Commonwealth: Health Legislation Amendment (Modernising My Health Record—Sharing by Default) Act 2025 (Cth)

Health Legislation Amendment (Modernising My Health Record—Sharing by Default) Act 2025 No. 8, 2025 An Act to amend the law relating to electronic health records and medicare benefits, and for other purposes Contents 1 Short title 2 Commencement 3 Schedules Schedule 1—Main amendments Part 1—My Health Records My Health Records Act 2012 Part 2—Medicare benefits Division 1—Amendments Health Insurance Act 1973 Division 2—Amendments commencing if the Health Insurance Legislation Amendment (Assignment of Medicare Benefits) Act 2024 does not commence Health Insurance Act 1973 Division 3—Amendments commencing if the Health Insurance Legislation Amendment (Assignment of Medicare Benefits) Act 2024 commences Health Insurance Act 1973 Division 4—Amendments commencing if the Administrative Review Tribunal (Miscellaneous Measures) Act 2025 commences Health Insurance Act 1973 Schedule 2—Other amendments A New Tax System (Goods and Services Tax) Act 1999 Fringe Benefits Tax Assessment Act 1986 Health Insurance Act 1973 National Health Act 1953 National Health Reform Act 2011 Private Health Insurance Act 2007 Health Legislation Amendment (Modernising My Health Record—Sharing by Default) Act 2025 No. 8, 2025 An Act to amend the law relating to electronic health records and medicare benefits, and for other purposes [Assented to 14 February 2025] The Parliament of Australia enacts: 1 Short title This Act is the Health Legislation Amendment (Modernising My Health Record—Sharing by Default) Act 2025. 2 Commencement (1) Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms. Commencement information Column 1 Column 2 Column 3 Provisions Commencement Date/Details 1. Sections 1 to 3 and anything in this Act not elsewhere covered by this table The day this Act receives the Royal Assent. 14 February 2025 2. Schedule 1, Part 1 The day after this Act receives the Royal Assent. 15 February 2025 3. Schedule 1, Part 2, Division 1 The day after this Act receives the Royal Assent. 15 February 2025 4. Schedule 1, Part 2, Division 2 The day after this Act receives the Royal Assent. 15 February 2025 However, the provisions do not commence at all if Schedule 1 to the Health Insurance Legislation Amendment (Assignment of Medicare Benefits) Act 2024 commences on or before that day. 5. Schedule 1, Part 2, Division 3 The later of: (a) the start of the day after this Act receives the Royal Assent; and (b) immediately after the commencement of Schedule 1 to the Health Insurance Legislation Amendment (Assignment of Medicare Benefits) Act 2024. 6. Schedule 1, Part 2, Division 4 The later of: 21 February 2025 (a) immediately after the commencement of the provisions covered by table item 3; and (paragraph (b) applies) (b) the commencement of Schedule 2 to the Administrative Review Tribunal (Miscellaneous Measures) Act 2025. 7. Schedule 2 The day after this Act receives the Royal Assent. 15 February 2025 Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act. (2) Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act. 3 Schedules Legislation that is specified in a Schedule to this Act is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this Act has effect according to its terms. Schedule 1—Main amendments Part 1—My Health Records My Health Records Act 2012 1 Section 3 Omit "voluntary national public system for the provision of access to health information relating to recipients of healthcare", substitute "national public system for the provision of access to health information relating to recipients of healthcare that is voluntary for those recipients". 2 Section 4 (paragraph beginning "If a healthcare recipient is registered") After "a healthcare provider may", insert "(or, in some circumstances, must)". 3 Section 5 Insert: approved registered repository operator means a healthcare provider organisation that: (a) is a registered repository operator; and (b) satisfies the requirements (if any) specified in the My Health Records Rules. finally determined: see section 10C. prescribed healthcare provider organisation means a healthcare provider organisation that is: (a) a corporation to which paragraph 51(xx) of the Constitution applies; and (b) of a kind specified in the My Health Records Rules. share by default provision: each of the following is a share by default provision: (a) section 41A (prescribed healthcare provider organisations must be registered); (b) section 78A (some information must be shared with the My Health Record system unless exception applies); (c) section 78C (record keeping requirements in relation to sharing information with the My Health Record system); (d) section 78D (prescribed healthcare provider organisations must display notice when not sharing information with the My Health Record system); (e) section 19AD (medicare benefits not payable in respect of certain professional services) of the Health Insurance Act 1973; (f) section 19AF (record keeping requirement) of the Health Insurance Act 1973; (g) section 19AG (advance payment before information is shared with the My Health Record system) of the Health Insurance Act 1973; (h) section 19AH (recovery of payments) of the Health Insurance Act 1973. shares with the My Health Record system: see section 10A. upload exception applies: see section 10B. 4 After section 10 Insert: 10A Sharing information with the My Health Record system (1) An entity other than an approved registered repository operator shares with the My Health Record system information if the entity uploads, for the purposes of the My Health Record system, the information to: (a) a repository that forms part of the National Repositories Service; or (b) a repository to which a registered repository operator's registration relates. (2) An approved registered repository operator shares with the My Health Record system information if the registered repository operator: (a) uploads, for the purposes of the My Health Record system, the information to a repository that forms part of the National Repositories Service; or (b) takes, in relation to the information, the action specified in the My Health Records Rules. 10B When an upload exception applies An upload exception applies in relation to an entity sharing with the My Health Record system information about healthcare provided to an individual if: (a) the individual is not a registered healthcare recipient; or (b) either: (i) the individual, or an authorised representative or nominated representative of the individual, has advised the entity; or (ii) the entity has otherwise been informed that the individual, or an authorised representative or nominated representative of the individual, has advised; that the information must not be uploaded to the My Health Record system; or (c) an individual healthcare provider reasonably believes that the information should not be shared with the My Health Record system because of a serious concern for the health, safety or wellbeing of the individual; or (d) the information cannot be shared with the My Health Record system due to circumstances beyond the reasonable control of the entity. 10C When an application is finally determined (1) An application under section 41B, 42 or 78B is finally determined when the System Operator has made a decision (the original decision) on the application and: (a) the original decision is to approve the application; or (b) no notice of the original decision is given because subsection 97(2A) applies; or (c) no notice asking the System Operator to reconsider the original decision is given within the period mentioned in subsection 97(4); or (d) all of the following apply: (i) a notice asking the System Operator to reconsider the original decision is given within the period mentioned in subsection 97(4); (ii) the System Operator reconsiders the original decision; (iii) no application is made to the Administrative Review Tribunal within the period mentioned in section 18 of the Administrative Review Tribunal Act 2024 for review of the System Operator's reconsideration decision; or (e) an application is made to the Administrative Review Tribunal within the period mentioned in section 18 of the Administrative Review Tribunal Act 2024 for review of the System Operator's reconsideration of the original decision, the Administrative Review Tribunal decides the application and one of the following applies: (i) subsection 123(1) of that Act does not apply in relation to the Administrative Review Tribunal's decision; (ii) no application is made under section 123 of that Act within the period mentioned in section 125 of that Act to refer the Administrative Review Tribunal's decision to the guidance and appeals panel; (iii) any application that is made under section 123 of that Act within the period mentioned in section 125 of that Act to refer the Administrative Review Tribunal's decision to the guidance and appeals panel is refused; or (f) both of the following apply: (i) the President of the Administrative Review Tribunal refers the Administrative Review Tribunal's decision on the application for review of the System Operator's reconsideration of the original decision to the guidance and appeals panel under section 123 of the Administrative Review Tribunal Act 2024; (ii) the Administrative Review Tribunal makes a decision on the guidance and appeals panel application (within the meaning of the Administrative Review Tribunal Act 2024) taken to be made because of the referral. (2) An application under section 41B or 78B is finally determined when the System Operator ceases to consider the application under subsection 41B(4) or 78B(4). 5 After Division 1 of Part 3 Insert: Division 1A—Healthcare provider organisations that are required to be registered 41A Prescribed healthcare provider organisations must be registered (1) A prescribed healthcare provider organisation contravenes this subsection if the healthcare provider organisation is not a registered healthcare provider organisation and is not an approved registered repository operator. Civil penalty: 250 penalty units. (2) However, subsection (1) does not apply: (a) during any period starting when the healthcare provider organisation applies to the System Operator under section 41B or 42 and ending when the application is finally determined; or (b) during any period approved by the System Operator under section 41B in relation to the healthcare provider organisation. Note: A person who wishes to rely on subsection (2) in proceedings for a civil penalty order bears an evidential burden in relation to the matters in that subsection: see section 96 of the Regulatory Powers Act. 41B System Operator may approve a period during which registration is not required Application (1) A healthcare provider organisation may apply to the System Operator to approve a period during which subsection 41A(1) does not apply to the healthcare provider organisation. (2) The application must: (a) be in the approved form; and (b) include, or be accompanied by, the information and documents required by the form; and (c) be lodged at a place, or by a means, specified in the form. Further information may be required (3) If a healthcare provider organisation makes an application under subsection (1), the System Operator may, by notice in writing, require the healthcare provider organisation to give the System Operator, within the period specified in the notice, such further information in relation to the application as the System Operator requires. (4) The System Operator is not required to decide the application, and may cease considering the application, if the healthcare provider organisation does not provide the required information within the period specified in the notice. Approval by System Operator (5) On application under subsection (1) or on the System Operator's initiative, the System Operator may, by written notice to a healthcare provider organisation, approve a period during which subsection 41A(1) does not apply to the healthcare provider organisation. (6) In deciding whether to approve the period, the System Operator must take into account the following: (a) the healthcare provider organisation's size and technological readiness; (b) the potential disruption (if any) to the provision of healthcare if the healthcare provider organisation is not a registered healthcare provider organisation; (c) any other matter the System Operator considers relevant. (7) An approval under subsection (5) is not a legislative instrument. 6 Paragraph 43(b) Omit "Rules; and", substitute "Rules.". 7 Paragraph 43(c) Repeal the paragraph. 8 After subsection 51(3) Insert: (3A) The System Operator may, in writing, decide to cancel or suspend the registration of a healthcare provider organisation if the System Operator is not satisfied that the healthcare provider organisation is able to comply with the conditions of the healthcare provider organisation's registration. 9 Subsection 51(5) After "(3)", insert "or (3A)". 10 Paragraphs 53(1)(a) and (4)(a) After "(3),", insert "(3A),". 11 After paragraph 54(a) Insert: (ab) if the entity is a registered healthcare provider organisation or registered repository operator—the entity is taken not to be registered for the purposes of paragraph (a) of the definition of approved registered repository operator in section 5 and sections 10A, 41A, 78A, 78C and 78D; and 12 After subparagraph 69(1)(b)(ii) Insert: (iia) a share by default provision; or 13 At the end of Subdivision B of Division 2 of Part 4 Add: 70AA Collection, use and disclosure in relation to compliance with share by default provisions (1) Subject to section 69, the System Operator is authorised to collect, use and disclose to a person covered by subsection (2) information covered by subsection (3) for the purposes of monitoring, investigating or enforcing compliance with a share by default provision. (2) This subsection covers the following persons: (a) the Chief Executive Medicare; (b) the Secretary of the Department; (c) a Commonwealth entity (within the meaning of the Public Governance, Performance and Accountability Act 2013) (if any) specified in the My Health Records Rules. (3) This subsection covers health information that is: (a) included in a healthcare recipient's My Health Record; and (b) of a kind specified in the My Health Records Rules. (4) Subsection (1) does not authorise the System Operator to collect, use or disclose healthcare recipient‑only notes. 14 At the end of Part 4 Add: Division 5—Authorised collection, use and disclosure for compliance purposes 73C Collection, use and disclosure of health information in relation to compliance with share by default provisions (1) A person covered by subsection (2) is authorised to collect, use and disclose, for the purposes of monitoring, investigating or enforcing compliance with a share by default provision, health information disclosed to the person under section 70AA. (2) This subsection covers the following persons: (a) the Chief Executive Medicare; (b) the Secretary of the Department; (c) a Commonwealth entity (within the meaning of the Public Governance, Performance and Accountability Act 2013) (if any) specified in the My Health Records Rules for the purposes of paragraph 70AA(2)(c). 73D Collection, use and disclosure of healthcare identifiers and identifying information in relation to compliance with share by default provisions (1) An entity mentioned in column 1 of an item of the following table is authorised to take action of the kind described in column 2 of that item with information of the kind described in column 3 of that item in the circumstances described in column 4 of that item. Collection, use and disclosure in relation to compliance with share by default provisions Item Column 1 Column 2 Column 3 Column 4 Entity Permitted action Information Circumstances 1 participant in the My Health Record system use identifying information about any of the following: the use or disclosure is for the purposes of compliance with a share by default provision disclose (a) a healthcare recipient; (b) a healthcare provider the healthcare identifier of any of the following: (a) a healthcare recipient; (b) a healthcare provider 2 Secretary of the Department collect identifying information about any of the following: the collection, use or disclosure is for the purposes of monitoring, investigating or enforcing compliance with a share by default provision use (a) a healthcare recipient; disclose (b) a healthcare provider the healthcare identifier of any of the following: (a) a healthcare recipient; (b) a healthcare provider 3 Chief Executive Medicare collect identifying information about any of the following: the collection, use or disclosure is for the purposes of monitoring, investigating or enforcing compliance with a share by default provision use (a) a healthcare recipient; disclose (b) a healthcare provider the healthcare identifier of any of the following: (a) a healthcare recipient; (b) a healthcare provider 4 service operator for the purposes of the Healthcare identifiers Act 2010 collect identifying information about any of the following: the collection, use or disclosure is for the purposes of monitoring, investigating or enforcing compliance with a share by default provision use (a) a healthcare recipient; disclose (b) a healthcare provider the healthcare identifier of any of the following: (a) a healthcare recipient; (b) a healthcare provider 5 any Commonwealth entity (within the meaning of the Public Governance, Performance and Accountability Act 2013) specified in the My Health Records Rules collect identifying information about any of the following: the collection, use or disclosure is for the purposes of monitoring, investigating or enforcing compliance with a share by default provision use (a) a healthcare recipient; disclose (b) a healthcare provider the healthcare identifier of any of the following: (a) a healthcare recipient; (b) a healthcare provider 15 After section 76 Insert: 76A Requirement to notify if healthcare provider organisation ceases to be able to meet conditions on registration A registered healthcare provider organisation must give written notice to the System Operator within 14 days of ceasing to be able to comply with the conditions of the healthcare provider organisation's registration. Civil penalty: 1,500 penalty units. 16 At the end of Part 5 Add: 78A Some information must be shared with the My Health Record system unless exception applies Civil penalties (1) If: (a) a prescribed healthcare provider organisation is: (i) a registered healthcare provider organisation; or (ii) an approved registered repository operator; and (b) healthcare of a kind specified in the My Health Records Rules for the healthcare provider organisation is provided to a healthcare recipient; the healthcare provider organisation must share with the My Health Record system within the period specified in the My Health Records Rules the information specified in the My Health Records Rules for the kind of healthcare. Civil penalty: 30 penalty units. (2) If: (a) a prescribed healthcare provider organisation is: (i) a registered healthcare provider organisation; or (ii) an approved registered repository operator; and (b) a record of a kind specified in the My Health Records Rules for the healthcare provider organisation is created in relation to healthcare provided to a healthcare recipient; the healthcare provider organisation must share with the My Health Record system within the period specified in the My Health Records Rules the information specified in the My Health Records Rules for the kind of record. Civil penalty: 30 penalty units. Exceptions (3) Subsections (1) and (2) do not apply if: (a) an upload exception applies in relation to the healthcare provider organisation sharing the information with the My Health Record system; or (b) another entity has shared the information with the My Health Record system; or (c) a law of a State or Territory prescribed by the regulations for the purposes of subsection 41(4) or subclause 9(3) of Schedule 1 prevents the healthcare provider organisation from sharing the information with the My Health Record system; or (d) the information is specified in the My Health Records Rules; or (e) the healthcare provider organisation is specified in the My Health Records Rules; or (f) the period within which the information is required to be shared with the My Health Record system ends: (i) during any upload suspension period determined under subsection (4); or (ii) during the period starting when the healthcare provider organisation applies to the System Operator under section 78B and ending when the application is finally determined; or (iii) during a period approved by the System Operator under section 78B in relation to the healthcare provider organisation; or (iv) during the period starting when the healthcare provider organisation applies to the System Operator under section 19AE of the Health Insurance Act 1973 and ending when the application is resolved (within the meaning of that Act); or (v) during a period approved by the System Operator under section 19AE of the Health Insurance Act 1973 in relation to the healthcare provider organisation. Note 1: For when an upload exception applies, see section 10B. Note 2: A person who wishes to rely on subsection (3) in proceedings for a civil penalty order bears an evidential burden in relation to the matters in that subsection: see section 96 of the Regulatory Powers Act. (4) The Secretary of the Department may, by legislative instrument, determine that a period is an upload suspension period. (5) Without limiting this section or subsection 33(3A) of the Acts Interpretation Act 1901, the My Health Records Rules made for the purposes of subsections (1) and (2) may specify different periods for different healthcare provider organisations or different kinds of healthcare or record. 78B System Operator may approve a period during which sharing with the My Health Record system is not required Application (1) A prescribed healthcare provider organisation may apply to the System Operator to approve a period during which the healthcare provider organisation is not required to share information with the My Health Record system. (2) The application must: (a) be in the approved form; and (b) include, or be accompanied by, the information and documents required by the form; and (c) be lodged at a place, or by a means, specified in the form. Further information may be required (3) If a prescribed healthcare provider organisation makes an application under subsection (1), the System Operator may, by notice in writing, require the healthcare provider organisation to give the System Operator, within the period specified in the notice, such further information in relation to the application as the System Operator requires. (4) The System Operator is not required to decide the application, and may cease considering the application, if the healthcare provider organisation does not provide the required information within the period specified in the notice. Approval by System Operator (5) On application under subsection (1) or on the System Operator's initiative, the System Operator may, by written notice to a prescribed healthcare provider organisation, approve a period during which the healthcare provider organisation is not required to share information with the My Health Record system. (6) In deciding whether to approve the period, the System Operator must take into account the following: (a) the healthcare provider organisation's size and technological readiness; (b) the potential disruption (if any) to the provision of healthcare if the healthcare provider organisation does not share information with the My Health Record system; (c) any other matter the System Operator considers relevant. (7) An approval under subsection (5) is not a legislative instrument. 78C Record keeping requirements in relation to sharing information with the My Health Record system Requirement to keep evidence of upload exceptions (1) If: (a) a prescribed healthcare provider organisation is: (i) a registered healthcare provider organisation; or (ii) an approved registered repository operator; and (b) either: (i) healthcare of a kind specified in the My Health Records Rules for the purposes of subsection 78A(1) for the healthcare provider organisation is provided to a healthcare recipient; or (ii) a record of a kind specified in the My Health Records Rules for the purposes of subsection 78A(2) for the healthcare provider organisation is created in relation to healthcare provided to a healthcare recipient; and (c) an upload exception applies in relation to the healthcare provider organisation sharing information about the healthcare with the My Health Record system; the healthcare provider organisation must keep for a period of 2 years starting on the date the healthcare is provided evidence that an upload exception applied that meets the requirements (if any) specified in the My Health Records Rules. Civil penalty: 10 penalty units. (2) Subsection (1) does not apply if the healthcare provider organisation has a reasonable excuse. Note: A person who wishes to rely on subsection (2) in proceedings for a civil penalty order bears an evidential burden in relation to the matter in that subsection: see section 96 of the Regulatory Powers Act. Requirement to produce evidence when required (3) The System Operator or the Secretary of the Department may, by written notice given to a healthcare provider organisation, require the healthcare provider organisation to produce to the System Operator or the Secretary of the Department, within the period and in the manner specified in the notice, evidence kept by the healthcare provider organisation under subsection (1). (4) A healthcare provider organisation must comply with a requirement under subsection (3). Civil penalty: 10 penalty units. Handling of evidence produced (5) The System Operator or the Secretary of the Department may make and retain copies of, or take and retain extracts from, any evidence produced under this section. (6) The System Operator or the Secretary of the Department may take, and retain for as long as is necessary, possession of evidence produced under this section. (7) The person otherwise entitled to possession of the evidence is entitled to be supplied, as soon as practicable, with a copy certified by the System Operator or the Secretary of the Department to be a true copy. (8) The certified copy must be received in all courts and tribunals as evidence as if it were the original. (9) Until a certified copy is supplied, the System Operator or the Secretary of the Department must, at such times and places as the System Operator or the Secretary of the Department thinks appropriate, permit the person otherwise entitled to possession of the evidence, or a person authorised by that person, to inspect and make copies of, or take extracts from, the evidence. 78D Prescribed healthcare provider organisations must display notice when not sharing information with the My Health Record system (1) A prescribed healthcare provider organisation must display a notice in accordance with subsection (2) during the following periods: (a) a period for which the healthcare provider organisation is not a registered healthcare provider organisation and is not an approved registered repository operator; (b) a period starting when the healthcare provider organisation applies to the System Operator under section 78B and ending when the application is finally determined; (c) a period approved by the System Operator under section 78B in relation to the healthcare provider organisation; (d) a period starting when the healthcare provider organisation applies to the System Operator under section 19AE of the Health Insurance Act 1973 and ending when the application is resolved (within the meaning of that Act); (e) a period approved by the System Operator under section 19AE of the Health Insurance Act 1973 in relation to the healthcare provider organisation. Civil penalty: 10 penalty units. (2) The notice must: (a) indicate that the healthcare provider organisation is not currently sharing information with the My Health Record system; and (b) if paragraph (1)(a) applies—indicate that medicare benefits will not be payable in respect of healthcare covered by subsection (3); and (c) be displayed in a prominent place: (i) at each of the healthcare provider organisation's premises where healthcare covered by subsection (3) is provided; and (ii) on the healthcare provider organisation's website; and (iii) on any online facility the healthcare provider organisation uses to allow healthcare recipients to arrange bookings for healthcare covered by subsection (3). (3) For the purposes of subsection (2), this subsection covers: (a) healthcare of a kind (if any) specified for the purposes of subsection 78A(1) for the healthcare provider organisation; and (b) healthcare to which records of a kind (if any) specified for the purposes of subsection 78A(2) for the healthcare provider organisation relate. 17 Subsection 79(2) Repeal the subsection, substitute: Authorised applicant (2) For the purposes of Part 4 of the Regulatory Powers Act, each person mentioned in column 1 of an item of the following table is an authorised applicant in relation to a provision mentioned in column 2 of the item: Authorised applicants Item Column 1 Column 2 Authorised applicant Provisions 1 Information Commissioner (a) subsection 59(1); (b) subsection 59(2); (c) subsection 59(4); (d) subsection 59A(1); (e) subsection 60(1); (f) subsection 60(4); (g) subsection 71B(1); (h) subsection 74(1); (i) subsection 75(2); (j) subsection 77(1); (k) subsection 77(2B); (l) subsection 78(1); (m) subsection 78(2); (n) a civil penalty provision of the regulations. 2 Secretary of the Department (a) subsection 41A(1); (b) section 76; (c) section 76A; (d) subsection 78A(1); (e) subsection 78A(2); (f) subsection 78C(1); (g) subsection 78C(4); (h) subsection 78D(1). (2A) The Secretary of the Department may, in writing, delegate the Secretary's powers and functions under Part 4 of the Regulatory Powers Act in relation to the provisions mentioned in item 2 of the table in subsection (2) to an SES employee, or acting SES employee, in the Department. (2B) A person exercising powers or performing functions under a delegation under subsection (2A) must comply with any directions of the Secretary of the Department. 18 After Division 1 of Part 6 Insert: Division 1A—Infringement notices 79A Infringement notices Provisions subject to an infringement notice (1) The following provisions are subject to an infringement notice under Part 5 of the Regulatory Powers Act: (a) subsection 41A(1); (b) subsection 78C(4); (c) subsection 78D(1). Note: Part 5 of the Regulatory Powers Act creates a framework for using infringement notices in relation to provisions. Infringement officer (2) For the purposes of Part 5 of the Regulatory Powers Act, an SES employee, or acting SES employee, in the Department authorised, in writing, by the Secretary of the Department for the purposes of this subsection is an infringement officer in relation to the provisions mentioned in subsection (1). Relevant chief executive (3) For the purposes of Part 5 of the Regulatory Powers Act, the Secretary of the Department is the relevant chief executive in relation to the provisions mentioned in subsection (1). (4) The relevant chief executive may, in writing, delegate the relevant chief executive's powers and functions under Part 5 of the Regulatory Powers Act in relation to the provisions mentioned in subsection (1) to an SES employee, or acting SES employee, in the Department. (5) A person exercising powers or performing functions under a delegation under subsection (4) must comply with any directions of the relevant chief executive. Extension to external Territories (6) Part 5 of the Regulatory Powers Act, as that Part applies in relation to the provisions mentioned in subsection (1), extends to every external Territory. 19 At the end of subsection 80(2) Add: ; (c) the Secretary of the Department. 20 At the end of subsection 81(2) Add: ; (c) the Secretary of the Department. 21 After paragraph 97(1)(b) Insert: (ba) a decision under section 41B to refuse an application to approve a period; 22 Paragraph 97(1)(c) Omit "health", substitute "healthcare". 23 At the end of subsection 97(1) Add: ; (j) a decision under section 78B to refuse an application to approve a period. 24 Application provisions (1) The amendments of section 43 of the My Health Records Act 2012 made by this Schedule apply in relation to any application made after the commencement of this item. (2) The amendments of sections 51, 53 and 54 of the My Health Records Act 2012 made by this Schedule apply in relation to any registration of a healthcare recipient or other entity that is in effect after the commencement of this item. (3) Sections 70AA and 73C of the My Health Records Act 2012, as inserted by this Schedule, apply in relation to health information created after the commencement of this item. (4) Section 76A of the My Health Records Act 2012, as inserted by this Schedule, applies in relation to any registration of a healthcare provider organisation that is in effect after the commencement of this item. (5) Section 78A of the My Health Records Act 2012, as inserted by this Schedule, applies in relation to any information created after the commencement of this item. (6) The amendments of section 79 of the My Health Records Act 2012 made by this Schedule apply in relation to any application under section 82 of the Regulatory Powers Act in relation to a civil penalty provision of the My Health Records Act 2012 made after the commencement of this item. Part 2—Medicare benefits Division 1—Amendments Health Insurance Act 1973 25 Subsection 3(1) Insert: associate, of a person in relation to a professional service: see subsection 19AD(4). authorised representative has the same meaning as in the My Health Records Act 2012. My Health Record system has the same meaning as in the My Health Records Act 2012. My Health Record System Operator means the System Operator within the meaning of the My Health Records Act 2012. nominated representative has the same meaning as in the My Health Records Act 2012. resolved, in relation to an application under section 19AE: see subsections 19AE(10) and (11). shares with the My Health Record system has the same meaning as in the My Health Records Act 2012. upload exception applies: see subsection 19AD(3). upload rules: see section 19AI. 26 After section 19AC Insert: 19AD My Health Record—medicare benefits not payable in respect of certain professional services (1) Medicare benefit is not payable in respect of a professional service specified in the upload rules rendered by or on behalf of a person specified for the service in the upload rules unless the person shares with the My Health Record system within the period specified in the upload rules the information specified in the upload rules for the service. (2) Subsection (1) does not apply if: (a) an upload exception applies in relation to the person sharing the information with the My Health Record system; or (b) another entity (within the meaning of the My Health Records Act 2012) has shared the information with the My Health Record system; or (c) a law of a State or Territory prescribed by regulations for the purposes of subsection 41(4) of, or subclause 9(3) of Schedule 1 to, the My Health Records Act 2012 prevents the person or any associate of the person for the service from sharing the information with the My Health Record system; or (d) the information is specified in My Health Records Rules made for the purposes of paragraph 78A(3)(d) of the My Health Records Act 2012; or (e) the person or an associate of the person for the service is specified in My Health Records Rules made for the purposes of paragraph 78A(3)(e) of the My Health Records Act 2012; or (f) the end of the period specified in the upload rules for the purposes of subsection (1) occurs: (i) during the period starting when the person or an associate of the person for the service applies to the My Health Record System Operator under section 19AE and ending when the application is resolved; or (ii) during a period approved by the My Health Record System Operator under section 19AE in relation to the person or an associate of the person for the service; or (iii) during any upload suspension period determined under subsection 78A(4) of the My Health Records Act 2012; or (iv) during the period starting when the person or an associate of the person for the service applies to the My Health Record System Operator under section 41B, 42 or 78B of that Act and ending when the application is finally determined (within the meaning of that Act); or (v) during the period approved by the My Health Record System Operator under section 41B or 78B of that Act in relation to the person or an associate of the person for the service. (3) An upload exception applies in relation to a person sharing with the My Health Record system information about a professional service rendered to an individual if: (a) the individual is not a registered healthcare recipient (within the meaning of the My Health Records Act 2012); or (b) either: (i) the individual, or an authorised representative or nominated representative of the individual, has advised the person or an associate of the person for the service; or (ii) the person or an associate of the person for the service has otherwise been informed that the individual, or an authorised representative or nominated representative of the individual, has advised; that the information must not be uploaded to the My Health Record system; or (c) an individual healthcare provider (within the meaning of the My Health Records Act 2012) reasonably believes that the information should not be shared with the My Health Record system because of a serious concern for the health, safety or wellbeing of the individual; or (d) the information cannot be shared with the My Health Record system due to circumstances beyond the reasonable control of the person and any associate of the person for the service. (4) A healthcare provider organisation (within the meaning of the My Health Records Act 2012) is an associate of a person in relation to a professional service in the following circumstances: (a) the person renders the service as an employee (within the meaning of the My Health Records Act 2012) of the healthcare provider organisation; (b) another person, as an employee (within the meaning of the My Health Records Act 2012) of the healthcare provider organisation, renders the service on behalf of the person; (c) the healthcare provider organisation provides support services or facilities to facilitate the rendering of the service by or on behalf of the person; (d) the circumstances (if any) specified in the upload rules. (5) Without limiting this section or subsection 33(3A) of the Acts Interpretation Act 1901, upload rules made for the purposes of subsection (1) may specify different periods for different professional services or different kinds of person. 19AE My Health Record—approval of period during which sharing with the My Health Record system is not required Scope (1) This section applies in relation to an entity (within the meaning of the My Health Records Act 2012) that is: (a) a person who renders a professional service for which the person is specified in the upload rules for the purposes of subsection 19AD(1); or (b) a person on whose behalf a professional service for which the person is specified in the upload rules for the purposes of subsection 19AD(1) is rendered; or (c) an associate of a person in relation to a professional service for which the person is specified in the upload rules for the purposes of subsection 19AD(1). Application (2) An entity may apply to the My Health Record System Operator to approve a period during which the entity is not required to share information with the My Health Record system. (3) The application must: (a) be in the form approved, in writing, by the My Health Record System Operator; and (b) include, or be accompanied by, the information and documents required by the form; and (c) be lodged at a place, or by a means, specified in the form. Note: The My Health Record System Operator may approve the same form, and use the same process, for the purposes of this section and section 78B of the My Health Records Act 2012. Further information may be required (4) If an entity makes an application under subsection (2), the My Health Record System Operator may, by notice in writing, require the entity to give the My Health Record System Operator, within the period specified in the notice, such further information in relation to the application as the My Health Record System Operator requires. (5) The My Health Record System Operator is not required to decide the application, and may cease considering the application, if the entity does not provide the required information within the period specified in the notice. Approval by My Health Record System Operator (6) On application under subsection (2) or on the My Health Record System Operator's initiative, the My Health Record System Operator may, by written notice to an entity, approve a period during which the entity is not required to share information with the My Health Record system. (7) In deciding whether to approve the period, the My Health Record System Operator must take into account the following: (a) the entity's size and technological readiness; (b) the potential disruption (if any) to the provision of healthcare if the entity does not share information with the My Health Record system; (c) any other matter the My Health Record System Operator considers relevant. (8) An approval under subsection (6) is not a legislative instrument. Review of decisions (9) Section 97 (review of decisions) of the My Health Records Act 2012 applies to a decision under this section to refuse an application to approve a period. (10) An application under this section is resolved when the My Health Record System Operator has made a decision (the original decision) on the application and: (a) the original decision is to approve the application; or (b) no notice of the original decision is given because subsection 97(2A) of the My Health Records Act 2012 applies; or (c) no notice asking the My Health Record System Operator to reconsider the original decision is given within the period mentioned in subsection 97(4) of the My Health Records Act 2012; or (d) all of the following apply: (i) a notice asking the My Health Record System Operator to reconsider the original decision is given within the period mentioned in subsection 97(4) of the My Health Records Act 2012; (ii) the My Health Record System Operator reconsiders the original decision; (iii) no application is made to the Administrative Review Tribunal within the period mentioned in section 18 of the Administrative Review Tribunal Act 2024 for review of the My Health Record System Operator's reconsideration decision; or (e) an application is made to the Administrative Review Tribunal within the period mentioned in section 18 of the Administrative Review Tribunal Act 2024 for review of the My Health Record System Operator's reconsideration of the original decision, the Administrative Review Tribunal decides the application and one of the following applies: (i) subsection 123(1) of that Act does not apply in relation to the Administrative Review Tribunal's decision; (ii) no application is made under section 123 of that Act within the period mentioned in section 125 of that Act to refer the Administrative Review Tribunal's decision to the guidance and appeals panel; (iii) any application that is made under section 123 of that Act within the period mentioned in section 125 of that Act to refer the Administrative Review Tribunal's decision to the guidance and appeals panel is refused; or (f) both of the following apply: (i) the President of the Administrative Review Tribunal refers the Administrative Review Tribunal's decision on the application for review of the My Health Record System Operator's reconsideration of the original decision to the guidance and appeals panel under section 123 of the Administrative Review Tribunal Act 2024; (ii) the Administrative Review Tribunal makes a decision on the guidance and appeals panel application (within the meaning of the Administrative Review Tribunal Act 2024) taken to be made because of the referral. (11) An application under this section is resolved when the My Health Record System Operator ceases to consider the application under subsection (5). 19AF My Health Record—record keeping requirement Requirement to keep evidence of upload exceptions (1) If: (a) medicare benefit is payable in respect of a professional service specified in the upload rules for the purposes of subsection 19AD(1); and (b) medicare benefit would not have been payable in respect of the service if an upload exception had not applied; the person by or on whose behalf the service was rendered must keep, or ensure another person keeps, for a period of 2 years starting on the day the service was rendered, evidence that an upload exception applied that meets the requirements (if any) specified in the upload rules. Civil penalty: 10 penalty units. (2) Subsection (1) does not apply if the person has a reasonable excuse. Note: A person who wishes to rely on subsection (2) in proceedings for a civil penalty order bears an evidential burden in relation to the matter in that subsection (see section 130H). Requirement to produce evidence when required (3) If the Chief Executive Medicare reasonably believes that a person has possession, custody or control of evidence mentioned in subsection (1) in relation to a professional service, the Chief Executive Medicare may, by written notice given to the person, require the person to produce the evidence to the Chief Executive Medicare or a Departmental employee (within the meaning of the Human Services (Medicare) Act 1973), within the period and in the manner specified in the notice. (4) Subsection (3) does not apply in relation to: (a) the person in respect of whom the service was rendered; or (b) the person who incurred the medical expenses in respect of the service. (5) A person must comply with a requirement under subsection (3). Civil penalty: 10 penalty units. Handling of evidence produced (6) The Chief Executive Medicare or a Departmental employee (within the meaning of the Human Services (Medicare) Act 1973) may make and retain copies of, or take and retain extracts from, any evidence produced under this section. (7) The Chief Executive Medicare or a Departmental employee (within the meaning of the Human Services (Medicare) Act 1973) may take, and retain for as long as is necessary, possession of evidence produced under this section. (8) The person otherwise entitled to possession of the evidence is entitled to be supplied, as soon as practicable, with a copy certified by the Chief Executive Medicare or a Departmental employee (within the meaning of the Human Services (Medicare) Act 1973) to be a true copy. (9) The certified copy must be received in all courts and tribunals as evidence as if it were the original. (10) Until a certified copy is supplied, the Chief Executive Medicare or Departmental employee (within the meaning of the Human Services (Medicare) Act 1973) must, at such times and places as the Chief Executive Medicare or employee thinks appropriate, permit the person otherwise entitled to possession of the evidence, or a person authorised by that person, to inspect and make copies of, or take extracts from, the evidence. 19AG My Health Record—advance payment before information is shared with the My Health Record system Amounts that may become payable under section 10 (1) A payment, on account of an amount that would but for section 19AD be payable under section 10 in respect of a professional service, may be made, on the terms and conditions (if any) determined under subsection (2). (2) The Secretary may, by legislative instrument, determine terms and conditions for payments on account of amounts that would be payable but for section 19AD. (3) A payment on account of an amount that would be payable but for section 19AD is to be made to the person to whom the amount would be paid if it were payable. (4) Making a payment under this section on account of an amount satisfies any requirement for the Chief Executive Medicare on behalf of the Commonwealth to pay the amount. 19AH My Health Record—recovery of payments Scope (1) This section applies in relation to: (a) an amount (a relevant amount) paid under section 19AG on account of an amount that would but for section 19AD be payable under section 10 in respect of a professional service rendered by or on behalf of a person (the service provider); and (b) an amount (a relevant amount) of medicare benefit paid in respect of a professional service specified in the upload rules for the purposes of subsection 19AD(1) rendered by or on behalf of a person (the service provider) specified for the service in the upload rules for the purposes of that subsection. (2) Subsections (3), (4), (6) and (8) apply whether the relevant amount was paid to the service provider or another person. Amounts not payable (3) If, at the end of the period specified in the upload rules for the purposes of subsection 19AD(1), medicare benefit is not payable in respect of the professional service under section 19AD, an amount equal to the relevant amount is recoverable as a debt due to the Commonwealth from the service provider or from the estate of the service provider. Amounts not evidenced (4) If: (a) the service provider is required, by a notice given under subsection 19AF(3), to produce evidence in relation to the professional service; and (b) the service provider does not comply with the requirement within the period set out in the notice; an amount equal to the relevant amount is recoverable as a debt due to the Commonwealth from the service provider or from the estate of the service provider. (5) Subsection (4) does not apply if the service provider satisfies the Chief Executive Medicare that the service provider's non‑compliance is due to circumstances beyond the service provider's control. (6) If: (a) the service provider is required, by a notice given under subsection 19AF(3), to produce evidence in relation to the professional service; and (b) the service provider complies with the requirement within the period set out in the notice; and (c) the evidence produced does not properly substantiate (wholly or partly) that the relevant amount is payable in accordance with section 19AD; then, to the extent that the relevant amount is not properly substantiated, that amount is recoverable as a debt due to the Commonwealth from the service provider or from the estate of the service provider. (7) Subsection (6) does not apply if the service provider satisfies the Chief Executive Medicare that the reason that the evidence produced does not properly substantiate that the relevant amount is payable in accordance with section 19AD is due to circumstances beyond the service provider's control. (8) If: (a) a person (the notice recipient) other than the service provider is required, by a notice given under subsection 19AF(3), to produce evidence in relation to the professional service; and (b) the notice recipient complies with the requirement within the period set out in the notice; and (c) the evidence produced does not properly substantiate (wholly or partly) that the relevant amount is payable in accordance with section 19AD; then, to the extent that the relevant amount is not properly substantiated, that amount is recoverable as a debt due to the Commonwealth from the service provider or from the estate of the service provider. (9) Subsection (8) does not apply if the service provider satisfies the Chief Executive Medicare that the reason that the evidence produced does not properly substantiate that the relevant amount is payable in accordance with section 19AD is due to circumstances beyond the control of the service provider and the notice recipient. General (10) To avoid doubt, for the purposes of this section and sections 129AAH and 129AAJ, the relevant amount is payable in accordance with section 19AD if section 19AD does not prevent payment of medicare benefit in respect of the professional service.