt - out model to all healthcare recipients after trial

  (1)   If, having applied the opt - out model under clause   1, the Minister decides that the opt - out model results in participation in the My Health Record system at a level that provides value for those using the My Health Record system, the Minister may make My Health Records Rules applying the opt - out model to all healthcare recipients in Australia.

  (2)   In making the decision, the Minister may take into account:

  (a)   the evidence obtained in applying the opt - out model under clause   1; and

  (b)   any other matter relevant to the decision.

  (3)   Before the Minister makes My Health Records Rules under this clause, the Minister must consult the Ministerial Council.

Part   2 -- Registering all healthcare recipients

Division   1 -- Registering healthcare recipients

3   Registration of a healthcare recipient by the System Operator

  (1)   The System Operator may register a healthcare recipient if:

  (a)   the healthcare recipient is eligible for registration under clause   4; and

  (b)   the System Operator is satisfied, having regard to the matters (if any) specified in the My Health Records Rules, that the identity of the healthcare recipient has been appropriately verified; and

  (c)   the System Operator is satisfied that:

  (i)   the healthcare recipient has been given the opportunity, in accordance with clause   5, to make an election not to be registered; and

  (ii)   no such election is in force.

  (2)   Despite subclause   (1), the System Operator must not register a healthcare recipient:

  (a)   if the System Operator is satisfied that registering the healthcare recipient may compromise the security or integrity of the My Health Record system, having regard to the matters (if any) prescribed by the My Health Records Rules; or

  (b)   in other circumstances prescribed by the My Health Records Rules.

4   When a healthcare recipient is eligible for registration

    A healthcare recipient is eligible for registration if:

  (a)   a healthcare identifier has been assigned to the healthcare recipient under paragraph   9(1)(b) of the Healthcare Identifiers Act 2010 ; and

  (b)   the System Operator has collected the following information in relation to the healthcare recipient:

  (i)   full name;

  (ii)   date of birth;

  (iii)   healthcare identifier, Medicare card number or Department of Veterans' Affairs file number;

  (iv)   sex;

  (v)   such other information as is prescribed by the regulations.

5   Healthcare recipient elects not to be registered

  (1)   A healthcare recipient may, by notice to the System Operator, elect not to be registered.

  (2)   The notice:

  (a)   must be in the approved form; and

  (b)   be lodged at a place, or by a means, specified in the form; and

  (c)   if:

  (i)   under the My Health Records Rules, it is provided that the election by a member of a class of healthcare recipients must be given within a period, or on the occurrence of an event, specified in those rules; and

  (ii)   the healthcare recipient is a member of that class;

    the notice of the election must be given to the System Operator within that period, or on the occurrence of that event.

  (3)   The election begins to be in force on the day on which the healthcare recipient gives notice of the election to the System Operator.

  (4)   The election ceases to be in force on the day on which an application is made under clause   6 to be registered.

6   Healthcare recipients may apply for registration

  (1)   A healthcare recipient may apply to the System Operator for registration of the healthcare recipient.

  (2)   The application must:

  (a)   be in the approved form; and

  (b)   include, or be accompanied by, the information and documents required by the form; and

  (c)   be lodged at a place, or by a means, specified in the form.

  (3)   If:

  (a)   a healthcare recipient makes an application in accordance with this clause; and

  (b)   the healthcare recipient is eligible for registration under clause   4; and

  (c)   the System Operator is satisfied, having regard to the matters (if any) specified in the My Health Records Rules, that the identity of the healthcare recipient has been appropriately verified;

the System Operator must register the healthcare recipient.

  (4)   Despite subclause   (3), the System Operator must not register a healthcare recipient:

  (a)   if the System Operator is satisfied that registering the healthcare recipient may compromise the security or integrity of the My Health Record system, having regard to the matters (if any) prescribed by the My Health Records Rules; or

  (b)   in other circumstances prescribed by the My Health Records Rules.

Division   2 -- Information sharing for the purposes of the opt - out system

7   Collection, use and disclosure of health information by the System Operator

    The System Operator may collect, use and disclose health information about a healthcare recipient for the purposes of including the health information in the My Health Record of a registered healthcare recipient.

8   Collection, use and disclosure of healthcare identifiers, identifying information and information identifying authorised representatives and nominated representatives

  (1)   An entity mentioned in column 1 of an item of the following table, is authorised to take action of the kind described in column 2 of that item with information of the kind described in column 3 of that item in the circumstances described in column 4 of that item.

 

Collection, use and disclosure for the purpose of the My Health Record system
Item	Column 1 Entity	Column 2 Permitted action	Column 3 Information	Column 4 Circumstances
1	System Operator	collect use disclose	identifying information about any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient; (d) a healthcare provider the healthcare identifier of any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient; (d) a healthcare provider	the collection, use or disclosure is for the purposes of the My Health Record system
2	System Operator	collect use disclose	information relevant to whether a person is an authorised representative, or nominated representative, of another person	the collection, use or disclosure is for the purposes of determining whether a person is an authorised representative, or a nominated representative, of another person
3	registered repository operator registered portal operator	collect use disclose to a participant in the My Health Record System	the healthcare identifier of any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient; (d) a healthcare provider	the collection, use or disclosure is for the purposes of the My Health Record system
4	service operator for the purposes of the Healthcare Identifiers Act 2010	collect from the System Operator use disclose to the System Operator	information relevant to whether a person is an authorised representative, or nominated representative, of another person	the collection, use or disclosure is for the purposes of assisting the System Operator to determine whether a person is an authorised representative, or a nominated representative, of another person
5	Chief Executive Medicare	collect from the System Operator use disclose to the System Operator	identifying information about any person who is, or may be, any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient	the collection, use or disclosure is: (a) for the purposes of assisting the System Operator to verify the identity of the person; or (b) otherwise for the purposes of the My Health Record system
6	Chief Executive Medicare	collect from the System Operator use disclose to the System Operator	information relevant to whether a person is an authorised representative, or nominated representative, of another person	the collection, use or disclosure is for the purposes of assisting the System Operator to determine whether a person is an authorised representative, or a nominated representative, of another person
7	Chief Executive Medicare	collect use disclose to a participant in the My Health Record system	identifying information about any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient healthcare identifier of any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient	both of the following are satisfied: (a) the collection, use or disclosure is for the purpose of including health information in the healthcare recipient's My Health Record; (b) an election is not currently in force under clause   13 not to have the healthcare recipient's health information made available to the System Operator
8	Veterans' Affairs Department Defence Department	use disclose to the System Operator	identifying information about any person who is, or may be, any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient	the use or disclosure is for the purposes of assisting the System Operator to verify the identity of the person
9	Veterans' Affairs Department Defence Department	collect from the service operator under the Healthcare Identifiers Act 2010 use disclose to a participant in the My Health Record system	identifying information about any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient healthcare identifier of any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient	both of the following are satisfied: (a) the collection, use or disclosure is for the purpose of including prescribed information in the healthcare recipient's My Health Record; (b) an election is not currently in force under clause   13 not to have the healthcare recipient's health information made available to the System Operator
10	a prescribed entity	collect use disclose to another prescribed entity	identifying information about any person who is, or may be, any of the following: (a) a healthcare recipient; (b) an authorised representative of a healthcare recipient; (c) a nominated representative of a healthcare recipient	the collection, use or disclosure is for the purposes of assisting the System Operator to verify the identity of the person

Note:   Under section   15 of the Healthcare Identifiers Act 2010 , the service operator under that Act is authorised to collect, use and disclose healthcare identifiers of, and identifying information about, healthcare recipients and their representatives for the purposes of the My Health Record system. The service operator is also authorised to collect, use and disclose healthcare identifiers of, and identifying information about, healthcare providers under section   24 of that Act.

  (2)   If:

  (a)   any of the following entities discloses information to the System Operator in circumstances in which the information is authorised to be disclosed under subclause   (1):

  (i)   the Chief Executive Medicare;

  (ii)   the Veterans' Affairs Department;

  (iii)   the Defence Department;

  (iv)   the service operator for the purposes of the Healthcare Identifiers Act 2010 ;

  (v)   an entity prescribed for the purposes of item   10 of the table in subclause   (1); and

  (b)   the entity that disclosed the information becomes aware that the information has changed;

that entity must, as soon as practicable after becoming aware of the change, inform the System Operator of the change.

Division   3 -- Handling health information for the purposes of a healthcare recipient's My Health Record

Subdivision A -- Healthcare provider to upload health information

9   Authorisation for healthcare provider to upload health information

  (1)   A registered healthcare provider organisation is authorised to upload to the My Health Record system any record that includes health information about a registered healthcare recipient, subject to the following:

  (a)   express advice given by the healthcare recipient to the registered healthcare provider organisation that a particular record, all records or a specified class of records must not be uploaded;

  (b)   a law of a State or Territory that is prescribed by the regulations for the purposes of subclause   (3).

  (2)   A registered healthcare provider organisation is authorised to upload to the My Health Record system a record in relation to a healthcare recipient (the patient ) that includes health information about another healthcare recipient (the third party ), if the health information about the third party is directly relevant to the healthcare of the patient, subject to a law of a State or Territory that is prescribed by the regulations for the purposes of subclause   (3).

  (3)   An authorisation referred to in subclause   (1) or (2) has effect despite a law of a State or Territory that requires consent to the disclosure of particular health information:

  (a)   given expressly; or

  (b)   given in a particular way;

other than a law of a State or Territory prescribed by the regulations for the purposes of this subclause.

Subdivision B -- Functions of the Chief Executive Medicare

10   Registered repository operator

    It is a function of the Chief Executive Medicare to seek to become a registered repository operator and, if registered, to operate a repository for the purposes of the My Health Record system in accordance with this Division.

11   Uploading health information to the repository

    At any time when the Chief Executive Medicare is a registered repository operator, the Chief Executive Medicare may, at his or her discretion, upload health information held by the Chief Executive Medicare about a registered healthcare recipient to the repository operated by the Chief Executive Medicare.

12   Making health information available to the System Operator

  (1)   At any time when the Chief Executive Medicare is a registered repository operator, the Chief Executive Medicare may, at his or her discretion, make available to the System Operator health information held by the Chief Executive Medicare about a registered healthcare recipient.

  (2)   Despite subclause   (1), the Chief Executive Medicare must not make health information about a healthcare recipient available to the System Operator, if the healthcare recipient has elected under clause   13 not to have the information made available, and that election is in force.

13   Healthcare recipient may elect not to have health information disclosed to the System Operator

  (1)   A healthcare recipient may, by notice to the System Operator, elect not to have health information about the healthcare recipient held by the Chief Executive Medicare made available to the System Operator.

  (2)   The notice under subclause   (1):

  (a)   must be in the approved form; and

  (b)   be lodged at a place, or by a means, specified in the form; and

  (c)   if:

  (i)   under the My Health Records Rules, it is provided that the election by a member of a class of healthcare recipients must be given within a period, or on the occurrence of an event, specified in those rules; and

  (ii)   the healthcare recipient is a member of that class;

    the notice of the election must be given to the System Operator within that period, or on the occurrence of that event.

  (3)   The election begins to be in force from the day on which the healthcare recipient gives notice of the election to the System Operator.

  (4)   The election ceases to be in force:

  (a)   if the healthcare recipient notifies the System Operator that the healthcare recipient withdraws the election--from the day on which the notice is given; and

  (b)   if another time is prescribed by the My Health Records Rules--at that time.

  (5)   The notice under subclause   (4):

  (a)   must be in the approved form; and

  (b)   be lodged at a place, or by a means, specified in the form.

14   Health information uploaded or made available may include details of healthcare providers

    The health information about a healthcare recipient uploaded under clause   11 or made available under clause   12 may include the name of one or more healthcare providers that have provided healthcare to the healthcare recipient.

15   Way in which repository operated not limited by this Division

    Nothing in this Division limits the way in which the repository is to be operated.

Subdivision C -- Other registered repository operators

16   Making health information available to the System Operator

    A registered repository operator (other than the Chief Executive Medicare) may make available to the System Operator health information held by the registered repository operator about a registered healthcare recipient.

Part   3 -- Other consequences of applying the opt - out rules

17   References to other provisions of this Act

    If Part   2 of this Schedule applies in relation to a healthcare recipient:

  (a)   Division   4 of Part   2 of this Act does not apply in relation to the healthcare recipient; and

  (b)   Division   1 of Part   3 of this Act does not apply in relation to the healthcare recipient; and

  (c)   section   46 applies as if the reference to "this Part" were a reference to "Part   2 of Schedule   1 to this Act"; and

  (d)   section   50D does not apply in relation to the healthcare recipient; and

  (e)   paragraphs 51(2)(d) and (e) do not apply in relation to the healthcare recipient (consent to upload information to the My Health Record system); and

  (f)   section   57 applies as if a reference to a decision under Part   3 to register a healthcare recipient were a reference to a decision under Part   2 of this Schedule to register the healthcare recipient; and

  (g)   Division   6 of Part   3 of this Act does not apply in relation to the healthcare recipient; and

  (h)   in relation to the healthcare recipient, the reference in paragraph   97(1)(b) to a decision under section   41 to refuse to register a healthcare recipient is taken to include a reference to a decision under Part   2 of this Schedule to refuse to register the healthcare recipient; and

  (i)   if the healthcare recipient is registered under Part   2 of this Schedule--a reference in this Act to a registered healthcare recipient is taken to include a reference to the healthcare recipient.