AustraliaMy Health Records Act 2012 (Cth), Unauthorized Collection, Use and Disclosure of My Health Record Information
My Health Records Act 2012 (Cth), No. 63, 2012, ss. 59 and 73
In force since .
A sensitive categories rule binding public and private bodies.
- Enforcement body
- Office of the Australian Information Commissioner (OAIC)
- Audit expectation
- none
What it requires
- Do not collect health information from the My Health Record system, or use or disclose health information obtained through it, where the act is not authorised under Division 2 of Part 4 and you know or are reckless as to that fact (section 59).
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 59(3) makes an unauthorised collection, use or disclosure of health information from a My Health Record, done knowing or reckless as to that fact, an offence punishable by imprisonment for 5 years or 300 penalty units, or both.
What it makes you log
Logging duty
Sections 59 and 73 prohibit unauthorised collection, use and disclosure of My Health Record information and treat a contravention as an interference with privacy. Neither section states a duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Section 59 of the My Health Records Act 2012 prohibits collecting, using or disclosing health information from a healthcare recipient's My Health Record where the act is not authorized and the person knows or is reckless as to that fact. The offence carries imprisonment for 5 years or 300 penalty units, or both. A civil penalty of 1,500 penalty units applies to the same conduct.
An act or practice that contravenes the Act in connection with health information in a My Health Record is taken to be an interference with the privacy of the healthcare recipient for the purposes of the Privacy Act 1988. Sections 3 to 112 of the Act commenced on .
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .