(1) A person commits an offence if:
(a) the person obtains information in the course of carrying out functions connected with the administration of this Act; and
(b) the person engages in conduct that results in the disclosure of the information.
Maximum penalty: 100 penalty units or imprisonment for 12 months.
(2) Subsection (1) does not apply if:
(a) the person discloses the information:
(i) for the administration of this Act; or
(ii) with the consent of the person to whom the information relates; or
(iii) for legal proceedings arising out of the operation of this Act; or
(b) the information is otherwise available to the public; or
(c) the person is authorised by law to disclose the information.
(3) Without limiting subsection (2)(c), a person is authorised to disclose information in any of the following circumstances:
(a) the information is provided to the Commonwealth by the System Manager;
(b) the information is provided to the System Manager under an SDA or a Health Service Directive;
(c) the information is provided as part of an investigation into a Service, a Health Service Inquiry or a Health Service Audit.