Commonwealth Consolidated Acts Commonwealth Consolidated Acts(1) A person must not use or disclose health information included in a healthcare recipient's My Health Record if:
(a) the information was disclosed to the person in contravention of subsection 59(2); and
(b) the person knows that, or is reckless as to whether, the disclosure of the information to the person contravened that subsection.
(2) Subsection (1) does not apply if the person discloses the information for the purpose of an appropriate authority investigating the contravention mentioned in paragraph (1)(a).
Fault - based offence
(3) A person commits an offence if the person contravenes subsection (1).
Penalty: Imprisonment for 5 years or 300 penalty units, or both.
Civil penalty
(4) A person is liable to a civil penalty if the person contravenes subsection (1).
Civil penalty: 1,500 penalty units.