(1) A person conducting a business or undertaking must ensure that health monitoring reports in relation to a worker carrying out work for the business or undertaking are kept as a confidential record—(a) identified as a record in relation to the worker; and(b) for at least 40 years after the record is made.Penalty—Maximum penalty—(a) for an individual—12 1 / 2 penalty units; or(b) for a body corporate—60 penalty units.
(2) The person must ensure that the health monitoring report and results of a worker are not disclosed to another person without the worker’s written consent.Penalty—Maximum penalty—(a) for an individual—12 1 / 2 penalty units; or(b) for a body corporate—60 penalty units.
(3) Subsection (2) does not apply if the record is disclosed under section 442 or 443 or to a person who must keep the record confidential under a duty of professional confidentiality.