Skip to main
Help and resources
Register
for My Account
Sign in
to My Account
Search
Australian Government
Federal Register of Legislation
Site navigation
Constitution
Acts
Legislative instruments
Notifiable instruments
Gazettes
Administrative Arrangements
Prerogative instruments
Norfolk Island
Annual survey
We would appreciate it if you could complete our website
survey
, open until 28 November 2025.
1 Announcement
Home
Acts
In force
Text
Details
Authorises
Downloads
All versions
Interactions
My Health Records Act 2012
Citation change
In force
Administered by
Department of Health, Disability and Ageing
Superseded version
View latest version
View as made version
Order print copy
Save this title to My Account
Set up an alert
C2018C00509 C08
11 December 2018
-
09 December 2019
Legislation text
View document
Select value
Act
Filter active
Table of contents
Enter text to search the table of contents
Collapse
Part 1—Preliminary
1 Short title
2 Commencement
3 Object of Act
4 Simplified outline of this Act
4A Schedule 1
5 Definitions
6 Definition of authorised representative of a healthcare recipient
7 Definition of nominated representative of a healthcare recipient
7A Duties of authorised representative or nominated representative
8 Things done etc. under provisions of other Acts
9 Definition of identifying information
10 Definition of shared health summary
11 Act to bind the Crown
12 Concurrent operation of State laws
13 External Territories
13A System Operator may arrange for use of computer programs to make decisions
13B System Operator may use electronic communications
Collapse
Part 2—The System Operator and the functions of the Chief Executive Medicare
Collapse
Division 1—System Operator
14 Identity of the System Operator
15 Functions of the System Operator
16 Research or public health purposes The System Operator’s function under paragraph 15(ma) does not include providing de-identified data to a private health insurer (within the meaning of the Private Health Insurance Act 2007) or any other insurer. 17 Retention and destruction of records uploaded to National Repositories Service
Collapse
(iii) if, under subsection (3), the record is required to be destroyed because of the cancellation of registration of the healthcare recipient—when the System Operator is required to destroy the record under subsection (4). Destruction of records after cancellation on request (3) If the System Operator is required to cancel the registration of the healthcare recipient under subsection 51(1) (cancellation on request), the System Operator must destroy any record that includes health information that is included in the My Health Record of the healthcare recipient, other than the following information: (a) the name and healthcare identifier of the healthcare recipient; (b) the name and healthcare identifier of the person who requested the cancellation, if different from the healthcare recipient; (c) the day the cancellation decision takes effect under subsection 51(7). (4) The System Operator must comply with subsection (3): (a) as soon as practicable after the cancellation decision takes effect under subsection 51(7); or (b) if any of the following requirements apply before the records are destroyed under paragraph (a)—as soon as practicable after the conclusion of the matter to which the requirement relates: (i) a court order requires the System Operator not to destroy records of the healthcare recipient; (ii) the System Operator is required to disclose records of the healthcare recipient under section 69 or 69A; (iii) the System Operator is required to disclose records of the healthcare recipient under a law covered by subsection 65(3). (5) To avoid doubt, if the System Operator is required under subsection (3) to destroy a record that includes health information, the System Operator must also destroy the following: (a) any copy of the record; (b) any previous version of the record; (c) any back-up version of the record. Division 4—Functions of Chief Executive Medicare
38 Registered repository operator
Collapse
Part 3—Registration
Collapse
Division 1—Registering healthcare recipients
39 Healthcare recipients may apply for registration
40 When a healthcare recipient is eligible for registration
41 Registration of a healthcare recipient by the System Operator
Collapse
Division 2—Registering healthcare provider organisations
42 Healthcare provider organisation may apply for registration
43 When a healthcare provider organisation is eligible for registration
44 Registration of a healthcare provider organisation
45 Condition of registration—uploading of records, etc.
45A Condition of registration—handling old records that are works subject to copyright
45B Condition of registration—handling old sound recordings and cinematograph films that are subject to copyright
45C Liability where work uploaded in breach of section 45A or 45B
46 Condition of registration—non-discrimination in providing healthcare to a healthcare recipient who does not have a My Health Record etc.
Collapse
Division 3—Registering repository operators, portal operators and contracted service providers
47 Persons may apply for registration as a repository operator, a portal operator or a contracted service provider
48 When a person is eligible for registration as a repository operator, a portal operator or a contracted service provider
49 Registration of a repository operator, a portal operator or a contracted service provider
50 Condition about provision of information to System Operator
50A Condition of registration—handling old records that are works subject to copyright
50B Condition of registration—handling old sound recordings and cinematograph films that are subject to copyright
50C Liability where work uploaded in breach of section 50A or 50B
50D Authorisation to make health information available to the System Operator
Collapse
Division 4—Cancellation, suspension and variation of registration
51 Cancellation or suspension of registration
52 Variation of registration
53 Notice of cancellation, suspension or variation of registration etc.
54 Effect of suspension
55 My Health Records Rules may specify requirements after registration is cancelled or suspended
Collapse
Division 5—The Register
56 The Register
57 Entries to be made in Register
Collapse
Division 6—Collection, use and disclosure of information for the purposes of the My Health Record System
58 Collection, use and disclosure of health information by the System Operator
58A Collection, use and disclosure of healthcare identifiers, identifying information and information identifying authorised representatives and nominated representatives
Collapse
Part 4—Collection, use and disclosure of health information included in a healthcare recipient’s My Health Record
Collapse
Division 1—Unauthorised collection, use and disclosure of health information included in a healthcare recipient’s My Health Record
59 Unauthorised collection, use and disclosure of health information included in a healthcare recipient’s My Health Record
59A Unauthorised use of information included in a healthcare recipient’s My Health Record for prohibited purpose (1) A person must not use health information included in a healthcare recipient’s My Health Record for a prohibited purpose, if the person obtained the information by using or gaining access to the My Health Record system. Note: For prohibited purpose, see section 70A. Civil penalty: 1,500 penalty units. (2) Subsection (1) does not apply if the person is the healthcare recipient, but does apply if the person is the nominated representative of the healthcare recipient (despite subsection 7(2)). 60 Secondary disclosure
Collapse
Division 2—Authorised collection, use and disclosure
Collapse
Subdivision A—Collection, use and disclosure in accordance with access controls
61 Collection, use and disclosure for providing healthcare
62 Collection, use and disclosure to nominated representative
Collapse
Subdivision B—Collection, use and disclosure other than in accordance with access controls
63 Collection, use and disclosure for management of My Health Record system
64 Collection, use and disclosure in the case of a serious threat
65 Collection, use and disclosure authorised by law
(3) This subsection covers the following laws: (a) this Act; (b) the Auditor-General Act 1997; (c) the Ombudsman Act 1976; (d) a law of the Commonwealth to the extent that the law requires or authorises the collection, use or disclosure of information for the purposes of performing the Information Commissioner’s functions in relation to the My Health Record system. 66 Collection, use and disclosure with healthcare recipient’s consent
67 Collection, use and disclosure by a healthcare recipient
68 Collection, use and disclosure for indemnity cover
69 Disclosure to courts and tribunals
69A Disclosure to designated entity under order by judicial officer Disclosure to designated entity under order by judicial officer (1) If an entity that is: (a) an agency, or a State or Territory authority, within the meaning of the Privacy Act 1988; and (b) not a court, tribunal or coroner; (a designated entity) presents to the System Operator an order made under this section, the System Operator must comply with the order. (2) Except as mentioned in subsection (1) or in accordance with a law covered by subsection 65(3), a participant in the My Health Record system, or a healthcare recipient, cannot be required to disclose health information included in a healthcare recipient’s My Health Record to a designated entity. (3) This section does not authorise the System Operator to use or disclose healthcare recipient-only notes. (4) If the System Operator uses or discloses personal information under this section, it must make a written note of the use or disclosure. Application for and making of order (5) A designated entity may apply to any of the following judicial officers: (a) a magistrate of a State or Territory; (b) a judge who is eligible under subsection 69B(2); for an order under this section in relation to the disclosure, to the entity, of health information included in a healthcare recipient’s My Health Record. (6) The judicial officer may make the order if: (a) the designated entity satisfies the judicial officer, by information on oath or affirmation, that: (i) the designated entity has powers or duties of the kind mentioned in subsection (7); and (ii) if the designated entity has powers of the kind mentioned in paragraph (7)(a)—the designated entity has exercised or purported to exercise its power to require the System Operator to disclose information to which the order will relate; and (iii) in all the circumstances, the particular disclosure of the particular information to the designated entity is reasonably necessary for the purposes of a thing done by, or on behalf of, the designated entity; and (iv) there is no effective means for the designated entity to obtain the particular information, other than an order under this section; and (b) the judicial officer is satisfied that, having regard to the matter mentioned in subparagraph (a)(iii) and the privacy of the healthcare recipient, the disclosure of the information would not, on balance, unreasonably interfere with the privacy of the healthcare recipient. (7) A designated entity has powers or duties of the kind mentioned in this subsection if: (a) the designated entity has power under a law of the Commonwealth or a State or Territory (other than a law covered by subsection 65(3)) to require persons to give information to the designated entity; or (b) officers of the designated entity are, in the ordinary course of their duties, authorised to execute warrants to enter premises and seize things found, including documents. (8) The judicial officer must not make the order unless the designated entity or some other person has given the judicial officer, either orally or by affidavit, such further information (if any) as the judicial officer requires concerning the grounds on which the order is being sought. (9) The order must: (a) identify the healthcare recipient; and (b) specify the particular information to be disclosed; and (c) authorise one or more officers of the designated entity (whether or not named in the order) to obtain the information from the System Operator and require the System Operator to disclose the information to the designated entity; and (d) specify the day (not more than 6 months after the making of the order) on which the order ceases to have effect; and (e) state the purpose for which the order is made. 69B Judicial officers for orders under section 69A Eligible judge of a court created by the Parliament (1) A judge of a court created by the Parliament may, by writing, consent to be nominated by the Attorney-General under subsection (2). (2) The Attorney-General may, by writing, nominate a judge of a court created by the Parliament in relation to whom a consent is in force under subsection (1) to be eligible for the purposes of paragraph 69A(5)(b). (3) A nomination under subsection (2) is not a legislative instrument. Magistrates (4) A magistrate need not accept the functions conferred by section 69A. (5) The Governor-General may: (a) arrange with the Governor of a State for the performance, by all or any of the persons who from time to time hold office as magistrates of that State, of the functions of a magistrate conferred by section 69A; or (b) arrange with the Chief Minister of the Australian Capital Territory for the performance, by all or any of the persons who from time to time hold office as magistrates of the Australian Capital Territory, of the functions of a magistrate conferred by section 69A; or (c) arrange with the Administrator of the Northern Territory for the performance, by all or any of the persons who from time to time hold office as Judges of the Local Court of the Northern Territory, of the functions of a magistrate conferred by section 69A. Judicial officers exercising powers in personal capacity (6) The functions conferred on a judicial officer by section 69A are conferred on the judicial officer: (a) in a personal capacity; and (b) not as a court or a member of a court. (7) A judicial officer performing a function conferred by section 69A has the same protection and immunity as if the judicial officer were performing the function: (a) as the court of which the judicial officer is a member; or (b) as a member of the court of which the judicial officer is a member. 70 Disclosure in relation to unlawful activity
Collapse
Subdivision C—Unauthorised use of information included in a healthcare recipient’s My Health Record for prohibited purpose 70A Definition of prohibited purpose (1) Information included in a healthcare recipient’s My Health Record is used for a prohibited purpose if the person who uses the information does so for any one or more of the following purposes: (a) the purpose of: (i) underwriting a contract of insurance that covers the healthcare recipient; or (ii) determining whether to enter into a contract of insurance that covers the healthcare recipient (whether alone or as a member of a class); or (iii) determining whether a contract of insurance covers the healthcare recipient in relation to a particular event; or (iv) an employer employing, or continuing or ceasing to employ, the healthcare recipient; (b) a purpose prescribed by the regulations. (2) If the person uses information for purposes that include, or for a purpose that includes, a purpose mentioned in subsection (1), the person is taken to be using the information for a prohibited purpose. (3) To avoid doubt, use of information is not for a prohibited purpose if the use is solely for: (a) the purpose of providing healthcare to the healthcare recipient; or (b) purposes relating to the provision of indemnity cover for a healthcare provider. (5) References in paragraph (1)(a) to insurance do not include State insurance that does not extend beyond the limits of the State concerned. (6) For the purposes of this section, using information for a purpose includes requesting or requiring the information for that purpose. 70B Use for prohibited purpose is unauthorised (1) Despite Subdivisions A and B, a person is not authorised under this Division to use health information included in a registered healthcare recipient’s My Health Record for a prohibited purpose. (2) Subsection (1) does not apply if the person is the healthcare recipient, but does apply if the person is the nominated representative of the healthcare recipient (despite subsection 7(2)). Division 3—Prohibitions and authorisations limited to My Health Record system
71 Prohibitions and authorisations limited to health information collected by using the My Health Record system
Collapse
Division 3A—Offences and penalties in relation to use of My Health Record-derived information for prohibited purpose 71AA Definitions In this Division: My Health Record of a healthcare recipient includes a My Health Record of the healthcare recipient that has been cancelled or suspended. use information for a purpose includes request or require the information for that purpose. 71A Offence for use of My Health Record-derived information for prohibited purpose (1) A person commits an offence if: (a) the person uses information; and (b) the person does so for a prohibited purpose, and the person knows or is reckless as to that fact; and (c) the information is health information; and (d) the information is or was included in a healthcare recipient’s My Health Record; and (e) the person is not the healthcare recipient. Penalty: Imprisonment for 5 years or 300 penalty units, or both. (2) Subsection (1) does not apply if the information was not collected from, and is not derived from a disclosure that was made by, a person who obtained the information by using or gaining access to the My Health Record system. For this purpose, it does not matter whether or not any collection or disclosure of the information was authorised under this Act or any other law. Note: A defendant bears an evidential burden in relation to the matter in subsection (2): see subsection 13.3(3) of the Criminal Code. (3) Strict liability applies to paragraphs (1)(d) and (e). Note: For strict liability, see section 6.1 of the Criminal Code. (4) Despite paragraph (1)(e) and subsection 7(2), subsection (1) of this section applies to a person who is the nominated representative of the healthcare recipient. 71B Civil penalty for use of My Health Record-derived information for prohibited purpose (1) A person must not use health information that is or was included in a healthcare recipient’s My Health Record for a prohibited purpose. Civil penalty: 1,500 penalty units. (2) Subsection (1) does not apply if the information was not collected from, and is not derived from a disclosure that was made by, a person who obtained the information by using or gaining access to the My Health Record system. For this purpose, it does not matter whether or not any collection or disclosure of the information was authorised under this Act or any other law. Note: A person bears an evidential burden in relation to the matter in subsection (2): see section 96 of the Regulatory Powers (Standard Provisions) Act 2014. (3) Subsection (1) does not apply if the person is the healthcare recipient, but does apply if the person is the nominated representative of the healthcare recipient (despite subsection 7(2)). Division 4—Interaction with the Privacy Act 1988
72 Interaction with the Privacy Act 1988
73 Contravention of this Act is an interference with privacy
73A Information Commissioner may disclose details of investigations to System Operator
73B Obligations of System Operator in relation to correction, etc.
Collapse
Part 5—Other civil penalty provisions
74 Registered healthcare provider organisations must ensure certain information is given to System Operator
75 Data breaches
76 Requirement to notify if cease to be eligible to be registered
77 Requirement not to hold or take records outside Australia
78 My Health Records Rules must not be contravened
Collapse
Part 6—Enforcement
Collapse
Division 1—Civil penalties
79 Civil penalty provisions
Collapse
Division 2—Enforceable undertakings
80 Enforceable undertakings
Collapse
Division 3—Injunctions
81 Injunctions
Collapse
Part 8—Other matters
Collapse
Division 1—Review of decisions
97 Review of decisions
Collapse
Division 2—Delegations
98 Delegations by the System Operator
Collapse
Division 3—Authorisations of entities also cover employees
99 Authorisations extend to employees etc.
Collapse
Division 4—Treatment of certain entities
100 Treatment of partnerships
101 Treatment of unincorporated associations
102 Treatment of trusts with multiple trustees
104 Division does not apply to Division 3 of Part 3
Collapse
Division 5—Alternative constitutional bases
105 Alternative constitutional bases
Collapse
Division 6—Annual reports and review of Act
106 Annual reports by Information Commissioner
107 Annual reports by the System Operator
108 Review of the operation of the Act
Collapse
Division 7—My Health Records Rules, regulations and other instruments
109 Minister may make My Health Records Rules
110 Minister may determine a law of a State or Territory to be a designated privacy law
111 Guidelines relating to the Information Commissioner’s enforcement powers etc.
112 Regulations
Collapse
Schedule 1—My Health Records for all healthcare recipients
Collapse
Part 1—Opt-out model for the participation of healthcare recipients in the My Health Record system
1 Trial of opt-out model
2 Minister may apply the opt-out model to all healthcare recipients after trial
Collapse
Part 2—Registering all healthcare recipients
Collapse
Division 1—Registering healthcare recipients
3 Registration of a healthcare recipient by the System Operator
4 When a healthcare recipient is eligible for registration
5 Healthcare recipient elects not to be registered
6 Healthcare recipients may apply for registration
Collapse
Division 2—Information sharing for the purposes of the opt-out system
7 Collection, use and disclosure of health information by the System Operator
8 Collection, use and disclosure of healthcare identifiers, identifying information and information identifying authorised representatives and nominated representatives
Collapse
Division 3—Handling health information for the purposes of a healthcare recipient’s My Health Record
Collapse
Subdivision A—Healthcare provider to upload health information
9 Authorisation for healthcare provider to upload health information
Collapse
Subdivision B—Functions of the Chief Executive Medicare
10 Registered repository operator
11 Uploading health information to the repository
12 Making health information available to the System Operator
13 Healthcare recipient may elect not to have health information disclosed to the System Operator
14 Health information uploaded or made available may include details of healthcare providers
15 Way in which repository operated not limited by this Division
Collapse
Subdivision C—Other registered repository operators
16 Making health information available to the System Operator
Collapse
Part 3—Other consequences of applying the opt-out rules
17 References to other provisions of this Act
Collapse
Endnotes
Endnote 1—About the endnotes
Endnote 2—Abbreviation key
Endnote 3—Legislation history
Endnote 4—Amendment history