Commonwealth Consolidated Acts Commonwealth Consolidated ActsInformation to which this section applies
(1) Subject to subsection (2), this section applies to information that:
(a) is information relating to an individual; and
(b) is held by an agency (whether or not the information was obtained by that agency or any other agency after the commencement of this section); and
(c) was obtained by the agency or any other agency in connection with:
(i) a claim for payment of a benefit under the Medicare Benefits Program or the Pharmaceutical Benefits Program; or
(ii) a supply of a pharmaceutical benefit to which subsection 98AC(1) applies.
Information to which this section does not apply
(2) This section does not apply to such information:
(a) so far as it identifies:
(i) a person who provided the service or goods in connection with which the claim for payment is made, or who provided the pharmaceutical benefit; or
(ii) a person who, in his or her capacity as the provider of services, made a referral or request to another person to provide the service or goods or the pharmaceutical benefit; or
(b) so far as it is contained in a database that:
(i) is maintained for the purpose of identifying persons who are eligible to be paid benefits under the Medicare Benefits Program or the Pharmaceutical Benefits Program; and
(ii) does not contain information relating to claims for payment of such benefits; or
(c) so far as it is not stored in a database.
Issuing rules
(3) The Information Commissioner must, by legislative instrument, issue rules relating to information to which this section applies.
(3A) The issuing of rules under this section is a privacy function for the purposes of the Australian Information Commissioner Act 2010 .
Replacing or varying rules
(4) At any time, the Information Commissioner may, by legislative instrument, issue further rules that vary the existing rules.
Content of rules
(5) So far as practicable, the rules must:
(a) specify the ways in which information may be stored and, in particular, specify the circumstances in which creating copies of information in paper or similar form is prohibited; and
(b) specify the uses to which agencies may put information; and
(c) specify the circumstances in which agencies may disclose information; and
(d) prohibit agencies from storing in the same database:
(i) information that was obtained under the Medicare Benefits Program; and
(ii) information that was obtained under the Pharmaceutical Benefits Program; and
(e) prohibit linkage of:
(i) information that is held in a database maintained for the purposes of the Medicare Benefits Program; and
(ii) information that is held in a database maintained for the purposes of the Pharmaceutical Benefits Program;
unless the linkage is authorised in the way specified in the rules; and
(f) specify the requirements with which agencies must comply in relation to old information, in particular requirements that:
(i) require the information to be stored in such a way that the personal identification components of the information are not linked with the rest of the information; and
(ii) provide for the longer term storage and retrieval of the information; and
(iii) specify the circumstances in which, and the conditions subject to which, the personal identification components of the information may later be re - linked with the rest of the information.
(5A) Nothing in this section, or in the rules issued by the Information Commissioner, precludes the inclusion, in a database of information held by the Chief Executive Medicare and relating to claims for benefits under the Pharmaceutical Benefits Program, of the pharmaceutical entitlements number applicable to the person to whom each such claim relates:
(a) as a person covered by a benefit entitlement card; or
(b) as a person included within a class identified by the Minister in a determination under subsection 86E(1).
(5AA) Nothing in this section, or in the rules issued by the Information Commissioner, prevents the My Health Record System Operator including information to which this section applies in the My Health Record of a healthcare recipient.
(5B) Nothing in this section, or in the rules issued by the Information Commissioner, precludes the inclusion, in a database of information:
(a) held by the Chief Executive Medicare; and
(b) relating to supplies of pharmaceutical benefits to which subsection 98AC(1) applies;
of the pharmaceutical entitlements number applicable to the person to whom each such supply relates:
(c) as a person covered by a benefit entitlement card; or
(d) as a person included within a class identified by the Minister in a determination under subsection 86E(1).
(5C) Nothing in this section, or in the rules issued by the Information Commissioner, precludes the matching of information under subsection 132B(1) or the operation of Part VIIIA generally.
Consultation
(6) Before issuing rules, the Information Commissioner must take reasonable steps to consult with organisations (including agencies) whose interests would be affected by the rules.
When rules commence
(8) Despite section 12 of the Legislation Act 2003 , rules commence:
(a) from the first day on which they are no longer liable to be disallowed; or
(b) if the rules provide for their commencement after that day--in accordance with that provision.
(11) In this section:
"agency" has the same meaning as in the Privacy Act 1988 .
"benefit entitlement card" means:
(a) a medicare card within the meaning of subsection 84(1); and
(b) a card that evidences the person's status as a concessional beneficiary within the meaning of subsection 84(1).
"database" means a discrete body of information stored by means of a computer.
"Medicare Benefits Program" means the program for providing Medicare benefits under the Health Insurance Act 1973 .
"My Health Record" has the same meaning as in the My Health Records Act 2012 .
"My Health Record System Operator" has the same meaning as System Operator has in the My Health Records Act 2012 .
"old information" means information to which this section applies that has been held by one or more agencies for at least the preceding 5 years.
"personal identification components" , in relation to information, means so much of the information as includes any of the following:
(a) the name of the person to whom the information relates;
(b) the person's address;
(c) the person's Medicare card number;
(d) the person's Pharmaceutical entitlements number.
"Pharmaceutical Benefits Program" means the program for supplying pharmaceutical benefits under Part VII of this Act.
"pharmaceutical entitlements number" , in relation to a person, means:
(a) if the person is covered by a medicare card--a medicare number within the meaning of subsection 84(1) that is applicable to the person as a person covered by that card; and
(b) if the person is covered by a card that evidences the person's status as a concessional beneficiary within the meaning of subsection 84(1)--the number applicable to that person as a person covered by that card.