An entity must:
(a) take reasonable steps to protect healthcare identifiers the entity holds from:
(i) misuse and loss; and
(ii) unauthorised access, modification or disclosure; and
(b) comply with any requirements prescribed by the regulations for the protection of healthcare identifiers the entity holds.
Note: The regulations may provide for the imposition of a penalty for contravention of a regulation: see subsection 39(2).