Health Legislation Amendment (Modernising My Health Record—Sharing by Default) Act 2025 (Cth)

Health Legislation Amendment (Modernising My Health Record—Sharing by Default) Act 2025 No. 8, 2025 An Act to amend the law relating to electronic health records and medicare benefits, and for other purposes Contents 1 Short title 2 Commencement 3 Schedules Schedule 1—Main amendments Part 1—My Health Records My Health Records Act 2012 Part 2—Medicare benefits Division 1—Amendments Health Insurance Act 1973 Division 2—Amendments commencing if the Health Insurance Legislation Amendment (Assignment of Medicare Benefits) Act 2024 does not commence Health Insurance Act 1973 Division 3—Amendments commencing if the Health Insurance Legislation Amendment (Assignment of Medicare Benefits) Act 2024 commences Health Insurance Act 1973 Division 4—Amendments commencing if the Administrative Review Tribunal (Miscellaneous Measures) Act 2025 commences Health Insurance Act 1973 Schedule 2—Other amendments A New Tax System (Goods and Services Tax) Act 1999 Fringe Benefits Tax Assessment Act 1986 Health Insurance Act 1973 National Health Act 1953 National Health Reform Act 2011 Private Health Insurance Act 2007 Health Legislation Amendment (Modernising My Health Record—Sharing by Default) Act 2025 No. 8, 2025 An Act to amend the law relating to electronic health records and medicare benefits, and for other purposes [Assented to 14 February 2025] The Parliament of Australia enacts: 1 Short title This Act is the Health Legislation Amendment (Modernising My Health Record—Sharing by Default) Act 2025. 2 Commencement (1) Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms. Commencement information Column 1 Column 2 Column 3 Provisions Commencement Date/Details 1. Sections 1 to 3 and anything in this Act not elsewhere covered by this table The day this Act receives the Royal Assent. 14 February 2025 2. Schedule 1, Part 1 The day after this Act receives the Royal Assent. 15 February 2025 3. Schedule 1, Part 2, Division 1 The day after this Act receives the Royal Assent. 15 February 2025 4. Schedule 1, Part 2, Division 2 The day after this Act receives the Royal Assent. 15 February 2025 However, the provisions do not commence at all if Schedule 1 to the Health Insurance Legislation Amendment (Assignment of Medicare Benefits) Act 2024 commences on or before that day. 5. Schedule 1, Part 2, Division 3 The later of: (a) the start of the day after this Act receives the Royal Assent; and (b) immediately after the commencement of Schedule 1 to the Health Insurance Legislation Amendment (Assignment of Medicare Benefits) Act 2024. 6. Schedule 1, Part 2, Division 4 The later of: 21 February 2025 (a) immediately after the commencement of the provisions covered by table item 3; and (paragraph (b) applies) (b) the commencement of Schedule 2 to the Administrative Review Tribunal (Miscellaneous Measures) Act 2025. 7. Schedule 2 The day after this Act receives the Royal Assent. 15 February 2025 Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act. (2) Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act. 3 Schedules Legislation that is specified in a Schedule to this Act is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this Act has effect according to its terms. Schedule 1—Main amendments Part 1—My Health Records My Health Records Act 2012 1 Section 3 Omit "voluntary national public system for the provision of access to health information relating to recipients of healthcare", substitute "national public system for the provision of access to health information relating to recipients of healthcare that is voluntary for those recipients". 2 Section 4 (paragraph beginning "If a healthcare recipient is registered") After "a healthcare provider may", insert "(or, in some circumstances, must)". 3 Section 5 Insert: approved registered repository operator means a healthcare provider organisation that: (a) is a registered repository operator; and (b) satisfies the requirements (if any) specified in the My Health Records Rules. finally determined: see section 10C. prescribed healthcare provider organisation means a healthcare provider organisation that is: (a) a corporation to which paragraph 51(xx) of the Constitution applies; and (b) of a kind specified in the My Health Records Rules. share by default provision: each of the following is a share by default provision: (a) section 41A (prescribed healthcare provider organisations must be registered); (b) section 78A (some information must be shared with the My Health Record system unless exception applies); (c) section 78C (record keeping requirements in relation to sharing information with the My Health Record system); (d) section 78D (prescribed healthcare provider organisations must display notice when not sharing information with the My Health Record system); (e) section 19AD (medicare benefits not payable in respect of certain professional services) of the Health Insurance Act 1973; (f) section 19AF (record keeping requirement) of the Health Insurance Act 1973; (g) section 19AG (advance payment before information is shared with the My Health Record system) of the Health Insurance Act 1973; (h) section 19AH (recovery of payments) of the Health Insurance Act 1973. shares with the My Health Record system: see section 10A. upload exception applies: see section 10B. 4 After section 10 Insert: 10A Sharing information with the My Health Record system (1) An entity other than an approved registered repository operator shares with the My Health Record system information if the entity uploads, for the purposes of the My Health Record system, the information to: (a) a repository that forms part of the National Repositories Service; or (b) a repository to which a registered repository operator's registration relates. (2) An approved registered repository operator shares with the My Health Record system information if the registered repository operator: (a) uploads, for the purposes of the My Health Record system, the information to a repository that forms part of the National Repositories Service; or (b) takes, in relation to the information, the action specified in the My Health Records Rules. 10B When an upload exception applies An upload exception applies in relation to an entity sharing with the My Health Record system information about healthcare provided to an individual if: (a) the individual is not a registered healthcare recipient; or (b) either: (i) the individual, or an authorised representative or nominated representative of the individual, has advised the entity; or (ii) the entity has otherwise been informed that the individual, or an authorised representative or nominated representative of the individual, has advised; that the information must not be uploaded to the My Health Record system; or (c) an individual healthcare provider reasonably believes that the information should not be shared with the My Health Record system because of a serious concern for the health, safety or wellbeing of the individual; or (d) the information cannot be shared with the My Health Record system due to circumstances beyond the reasonable control of the entity. 10C When an application is finally determined (1) An application under section 41B, 42 or 78B is finally determined when the System Operator has made a decision (the original decision) on the application and: (a) the original decision is to approve the application; or (b) no notice of the original decision is given because subsection 97(2A) applies; or (c) no notice asking the System Operator to reconsider the original decision is given within the period mentioned in subsection 97(4); or (d) all of the following apply: (i) a notice asking the System Operator to reconsider the original decision is given within the period mentioned in subsection 97(4); (ii) the System Operator reconsiders the original decision; (iii) no application is made to the Administrative Review Tribunal within the period mentioned in section 18 of the Administrative Review Tribunal Act 2024 for review of the System Operator's reconsideration decision; or (e) an application is made to the Administrative Review Tribunal within the period mentioned in section 18 of the Administrative Review Tribunal Act 2024 for review of the System Operator's reconsideration of the original decision, the Administrative Review Tribunal decides the application and one of the following applies: (i) subsection 123(1) of that Act does not apply in relation to the Administrative Review Tribunal's decision; (ii) no application is made under section 123 of that Act within the period mentioned in section 125 of that Act to refer the Administrative Review Tribunal's decision to the guidance and appeals panel; (iii) any application that is made under section 123 of that Act within the period mentioned in section 125 of that Act to refer the Administrative Review Tribunal's decision to the guidance and appeals panel is refused; or (f) both of the following apply: (i) the President of the Administrative Review Tribunal refers the Administrative Review Tribunal's decision on the application for review of the System Operator's reconsideration of the original decision to the guidance and appeals panel under section 123 of the Administrative Review Tribunal Act 2024; (ii) the Administrative Review Tribunal makes a decision on the guidance and appeals panel application (within the meaning of the Administrative Review Tribunal Act 2024) taken to be made because of the referral. (2) An application under section 41B or 78B is finally determined when the System Operator ceases to consider the application under subsection 41B(4) or 78B(4). 5 After Division 1 of Part 3 Insert: Division 1A—Healthcare provider organisations that are required to be registered 41A Prescribed healthcare provider organisations must be registered (1) A prescribed healthcare provider organisation contravenes this subsection if the healthcare provider organisation is not a registered healthcare provider organisation and is not an approved registered repository operator. Civil penalty: 250 penalty units. (2) However, subsection (1) does not apply: (a) during any period starting when the healthcare provider organisation applies to the System Operator under section 41B or 42 and ending when the application is finally determined; or (b) during any period approved by the System Operator under section 41B in relation to the healthcare provider organisation. Note: A person who wishes to rely on subsection (2) in proceedings for a civil penalty order bears an evidential burden in relation to the matters in that subsection: see section 96 of the Regulatory Powers Act. 41B System Operator may approve a period during which registration is not required Application (1) A healthcare provider organisation may apply to the System Operator to approve a period during which subsection 41A(1) does not apply to the healthcare provider organisation. (2) The application must: (a) be in the approved form; and (b) include, or be accompanied by, the information and documents required by the form; and (c) be lodged at a place, or by a means, specified in the form. Further information may be required (3) If a healthcare provider organisation makes an application under subsection (1), the System Operator may, by notice in writing, require the healthcare provider organisation to give the System Operator, within the period specified in the notice, such further information in relation to the application as the System Operator requires. (4) The System Operator is not required to decide the application, and may cease considering the application, if the healthcare provider organisation does not provide the required information within the period specified in the notice. Approval by System Operator (5) On application under subsection (1) or on the System Operator's initiative, the System Operator may, by written notice to a healthcare provider organisation, approve a period during which subsection 41A(1) does not apply to the healthcare provider organisation. (6) In deciding whether to approve the period, the System Operator must take into account the following: (a) the healthcare provider organisation's size and technological readiness; (b) the potential disruption (if any) to the provision of healthcare if the healthcare provider organisation is not a registered healthcare provider organisation; (c) any other matter the System Operator considers relevant. (7) An approval under subsection (5) is not a legislative instrument. 6 Paragraph 43(b) Omit "Rules; and", substitute "Rules.". 7 Paragraph 43(c) Repeal the paragraph. 8 After subsection 51(3) Insert: (3A) The System Operator may, in writing, decide to cancel or suspend the registration of a healthcare provider organisation if the System Operator is not satisfied that the healthcare provider organisation is able to comply with the conditions of the healthcare provider organisation's registration. 9 Subsection 51(5) After "(3)", insert "or (3A)". 10 Paragraphs 53(1)(a) and (4)(a) After "(3),", insert "(3A),". 11 After paragraph 54(a) Insert: (ab) if the entity is a registered healthcare provider organisation or registered repository operator—the entity is taken not to be registered for the purposes of paragraph (a) of the definition of approved registered repository operator in section 5 and sections 10A, 41A, 78A, 78C and 78D; and 12 After subparagraph 69(1)(b)(ii) Insert: (iia) a share by default provision; or 13 At the end of Subdivision B of Division 2 of Part 4 Add: 70AA Collection, use and disclosure in relation to compliance with share by default provisions (1) Subject to section 69, the System Operator is authorised to collect, use and disclose to a person covered by subsection (2) information covered by subsection (3) for the purposes of monitoring, investigating or enforcing compliance with a share by default provision. (2) This subsection covers the following persons: (a) the Chief Executive Medicare; (b) the Secretary of the Department; (c) a Commonwealth entity (within the meaning of the Public Governance, Performance and Accountability Act 2013) (if any) specified in the My Health Records Rules. (3) This subsection covers health information that is: (a) included in a healthcare recipient's My Health Record; and (b) of a kind specified in the My Health Records Rules. (4) Subsection (1) does not authorise the System Operator to collect, use or disclose healthcare recipient‑only notes. 14 At the end of Part 4 Add: Division 5—Authorised collection, use and disclosure for compliance purposes 73C Collection, use and disclosure of health information in relation to compliance with share by default provisions (1) A person covered by subsection (2) is authorised to collect, use and disclose, for the purposes of monitoring, investigating or enforcing compliance with a share by default provision, health information disclosed to the person under section 70AA. (2) This subsection covers the following persons: (a) the Chief Executive Medicare; (b) the Secretary of the Department; (c) a Commonwealth entity (within the meaning of the Public Governance, Performance and Accountability Act 2013) (if any) specified in the My Health Records Rules for the purposes of paragraph 70AA(2)(c). 73D Collection, use and disclosure of healthcare identifiers and identifying information in relation to compliance with share by default provisions (1) An entity mentioned in column 1 of an item of the following table is authorised to take action of the kind described in column 2 of that item with information of the kind described in column 3 of that item in the circumstances described in column 4 of that item. Collection, use and disclosure in relation to compliance with share by default provisions Item Column 1 Column 2 Column 3 Column 4 Entity Permitted action Information Circumstances 1 participant in the My Health Record system use identifying information about any of the following: the use or disclosure is for the purposes of compliance with a share by default provision disclose (a) a healthcare recipient; (b) a healthcare provider the healthcare identifier of any of the following: (a) a healthcare recipient; (b) a healthcare provider 2 Secretary of the Department collect identifying information about any of the following: the collection, use or disclosure is for the purposes of monitoring, investigating or enforcing compliance with a share by default provision use (a) a healthcare recipient; disclose (b) a healthcare provider the healthcare identifier of any of the following: (a) a healthcare recipient; (b) a healthcare provider 3 Chief Executive Medicare collect identifying information about any of the following: the collection, use or disclosure is for the purposes of monitoring, investigating or enforcing compliance with a share by default provision use (a) a healthcare recipient; disclose (b) a healthcare provider the healthcare identifier of any of the following: (a) a healthcare recipient; (b) a healthcare provider 4 service operator for the purposes of the Healthcare identifiers Act 2010 collect identifying information about any of the following: the collection, use or disclosure is for the purposes of monitoring, investigating or enforcing compliance with a share by default provision use (a) a healthcare recipient; disclose (b) a healthcare provider the healthcare identifier of any of the following: (a) a healthcare recipient; (b) a healthcare provider 5 any Commonwealth entity (within the meaning of the Public Governance, Performance and Accountability Act 2013) specified in the My Health Records Rules collect identifying information about any of the following: the collection, use or disclosure is for the purposes of monitoring, investigating or enforcing compliance with a share by default provision use (a) a healthcare recipient; disclose (b) a healthcare provider the healthcare identifier of any of the following: (a) a healthcare recipient; (b) a healthcare provider 15 After section 76 Insert: 76A Requirement to notify if healthcare provider organisation ceases to be able to meet conditions on registration A registered healthcare provider organisation must give written notice to the System Operator within 14 days of ceasing to be able to comply with the conditions of the healthcare provider organisation's registration. Civil penalty: 1,500 penalty units. 16 At the end of Part 5 Add: 78A Some information must be shared with the My Health Record system unless exception applies Civil penalties (1) If: (a) a prescribed healthcare provider organisation is: (i) a registered healthcare provider organisation; or (ii) an approved registered repository operator; and (b) healthcare of a kind specified in the My Health Records Rules for the healthcare provider organisation is provided to a healthcare recipient; the healthcare provider organisation must share with the My Health Record system within the period specified in the My Health Records Rules the information specified in the My Health Records Rules for the kind of healthcare. Civil penalty: 30 penalty units. (2) If: (a) a prescribed healthcare provider organisation is: (i) a registered healthcare provider organisation; or (ii) an approved registered repository operator; and (b) a record of a kind specified in the My Health Records Rules for the healthcare provider organisation is created in relation to healthcare provided to a healthcare recipient; the healthcare provider organisation must share with the My Health Record system within the period specified in the My Health Records Rules the information specified in the My Health Records Rules for the kind of record. Civil penalty: 30 penalty units. Exceptions (3) Subsections (1) and (2) do not apply if: (a) an upload exception applies in relation to the healthcare provider organisation sharing the information with the My Health Record system; or (b) another entity has shared the information with the My Health Record system; or (c) a law of a State or Territory prescribed by the regulations for the purposes of subsection 41(4) or subclause 9(3) of Schedule 1 prevents the healthcare provider organisation from sharing the information with the My Health Record system; or (d) the information is specified in the My Health Records Rules; or (e) the healthcare provider organisation is specified in the My Health Records Rules; or (f) the period within which the information is required to be shared with the My Health Record system ends: (i) during any upload suspension period determined under subsection (4); or (ii) during the period starting when the healthcare provider organisation applies to the System Operator under section 78B and ending when the application is finally determined; or (iii) during a period approved by the System Operator under section 78B in relation to the healthcare provider organisation; or (iv) during the period starting when the healthcare provider organisation applies to the System Operator under section 19AE of the Health Insurance Act 1973 and ending when the application is resolved (within the meaning of that Act); or (v) during a period approved by the System Operator under section 19AE of the Health Insurance Act 1973 in relation to the healthcare provider organisation. Note 1: For when an upload exception applies, see section 10B. Note 2: A person who wishes to rely on subsection (3) in proceedings for a civil penalty order bears an evidential burden in relation to the matters in that subsection: see section 96 of the Regulatory Powers Act. (4) The Secretary of the Department may, by legislative instrument, determine that a period is an upload suspension period. (5) Without limiting this section or subsection 33(3A) of the Acts Interpretation Act 1901, the My Health Records Rules made for the purposes of subsections (1) and (2) may specify different periods for different healthcare provider organisations or different kind