Health Legislation Amendment (eHealth Application Day) Proclamation 2016

Overview

The Health Legislation Amendment (eHealth) Act 2015 was enacted by the Australian Parliament to address gaps in the regulation of electronic health records and healthcare identifiers. The Act aimed to implement recommendations from the Review of the Personally Controlled Electronic Health Record, December 2013, and the Healthcare Identifiers Act and Service Review, Final Report 2013. The Health Legislation Amendment (eHealth-Application Day) Proclamation 2016, issued under the authority of the Minister for Health, specifies the application day for certain amendments to the Act, setting it as 1 March 2016 unless otherwise fixed. These amendments enhance the legal framework governing the My Health Record system, which allows individuals and their healthcare providers to access key health information online. The amendments impose stricter penalties for unauthorised access and misuse of health information and healthcare identifiers, clarify obligations for notifying data breaches, and adjust the legal landscape to facilitate the operation of the My Health Record system without reliance on intellectual property licenses.

Scope and Application

The Health Legislation Amendment (eHealth) Act 2015, as proclaimed by the Health Legislation Amendment (eHealth-Application Day) Proclamation 2016, applies to participants in the My Health Record system, including the System Operator, registered healthcare provider organisations, registered contracted service providers, registered repository operators, and registered portal operators. This legislation imposes legal obligations on these entities concerning the collection, use, disclosure, and removal of My Health Record system information and healthcare identifiers. The Act also introduces civil and criminal penalties for unauthorised activities and increases the penalties for failure to comply with My Health Records Rules. Furthermore, the Act includes an exception to copyright infringement to facilitate the operation of the My Health Record system and clarifies the requirements for notifying data breaches. The jurisdictional reach of this legislation is national, applying across Australia, and it extends to the enforcement of penalties and compliance with the rules set forth within the Act. The application day for these amendments is set as 1 March 2016, unless otherwise specified by further proclamation, with a default date of 27 May 2016 if no such proclamation is made by 26 May 2016. The Act’s provisions are designed to enhance the security, privacy, and efficiency of health records management in alignment with the Government’s response to the Review of the Personally Controlled Electronic Health Record and the recommendations from the Healthcare Identifiers Act and Service Review.

Key Provisions

The Health Legislation Amendment (eHealth) Act 2015 introduces significant changes to several health-related Acts, with the primary focus being on enhancing the My Health Record system and the Healthcare Identifiers Service. Section 111 of Part 2 of Schedule 1 to the Act specifies that the application day for these amendments is 1 March 2016, as declared by the Health Legislation Amendment (eHealth-Application Day) Proclamation 2016. This date ensures that the provisions come into effect as planned, unless otherwise stated. The Act aims to modernise and streamline the electronic health records and identifiers systems in response to recommendations from the Review of the Personally Controlled Electronic Health Record and the Healthcare Identifiers Act and Service Review. The Act imposes specific obligations on various parties involved in the My Health Record system, including the System Operator, registered healthcare provider organisations, contracted service providers, repository operators, and portal operators. These obligations include ensuring the secure handling and processing of health information, compliance with the My Health Records Rules, and the implementation of robust measures to prevent unauthorised collection, use, disclosure, or removal of health records. For instance, Section 115 outlines the penalties for unauthorised actions concerning health records or healthcare identifiers, thereby establishing a clear legal framework to protect sensitive information. Failure to comply with the provisions of the Act can result in significant legal consequences. Section 116 imposes civil and criminal penalties for the unauthorised collection, use, or disclosure of My Health Record system information or healthcare identifiers, as well as penalties for the removal of health records from Australia. These penalties serve as a deterrent against breaches and ensure accountability among system participants. Section 117 increases the penalties for non-compliance with My Health Records Rules, emphasising the importance of adhering to regulatory standards. Additionally, Section 118 creates an exception to copyright infringement, allowing the My Health Record system to operate without needing intellectual property licenses, thereby facilitating smoother operations and accessibility to health records. The Act also addresses the issue of data breaches by clarifying the requirements for notifying such incidents. Section 120 outlines the specific obligations regarding the timely notification of data breaches, ensuring that affected individuals and relevant authorities are promptly informed. This provision is crucial for maintaining transparency and trust in the electronic health records system. The comprehensive approach taken by the Act in addressing these areas helps to safeguard health information and improve the efficiency and reliability of the healthcare system.