Handles health records, in Australia

My Health Records Act 2012 (Cth), No. 63, 2012, ss. 59 and 73 · Read the law's page

• Do not collect health information from the My Health Record system, or use or disclose health information obtained through it, where the act is not authorised under Division 2 of Part 4 and you know or are reckless as to that fact (section 59).

Security of Critical Infrastructure Act 2018 (Cth), Part 2B, ss. 30BB-30BD and 30BEA; Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022, s. 5 · Read the law's page

• This binds the responsible entity for a critical infrastructure asset to which Part 2B of the Security of Critical Infrastructure Act 2018 applies: an asset the Application Rules specify (among them a critical banking, superannuation, insurance, financial market infrastructure, hospital, electricity, gas, water, data storage or processing or telecommunications asset owned or operated by a carrier), or an asset the Minister has declared under section 51 (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecommunications services).
• Give the relevant Commonwealth body a report about the incident as soon as practicable, and in any event within 12 hours after you become aware that a cyber security incident has occurred or is occurring and has had, or is having, a significant impact on the availability of the asset (section 30BC(1)). The report may be given orally or in writing.
• If you give the report orally, make a written record of it in the approved form and give a copy to the relevant Commonwealth body within 84 hours after you give the report (section 30BC(3)).
• Give the relevant Commonwealth body a report as soon as practicable, and in any event within 72 hours after you become aware that a cyber security incident has occurred, is occurring or is imminent and has had, is having or is likely to have a relevant impact on the asset (section 30BD(1)).

Security of Critical Infrastructure Act 2018 (Cth), Part 2A, ss. 30AB-30AD; Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023, ss. 4 and 8 · Read the law's page

• This binds the responsible entity for a critical infrastructure asset to which Part 2A of the Security of Critical Infrastructure Act 2018 applies: an asset the Critical infrastructure risk management program Rules specify (a critical electricity, gas, water, liquid fuel, food and grocery, freight, broadcasting, data storage or processing or domain name system asset, a critical energy market operator asset, a designated hospital, or a critical financial market infrastructure asset used in connection with the operation of a payment system), or an asset the Minister has declared under section 51 (reached by declaring that you operate an essential service, handle health records or provide financial services).
• Adopt and maintain a written critical infrastructure risk management program that applies to you (section 30AC).
• Comply with the program you have adopted, and review it on a regular basis (sections 30AD and 30AE).
• In the program, identify each hazard with a material risk of a relevant impact on the asset and, so far as it is reasonably practicable, minimise or eliminate that risk and mitigate its impact (section 30AH(1)).
• In the program, establish and maintain a process or system to minimise or eliminate any material risk of a cyber and information security hazard occurring, and to mitigate its relevant impact on the asset, as far as it is reasonably practicable (Rules, section 8(2)).
• Within 12 months after the end of the period in section 4(2) of the Rules, comply with a framework in the Rules' table (AS ISO/IEC 27001:2015, the Essential Eight Maturity Model at maturity level one, the NIST Framework for Improving Critical Infrastructure Cybersecurity, the C2M2 at Maturity Indicator Level 1, or the AESCSF at Security Profile 1) or with an equivalent framework (Rules, section 8(3) to (5)).