Personally Controlled Electronic Health Records (Consequential Amendments) Act 2012 (Cth)

Personally Controlled Electronic Health Records (Consequential Amendments) Act 2012

No. 64, 2012

An Act to make amendments consequential on the enactment of the Personally Controlled Electronic Health Records Act 2012, and for related purposes

Contents

Personally Controlled Electronic Health Records (Consequential Amendments) Act 2012

No. 64, 2012

An Act to make amendments consequential on the enactment of the Personally Controlled Electronic Health Records Act 2012, and for related purposes

[Assented to 26 June 2012]

The Parliament of Australia enacts:

1Short title

This Act may be cited as the Personally Controlled Electronic Health Records (Consequential Amendments) Act 2012.

2Commencement

1. (1)

   Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.

Commencement information
Column 1	Column 2	Column 3
Provision(s)	Commencement	Date/Details
1. Sections 1 to 3 and anything in this Act not elsewhere covered by this table	The day this Act receives the Royal Assent.	26 June 2012
2. Schedule 1	A day or days to be fixed by Proclamation. However, if any of the provision(s) do not commence by the later of: (a) 1 July 2012; and (b) the day this Act receives the Royal Assent; they commence on the day after the later of those days.	29 June 2012 (see F2012L01398)

Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.

1. (2)

   Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.

3Schedule(s)

Each Act that is specified in a Schedule to this Act is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this Act has effect according to its terms.

Schedule 1Consequential amendments

Healthcare Identifiers Act 2010

1

After section 4

Insert:

4AExternal Territories

This Act extends to every external Territory.

2

Section 5

Insert:

Australian Childhood Immunisation Register means the Australian Childhood Immunisation Register kept under section 46B of the Health Insurance Act 1973.

3

Section 5

Insert:

Medicare Benefits Program means the program for providing Medicare benefits under the Health Insurance Act 1973.

4

Section 5

Insert:

participant in the PCEHR system has the same meaning as in the Personally Controlled Electronic Health Records Act 2012.

5

Section 5

Insert:

PCEHR has the same meaning as in the Personally Controlled Electronic Health Records Act 2012.

6

Section 5

Insert:

PCEHR system has the same meaning as in the Personally Controlled Electronic Health Records Act 2012.

7

Section 5

Insert:

PCEHR System Operator means the System Operator within the meaning of the Personally Controlled Electronic Health Records Act 2012.

8

Section 5

Insert:

Pharmaceutical Benefits Program means the program for providing pharmaceutical benefits under the National Health Act 1953.

9

Section 5

Insert:

professional and business details of a healthcare provider includes the healthcare provider’s healthcare identifier.

10

Section 5

Insert:

registered portal operator has the same meaning as in the Personally Controlled Electronic Health Records Act 2012.

11

Section 5

Insert:

registered repository operator has the same meaning as in the Personally Controlled Electronic Health Records Act 2012.

12

Paragraph 10(b)

After “Division 2”, insert “or 2A”.

13

Division 1 of Part 3 (heading)

Repeal the heading, substitute:

Division 1—Use and disclosure of identifying information

14

After section 11

Insert:

11AUse and disclosure of identifying information

The service operator is authorised to use, and to disclose to the PCEHR System Operator, identifying information for any purpose for which the PCEHR System Operator is authorised to collect, use or disclose the identifying information under Division 2A.

15

Section 18

Omit “must”, substitute “may”.

16

After section 19

Insert:

19ADisclosure to PCEHR System Operator

The service operator is authorised to use, and to disclose to the PCEHR System Operator, a healthcare identifier for a purpose for which the PCEHR System Operator is authorised to collect, use or disclose the healthcare identifier under Division 2A.

19BDisclosure to Chief Executive Medicare

The service operator is authorised:

1. (a)

   to use a healthcare identifier, and identifying information held by the service operator; and

2. (b)

   to disclose to the Chief Executive Medicare a healthcare identifier, and identifying information held by the service operator;

for a purpose for which the Chief Executive Medicare is authorised to collect, use or disclose the healthcare identifier under Division 2A.

19CDisclosure to other Departments

The service operator is authorised:

1. (a)

   to use a healthcare identifier, and identifying information held by the service operator, of a healthcare recipient; and

2. (b)

   to disclose to the Veterans’ Affairs Department, the Defence Department or such other Department as is prescribed, a healthcare identifier, and identifying information held by the service operator, of a healthcare recipient;

for a purpose for which that Department is authorised to collect, use or disclose the healthcare identifier under Division 2A.

17

Subsection 20(1)

Omit “is authorised to disclose an identified healthcare provider’s healthcare identifier to an entity”, substitute “or a registration authority is authorised to use, and disclose to an entity, an identified healthcare provider’s healthcare identifier and identifying information”.

19

Paragraph 20(2)(b)

After “use”, insert “and disclose”.

20

At the end of subsection 20(2)

Add:

1. ; and (c)

   to adopt the healthcare identifier as the entity’s own identifier of the healthcare provider for the purpose of enabling the healthcare provider’s identity to be authenticated in electronic transmissions.

21

After Division 2 of Part 3

Insert:

Division 2A—Collection, use and disclosure of healthcare identifiers and identifying information for purposes of the PCEHR System

22ACollection, use and disclosure by PCEHR System Operator

1. (1)

   This section applies if a healthcare recipient or a healthcare provider is applying, or has applied, for registration or is registered under the Personally Controlled Electronic Health Records Act 2012.

2. (2)

   The PCEHR System Operator is authorised:

   1. (a)

      to collect identifying information of the healthcare recipient or healthcare provider from the service operator; and

   2. (b)

      to collect the healthcare identifier of the healthcare recipient or healthcare provider; and

   3. (c)

      to use and disclose the identifying information and healthcare identifier;

for the purpose of verifying the identity of the healthcare recipient or healthcare provider and for other purposes of the PCEHR system, subject to the Personally Controlled Electronic Health Records Act 2012.

1. (3)

   If the healthcare recipient has an authorised representative or a nominated representative, the PCEHR System Operator is authorised:

   1. (a)

      to collect identifying information of the authorised representative or nominated representative from the service operator; and

   2. (b)

      to collect the healthcare identifier of the authorised representative or nominated representative; and

   3. (c)

      to use and disclose the identifying information and healthcare identifier;

for the purpose of verifying the identity of the authorised representative or nominated representative and for other purposes of the PCEHR system, subject to the Personally Controlled Electronic Health Records Act 2012.

22BAdoption by PCEHR System Operator, registered repository operator or registered portal operator

1. (1)

   The PCEHR System Operator, a registered repository operator or a registered portal operator is authorised to adopt the healthcare identifier of a healthcare recipient or a healthcare provider as its own identifier of the recipient or the provider, so far as is reasonably necessary for the purposes of the PCEHR system.

2. (2)

   The PCEHR System Operator, a registered repository operator or a registered portal operator is authorised to adopt the healthcare identifier of an authorised representative or a nominated representative of a healthcare recipient as its own identifier of the authorised representative or nominated representative, so far as is reasonably necessary for the purposes of the PCEHR system.

22CCollection, use and disclosure by registered repository operators or registered portal operators

A registered repository operator or a registered portal operator is authorised:

1. (a)

   to collect the healthcare identifier of a healthcare recipient or healthcare provider, or an authorised representative or nominated representative of a healthcare recipient; and

2. (b)

   to use the healthcare identifier; and

3. (c)

   to disclose the healthcare identifier to a participant in the PCEHR system;

for the purposes of the PCEHR system, subject to the Personally Controlled Electronic Health Records Act 2012.

22DCollection, use and disclosure by the Chief Executive Medicare and Departments

1. (1)

   The Chief Executive Medicare, the Veterans’ Affairs Department, the Defence Department and such other Departments as are prescribed are authorised:

   1. (a)

      to collect identifying information of a healthcare recipient from the service operator; and

   2. (b)

      to collect the healthcare identifier of a healthcare recipient; and

   3. (c)

      to use the healthcare identifier and identifying information; and

   4. (d)

      to disclose the healthcare identifier and identifying information to a participant in the PCEHR system.

2. (2)

   The authorisation of the Chief Executive Medicare under subsection (1) is limited to collections, uses and disclosures for the purposes of including, in the healthcare recipient’s PCEHR, information about the healthcare recipient:

   1. (a)

      that is any of the following:

      1. (i)

         information that relates to the Medicare Benefits Program or the Pharmaceutical Benefits Program;

      2. (ii)

         information included on the Australian Childhood Immunisation Register;

      3. (iii)

         information included on the register administered by the Commonwealth that records the decision made by an individual about whether to become an organ and tissue donor for transplantation after death; and

   2. (b)

      that the healthcare recipient has consented to being included in his or her PCEHR.

3. (3)

   The authorisation of a Department under subsection (1) is limited to collections, uses and disclosures for the purposes of including, in the healthcare recipient’s PCEHR, information about the healthcare recipient:

   1. (a)

      that is information prescribed by the regulations; and

   2. (b)

      that the healthcare recipient has consented to being included in his or her PCEHR.

4. (4)

   Despite paragraphs (2)(b) and (3)(b), the consent of the healthcare recipient is not required for the uploading of information by the Chief Executive Medicare in accordance with paragraph 38(2)(a) of the Personally Controlled Electronic Health Records Act 2012.

22ERegulations may authorise collection, use and disclosure related to the PCEHR system

The regulations may authorise a person:

1. (a)

   to collect identifying information of a healthcare recipient, a healthcare provider, an authorised representative of a healthcare recipient or a nominated representative of a healthcare recipient from the service operator; and

2. (b)

   to collect the healthcare identifier of a healthcare recipient, a healthcare provider, an authorised representative of a healthcare recipient or a nominated representative of a healthcare recipient; and

3. (c)

   to use the identifying information and healthcare identifier; and

4. (d)

   to disclose the identifying information and healthcare identifier to a participant in the PCEHR system;

so far as the collection, use or disclosure:

1. (e)

   relates to a collection, use or disclosure of health information that is authorised under the Personally Controlled Electronic Health Records Act 2012; or

2. (f)

   is reasonably necessary for the performance of a function or the exercise of a power in relation to the PCEHR system.

22

After section 24

Insert:

24ACollection, use and disclosure of healthcare identifier of healthcare provider with consent

The service operator or another entity may collect, use or disclose a healthcare provider’s healthcare identifier for a purpose relating to the provision of healthcare if:

1. (a)

   the healthcare provider has consented to the collection, use or disclosure; and

2. (b)

   the collection, use or disclosure is in accordance with any limitations to which the consent is subject.

23

After paragraph 36(b):

Add:

1. (ba)

   a person (the contractor) performing services under a contract between the contractor and the first entity, if:

   1. (i)

      the first entity is a participant in the PCEHR system, other than a healthcare provider or a contracted service provider; and

   2. (ii)

      the purpose relates to the PCEHR system; or

24

Subparagraph 36(c)(i)

After “applies”, insert “or of a contractor to which paragraph (ba) applies”.

25

Subparagraph 36(c)(ii)

Omit “that paragraph”, substitute “whichever of those paragraphs applies”.

Health Insurance Act 1973

26

Subsection 3(1)

Insert:

PCEHR System Operator has the same meaning as System Operator has in the Personally Controlled Electronic Health Records Act 2012.

27

Subsection 3(1)

Insert:

registered consumer has the meaning given by the Personally Controlled Electronic Health Records Act 2012.

28

Subsection 3(1)

Insert:

registered repository operator has the meaning given by the Personally Controlled Electronic Health Records Act 2012.

29

After paragraph 46E(1)(b)

Insert:

1. (ba)

   upload to a repository operated by the Chief Executive Medicare or by another registered repository operator, information about the immunisation of a particular child who is a registered consumer, if the consumer consents to that information being uploaded; and

2. (bb)

   give information to the PCEHR System Operator about the immunisation of a particular child who is a registered consumer, if the consumer consents to that information being uploaded; and

29A

At the end of section 46E

Add:

1. (4)

   Despite paragraphs (1)(ba) and (bb), the consent of the consumer is not required for the uploading of information by the Chief Executive Medicare in accordance with paragraph 38(2)(a) of the Personally Controlled Electronic Health Records Act 2012.

30

Subsection 130(1)

After “2008”, insert “, the Personally Controlled Electronic Health Records Act 2012 (whether as a delegate or otherwise)”.

National Health Act 1953

31

Subsection 135A(1)

After “indemnity legislation”, insert “or the Personally Controlled Electronic Health Records Act 2012 (whether as a delegate or otherwise)”.

32

After subsection 135AA(5A)

Insert:

1. (5AA)

   Nothing in this section, or in the guidelines issued by the Information Commissioner, prevents the PCEHR System Operator including information to which this section applies in the PCEHR of a consumer.

33

Subsection 135AA(11)

Insert:

PCEHR has the same meaning as in the Personally Controlled Electronic Health Records Act 2012.

34

Subsection 135AA(11)

Insert:

PCEHR System Operator has the same meaning as System Operator has in the Personally Controlled Electronic Health Records Act 2012.

[Minister’s second reading speech made in—

House of Representatives on 23 November 2011

Senate on 29 February 2012]

(265/11)