Health Records and Information Privacy Regulation 2022 (NSW)

Part 1Preliminary1Name of Regulation

This Regulation is the Health Records and Information Privacy Regulation 2022.

2Commencement

This Regulation commences on the day on which it is published on the NSW legislation website.

Note—

This Regulation repeals and replaces the Health Records and Information Privacy Regulation 2017, which would otherwise be repealed on 1 September 2022 by the Subordinate Legislation Act 1989, section 10(2).

3Definitions(1)

In this Regulation—

accredited chaplain, in relation to a public hospital or health institution, means a person—

• (a)

  who has been accredited for the purposes of providing chaplaincy services in the hospital or institution by the chief executive of the public health organisation that controls the hospital or institution, and

• (b)

  whose accreditation has not been revoked.

chief executive, in relation to a public health organisation, has the same meaning as in the Health Services Act 1997.

health institution, public health organisation and public hospital have the same meanings as in the Health Services Act 1997.

the Act means the Health Records and Information Privacy Act 2002.

Note—

The Act and the Interpretation Act 1987 contain definitions and other provisions that affect the interpretation and application of this Regulation.

(2)

A reference in this Regulation to a public hospital or health institution controlled by a public health organisation includes a reference to a public hospital or health institution that is conducted by or on behalf of the organisation.

4Definition of “health service”—the Act, s 4

For the Act, section 4(1), definition of health service, paragraph (l), the following are prescribed—

• (a)

  services provided by an accredited chaplain in a public hospital or health institution controlled by a public health organisation,

• (b)

  research services conducted by or on behalf of the following—

  • (i)

    the Ministry of Health,

  • (ii)

    the Health Administration Corporation,

  • (iii)

    a public health organisation,

  • (iv)

    a public hospital,

  • (v)

    the Cancer Institute (NSW),

• (c)

  research services conducted under an agreement with an organisation referred to in paragraph (b),

• (d)

  services provided by the Centre for Health Record Linkage (CHeReL),

• (e)

  services relating to the establishment and operation of the Single Digital Patient Record (the SDPR), including services to—

  • (i)

    provide and control access to the SDPR, and

  • (ii)

    create or manage records in or accessible via the SDPR, including archived records.

s 4: Am 2023 (642), Sch 1; 2025 (240), Sch 1.

Part 2Use or disclosure of health information—the Act, Sch 1, cll 10 and 115Chaplaincy services(1)

For the Act, Schedule 1, clauses 10(1)(k) and 11(1)(l), a public health organisation may use or disclose health information for the secondary purpose of providing the service of an accredited chaplain in a public hospital or health institution controlled by the public health organisation.

(2)

Subsection (1) applies only if the individual to whom the health information relates would reasonably expect the public health organisation to use or disclose the health information for the secondary purpose.

(3)

Subsection (1) applies only to the disclosure of health information if the disclosure is made to an accredited chaplain for the public hospital or health institution.

6Professional misconduct(1)

For the Act, Schedule 1, clauses 10(1)(k) and 11(1)(l), an organisation may use or disclose health information for a secondary purpose if—

• (a)

  the organisation has reasonable grounds to suspect a person has or may have engaged in conduct that may be unsatisfactory professional performance, professional misconduct or unprofessional conduct under the Health Practitioner Regulation National Law, and

• (b)

  the use or disclosure is necessary as part of an investigation of the matter by, or in reporting concerns to, relevant persons or authorities, including a National Board or an investigator appointed under the Health Practitioner Regulation National Law by a National Board.

(2)

In this section—

Health Practitioner Regulation National Law means—

• (a)

  the Health Practitioner Regulation National Law—

  • (i)

    as in force from time to time, set out in the Schedule to the Health Practitioner Regulation National Law Act 2009 of Queensland, and

  • (ii)

    as it applies, including with any modifications, as a law of a State or Territory other than New South Wales, or

• (b)

  the law of another State or Territory that substantially corresponds to the law referred to in paragraph (a).

National Board has the same meaning as in the Health Practitioner Regulation National Law.

7Complaints(1)

For the Act, Schedule 1, clauses 10(1)(k) and 11(1)(l), an organisation may use or disclose health information for a secondary purpose if—

• (a)

  the organisation has reasonable grounds to suspect a complaint has been made against a registered health practitioner, and

• (b)

  the health information is only used or disclosed—

  • (i)

    at the request of a council established under the Health Practitioner Regulation National Law (NSW), section 41B, and

  • (ii)

    to assist the council with the management of the registered health practitioner under the Health Practitioner Regulation National Law (NSW), Part 8, and

• (c)

  the health information only relates to a patient of the registered health practitioner.

(2)

In this section—

complaint, against a registered health practitioner, means a complaint made about the practitioner under—

• (a)

  the Health Practitioner Regulation National Law (NSW), Part 8, or

• (b)

  the Health Care Complaints Act 1993, Part 2.

7ADisclosure for compassionate reasons

For the Act, Schedule 1, clause 11(1)(l), an organisation may disclose health information for a secondary purpose if —

• (a)

  the disclosure of the information for the secondary purpose is to provide the information to an immediate family member of the individual for compassionate reasons, and

• (b)

  the disclosure is limited to the extent reasonable for those compassionate reasons, and

• (c)

  the individual is deceased, and

• (d)

  the disclosure is not contrary to a wish expressed by the individual, and not withdrawn, before the death of the individual of which the organisation was aware or could make itself aware by taking reasonable steps, and

• (e)

  if the immediate family member is under the age of 18 years, the organisation reasonably believes that the family member has sufficient maturity in the circumstances to receive the information.

s 7A: Ins 2022 (799), sec 3.

Part 3Miscellaneous8Exemption for My Health Record system—the Act, s 75(2)(c)(1)

The Act, Schedule 1, clause 15 does not apply to an organisation to the extent that the organisation includes in the My Health Record system health information about an individual registered for the My Health Record system.

(2)

In this section—

My Health Record system has the same meaning as in the My Health Records Act 2012 of the Commonwealth.

9Health records linkage systems—the Act, Sch 1, cl 15

For the Act, Schedule 1, clause 15(3), definition of health records linkage system, the following systems administered by the Health Administration Corporation are prescribed as not being a health records linkage system—

• (a)

  the system known as HealtheNet,

• (b)

  the system known as Clinical Health Information Exchange,

• (c)

  the system known as the Single Digital Patient Record.

s 9: Am 2025 (623), Sch 1[1] [2].

10Certain public sector agencies to be treated as single agency—the Act, s 75(2)(d)(i) and (iii)(1)

The following public sector agencies must be treated as a single agency for the purposes of the Health Privacy Principles and health privacy codes of practice—

• (a)

  the Ministry of Health,

• (b)

  the Health Administration Corporation,

• (c)

  a local health district within the meaning of the Health Services Act 1997,

• (d)

  a statutory health corporation within the meaning of the Health Services Act 1997,

• (e)

  the Cancer Institute (NSW).

(2)

The following public sector agencies must be treated as a single agency for the purposes of the Act—

• (a)

  Corrective Services NSW,

• (b)

  the Department of Communities and Justice.

s 10: Am 2024 (508), Sch 1.3[1] [2].

11Repeal and savings(1)

The Health Records and Information Privacy Regulation 2017 is repealed.

(2)

An act, matter or thing that, immediately before the repeal of the Health Records and Information Privacy Regulation 2017, had effect under that Regulation continues to have effect under this Regulation.

Historical notesTable of amending instruments

Health Records and Information Privacy Regulation 2022 (467). LW 19.8.2022. Date of commencement, on publication on LW, sec 2. This Regulation has been amended as follows—

2022	799	Health Records and Information Privacy Amendment (Disclosure of Health Information) Regulation 2022. LW 16.12.2022. Date of commencement, on publication on LW, sec 2.
2023	(642)	Health Records and Information Privacy Amendment Regulation 2023. LW 1.12.2023. Date of commencement, on publication on LW, sec 2.
2024	(508)	Information Sharing Amendment (Corrective Services NSW) Regulation 2024. LW 30.9.2024. Date of commencement, 1.10.2024, sec 2.
2025	(240)	Health Records and Information Privacy Amendment (Single Digital Patient Record) Regulation 2025. LW 30.5.2025. Date of commencement, on publication on LW, sec 2.
(623)	Health Records and Information Privacy Amendment (Single Digital Patient Record) Regulation (No 2) 2025. LW 21.11.2025. Date of commencement, on publication on LW, sec 2.

Table of amendments

Sec 4	Am 2023 (642), Sch 1; 2025 (240), Sch 1.
Sec 7A	Ins 2022 (799), sec 3.
Sec 9	Am 2025 (623), Sch 1[1] [2].
Sec 10	Am 2024 (508), Sch 1.3[1] [2].