Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025

EXPLANATORY STATEMENT

Healthcare Identifiers Act 2010

Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025

Purpose and operation

The Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025 amends the Healthcare Identifiers Regulations 2020 to allow consumer self-registration to the active script list (ASL).

This amendment enables the implementation of capabilities listed under the 2018-19 budget measure, Improving access to Medicines – ePrescribing for Safer Medicines.

The purpose of the amendment is to legalise the collection and disclosure of individual health identifiers (IHI) between

• The healthcare identifiers services operator (service operator) and  
• Active Script List Registry operator (ASLR operator).

This amendment addresses a legal impediment. This advice noted the healthcare identifiers legislation does not authorise the collection and disclosure of consumer’s individual healthcare identifiers (IHI) to the ASLR operator.

The capability is already available and the technical requirements for self-registration are enabled in the most recent conformance profile (v3.0.1). Software vendors have commenced the development and build of these capabilities.

The instrument will provide additional authorisations for the handling of healthcare identifiers for the purpose for consumer self-registration for the ASL. The purpose of the proposed amending Regulations is to authorise the disclosure of IHIs between the service operator and an ASLR operator.

Background

The Healthcare Identifiers Act 2010 (HI Act) establishes a national system for assigning unique identifiers to healthcare recipients and providers, ensuring accurate matching of health information. It specifies the conditions for collecting, using, and disclosing these identifiers. Healthcare identifiers are critical for enabling digital health initiatives such as electronic prescribing. 

Electronic prescribing allows prescribers, dispensers, and healthcare recipients to use electronic prescriptions as an alternative to paper prescriptions. Electronic prescriptions are stored in the National Prescription Delivery Service (NPDS) and healthcare recipients receive an access token to retrieve their medication from a pharmacy. 

To manage multiple electronic prescriptions, a national token management solution called the ASL is available. A healthcare recipient’s ASL consolidates electronic prescription tokens into a single list, benefiting those on multiple medications. Healthcare recipients can currently register for an ASL only through their pharmacist.  

These regulations will legalise the collection and disclosure of healthcare identifiers between the service operator and an ASLR operator, enabling a healthcare recipient to self-register for an ASL without having to visit a pharmacy.  

The Australian Digital Health Agency (the Agency) supports electronic prescribing through a technical framework that ensures compliance with privacy laws, health legislation, and record-keeping obligations. All participants, including service providers and mobile applications, must adhere to these technical requirements. 

This instrument is part of a broader set of obligations for electronic prescribing that all providers must meet. These include: 

• Operating data collection and storage in line with privacy laws (Privacy Act 1988 and state/territory legislation). 

• Managing prescriptions in accordance with health legislation (National Health Act 1953). 

• Complying with record-keeping obligations (Archives Act 1983). 

Section 33 of the HI Act provides that the Minister must consult with the Ministerial Council about the regulations before the Governor-General makes a regulation for the purpose of the HI Act.  

The Ministerial Council refers to Commonwealth, state and territory health ministers, who have been consulted, and endorsed the proposed amendments. 

Authority

Section 39 of the HI Act authorises the Governor-General to make regulations, consistent with the HI Act, for matters prescribed in the HI Act. Section 20 of the HI Act provides that regulations may authorise the collection, use or disclosure of identifying information of a healthcare recipient. This instrument is made under authorisation of the Minister for Health to amend the Healthcare Identifiers Regulations 2020 (HI Regulations) to allow consumer self-registration to the ASL.

Reliance on subsection 33(3) of the Acts Interpretation Act 1901

Subsection 33(3) of the Acts Interpretation Act 1901 provides that where an Act confers a power to make, grant or issue any instrument of a legislative or administrative character (including rules, regulations or by-laws), the power shall be construed as including a power exercisable in the like manner and subject to the like conditions (if any) to repeal, rescind, revoke, amend, or vary any such instrument.

Commencement

This instrument commences the day after registration on the Federal Register of Legislation.

Consultation

The Department extensively consulted with key stakeholders who will be affected or have a vested interest in the HI ASL Regulations. The first exposure draft, along with the ASL self-registration consultation paper, was published on the Department’s Consultation Hub from 12 April to 12 May 2023. Responses were received from stakeholders including the Australian Digital Health Agency, Services Australia, Royal Australian College of General Practitioners, Pharmaceutical Society of Australia, and jurisdictions, including the NSW Information and Privacy Commission. The feedback subsequently incorporated into the first exposure draft.

The final exposure draft of the HI ASL Regulations was provided to the Digital Medicines Section on 19 April 2024 and circulated to the Agency and Services Australia for final review.

The Digital Medicines Section also consulted with the Intergovernmental Relations (IGR) Section who liaises with state and territory IGR teams and co-ordinates the Department's interactions with the HCEF and HMM.

A minor amendment was made to the instrument after endorsement by the health ministers. Advice was received on the 20 September 2024 that the health ministers were informed of the change with nil further responses received from jurisdictions.

The exposure draft has previously been considered and endorsed by the Health Chiefs Executive Forum (HCEF) on the 30 September 2024 and the Health Ministers Meeting (HMM) on the 16 October 2024.

General

This instrument is a legislative instrument for the purposes of the Legislation Act 2003.

Details of this instrument are set out in Attachment A.

This instrument is compatible with the human rights and freedoms recognised or declared under section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011. A full statement of compatibility is set out in Attachment B.

ATTACHMENT A

Details of Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025

Section 1 – Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025

This section provides that the name of the instrument is the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025.

Section 2 – Commencement

This section provides that the instrument takes effect the day after the instrument is registered on the Federal Register of Legislation.

Section 3 – Authority

This section provides that the instrument is made under Section 39 of the Healthcare Identifiers Act 2010.

Section 4 – Schedules

This section provides that each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.

Schedule 1 – Amendments

Item [1] – Section 5

This section provides definitions of the roles of the primary actors and components involved in facilitating Active Script List (ASL) self-registration as follows:

         active script list supports the optional ability for healthcare recipients, prescribers and dispensers to access electronic prescription tokens in a consolidated format rather than through presentation of separate tokens for individual scripts.

         active script list registry is a system and service that enables the ASL by allowing:

        a consumer to register for an ASL via a consent model.

        prescribing and dispensing systems to add electronic prescription tokens to a consumer’s ASL.

        consumers access to their ASL, thereby allowing them to view and manage their electronic prescription tokens via mobile applications (through mobile intermediaries).

         active script list registry operator is the entity that owns and operates the ASL.

         electronic prescription is an electronic clinical document that contains all information relating to an order to supply medicine to a consumer and is a legally dispensable instruction. An electronic prescription is generated by an authorised prescriber, authenticated, and securely transmitted via the national prescription delivery service for dispensing and supply, integrated into the pharmacy dispensing software.

         mobile intermediary service is software that manages communication between the national prescription delivery service and mobile applications. The mobile intermediary’s main purpose is to access prescription information contained in the national prescription delivery service on behalf of mobile applications and provide other functionality such as user authentication and validation and access to the ASL.

         mobile intermediary service operator is an entity that operates a mobile intermediary service.

         mobile prescription application is used by the consumer to self-register for, view and manage their ASL.

         mobile prescription application service provider is an entity that operates and/or provides a mobile prescription application.

         token is one of the data requirements for an Evidence of Prescription and is a QR code provided to a consumer or added to their ASL at the time of prescribing. The token is presented to a pharmacy for scanning and is used to identify and access an electronic prescription or repeat authorisation for dispensing and supply of medicine.

Item [2] – subsection 9A(1)

Subsection 9A(1) provides that the authorisations set out under subsections 9A(2) to 9A(6) of the Regulations are made for the purposes of subsection 20(1) of the Health Identifiers Act 2010.

Subsection 20(1) of the Healthcare Identifiers Act 2010 provides that the regulations may authorise the collection, use or disclosure of the identifying information, or healthcare identifier, of a healthcare recipient (or the healthcare recipient’s authorised or nominated representative).

Item [2] – subsection 9A(2)

Subsection 9A(2) provides authorisation for the Service Operator to:

         collect from an ASLR Operator, a consumer’s identifying information or healthcare identifier; and

         use the consumer’s identifying information or healthcare identifier to verify if the consumer has a valid healthcare identifier; and

         disclose the consumers' validated healthcare identifier an ASLR Operator.

Any collection, use or disclosure under subsection 9A(2) must be for the purpose of facilitating the provision of adequate and appropriate healthcare to the relevant consumer.

Subsection 9A(2) authorises the Service Operator to collect information from \ an ASLR Operator and disclose the healthcare identifier of a healthcare recipient to the ASLR Operator. This amendment is needed to verify that the consumer has a valid healthcare identifier that can be used to register the consumer for an ASL.

Item [2] – subsection 9A(3)

Subsection 9A (3) provides authorisation for an ASLR Operator to:

         collect a consumer’s healthcare identifier from the Service Operator; and

         use the healthcare identifier collected from the Service Operator to register the consumer for an ASL.

Any collection or use under subsection 9A(3) must be for the purpose of facilitating the provision of adequate and appropriate healthcare to the relevant consumer.

This subsection authorises an ASLR Operator to collect a healthcare identifier disclosed by the Service Operator. This will facilitate an ASLR Operator to register the consumer for an ASL using the healthcare identifier it obtains from or verifies with the Service Operator.

Item [2] – subsection 9A(4)

Subsection 9A(4) authorises an ASLR Operator to verify a healthcare recipient’s healthcare identifier, by:

         collecting from a consumer the individual’s identifying information or healthcare identifier though a mobile prescription application; and

         disclosing to the Service Operator the consumer’s identifying information or healthcare identifier.

Any collection or disclosure under subsection 9A(4) must be for the purpose of facilitating the provision of adequate and appropriate healthcare to the relevant consumer.

This provision authorises an ASLR Operator to disclose identifying information provided by a consumer to the Service Operator and will facilitate the Service Operator to disclose a validated healthcare identifier to the ASLR operator that can be used to register the consumer for an ASL.

Item [2] – subsection 9A(5)

Subsection 9A(5) authorises a mobile prescription application service provider to:

• collect a consumer’s identifying information or healthcare identifier from the consumer
• use the identifying information or healthcare identifier of the consumer to facilitate the consumer’s registration to an ASL; and
• disclose this information to a mobile intermediary service provider to facilitate registration of an ASL.

Any collection, use or disclosure under subsection 9A(5) must be for the purpose of facilitating the provision of adequate and appropriate healthcare to the relevant consumer.

The provision authorises the mobile prescription application service provider to collect identifying information and disclose it to a mobile intermediary service provider to facilitate disclosure of identifying information from the consumer to an ASLR Operator.

Item [2] – subsection 9A(6)

Subsection 9A(6) authorises the mobile intermediary service operator to:

         collect a consumer’s identifying information or the healthcare identifier from a mobile prescription application service provider.

         use the consumer’s identifying information or healthcare identifier to facilitate the consumer’s registration for an ASL.

         disclose the consumer’s identifying information or healthcare identifier to an ASLR Operator to facilitate the consumer’s registration for an ASL.

Any collection, use or disclosure under subsection 9A (6) must be for the purpose of facilitating the provision of adequate and appropriate healthcare to the relevant consumer.

This provision allows a mobile intermediary service operator to facilitate the disclosure of information from a mobile prescription application service provider to an ASLR Operator. The provision facilitates disclosure of identifying information or a healthcare identifier from a healthcare recipient to an ASLR Operator.

Item [3] – section 17

Section 17 provides that the authorisations under section 9A of the instrument apply to the use and disclosure of relevant information on or after the commencement of the proposed Regulations, irrespective of when the information was collected. This means that the authorisations under section 9A will apply to information that was collected before, on or after commencement of the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025.

ATTACHMENT B

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025 

This Disallowable Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the Disallowable Legislative Instrument

The Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025 amends the Healthcare Identifiers Regulations 2020, to allow self-registration to the ASL. The amendment legalises the disclosure of Individual Health Identifiers (IHI) between the Health Identifiers (HI) Services and the Active Script List Registry (ASLR) operators.

The amendment authorises the validation or querying steps of a valid IHI for a consumer who is registering themselves from an ASL.

This Instrument will empower consumers to be in full control of managing their medications through a mobile application allowing consumers to:

• Register for an ASL without having to attend a pharmacy.
• View and manage their active electronic prescriptions and remaining repeats.
• Manage access to their Active Script List by prescribers, pharmacists, and carers.

Human rights implications

This Disallowable Legislative Instrument does not raise any human rights issues.

This Disallowable Legislative Instrument does not engage any of the applicable rights or freedoms.

Conclusion 

This disallowable legislative instrument only engages human rights to the extent that they promote improved access and management of a consumers health care needs. Therefore, this instrument is compatible with human rights because these changes continue to ensure that existing arrangements advancing the protection of human rights are maintained.