National Health Amendment Act 1993

Administered by Attorney-General's Department

Legislation au C2004A04583 Not in force Act

Select Document

No. 28 of 1993

An Act to amend the National Health Act 1953, and for
related purposes

[Assented to 9 June 1993]

The Parliament of Australia enacts:

PART 1—PRELIMINARY

Short title

1. This Act may be cited as the National Health Amendment Act 1993.

Commencement

2. This Act commences on the day on which it receives the Royal Assent.

PART 2—AMENDMENTS TO THE NATIONAL HEALTH ACT 1953

Principal Act

3. In this Part, “Principal Act” means the National Health Act 19531.

Repeal of section and substitution of new section

4.(1) Section 135AA of the Principal Act is repealed and the following section is substituted:

Privacy guidelines

Information to which this section applies

“135AA.(1) Subject to subsection (2), this section applies to information that:

(a) is information relating to an individual; and

(b) is held by an agency (whether or not the information was obtained by that agency or any other agency after the commencement of this section); and

(c) was obtained by that agency or any other agency in connection with a claim for payment of a benefit under the Medicare Benefits Program or the Pharmaceutical Benefits Program.

Information to which this section does not apply

“(2) This section does not apply to such information:

(a) so far as it identifies:

(i) a person who provided the service or goods in connection with which the claim for payment is made; or

(ii) a person who, in his or her capacity as the provider of services, made a referral or request to another person to provide the service or goods; or

(b) so far as it is contained in a database that:

(i) is maintained for the purpose of identifying persons who are eligible to be paid benefits under the Medicare Benefits Program or the Pharmaceutical Benefits Program; and

(ii) does not contain information relating to claims for payment of such benefits; or

Issuing guidelines

“(3) The Privacy Commissioner must, by written notice, issue guidelines relating to information to which this section applies.

Replacing or varying guidelines

“(4) At any time, the Privacy Commissioner may, by written notice, issue further guidelines that vary the existing guidelines.

Content of guidelines

“(5) So far as practicable, the guidelines must:

(a) specify the ways in which information may be stored and, in particular, specify the circumstances in which creating copies of information in paper or similar form is prohibited; and

(b) specify the uses to which agencies may put information; and

(d) prohibit agencies from storing in the same database:

(i) information that was obtained under the Medicare Benefits Program; and

(ii) information that was obtained under the Pharmaceutical Benefits Program; and

(e) prohibit linkage of:

(i) information that is held in a database maintained for the purposes of the Medicare Benefits Program; and

(ii) information that is held in a database maintained for the purposes of the Pharmaceutical Benefits Program;

unless the linkage is authorised in the way specified in the guidelines; and

(f) specify the requirements with which agencies must comply in relation to old information, in particular requirements that:

(i) require the information to be stored in such a way that the personal identification components of the information are not linked with the rest of the information; and

(ii) provide for the longer term storage and retrieval of the information; and

(iii) specify the circumstances in which, and the conditions subject to which, the personal identification components of the information may later be re-linked with the rest of the information.

Consultation

“(6) Before issuing guidelines, the Privacy Commissioner must take reasonable steps to consult with organisations (including agencies) whose interests would be affected by the guidelines.

Disallowance

“(7) Guidelines are disallowable instruments for the purposes of section 46A of the Acts Interpretation Act 1901.

When guidelines take effect

“(8) Despite section 46A and paragraph 48(1)(b) of the Acts Interpretation Act 1901, guidelines take effect from:

(a) the first day on which they are no longer liable to be disallowed; or

(b) if the guidelines provide for their commencement after that day — in accordance with that provision.

Failure to table first guidelines within 6 months

“(9) If guidelines issued under subsection (1) are not laid before each House of the Parliament under paragraph 48(1)(c) of the Acts Interpretation Act 1901 (as applied by section 46A of that Act) within 6 months after the commencement of this section, the Privacy Commissioner must report the failure to issue guidelines within that period to each House of the Parliament within 15 sitting days of that House after the end of the period.

Tabling first guidelines after 6 months

“(10) Subsection (9) does not render invalid guidelines issued under subsection (3) that are not laid before each House of the Parliament within that period.

Definitions

“(11) In this section:

‘agency’ has the same meaning as in the Privacy Act 1988;

‘database’ means a discrete body of information stored by means of a computer;

‘Medicare Benefits Program’ means the program for providing Medicare benefits under the Health Insurance Act 1973;

‘old information’ means information to which this section applies that has been held by one or more agencies for at least the preceding 5 years;

‘personal identification components’, in relation to information, means so much of the information as includes any of the following:

(a) the name of the person to whom the information relates;

(b) the person’s address;

(d) the person’s Pharmaceutical entitlements number;

‘Pharmaceutical Benefits Program’ means the program for supplying pharmaceutical benefits under Part VII of this Act.”.

(2) On the commencement of this Act, consultations that took place under subsection 135AA(7) of the Principal Act before that commencement are taken to be consultations that took place under subsection 135AA(6) of the Principal Act as amended by this Act.

Breaches of the privacy guidelines

5. Section 135AB of the Principal Act is amended by omitting subsection (3) and substituting the following subsection:

“(3) If a complaint is made, Part V of the Privacy Act 1988 applies, with such modifications as the circumstances require, as if the complaint were an IPP complaint (within the meaning of that Act) made under section 36 of that Act.”.

PART 3—AMENDMENTS OF THE PRIVACY ACT 1988

Principal Act

6. In this Part, “Principal Act” means the Privacy Act 19882.

Interferences with privacy

7. Section 13 of the Principal Act is amended by inserting after paragraph (ba) the following paragraph:

“(bb) constitutes a breach of the guidelines in force under section 135 AA of the National Health Act 1953”.

Functions of Commissioner in relation to interferences with privacy

8. Section 27 of the Principal Act is amended by inserting after paragraph (1)(p) the following paragraph:

“(pa) to issue guidelines under section 135AA of the National Health Act 1953;”.

NOTES

1. No. 95, 1953, as amended. For previous amendments, see No. 68, 1955; Nos. 55 and 95, 1956; No. 92, 1957; No. 68, 1958; No. 72, 1959; No. 16, 1961; No. 82, 1962; No. 77, 1963; No. 37, 1964; Nos. 100 and 146, 1965; No. 44, 1966; Nos. 14 and 100, 1967; No. 100, 1968; No. 102, 1969; No. 41, 1970; No. 85, 1971; No. 114, 1972, Nos. 49 and 202, 1973; No. 37, 1974; Nos. 1, 13 and 93, 1975; Nos. 1, 60, 91, 99, 108, 157 and 177, 1976; Nos. 98 and 100, 1977; Nos. 36, 88, 132 and 189, 1978; Nos. 54, 91 and 122, 1979; Nos. 117 and 131, 1980; Nos. 40, 74, 92, 118, 163 and 176, 1981; Nos. 49, 80 and 112, 1982; Nos. 35, 54 and 139, 1983; Nos. 46, 63, 72, 120, 135 and 165, 1984; Nos. 24, 53, 65, 70, 95, 127 and 167, 1985; Nos. 28, 75, 94 and 115, 1986; Nos. 22, 44, 72, 118, 131 and 132, 1987; Nos. 79, 87, 99 and 155, 1988; No. 95, 1989; Nos. 3, 84, 106 and 141, 1990; Nos. 6, 68, 70, 73, 83, 84, 115, 116, 119, 122, 141, 169, 175, 208 and 211, 1991; and Nos. 70, 81, 88, 136, 192, 200 and 204, 1992.

2. No. 119, 1988, as amended. For previous amendments, see Nos. 11, 75, and 116, 1990; Nos 20, 28, 122, 136, and 194, 1991; No. 143, 1992.

[Minister’s second reading speech made in—

Senate on 6 May 1993

House of Representatives on 26 May 1993]

Overview

The National Health Amendment Act 1993 was enacted by the Parliament of Australia to address the need for improved privacy protections for personal information held by agencies in relation to claims for payment under the Medicare Benefits Program and the Pharmaceutical Benefits Program. This legislation amends the National Health Act 1953 to introduce privacy guidelines for the handling of such information, with the aim of ensuring that individuals' personal information is managed securely and confidentially. The Privacy Commissioner is tasked with issuing these guidelines, which must be consulted with relevant organisations before issuance and are subject to disallowance by Parliament. The Act also modifies the Privacy Act 1988 to include breaches of these guidelines as interferences with privacy, thereby extending the Commissioner's functions to cover these privacy breaches. The overarching policy objective is to safeguard personal health information and maintain public trust in the handling of sensitive data by government agencies.

Scope and Application

The National Health Amendment Act 1993 applies to the information held by agencies, specifically relating to individuals, which is obtained in connection with claims for payment of benefits under the Medicare Benefits Program or the Pharmaceutical Benefits Program. It amends the National Health Act 1953 by repealing section 135AA and substituting it with new provisions that detail the information to which the section applies and the information to which it does not apply, such as information identifying the provider of services or contained in specific eligibility databases. The Act also amends the Privacy Act 1988 to include breaches of the guidelines under the National Health Act as an interference with privacy. The Privacy Commissioner is required to issue guidelines specifying how information should be stored, used, and disclosed, with particular emphasis on prohibiting the storage and linkage of information from the two specified programs unless authorised. The Act extends its reach across the Commonwealth of Australia, affecting all agencies that handle personal information related to health benefits claims. Subordinate instruments may further extend or restrict the application of these provisions.

Key Provisions

The National Health Amendment Act 1993 introduces significant changes to the National Health Act 1953, primarily concerning the management and protection of personal health information. Under section 4, the Act repeals the previous section 135AA and substitutes it with a new section that defines the scope of information covered by privacy guidelines. This section applies to personal information held by agencies in connection with Medicare and Pharmaceutical Benefits Program claims, but excludes specific types of information such as those identifying service providers or those in eligibility databases (section 135AA(1)-(2)). The Privacy Commissioner is mandated to issue guidelines specifying how this information can be stored, used, and disclosed, prohibiting the mixing of Medicare and Pharmaceutical information in databases and linking them unless authorised (section 135AA(3)-(5)). The Commissioner must also consult with affected organisations before issuing these guidelines (section 135AA(6)). Guidelines are subject to disallowance, and failure to table them within six months of the Act's commencement requires a report to Parliament (sections 135AA(7)-(10)). The Act imposes obligations on agencies to adhere to the privacy guidelines issued by the Privacy Commissioner. This includes specific instructions on how information must be stored, used, and disclosed, as well as prohibitions on mixing certain types of information and linking databases unless expressly permitted by the guidelines (section 135AA(3)-(5)). Agencies must also comply with additional requirements for "old information," ensuring personal identification components are stored separately and can be re-linked under certain conditions (section 135AA(5)(f)). Furthermore, section 135AB(3) mandates that complaints regarding breaches of these guidelines be handled under Part V of the Privacy Act 1988. Breaches of the privacy guidelines are treated as interferences with privacy under section 13 of the Privacy Act 1988, which now includes breaches of the guidelines under section 135AA of the National Health Act 1953 (section 7). The Commissioner's functions are expanded to include issuing these guidelines (section 27(1)(pa)). While the Act does not specify penalties for breaches of the privacy guidelines, breaches of the Privacy Act 1988 can result in civil penalties for individuals (up to $180,000 for serious or repeated breaches) and criminal penalties for corporations (up to $1.8 million for serious or repeated breaches). These penalties reflect the importance of adhering to privacy protections in handling sensitive health information.

Area of Law: Privacy Law
Instrument: Act
Concepts: Commencement Provisions; Reporting & Disclosure Obligations; Enforcement Powers

Interactions

Sourced from the Federal Register of Legislation at 26 August 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au.

Legislation content

Overview

Scope and Application

Key Provisions

Legal classification tags

Interactions

Authorises

All Versions