The responsibilities relating to protection of * personal information, relating to a person to whom the approved provider provides * aged care, are as follows:
(a) the personal information must not be used other than:
(i) for a purpose connected with the provision of aged care to the person by the approved provider; or
(ii) for a purpose for which the personal information was given by or on behalf of the person to the approved provider;
(b) except with the written consent of the person, the personal information must not be disclosed to any other person other than:
(i) for a purpose connected with the provision of aged care to the person by the approved provider; or
(ii) for a purpose connected with the provision of aged care to the person by another approved provider, so far as the disclosure relates to the person's * refundable deposit balance or * accommodation bond balance or the period for which retention amounts may be deducted under section 57 - 20 of the Aged Care (Transitional Provisions) Act 1997 or to the person's remaining liability (if any) to pay an * accommodation payment, * accommodation contribution or * accommodation charge; or
(iia) for a purpose connected with the provision of aged care to the person by another approved provider, so far as the disclosure relates to an appraisal or reappraisal connected with a classification that is in force for a care recipient to whom subsection 27 - 4(5) applies ( * entry into another aged care service within 28 days); or
(iii) for a purpose for which the personal information was given by or on behalf of the person; or
(iv) for the purpose of complying with an obligation under this Act or the Aged Care (Transitional Provisions) Act 1997 or any of the Principles made under section 96 - 1 of this Act or the Aged Care (Transitional Provisions) Act 1997 ;
(c) the personal information must be protected by security safeguards that it is reasonable in the circumstances to take against the loss or misuse of the information.