2005

THE LEGISLATIVE ASSEMBLY

FOR THE AUSTRALIAN CAPITAL TERRITORY

(As presented)

(Minister for Health)

2005

THE LEGISLATIVE ASSEMBLY

FOR THE AUSTRALIAN CAPITAL TERRITORY

(As presented)

(Minister for Health)

An Act to amend the Health Records (Privacy and Access) Act 1997

The Legislative Assembly for the Australian Capital Territory enacts as follows:

This Act is the Health Records (Privacy and Access) Amendment Act 2005 (No 2).

This Act commences on a day fixed by the Minister by written notice.

Note 1 The naming and commencement provisions automatically commence on the notification day (see Legislation Act, s 75 (1)).

Note 2 A single day or time may be fixed, or different days or times may be fixed, for the commencement of different provisions (see Legislation Act, s 77 (1)).

Note 3 If a provision has not commenced within 6 months beginning on the notification day, it automatically commences on the first day after that period (see Legislation Act, s 79).

This Act amends the Health Records (Privacy and Access) Act 1997.

Subject to this Act, the privacy principles mentioned in schedule 1 have the force of law.

1 A record keeper who has possession or control of a health record must ensure that—

(a) the record is protected, by reasonable security safeguards, against each of the following:

(i) loss;

(ii) unauthorised access, use, modification or disclosure;

(iii) other misuse; and

(b) if the record is given to another entity—everything reasonably within the power of the record keeper is done to prevent unauthorised use or disclosure of any information contained in the record.

2 A record keeper must keep, and must not destroy, a health record about a consumer, even if it is later found or claimed to be inaccurate.

3 However, clause 2 does not apply to the destruction of a health record about a consumer if—

(a) the destruction is required or allowed under a law of the Territory; or

(b) the destruction is not prohibited under any other law and happens after—

(i) if the consumer is under 18 years old when the information is collected—the day the consumer turns 25 years old; or

(ii) if the consumer is an adult when the information is collected—7 years after the day a service was last provided to the consumer by the record keeper.

a standard of practice under the Health Professionals Act 2004

Note An example is part of the Act, is not exhaustive and may extend, but does not limit, the meaning of the provision in which it appears (see Legislation Act, s 126 and s 132).

1 A record keeper must keep a register of records that have been destroyed or transferred to another entity.

Note Entity includes a person (see Legislation Act, dict, pt 1).

2 The register must identify the following for records that have been destroyed or transferred:

(a) the consumer to whom the record relates;

(b) the period of time the record covers;

(c) for a destroyed record—the date the record was destroyed;

(d) for a transferred record—the entity to which the record has been transferred.

1 Health information may be kept by a health service provider if it is needed for the purpose for which it was collected, or another purpose allowed under a law of the Territory, even if its destruction is allowed under principle 4.1.

2 An entity other than a health service provider must take reasonable steps to destroy, or permanently deidentify, health information if it is no longer needed for the purpose for which it was collected or for any other purpose allowed under a law of the Territory.

1 A health service provider who is a member of a treating team for a consumer may have access to the personal health information about the consumer so far as necessary for the provision by the provider of a health service to the consumer.

2 If a person reasonably requires access to personal health information about a consumer for the purpose of the management, funding or quality of a health service received, or being received, by the consumer, the person may have access to the extent necessary for that purpose without the consumer’s consent.

3 A treating health service provider for a consumer may disclose personal health information about the consumer to an immediate family member if—

(a) the disclosure is made for compassionate reasons; and

(b) the provider believes, on reasonable grounds, that the disclosure would be expected by the consumer; and

(c) the disclosure is not contrary to any wishes previously expressed by the consumer that the provider is, or ought reasonably to be, aware of.

Note Section 17 deals with information subject to confidentiality.

4 An entity must not require a consumer, directly or indirectly, to obtain or grant access to a health record about the consumer unless the entity is required or allowed to make the requirement under—

(a) a law of the Territory; or

(b) a law of the Commonwealth; or

(c) an order of a court.

1 A record keeper who has possession or control of a health record must not disclose personal health information about a consumer from the record to an entity other than the consumer.

2 Clause 1 does not apply to the disclosure of personal health information about a consumer to an entity if—

(a) the information is being shared between members of a treating team for the consumer only to the extent necessary to improve or maintain the consumer’s health or manage a disability of the consumer; or

(b) the consumer is reasonably likely to have been aware, or to have been made aware under principle 2, that information of the kind disclosed is usually disclosed to the entity; or

(c) the consumer has consented to the disclosure; or

(d) the record keeper believes, on reasonable grounds, that the disclosure is necessary to prevent or lessen a serious and imminent risk to the life or physical, mental or emotional health of the consumer or someone else; or

(e) the disclosure is required or allowed under—

(i) a law of the Territory (including this Act); or

Note Disclosure is allowed under cl 8, cl 9 and cl 10.

(ii) a law of the Commonwealth; or

(iii) an order of a court; or

(f) the disclosure of the information is necessary for the management, funding or quality of the health service received, or being received, by the consumer.

3 Clause 1 also does not apply to the disclosure of personal health information about a consumer to an entity if—

(a) the disclosure is necessary for the purpose of research or the compilation or analysis of statistics; and

(b) it is impracticable to seek the consumer’s consent before disclosure; and

(c) the purpose mentioned in paragraph (a) cannot be achieved by the disclosure of information that does not identify the consumer and from which the consumer’s identity cannot reasonably be worked out; and

(d) the entity is required for any disclosed information (identifiable information) that identifies the consumer, or from which the consumer’s identity can be reasonably worked out—

(i) to provide protection that is at least equal to that of this Act and that prevents any further disclosure of it; and

(ii) to take reasonable steps to deidentify the information and destroy identifiable information at the earliest possible opportunity; and

(iii) to ensure that identifiable information is not made publicly available.

4 Clause 1 also does not apply to the disclosure of personal health information about a consumer to a person responsible for the consumer’s care (the carer) if—

(a) the consumer cannot give or withhold consent to the disclosure, whether or not because the consumer is a young person or legally incompetent person; and

(b) in the record keeper’s opinion, the disclosure is necessary to enable the carer to safely and effectively provide appropriate services to, or care for, the consumer.

5 In relation to the sharing of information among the treating team under clause 2 (a), unless it is obvious from the circumstances and context of the health service, the person in charge of the treating team must tell the consumer about the identity of each member of the treating team who will have access to the personal health information about the consumer.

6 However, the treating team leader need not tell the consumer about the identity of individuals who are required to handle health records, or personal health information about the consumer, for the management, funding or quality of the health service received, or being received, by the consumer.

7 A consent given by a consumer for clause 2 (c) must—

(a) be in writing and signed—

(i) if the consumer is a young person or legally incompetent person—by a guardian of the consumer; or

(ii) in any other case—by the consumer; and

(b) name the health service provider who made the record.

Note If a form is approved under s 35 for this provision, the form must be used.

8 An entity to which information is disclosed under clause 2, clause 3 or clause 4 must not use or disclose the information for a purpose other than the purpose for which the information was given to the entity.

9 If there is an emergency and a consumer cannot give or withhold consent to the disclosure of personal health information about the consumer, the treating health service provider may discuss relevant personal health information with an immediate family member of the consumer to the extent reasonable and necessary for the proper treatment of the consumer.

10 A treating health service provider for a consumer may disclose personal health information about the consumer to a person responsible for the consumer’s care (the carer) if—

(a) the consumer cannot give or withhold consent to the disclosure, whether or not because the consumer is a young person or legally incompetent person; and

(b) in the record keeper’s opinion, the disclosure is necessary to enable the carer to safely and effectively provide appropriate services to, or care for, the consumer.

11 A treating health service provider for a consumer may disclose personal health information about the consumer to an immediate family member if—

(a) the consumer cannot give or withhold consent to the disclosure, whether or not because the consumer is a young person or legally incompetent person; and

(b) the disclosure is made for compassionate reasons; and

(c) the provider believes, on reasonable grounds, that the disclosure would be, or would have been, expected by the consumer; and

(d) the disclosure is not contrary to any wishes previously expressed by the consumer of which the provider is aware or ought reasonably to be aware.

Jo has died, and Jo’s daughter who has looked after him for many years cannot understand why he died when he seemed to have recovered from a recent illness. She is extremely distressed. Subject to clause 11 (c) and (d), the treating health service provider may disclose personal health information about Jo’s illness if she considers that the disclosure would help Jo’s daughter.

Note An example is part of the Act, is not exhaustive and may extend, but does not limit, the meaning of the provision in which it appears (see Legislation Act, s 126 and s 132).

(1) A person must not, without a consumer’s consent—

(a) ask someone other than the consumer for a health status report about the consumer; or

(b) give someone other than the consumer a health status report about the consumer.

(2) A person must not obtain a health status report about a consumer from a health service provider without the consumer’s consent.

(3) If a person obtains the consumer’s consent for subsection (1) or (2) the person must—

(a) tell the consumer in writing of the consumer’s right to ask for a copy of the health status report and to give the person a statement commenting on the health status report; and

(b) if the consumer asks for a copy of the report—give a copy of the report to the consumer as soon as practicable; and

(c) if the consumer gives the person a statement commenting on the health status report—

(i) consider the comments; and

(ii) keep the statement with the report for as long as the person keeps the report.

(4) A consent given by a consumer for subsection (1) or (2) must—

(a) be in writing and signed—

(i) if the consumer is a young person or legally incompetent person—by a guardian of the consumer; or

(ii) in any other case—by the consumer; and

(b) if the health service report is to be, or has been, prepared or substantially prepared by a health service provider—name the health service provider.

Note If a form is approved under s 35 for this provision, the form must be used.

(5) This section does not apply to the extent (if any) that a health status report is asked for, obtained or provided in accordance with—

(a) a law of the Territory; or

(b) a law of the Commonwealth; or

(c) an order of a court.

(a) subject to any prohibition on giving access to the health record under any of the following provisions:

(i) section 14A (No access to health record relating to Children and Young People Act complaint etc);

(ii) section 15 (No access to health record where risk to life or health of consumer or another person);

(iii) section 17 (No access to health record where material given in confidence); and

(b) to the extent that any of the following provisions has a contrary application:

(i) section 14 (Grounds for nonproduction);

(ii) section 14A (No access to health record relating to Children and Young People Act complaint etc);

(iii) section 15 (No access to health record where risk to life or health of consumer or another person);

(iv) section 17 (No access to health record where material given in confidence).

(1) This section—

(a) applies if a record keeper receives a request for access to a health record under section 12; but

(b) does not apply to an oral request if the record keeper has asked under section 12 (3) (a) for the request to be made in writing.

(2) Within 2 weeks after the day the record keeper receives the request, the record keeper must—

(a) if the record keeper relies on a ground mentioned in section 14 for nonproduction of the record or part of the record—give the consumer written notice that the record keeper will not give access to the record; or

(b) if the record keeper is prohibited from giving access to the record or part of the record under section 14A, section 15 or section 17—give the consumer written notice that the record keeper is prohibited from giving access to the record; or

(c) either—

(i) give access to the record in accordance with section 13A; or

(ii) if a fee has been determined under section 34 for access—give the consumer written notice that the record keeper will give access to the record on payment of a stated fee that is not more than the determined fee.

(3) A notice under subsection (2) (a) must state the ground on which the record keeper relies for nonproduction of the record or part of the record.

(4) A notice under subsection (2) (b) must state the section under which the record keeper is prohibited from giving access to the record or part of the record.

(5) If the record keeper gives a notice under subsection (2) (a) or (b) that relates to only part of the record, the record keeper must comply with subsection (2) (c) in relation to the rest of the record.

(1) This section applies if—

(a) a consumer has a right of access to a health record; and

(b) the consumer consents under schedule 1, principle 10, clause 2 (c) to the disclosure of personal health information about the consumer from the record to an entity.

(2) The record keeper must disclose the information to the entity.

(3) For the purpose of accessing the information in the record, the entity is taken to be the consumer.

(4) To remove any doubt and without limiting subsection (3), the entity has the same right of access to the information in the record as the consumer.

(1) This section applies if a record keeper must give a person access to a health record.

(2) Access to the health record must be given—

(a) if the record keeper has given a notice under section 13 (2) (c) (ii) and the fee stated in the notice has been paid—no later than the later of the following:

(i) 1 week after the day the fee is paid;

(ii) 30 days after the day the record keeper received the request for access to the health record; or

(b) if the record keeper has not given a notice under section 13 (2) (c) (ii)—no later than 30 days after the day the record keeper receives the request for access to the health record.

(3) However, before giving access to the record to a person (the relevant person), the record keeper must take reasonable steps to require evidence of, and be satisfied about—

(a) the relevant person’s identity; and

(b) if someone else has authorised the access to be given to the relevant person—the identity and authority of the other person; and

(c) if the consumer is a young person, a legally incompetent person or dead—the fact that the relevant person (or, if paragraph (b) applies, the person authorising the relevant person) is—

(i) for a young person or legally incompetent person—a guardian of the person; or

(ii) for a deceased consumer—

(A) a legal representative of the deceased consumer; or

(B) if there is no legal representative of the deceased consumer—an immediate family member of the deceased consumer.

(4) If the record keeper requires evidence under subsection (3) before giving access to a health record and the evidence is not provided or does not satisfy the record keeper, the record keeper need not provide access to the health record.

(1) This section applies if a record keeper must give a person access to a health record.

(2) Access to the health record must be given as follows:

(a) for a request to inspect the record or, if the health record is stored in electronic form, a print-out of the record—by making the record or print-out available to the consumer at a time, and at a place in the ACT, stated in a written notice given to the consumer;

(b) for a request to receive a copy of the record—by giving the consumer—

(i) a copy of the record; or

(ii) if the consumer agrees—an accurate summary of the record; or

(iii) if the record, or part of the record, was made before the commencement of this Act and the record keeper does not give a copy of the record to the consumer—a written summary of the factual matters contained in the record or part of the record;

(c) for a request to view the record and have its content explained—by giving the consumer a written notice stating—

(i) if the record keeper is a suitably qualified health service provider, and is willing to do so—that the record keeper will be available to explain the record at a time, and at a place in the ACT, stated in the notice; or

(ii) in any other case—the name and address of a suitably qualified health service provider who practises in the ACT and will be available in the ACT with the record, by arrangement with the consumer, to explain the record.

Note A fee may be determined under s 34 for this provision.

A record keeper is taken to have refused access to a health record—

(a) if the record keeper fails to comply with a requirement of—

(i) section 13 (Response to request for access); or

(ii) section 13A (Disclosure in accordance with consent); or

(iii) section 13B (Giving access to health records); or

(iv) section 13C (How access to health record given); or

(b) if the record keeper has given a notice under section 13C (2) (a) about the record—

(i) if the notice does not state a date and time that is reasonable for making the record or print-out available for inspection by the consumer; or

(ii) if the record keeper unreasonably fails to make the record or print-out available to the consumer for inspection in accordance with the notice; or

(c) if the record keeper has given a notice under section 13C (2) (c) (i) about the record—

(i) if the notice does not state a time that is reasonable for the record keeper to be available; or

(ii) if the record keeper unreasonably fails to explain the content of the record in accordance with the notice; or

(d) if the record keeper has given a notice under section 13C (2) (c) (ii) about the record—if the health service provider named in the notice unreasonably fails—

(i) to make an arrangement with the consumer to explain the content of the record; or

(ii) to comply with an arrangement made to explain the content of the record.

(a) the record or part of a record relates to—

(i) a report under the Children and Young People Act 1999, section 158 or section 159; or

(ii) a notification under the Children’s Services Act 1986, section 103; and

(1) This section applies if—

(a) a record keeper has given a notice under section 13 (2) (b) about a health record on the ground mentioned in section 15 (a); and

(b) the record keeper considers that it would be desirable for a suitably qualified health service provider to discuss the health record with the consumer.

(2) The record keeper may include in, or attach to, the notice to the consumer under section 13 (2) (b) an offer—

(a) if the record keeper is a suitably qualified health service provider—to discuss the record with the consumer; or

(b) whether or not paragraph (a) applies, to arrange for a named health service provider who practises in the ACT, is suitably qualified and has consented to the arrangement, to discuss the content of the record with the consumer.

(1) This section applies if—

(a) a record keeper has given a notice under section 13 (2) (b) about a health record on the ground mentioned in section 15 (a); and

(b) any of the following apply:

(i) the record keeper has not made an offer under section 16;

(ii) the record keeper has made an offer under section 16 but the consumer has not accepted it;

(iii) the consumer has had a discussion with the health service provider named by the record keeper in an offer under section 16, but is not satisfied with the outcome of the discussion.

(2) The consumer may give a written notice (a nomination) to the record keeper nominating a health service provider for this section if the health service provider has consented to being nominated.

(3) The nomination lapses if—

(a) the record keeper gives the consumer a notice under section 16B about the health record; or

(b) the nominated health service provider—

(i) dies or otherwise stops being a health service provider; or

(ii) refuses to act or fails to act within a reasonable time.

(4) If a nomination lapses, the consumer may make another nomination under this section.

(1) This section applies if a record keeper receives a nomination under section 16A in relation to a health record.

(2) The record keeper must give the health record, or a copy of it, to the nominated health service provider within 2 weeks after the day the record keeper receives the nomination.

(3) However, the record keeper need not comply with subsection (2) if, within the 2-week period—

(a) the record keeper gives a notice under section 16D in relation to the nomination; or

(b) the nomination lapses.

The functions of a health service provider nominated by a notice under section 16A are—

(a) to form an opinion about the validity of the notice under section 13 (2) (b); and

(b) if the nominated health service provider considers it appropriate—to explain the grounds of the claim to the consumer; and

(c) to discuss the content of the health record with the consumer; and

(d) if the provider is satisfied that to allow the consumer to inspect the record would not be a significant risk to the life or the physical, mental or emotional health of the consumer—to allow the consumer to inspect the record or, if the consumer wishes to have a copy of the record and the record keeper agrees, to have a copy of the record; and

(e) if the provider is not satisfied as mentioned in paragraph (d)—to decline to allow the consumer to have access to the record.

(1) This section applies if—

(a) a record keeper receives a notice under section 16A nominating a health service provider; and

(b) the record keeper believes, on reasonable grounds, that the nominated health service provider is not a suitable person to act as the nominated health service provider.

(2) Within 2 weeks after the day the record keeper receives the nomination, the record keeper may give the consumer a written notice stating that the record keeper objects to the nominated health service provider.

(3) The notice—

(a) must state the ground of the objection; and

(b) may suggest the class of health service providers from which a health service provider should be nominated.

(4) However, the record keeper must not give a notice under subsection (2)—

(a) if—

(i) the health service provider who wrote the health record is registered with a registration board; and

(ii) the nominated health service provider is registered by the same board; or

(b) if the nominated health service provider is registered with the medical board and has the ability to understand and interpret the health record; or

(c) if the nominated health service provider—

(i) provides the same kind of service as the health service provider who wrote the health record; and

(ii) has the ability to understand and interpret the health record.

(4) In subsection (3):

consumer, for a consumer who has died, does not include a legal representative of the deceased consumer.

• domestic partner (s 169)

consumer means an individual who uses, or has used, a health service, or in relation to whom a health record has been created, and includes—

(a) if the consumer is a young person or legally incompetent person—a guardian of the consumer; and

(b) if the consumer has died and there is a legal representative of the deceased consumer—a legal representative of the deceased consumer; and

(c) if the consumer has died and there is no legal representative of the deceased consumer—an immediate family member of the deceased consumer.

Note Under s 13A an entity is taken to be the consumer for the purpose of accessing certain information if the consumer has consented to disclosure of the information to the entity.

destroy a record includes delete the record.

guardian means—

(a) for a young person—a parent, a legally appointed guardian of the young person or someone else with parental responsibility for the young person under the Children and Young People Act 1999, section 18; or

(b) for a legally incompetent person—

(i) a person who is—

(A) a legally appointed guardian of the legally incompetent person; or

(B) an attorney, appointed under an enduring power of attorney that has become operative, of the legally incompetent person; and

(ii) who has power to make decisions about the medical treatment or health care of the legally incompetent person.

Note 1 Criminal Code

The Criminal Code, ch 2 applies to all offences against this Act (see Code, pt 2.1).

The chapter sets out the general principles of criminal responsibility (including burdens of proof and general defences), and defines terms used for offences to which the Code applies (eg conduct, intention, recklessness and strict liability).

(1) A person commits an offence if the person threatens or intimidates someone else with the intention of causing the other person—

(a) to give a consent under this Act; or

(b) to do something without the consent required for it under this Act.

Maximum penalty: 50 penalty units, imprisonment for 6 months or both.

(2) A person commits an offence if—

(a) the person makes a representation to someone else; and

(b) the representation is false; and

(c) the person is reckless about whether the representation is false; and

(d) the person makes the representation with the intention of causing the other person—

(i) to give a consent under this Act; or

(ii) to do something without the consent required for it under this Act.

Maximum penalty: 50 penalty units, imprisonment for 6 months or both.

(3) Subsection (2) does not apply if the representation is not false in a material particular.

(4) A person commits an offence if—

(a) the person represents to a consumer that the consumer is legally required to consent to the provision of a health status report to anyone; and

(b) the representation is false.

Maximum penalty: 50 penalty units, imprisonment for 6 months or both.

(1) A person commits an offence if the person destroys, defaces or damages a health record or related material with the intention of evading or frustrating the operation of this Act.

Maximum penalty: 50 penalty units, imprisonment for 6 months or both.

(2) A person commits an offence if the person removes a health record from the ACT with the intention of evading or frustrating the operation of this Act.

Maximum penalty: 50 penalty units, imprisonment for 6 months or both.

(1) A person commits an offence if—

(a) the person threatens or intimidates someone else with the intention of—

(i) causing the other person to give the person access to a health record; or

(ii) otherwise obtaining access to a health record; and

(b) the person is not entitled to access to the health record.

Maximum penalty: 50 penalty units, imprisonment for 6 months or both.

(2) A person commits an offence if—

(a) the person makes a representation to someone else; and

(b) the representation is false; and

(c) the person is reckless about whether the representation is false; and

(d) the person makes the representation with the intention of—

(i) causing the other person to give the person access to a health record; or

(ii) otherwise obtaining access to a health record; and

(e) the person is not entitled to access to the health record.

Maximum penalty: 50 penalty units, imprisonment for 6 months or both.

(3) Subsection (2) does not apply if the representation is not false in a material particular.

Presentation speech made in the Legislative Assembly on 2005.

Notified under the Legislation Act on 2005.

For the latest republication of amended laws, see www.legislation.act.gov.au.