Healthcare Identifiers Regulations 2020
made under the
Healthcare Identifiers Act 2010
Compilation No. 2
Compilation date: 30 May 2025
Includes amendments: F2025L00617
About this compilation
This compilation
This is a compilation of the Healthcare Identifiers Regulations 2020 that shows the text of the law as amended and in force on 30 May 2025 (the compilation date).
The notes at the end of this compilation (the endnotes) include information about amending laws and the amendment history of provisions of the compiled law.
Uncommenced amendments
The effect of uncommenced amendments is not shown in the text of the compiled law. Any uncommenced amendments affecting the law are accessible on the Register (www.legislation.gov.au). The details of amendments made up to, but not commenced at, the compilation date are underlined in the endnotes. For more information on any uncommenced amendments, see the Register for the compiled law.
Application, saving and transitional provisions for provisions and amendments
If the operation of a provision or amendment of the compiled law is affected by an application, saving or transitional provision that is not included in this compilation, details are included in the endnotes.
Editorial changes
For more information about any editorial changes made in this compilation, see the endnotes.
Modifications
If the compiled law is modified by another law, the compiled law operates as modified but the modification does not amend the text of the law. Accordingly, this compilation does not show the text of the compiled law as modified. For more information on any modifications, see the Register for the compiled law.
Self‑repealing provisions
If a provision of the compiled law has been repealed in accordance with a provision of the law, details are included in the endnotes.
Contents
Part 1—Preliminary
1 Name
3 Authority
5 Definitions
6 Application of this instrument to partnerships, trusts and unincorporated associations
7 National registration authorities
8 Identifying information
Part 2—Collection, use and disclosure of identifying information and healthcare identifiers
9 Authorisation of collection, use and disclosure—healthcare provider assisting a healthcare recipient to register for a My Health Record
9A Authorisation of collection, use and disclosure—facilitating healthcare recipient to self‑register for an active script list
10 Collection, use and disclosure of healthcare provider’s healthcare identifier—providing healthcare to a healthcare recipient etc.
10A Collection, use and disclosure—individual healthcare provider information in relation to health facilitation program
10B Adopting the healthcare identifier of an individual healthcare provider—health facilitation program
Part 3—Requests by healthcare provider organisations to access healthcare identifiers
11 Details of responsible officer and organisation maintenance officer
12 Identity of individual making request
Part 4—Application, saving and transitional provisions
Division 1—Application, saving and transitional provisions in relation to the commencement of this instrument
13 Definitions
14 Things done under the old regulations
15 Use and disclosure of healthcare identifier of a healthcare provider
16 Continued operation of certain provisions not affected
Division 2—Application of the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025
17 Application of the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025
Endnotes
Endnote 1—About the endnotes
Endnote 2—Abbreviation key
Endnote 3—Legislation history
Endnote 4—Amendment history
This instrument is the Healthcare Identifiers Regulations 2020.
This instrument is made under the Healthcare Identifiers Act 2010.
Note: A number of expressions used in this instrument are defined in the Act, including the following:
(a) healthcare provider organisation;
(b) individual healthcare provider;
(c) organisation maintenance officer;
(d) responsible officer.
In this instrument:
ABN has the meaning given by section 41 of the A New Tax System (Australian Business Number) Act 1999.
ACN has the same meaning as in the Corporations Act 2001.
Act means the Healthcare Identifiers Act 2010.
active script list means a prescription management system for healthcare recipients.
active script list registry means a system that provides services for, and provides for the management of, active script lists for healthcare recipients, including (but not limited to) the following:
(a) facilitating a healthcare recipient to register for an active script list;
(b) storing information submitted by a healthcare recipient, using a mobile or web application, during the registration process;
(c) adding prescriptions, dispensing records and notifications to the active script list of a healthcare recipient;
(d) enabling viewing of a healthcare recipient’s active prescriptions and tokens so they can be used to dispense electronic prescriptions for the healthcare recipient;
(e) allowing mobile application vendors to provide mobile prescription applications.
active script list registry operator means an entity that operates an active script list registry.
electronic prescription has the same meaning as in the National Health (Pharmaceutical Benefits) Regulations 2017.
evidence of identity process means the process to confirm the identity of a healthcare provider organisation’s responsible officer and organisation maintenance officer undertaken by:
(a) if the responsible officer or organisation maintenance officer is an individual healthcare provider who is registered by a registration authority as a member of a health profession—the Australian Health Practitioner Regulation Agency established by the National Law; or
(b) in any other case—the service operator.
health facilitation program means a program that is operated or funded by one or more government bodies and that facilitates the provision of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients.
mobile intermediary service means a service that provides connection services for mobile prescription applications for the purpose of facilitating electronic prescriptions.
(a) to manage the healthcare recipient’s prescriptions using a mobile phone or other personal electronic device;
(b) to view, and manage access to, the healthcare recipient’s active script list.
mobile prescription application service provider means an entity that operates and/or provides a mobile prescription application.
My Health Records Act means the My Health Records Act 2012.
National Law has the same meaning as in the My Health Records Act.
operator of a health facilitation program means the body, or any of the bodies, that operates the program.
System Operator has the same meaning as in the My Health Records Act.
verification service means a service (whether operated electronically or otherwise) that allows an entity to compare information relating to the identity of an entity with a government record.
To avoid doubt, sections 36B, 36C and 36D of the Act apply to this instrument, and obligations, offences and civil penalty provisions in this instrument, in the same way as they apply to the Act, and obligations, offences and civil penalty provisions in the Act.
For the purposes of section 8 of the Act, each of the following registration authorities is a national registration authority:
(a) a National Health Practitioner Board established by the National Law;
(b) if it is authorised under the National Law to assign healthcare identifiers to healthcare providers—the Australian Health Practitioner Regulation Agency established by the National Law.
Identifying information—individual healthcare provider
(1) For the purposes of paragraph 7(1)(g) of the Act, the following information is identifying information of an individual healthcare provider:
(a) whether the healthcare provider is registered with a registration authority and the status of that registration (such as conditional, suspended, cancelled or lapsed);
(b) whether the healthcare provider is a member of a professional association of a kind described in paragraph 9A(1)(b) of the Act and the status of that membership (such as conditional, suspended, cancelled or lapsed);
(c) whether the healthcare provider is, or is likely to be, deceased;
(d) whether the death of the healthcare provider has been verified;
(e) whether the healthcare provider is linked to a healthcare provider organisation and, if so, the name of the organisation and the ABN or ACN of the organisation (whichever is applicable).
Identifying information—healthcare provider organisation
(2) For the purposes of paragraph 7(2)(e) of the Act, the following information is identifying information of a healthcare provider organisation:
(a) whether the organisation is registered under Division 2 of Part 3 of the My Health Records Act;
(b) whether the organisation has notified the service operator that the organisation does not wish to use a healthcare identifier, either temporarily or permanently;
(c) if applicable, the organisation’s business name on the register established under section 22 of the Business Names Registration Act 2011;
Note: Also see paragraph 7(2)(a) of the Act which states that the name of the healthcare provider is also identifying information.
(d) the type of healthcare service the organisation provides to another healthcare provider or a healthcare recipient;
Note: Examples of the type of healthcare service an organisation provides include general practice services, public hospital services or diagnostic imaging services.
(e) the name, date of birth and date of death (if applicable) of the organisation’s responsible officer and organisation maintenance officer;
(f) the work address, email address, telephone number and fax number of the organisation’s responsible officer and organisation maintenance officer;
(g) the identifying number assigned to the organisation’s responsible officer and organisation maintenance officer by the service operator;
(h) whether an evidence of identity process has been undertaken for the organisation’s responsible officer and organisation maintenance officer;
(i) if an evidence of identity process is being undertaken for the organisation’s responsible officer and organisation maintenance officer—the name of the agency or service operator undertaking the process;
(j) if an evidence of identity process has been undertaken for the organisation’s responsible officer and organisation maintenance officer—the name of the agency or service operator that undertook the process, the outcome of the process and when the process was undertaken;
(k) the record that specifies the network address and technical requirements permitting electronic messages to be sent to the organisation;
(l) any other network organisation or seed organisation (within the meaning of section 9A of the Act) that the healthcare provider organisation is linked to in a network;
(m) whether any individual healthcare providers are linked to the organisation and, if so, the names and other identifying information of those individual healthcare providers.
Note: Other identifying information may be required by the service operator from a healthcare provider—see section 7 of the Act.
Identifying information—healthcare recipient
(3) For the purposes of paragraph 7(3)(i) of the Act, the following information is identifying information of a healthcare recipient:
(a) the telephone number of the healthcare recipient;
(b) the electronic address of the healthcare recipient;
(c) whether the identity of the healthcare recipient has been verified;
(d) whether a healthcare identifier assigned to the healthcare recipient has been assigned provisionally (for example, because it has not been possible to verify the identity of the healthcare recipient);
(e) if information relating to the identity of the healthcare recipient has been, or is to be, verified using a particular form of identification document (such as a driver’s licence or passport), details of that document, including:
(i) the document number; and
(ii) the State or Territory in which the document was issued; and
(iii) the name of the entity that issued the document;
(f) if information relating to the identity of the healthcare recipient has been, or is to be, verified by using a verification service, the response of that service to any verification inquiry in relation to the healthcare recipient;
(g) whether the healthcare recipient is, or is likely to be, deceased;
(h) whether the death of the healthcare recipient has been verified;
(i) whether the healthcare recipient is a registered healthcare recipient for the purposes of the My Health Records Act;
(j) whether the healthcare recipient is an authorised representative, or nominated representative, of another healthcare recipient, and the identity of the other healthcare recipient;
(k) whether the healthcare recipient, or an authorised representative or nominated representative of the healthcare recipient, has made an election under clause 5 of Schedule 1 to the My Health Records Act that the healthcare recipient not be registered under that Act.
(1) This section is made for the purposes of subsection 20(1) of the Act.
(2) For the purposes of registering a healthcare recipient in the My Health Record system, a healthcare provider is authorised to do the following:
(a) collect, from the healthcare recipient, the identifying information or healthcare identifier of the healthcare recipient;
(b) use the identifying information or healthcare identifier of the healthcare recipient;
(1) This section is made for the purposes of subsection 20(1) of the Act.
Authorisation of service operator
(2) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, the service operator is authorised to do the following:
(a) collect, from an active script list registry operator, the identifying information or healthcare identifier of the healthcare recipient;
(b) use the identifying information or healthcare identifier to verify whether the healthcare recipient has a healthcare identifier;
(c) disclose the healthcare recipient’s healthcare identifier to the active script list registry operator.
Authorisation of active script list registry operators
(3) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, an active script list registry operator is authorised to:
(a) collect the healthcare recipient’s healthcare identifier from the service operator; and
(b) use the healthcare recipient’s healthcare identifier to register the healthcare recipient for an active script list.
(4) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, an active script list registry operator is authorised to:
(a) collect, from the healthcare recipient, the healthcare recipient’s identifying information or healthcare identifier using a mobile prescription application via a mobile intermediary service or a web application; and
(b) disclose the identifying information or healthcare identifier to the service operator to verify the healthcare recipient’s healthcare identifier.
Authorisation of mobile prescription application service providers
(5) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, a mobile prescription application service provider is authorised to do the following:
(a) collect, from the healthcare recipient, the identifying information or healthcare identifier of the healthcare recipient;
(b) use the identifying information or healthcare identifier of the healthcare recipient to facilitate the registration of the healthcare recipient for an active script list;
(c) disclose the identifying information or healthcare identifier of the healthcare recipient to a mobile intermediary service operator to facilitate the registration of the healthcare recipient for an active script list.
Authorisation of mobile intermediary service operators
(6) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, a mobile intermediary service operator is authorised to do the following:
(a) collect, from a mobile prescription application, the identifying information or healthcare identifier of the healthcare recipient;
(b) use the identifying information or healthcare identifier of the healthcare recipient to facilitate the registration of the healthcare recipient for an active script list;
(c) disclose the identifying information or healthcare identifier of the healthcare recipient to an active script list registry operator to facilitate the registration of the healthcare recipient for an active script list.
(1) This section is made for the purposes of subsection 25D(1) of the Act.
(2) A healthcare provider is authorised to use, and to disclose to another entity, the healthcare identifier of a healthcare provider for the purpose of communicating or managing health information as part of:
(a) the provision of healthcare to a healthcare recipient; or
(b) the management (including the investigation or resolution of complaints), funding, monitoring or evaluation of healthcare.
(3) The other entity is authorised to collect, use or disclose the healthcare identifier of a healthcare provider for the purpose for which the healthcare identifier was disclosed to the entity under subsection (2).
(1) This section is made for the purposes of subsection 25D(1) of the Act.
(2) An entity mentioned in column 1 of an item in the following table is authorised to take action of the kind described in column 2 of that item with information of the kind described in column 3 of that item in the circumstances described in column 4 of that item.
Collection, use and disclosure of individual healthcare provider information in relation to health facilitation program | ||||
Item | Column 1 | Column 2 | Column 3 | Column 4 |
1 | individual healthcare provider | use disclose to an operator of a health facilitation program or the service operator | healthcare identifier of the healthcare provider | the use or disclosure is for the purpose of: (a) determining the healthcare provider’s eligibility to participate in a health facilitation program; or (b) registering the provider to participate in a health facilitation program; or (c) the provider participating in a health facilitation program; or (d) if the provider has provided healthcare to healthcare recipients through a healthcare facilitation program—supporting continuity of healthcare to the healthcare recipients |
2 | individual healthcare provider | collect use | healthcare identifier of another healthcare provider | the collection or use is for the purpose of: (a) supporting the other provider’s participation in a health facilitation program; or (b) if the healthcare provider has provided healthcare to healthcare recipients through a healthcare facilitation program—supporting continuity of healthcare to the healthcare recipients |
3 | operator of a health facilitation program | collect from an individual healthcare provider use disclose to another healthcare provider or the service operator | healthcare identifier of an individual healthcare provider identifying information of an individual healthcare provider | the collection, use or disclosure is for the purpose of: (a) determining the healthcare provider’s eligibility to participate in the health facilitation program; or (b) registering the provider to participate in the program; or (c) managing the provider’s participation in the program; or (d) supporting the other provider’s participation in the program; or (e) if the provider has provided healthcare to healthcare recipients through the program—supporting continuity of healthcare to the healthcare recipients |
4 | service operator | collect from an individual healthcare provider or operator of a health facilitation program use disclose to an operator of a health facilitation program | healthcare identifier of the individual healthcare provider identifying information of the individual healthcare provider | the collection, use or disclosure is for the purpose of determining the healthcare provider’s eligibility to participate in the health facilitation program |
5 | operator of a health facilitation program | collect from service operator use | healthcare identifier of an individual healthcare provider identifying information of an individual healthcare provider | the collection or use is for the purpose of determining the healthcare provider’s eligibility to participate in the health facilitation program |
6 | operator of a health facilitation program | use disclose | healthcare identifier of an individual healthcare provider | the use or disclosure is for the purpose of evaluation, analysis or reporting relating to whether the program is supporting the delivery of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients |
7 | entity to whom healthcare identifier of an individual healthcare provider is disclosed for a purpose mentioned in column 4 of item 6 | collect use disclose | healthcare identifier of an individual healthcare provider | the collection, use or disclosure is for the purpose of evaluation, analysis or reporting relating to whether a health facilitation program is supporting the delivery of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients |
(1) This section is made for the purposes of subsection 25D(2) of the Act.
(2) An operator of a health facilitation program may adopt the healthcare identifier of an individual healthcare provider for use as the operator’s own identifier for the purposes of the health facilitation program.
(1) This section is made for the purposes of subsections 20(4) and 25D(4) of the Act.
(2) A healthcare provider organisation must not request the service operator to disclose a healthcare identifier to the organisation, unless:
(a) the identity of the organisation’s responsible officer and the identity of the organisation maintenance officer have been verified through an evidence of identity process; and
(b) information in relation to those officers of the kind mentioned in paragraphs 8(2)(e) to (j) of this instrument has been given to the service operator; and
(c) the information is accurate, up to date and complete.
(3) If:
(a) the service operator receives a request to disclose a healthcare identifier from a healthcare provider organisation; and
(b) the request was made in contravention of subsection (2);
the service operator must refuse to comply with the request.
(1) This section is made for the purposes of subsections 20(4) and (5), and 25D(4) and (5), of the Act.
Information identifying individual making a request
(2) If a healthcare provider organisation requests the service operator to disclose a healthcare identifier to the organisation, the organisation must, if it is reasonably practicable to do so, give the service operator enough information to ensure the service operator can identify, by name, the individual making the request on behalf of the organisation without having to seek further information.
Note: For example, the information may be given as part of the data transmitted to the service operator from a healthcare provider organisation’s practice management software.
Keeping retrievable records
(3) If it is not reasonably practicable to give the service operator the information mentioned in subsection (2) at the time the request is made, the healthcare provider organisation must:
(a) keep a record of the identity of the individual who accessed the healthcare identifier for the organisation from the service operator; and
(b) keep that record for the retrieval period for that individual; and
(c) if, during the retrieval period for that individual, the service operator gives the organisation written notice requiring the organisation to identify the individual—identify the individual to the service operator within the period of 14 days after the notice is given.
(4) Each of the following is a retrieval period for an individual:
(a) any period during which the individual is authorised by the healthcare provider organisation to access healthcare identifiers on the organisation’s behalf;
(b) if the individual ceases to be authorised by the healthcare provider organisation to access healthcare identifiers on the organisation’s behalf—the period of 7 years starting on the day after the person ceased to be authorised.
(5) A healthcare provider organisation is liable to a civil penalty if the organisation contravenes subsection (2) or (3).
Civil penalty: 50 penalty units.
In this Division:
commencement day means the day this instrument commences.
old regulations means the Healthcare Identifiers Regulations 2010, as in force immediately before the commencement day.
(1) If:
(a) a thing was done for a particular purpose under the old regulations; and
(b) the thing could be done for that purpose under this instrument;
the thing has effect for the purposes of this instrument as if it had been done for that purpose under this instrument.
(2) Without limiting subsection (1), a reference in that subsection to a thing being done includes a reference to a notice, request or other instrument being given or made.
(1) Section 10 applies in relation to the use and disclosure of information on or after the commencement day, regardless of whether the information was collected before, on or after that day.
(2) This section does not limit the application of section 10.
(1) The repeal of the old regulations by this instrument does not affect the continuing operation of a provision of a version of the Healthcare Identifiers Regulations 2010 that was not in force immediately before the commencement day if, immediately before that day, the provision had continuing operation because of Schedule 1 to the old regulations.
(2) This section does not limit the effect of section 7 of the Acts Interpretation Act 1901 (as it applies as a result of paragraph 13(1)(a) of the Legislation Act 2003).
(1) Section 9A, as inserted by the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025, applies in relation to the use and disclosure of information on or after the commencement of that instrument, regardless of whether the information was collected before, on or after that commencement.
(2) This section does not limit the application of section 9A.
The endnotes provide information about this compilation and the compiled law.
The following endnotes are included in every compilation:
Endnote 1—About the endnotes
Endnote 2—Abbreviation key
Endnote 3—Legislation history
Endnote 4—Amendment history
Abbreviation key—Endnote 2
The abbreviation key sets out abbreviations that may be used in the endnotes.
Legislation history and amendment history—Endnotes 3 and 4
Amending laws are annotated in the legislation history and amendment history.
The legislation history in endnote 3 provides information about each law that has amended (or will amend) the compiled law. The information includes commencement details for amending laws and details of any application, saving or transitional provisions that are not included in this compilation.
The amendment history in endnote 4 provides information about amendments at the provision (generally section or equivalent) level. It also includes information about any provision of the compiled law that has been repealed in accordance with a provision of the law.
Editorial changes
The Legislation Act 2003 authorises First Parliamentary Counsel to make editorial and presentational changes to a compiled law in preparing a compilation of the law for registration. The changes must not change the effect of the law. Editorial changes take effect from the compilation registration date.
If the compilation includes editorial changes, the endnotes include a brief outline of the changes in general terms. Full details of any changes can be obtained from the Office of Parliamentary Counsel.
Misdescribed amendments
A misdescribed amendment is an amendment that does not accurately describe how an amendment is to be made. If, despite the misdescription, the amendment can be given effect as intended, then the misdescribed amendment can be incorporated through an editorial change made under section 15V of the Legislation Act 2003.
If a misdescribed amendment cannot be given effect as intended, the amendment is not incorporated and “(md not incorp)” is added to the amendment history.
ad = added or inserted | o = order(s) |
am = amended | Ord = Ordinance |
amdt = amendment | orig = original |
c = clause(s) | par = paragraph(s)/subparagraph(s) |
C[x] = Compilation No. x | /sub‑subparagraph(s) |
Ch = Chapter(s) | pres = present |
def = definition(s) | prev = previous |
Dict = Dictionary | (prev…) = previously |
disallowed = disallowed by Parliament | Pt = Part(s) |
Div = Division(s) | r = regulation(s)/rule(s) |
ed = editorial change | reloc = relocated |
exp = expires/expired or ceases/ceased to have | renum = renumbered |
effect | rep = repealed |
F = Federal Register of Legislation | rs = repealed and substituted |
gaz = gazette | s = section(s)/subsection(s) |
LA = Legislation Act 2003 | Sch = Schedule(s) |
LIA = Legislative Instruments Act 2003 | Sdiv = Subdivision(s) |
(md) = misdescribed amendment can be given | SLI = Select Legislative Instrument |
effect | SR = Statutory Rules |
(md not incorp) = misdescribed amendment | Sub‑Ch = Sub‑Chapter(s) |
cannot be given effect | SubPt = Subpart(s) |
mod = modified/modification | underlining = whole or part not |
No. = Number(s) | commenced or to be commenced |
Name | Registration | Commencement | Application, saving and transitional provisions |
Healthcare Identifiers Regulations 2020 | 27 Aug 2020 (F2020L01072) | 28 Aug 2020 (s 2(1) item 1) |
|
Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025 | 24 Mar 2025 (F2025L00406) | 25 Mar 2025 (s 2(1) item 1) | — |
Healthcare Identifiers Amendment (Health Facilitation Programs) Regulations 2025 | 29 May 2025 (F2025L00617) | 30 May 2025 (s 2(1) item 1) | — |
Provision affected | How affected |
Part 1 |
|
s 2..................... | rep LA s 48D |
s 4..................... | rep LA s 48C |
s 5..................... | am F2025L00406; F2025L00617 |
Part 2 |
|
s 9A.................... | ad F2025L00406 |
s 10A................... | ad F2025L00617 |
s 10B................... | ad F2025L00617 |
Part 4 |
|
Division 2 |
|
Division 2................ | ad F2025L00406 |
s 17.................... | ad F2025L00406 |
Schedule 1................ | rep LA s 48C |