(1) A person commits an offence if:
(a) the person has, or has at any time had, a duty, function or power under this Act; and
(aa) the duty, function or power is not an * APRA private health insurance duty, function or power; and
(b) the person discloses information to another person; and
(c) the information is * protected information; and
(d) the disclosure is not an * authorised disclosure.
Penalty: Imprisonment for 2 years or 120 penalty units, or both.
(1A) An APRA private health insurance duty, function or power is a duty, function or power of * APRA, or that a person has in the person's capacity as an officer (within the meaning of section 56 of the Australian Prudential Regulation Authority Act 1998 ), under any of the following:
(a) this Act;
(b) the Private Health Insurance (Prudential Supervision) Act 2015 ;
(c) the Financial Institutions Supervisory Levies Collection Act 1998 , as that Act applies in relation to levies imposed on private health insurers;
(d) the Financial Sector (Collection of Data) Act 2001 , as that Act applies in relation to private health insurers.
Note: The disclosure of information regime for information obtained under APRA private health insurance duties, functions and powers is Part 6 of the Australian Prudential Regulation Authority Act 1998 (rather than this Division).
(2) Information is protected information if the information:
(a) either:
(i) is obtained by a person in the course of performing or exercising a duty, function or power under this Act, other than an * APRA private health insurance duty, function or power; or
(ii) was information to which subparagraph (i) applied and is obtained by a person by way of an * authorised disclosure under section 323 - 10, 323 - 15 or 323 - 20; and
(b) relates to a person other than the person who obtained it.
(3) A disclosure of information is an authorised disclosure if the disclosure is one that the person may make under section 323 - 5, 323 - 10, 323 - 15, 323 - 20, 323 - 25 or 323 - 30.
Note: A disclosure in accordance with subsection 132D(1) of the National Health Act 1953 is also taken to be an authorised disclosure for the purposes of this section: see subsection 132D(3) of the National Health Act 1953 .