(1) A person conducting a business or undertaking must ensure that health monitoring reports in relation to a worker carrying out work for the business or undertaking are kept as a confidential record--(a) identified as a record in relation to the worker, and(b) for at least 30 years after the record is made.: Maximum penalty--(a) in the case of an individual--15 penalty units, or(b) in the case of a body corporate--70 penalty units.
(2) The person must ensure that the health monitoring report and results of a worker are not disclosed to another person without the worker's written consent.: Maximum penalty--(a) in the case of an individual--15 penalty units, or(b) in the case of a body corporate--70 penalty units.
(3) Subclause (2) does not apply if the record is disclosed under clause 412, 413 or 414 or to a person who must keep the record confidential under a duty of professional confidentiality.