This is the Health Legislation Amendment (eHealth) Regulation 2015.

(1) Each provision of this instrument specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.

Commencement information
Column 1	Column 2	Column 3
Provisions	Commencement	Date/Details
1. The whole of this instrument	The day after this instrument is registered.	15 December 2015

Note: This table relates only to the provisions of this instrument as originally made. It will not be amended to deal with any later amendments of this instrument.

(2) Any information in column 3 of the table is not part of this instrument. Information may be inserted in this column, or information in it may be edited, in any published version of this instrument.

3 Authority

This instrument is made under the following Acts:

(a) the Healthcare Identifiers Act 2010;

(b) the My Health Records Act 2012.

4 Schedules

Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.

Schedule 1—Amendments relating to the Health Legislation Amendment (eHealth) Act 2015

Healthcare Identifiers Regulations 2010

1 Before regulation 1

Insert:

Part 1—Preliminary

2 After regulation 2

Insert:

2A Schedule 1

Schedule 1 has effect.

3 Regulation 3 (after the heading)

Insert:

Note: A number of expressions used in these Regulations are defined in the Act, including the following:

(a) healthcare provider organisation;

(b) individual healthcare provider.

4 Regulation 3

Insert:

ABN has the meaning given by section 41 of the A New Tax System (Australian Business Number) Act 1999.

ACN has the same meaning as in the Corporations Act 2001.

My Health Records Act means the My Health Records Act 2012.

5 Regulation 3 (definition of PCEHR Act)

Repeal the definition.

6 Regulation 3

Insert:

verification service means a service (whether operated electronically or otherwise) that allows an entity to compare information relating to the identity of an entity with a government record.

7 Regulation 3 (note at the end)

Repeal the note.

8 After regulation 3

Insert:

3A Application of these Regulations to partnerships, trusts and unincorporated associations

To avoid doubt, sections 36B, 36C and 36D of the Act apply to these Regulations, and obligations, offences and civil penalty provisions in these Regulations, in the same way as they apply to the Act, and obligations, offences and civil penalty provisions in the Act.

9 Subregulation 5(1)

Repeal the subregulation, substitute:

Identifying information—individual healthcare provider

(1) For paragraph 7(1)(g) of the Act, the following information is identifying information of an individual healthcare provider:

(a) whether the healthcare provider is registered with a registration authority and the status of that registration (such as conditional, suspended, cancelled or lapsed);

(b) whether the healthcare provider is a member of a professional association of a kind described in paragraph 9A(1)(b) of the Act and the status of that membership (such as conditional, suspended, cancelled or lapsed);

(d) whether the death of the healthcare provider has been verified;

(e) whether the healthcare provider is linked to a healthcare provider organisation and, if so, the name of the organisation and the ABN and ACN of the organisation (whichever is applicable).

10 Subregulation 5(2)

Omit:

(2) For paragraph 7(2)(e) of the Act, each of the following is identifying information:

substitute:

Identifying information—healthcare provider organisation

(2) For paragraph 7(2)(e) of the Act, the following information is identifying information of a healthcare provider organisation:

11 Paragraphs 5(2)(a) to (d)

Repeal the paragraphs, substitute:

(a) whether the organisation is registered under Division 2 of Part 3 of the My Health Records Act;

(b) whether the healthcare provider organisation has notified the service operator that the organisation does not wish to use a healthcare identifier, either temporarily or permanently;

12 At the end of subregulation 5(2)

Add:

; (o) whether any individual healthcare providers are linked to the organisation and, if so, the names and other identifying information of those individual healthcare providers.

13 At the end of regulation 5

Add:

Identifying information—healthcare recipient

(3) For paragraph 7(3)(i) of the Act, the following information is identifying information of a healthcare recipient:

(a) the telephone number of the healthcare recipient;

(b) the electronic address of the healthcare recipient;

(d) whether a healthcare identifier assigned to the healthcare recipient has been assigned provisionally (for example, because it has not been possible to verify the identity of the healthcare recipient);

(e) if information relating to the identity of the healthcare recipient has been, or is to be, verified using a particular form of identification document (such as a driver’s licence or passport), details of that document including:

(i) the document number; and

(ii) the State or Territory in which the document was issued; and

(iii) the name of the entity that issued the document;

(f) if information relating to the identity of the healthcare recipient has been, or is to be, verified by using a verification service, the response of that service to any verification inquiry in relation to the healthcare recipient;

(g) whether the healthcare recipient is, or is likely to be, deceased;

(h) whether the death of the healthcare recipient has been verified;

(i) whether the healthcare recipient is a registered healthcare recipient for the purposes of the My Health Records Act;

(j) whether the healthcare recipient is an authorised representative, or nominated representative, of another healthcare recipient, and the identity of the other healthcare recipient;

(k) whether the healthcare recipient, or an authorised representative or nominated representative of the healthcare recipient, has made an election under clause 5 of Schedule 1 to the My Health Records Act that the healthcare recipient not be registered under that Act.

14 Regulations 6, 7, 8, 12, 13, 14, and 15

Repeal the regulations, substitute:

Part 2—Requests by healthcare provider organisations to access healthcare identifiers

6 Details of responsible officers and organisation maintenance officers

(1) This regulation is made under subsections 20(4) and 25D(4) of the Act.

(2) A healthcare provider organisation must not request the service operator to disclose a healthcare identifier to the organisation, unless:

(a) the identity of the responsible officer and the organisation maintenance officer for the organisation has been verified through an evidence of identity process; and

(b) information in relation to those officers of the kind mentioned in paragraphs 5(2)(g) to (l) of these Regulations has been given to the service operator; and

(3) If the service operator receives a request to disclose a healthcare identifier from a healthcare provider organisation that has made the request in contravention of subregulation (2), the service operator may refuse to comply with the request.

7 Identity of individual making request

(1) This regulation is made under subsections 20(4) and (5) and 25D(4) and (5) of the Act.

Information identifying individual making a request

(2) If a healthcare provider organisation requests the service operator to disclose a healthcare identifier to the organisation, the organisation must, if it is reasonably practicable to do so, give the service operator enough information to ensure the service operator can identify by name the individual making the request on behalf of the organisation without having to seek further information.

Example: The information may be given as part of the data transmitted to the service operator from a healthcare provider organisation’s practice management software.

Keeping retrievable records

(3) If it is not reasonably practicable to give the service operator that information at the time the request is made, the healthcare provider organisation must:

(a) keep a record of the identity of the individual who accessed the healthcare identifier for the organisation from the service operator; and

(b) keep that record for the retrieval period for that individual; and

(c) if, during the retrieval period for that individual the service operator gives the organisation notice in writing requiring the organisation to identify the individual—identify the individual to the service operator within 14 days after the notice is given.

(4) Each of the following is a retrieval period for an individual:

(a) any period during which the individual is authorised by the healthcare provider organisation to access healthcare identifiers on the organisation’s behalf;

(b) if the individual ceases to be authorised by the healthcare provider organisation to access healthcare identifiers on the organisation’s behalf—the period of 7 years starting on the day after the person ceased to be authorised.

(5) A healthcare provider organisation is liable to a civil penalty if the organisation contravenes this section.

Civil penalty: 50 penalty units.

Part 3—Collection, use and disclosure of identifying information and healthcare identifiers

8 Authorisation of collection, use and disclosure—healthcare provider assisting a healthcare recipient to register

(1) This regulation is made under subsection 20(1) of the Act.

(2) A healthcare provider is authorised to:

(a) collect from a healthcare recipient; or

(b) use; or

the identifying information or healthcare identifier of the healthcare recipient for the purposes of registering the healthcare recipient on the My Health Record System.

15 At the end of the Regulations

Add:

Schedule 1—Application, saving and transitional provisions

Part 1—Application provisions relating to the Health Legislation Amendment (eHealth) Regulation 2015

1 Definitions

In this Division:

the amending Act means the Health Legislation Amendment (eHealth) Act 2015.

the amending regulation means the Health Legislation Amendment (eHealth) Regulation 2015.

2 Application of regulations to partnerships, trusts and unincorporated associations

The amendment made by item 8 of Schedule 1 to the amending regulation applies to:

(a) obligations arising on or after the application day, as defined in item 111 of Schedule 1 to the amending Act; and

(b) offence and civil penalty provisions contravened on or after that day.

3 Requests by healthcare providers to access healthcare identifiers

Regulations 6 and 7 of these Regulations, as inserted by item 14 of Schedule 1 to the amending regulation, apply to requests made on or after the application day, as defined in item 111 of Schedule 1 to the amending Act.

4 Collection, use and disclosure by a healthcare provider—registering a healthcare recipient

Regulation 8 of these Regulations, as inserted by item 14 of Schedule 1 to the amending regulation, applies to the collection, use and disclosure of information on or after the application day, as defined in item 111 of Schedule 1 to the amending Act.

Personally Controlled Electronic Health Records Regulation 2012

16 Section 1.1.1

Omit “Personally Controlled Electronic Health Records Regulation 2012”, substitute “My Health Records Regulation 2012”.

17 After section 1.1.2

Insert:

1.1.2A Schedule 1

Schedule 1 has effect.

18 Section 1.1.3 (after the heading)

Insert:

Note: A number of expressions used in this regulation are defined in the Act, including the following:

(a) healthcare provider organisation;

(b) individual healthcare provider.

19 Section 1.1.3

Insert:

ABN has the meaning given by section 41 of the A New Tax System (Australian Business Number) Act 1999.

ACN has the same meaning as in the Corporations Act 2001.

20 Section 1.1.3 (definition of Act)

Omit “Personally Controlled Electronic Health Records Act 2012”, substitute “My Health Records Act 2012”.

21 Section 1.1.3 (definition of organisation maintenance officer)

Repeal the definition, substitute:

organisation maintenance officer, for a healthcare provider organisation, has the meaning given by subsection 9A(8) of the Healthcare Identifiers Act.

22 Section 1.1.3 (definition of Remuneration Tribunal Determination)

Repeal the definition.

23 Section 1.1.3 (definition of responsible officer)

Repeal the definition, substitute:

responsible officer, for a healthcare provider organisation, has the meaning given by subsection 9A(7) of the Healthcare Identifiers Act.

24 Section 1.1.3 (definition of Travel Determination)

Repeal the definition.

25 Section 1.1.3

Insert:

verification service means a service (whether operated electronically or otherwise) that allows an entity to compare information relating to the identity of an entity with a government record.

26 Section 1.1.3 (note at the end)

Repeal the note.

27 Section 1.1.5

Repeal the section, substitute:

1.1.5 Identifying information—individual healthcare provider

For paragraph 9(1)(h) of the Act, the following information is identifying information of an individual healthcare provider:

(a) whether the healthcare provider is registered with a registration authority and the status of that registration (such as conditional, suspended, cancelled or lapsed);

(b) whether the healthcare provider is a member of a professional association of the kind described in paragraph 9A(1)(b) of the Healthcare Identifiers Act and the status of that membership (such as conditional, suspended, cancelled or lapsed);

(d) whether the death of the healthcare provider has been verified;

(e) whether the healthcare provider is linked to a healthcare provider organisation and, if so, the name of the organisation and the ABN and ACN of the organisation (whichever is applicable).

28 Section 1.1.6

Omit “the following information is prescribed in relation to a healthcare provider organisation”, substitute “the following information is identifying information of a healthcare provider organisation”.

29 Paragraph 1.1.6(a)

Repeal the paragraph, substitute:

(a) whether the organisation is registered under Division 2 of Part 3 of the Act;

(aa) whether the healthcare provider organisation has notified the service operator that the organisation does not wish to use a healthcare identifier, either temporarily or permanently;

30 Paragraph 1.1.6(c)

Omit “a consumer”, substitute “a healthcare recipient”.

31 At the end of section 1.1.6

Add:

; (l) whether any individual healthcare providers are linked to the organisation and, if so, the names and other identifying information of those individual healthcare providers.

32 At the end of Part 1

Add:

1.1.7 Identifying information—healthcare recipient

For paragraph 9(3)(i) of the Act, the following information is identifying information of a healthcare recipient:

(a) the telephone number of the healthcare recipient;

(b) the electronic address of the healthcare recipient;

(i) the document number; and

(ii) the State or Territory in which the document was issued; and

(iii) the name of the entity that issued the document;

(g) whether the healthcare recipient is, or is likely to be, deceased;

(h) whether the death of the healthcare recipient has been verified;

(i) whether the healthcare recipient is a registered healthcare recipient for the purposes of the Act;

(j) whether the healthcare recipient is an authorised representative, or nominated representative, of another healthcare recipient, and the identity of the other healthcare recipient;

(k) whether the healthcare recipient, or an authorised representative or nominated representative of the healthcare recipient, has made an election under clause 5 of Schedule 1 to the Act that the healthcare recipient not be registered under the Act.

33 Part 2

Repeal the Part.

34 Before section 3.1.1

Insert:

3.1.1A Other information in relation to a healthcare recipient needed for registration

(1) The following is other information in relation to a healthcare recipient for the purposes of subparagraph 40(b)(v) of the Act:

(a) whether the identity of the healthcare recipient has been verified;

(b) whether a healthcare identifier assigned to the healthcare recipient has been assigned provisionally (for example, because it has not been possible to verify the identity of the healthcare recipient).

(2) The following is other information in relation to a healthcare recipient for the purposes of subparagraph 4(b)(v) of Schedule 1 to the Act:

(a) whether the identity of the healthcare recipient has been verified;

(d) whether the death of the healthcare recipient has been verified.

35 Section 3.1.1 (heading)

Repeal the heading, substitute:

3.1.1 Registration of healthcare recipient by the System Operator

36 Section 3.1.1

After “of the Act”, insert “and subclause 9(3) of Schedule 1 to the Act”.

37 Paragraph 3.1.1(a)

Repeal the paragraph.

38 After Part 3

Insert:

Part 4—Collection, use and disclosure of information

4.1.1 Prescribed information to be included in a My Health Record

(1) This section is made for:

(a) column 4 of item 9 of the table in section 58A of the Act; and

(b) column 4 of item 9 in the table in clause 8 of Schedule 1 to the Act.

(2) The prescribed information is information that relates to the provision of healthcare to the healthcare recipient, other than information that relates to compensation or benefits provided under any of the following Acts:

(a) the Australian Participants in British Nuclear Tests (Treatment) Act 2006;

(b) the Military Rehabilitation and Compensation Act 2004;

(d) the Veterans’ Entitlements Act 1986.

4.1.2 Verifying identity of healthcare recipients etc.

(1) This section is made for item 10 of the table in section 58A and clause 8 of Schedule 1 to the Act.

(2) The Attorney‑General’s Department is authorised to collect, use and disclose to the System Operator identifying information of the kind mentioned in Column 3 of that item of the table for the purposes mentioned in Column 4 of that item of the table.

Part 5—Other matters

5.1.1 Subcommittee of the Ministerial Council

For paragraph 109(2)(b) of the Act, and subclause 1(3) of Schedule 1 to the Act, the following subcommittee of the Ministerial Council is prescribed:

(a) the Australian Health Ministers’ Advisory Council, whether known by that name or another name;

(b) if that Advisory Council ceases to exist—a subcommittee of the Ministerial Council that has been given the Advisory Council’s functions in relation to electronic health records.

39 At the end of the regulation

Add:

Schedule 1—Application, savings and transitional provisions

Part 1—Application provisions relating to the Health Legislation Amendment (eHealth) Regulation 2015

1 Definitions

In this Division:

the amending Act means the Health Legislation Amendment (eHealth) Act 2015.

the amending regulation means the Health Legislation Amendment (eHealth) Regulation 2015.

2 Repeal of regulations dealing with the jurisdictional advisory committee and independent advisory committee

Items 22, 24 and 33 of Schedule 1 to the amending regulation apply on and after the governance restructure day, as defined in item 112 of Schedule 1 to the amending Act.

3 Information to be provided before registration for a My Health Record

Item 34 of Schedule 1 to the amending regulation applies in relation to the registration of a healthcare recipient on or after the commencement of that Schedule.