Private Health Insurance (Health Insurance Business) Amendment Rules 2025

Administered by Department of Health, Disability and Ageing

Legislation au F2025L00519 Rules Not in force Legislative Instrument

Legislation content

EXPLANATORY STATEMENT

 

Private Health Insurance Act 2007

 

Private Health Insurance (Health Insurance Business) Amendment Rules 2025

 

Authority

 

Subsection 333-20(1) of the Private Health Insurance Act 2007 (the Act) authorises the Minister for Health and Aged Care (the Minister) to, by legislative instrument, make Private Health Insurance Rules. The types of rules are specified in the second column of the table provided in subsection 333-20(1). In particular, item 6 of the table authorises the Minister to make Private Health Insurance (Health Insurance Business) Rules providing for matters required or permitted by Part 4-2 of the Act, or necessary or convenient in order to carry out or give effect to Part 4-2 of the Act. Part 4-2 defines the key concept of health insurance business and provides for associated requirements.

 

Subsection 33(3) of the Acts Interpretation Act 1901 provides that where an Act confers a power to make, grant or issue any instrument of a legislative or administrative character (including rules, regulations or by-laws), the power shall be construed as including a power exercisable in the like manner and subject to the like conditions (if any) to repeal, rescind, revoke, amend, or vary any such instrument.

 

Purpose

 

The Private Health Insurance (Health Insurance Business) Amendment Rules 2025 (the Amendment Rules) amend the Private Health Insurance (Health Insurance Business) Rules 2018 (the Rules) to update the kinds of statistical information to be provided by hospitals to private health insurers, and by private hospitals to the Department of Health and Aged Care (the Department).

 

Background

 

Subsection 121-5(6) of the Act enables the Minister to make or revoke a declaration that a facility is a public or private hospital for the purposes of the Act. The Act specifies a number of matters to which the Minister must have regard in making or revoking a declaration under subsection 121-5(6), including whether the facility has entered into or complied with undertakings to provide private health insurers with the kinds of information specified in the Rules relating to the hospital treatment of insured persons under complying health insurance products that are referable to health benefit funds (paragraph 121-5(7)(e)). Furthermore, subsection 121-7(2) of the Act enables the Rules to specify conditions to which facilities declared under subsection 121-5(6) are subject. Under rule 7 of the Rules, declared private hospitals are subject to conditions requiring provision of data to the Department. 

 

The Rules apply and incorporate the following instruments without modification:

  1.      The matters contained in the document titled “HCP Data from Hospitals to Insurers” (the HCP document) (approved by the Assistant Secretary of the Private Hospitals Branch of the Department on 14 April 2025); and
  2.   The matters contained in the document titled “PHDB Data from Private Hospitals to the Department” (the PHDB document) (approved by the Assistant Secretary of the Private Hospitals Branch of the Department on 14 April 2025),

 

from the time the Amendment Rules commence.

 

The Hospital Casemix Protocol (HCP) and Private Hospital Data Bureau (PHDB) documents, as specified in the Amendment Rules and approved on 14 April 2025, replace the documents that were referred to previously in the Rules, and can be found free of charge on the Department’s website using the following link: https://www.health.gov.au/resources/collections/hospital-data-resources.

 

Supply of the “HCP Data from Hospitals to Insurers” involves the disclosure of sensitive personal information, including health information, from hospitals to private health insurers. However the information supplied is provided by hospitals with the patient’s consent as part of the patient’s contractual relationship with their hospital and private health insurer. There are protections for the information provided to insurers under the Privacy Act 1988 and/or state or territory privacy laws. 

 

Supply of the “PHDB Data from Private Hospitals to the Department” involves the disclosure of de-identified statistical information about the treatment of insured persons, from private hospitals to the Department. The information supplied could not be used by the Department to identify a patient. Further, this information is protected by subsection 323-1(1) of the Act, which makes it an offence to disclose the information where the disclosure is not authorised by the Act.  

 

Data specifications are reviewed routinely every year by the Department. Following consultation with external stakeholders, changes are generally introduced effective 1 July in each financial year.

 

Changes to the 2025/26 data specifications are designed to align with national metadata standards published in METeOR, the Australian Institute of Health and Welfare’s Metadata online registry, and to improve data quality.

 

Commencement

 

The Amendment Rules commence on 1 July 2025.

 

Consultation

 

The Department has consulted with private health insurers and the hospital sector (private and public) about the Amendment Rules through existing working group arrangements. The working groups are comprised of representatives from the Department and industry stakeholdersThe feedback received from industry is that it is appropriate for amendments to be managed by the existing working group arrangements. Previous amendments have also been managed in this way. The amended data specifications are distributed to industry via a Private Health Insurance Circular published by the Department. Private Health Insurance Circulars can be accessed at the following link: https://www.health.gov.au/news/phi-circulars.

 

Subsection 115-5(2) of the Act requires that the Minister must consult the Australian Prudential Regulation Authority (APRA) before making the Amendment Rules. The Department consulted APRA by email on 3 February 2025.

 

The Amendment Rules are a legislative instrument for the purposes of the Legislation Act 2003. 


Attachment

 

Details of the Private Health Insurance (Health Insurance Business) Amendment Rules 2025

 

Section 1         Name

 

Section 1 provides that the name of the instrument is the Private Health Insurance (Health Insurance Business) Amendment Rules 2025.

 

Section 2         Commencement

 

Section 2 provides that the instrument commences on 1 July 2025.

Section 3         Authority

 

Section 3 provides that the instrument is made under item 6 of the table in subsection 333-20(1) of the Private Health Insurance Act 2007.

Section 4         Schedules

 

Section 4 provides that each instrument that is specified in a Schedule to the instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to the instrument has effect according to its terms.

 

Schedule 1—Amendments

 

Private Health Insurance (Health Insurance Business) Rules 2018

 

Item 1 repeals subrule 4(2) and substitutes a new subrule 4(2), which provides that in rule 4, HCP Data from Hospitals to Insurers means the protocol set out in the document approved by the Assistant Secretary of the Private Hospitals Branch of the Department of Health and Aged Care on 14 April 2025 which consists of “Data Specifications (HCP)” and “Explanatory Notes (HCP)”, and sets out the data specifications for data provided by hospitals to private health insurers.

 

Item 2 repeals subrule 7(3) and substitutes a new subrule 7(3), which provides that in rule 7, PHDB Data from Private Hospitals to the Department means the protocol set out in the document approved by the Assistant Secretary of the Private Hospitals Branch of the Department of Health and Aged Care on 14 April 2025 which consists of “Data Specifications (PHDB)” and “Explanatory Notes (PHDB)”, and sets out the data specifications for data provided by private hospitals to the Department.


Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

 

Private Health Insurance (Health Insurance Business) Amendment Rules 2025

This Disallowable Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

 

Overview of the Disallowable Legislative Instrument

Private Health Insurance (Health Insurance Business) Rules provide for matters required or permitted by Part 4-2 of the Private Health Insurance Act 2007 (the Act), or necessary or convenient in order to carry out or give effect to Part 4-2 of the Act.

 

The Private Health Insurance (Health Insurance Business) Amendment Rules 2025 (the Amendment Rules) amend the Private Health Insurance (Health Insurance Business) Rules 2018 (the Rules) to update the kinds of statistical information to be provided by hospitals to insurers, and by private hospitals to the Department of Health and Aged Care (the Department).

 

Under paragraph 121-5(7)(e) of the Act, when making or revoking a hospital declaration the Minister for Health and Aged Care must have regard to whether the facility has entered into or complied with undertakings to provide private health insurers with information specified in the Rules relating to the treatment of insured persons.

 

Subsection 121-7(2) of the Act provides that hospital declarations are subject to any conditions specified in the Rules. Rule 7 of the Rules provides that private hospital declarations are subject to the conditions that the hospital provides the Department with the kinds of information specified in the PHDB Data from Private Hospital to the Department.

 

The Rules apply and incorporate the following instruments without modification:

  1.      The matters contained in the document titled “HCP Data from Hospitals to Insurers” (the HCP document) (approved by the Assistant Secretary of the Private Hospitals Branch of the Department on 14 April 2025); and
  2.     The matters contained in the document titled “PHDB Data from Private Hospitals to the Department” (the PHDB document) (approved by the Assistant Secretary of the Private Hospitals Branch of the Department on 14 April 2025),

 

from the time the Amendment Rules commence.

 

The Amendment Rules will commence on 1 July 2025.

 

The revised Hospital Casemix Protocol (HCP) and the Private Hospital Data Bureau (PHDB) documents, as specified in the Amendment Rules and as approved on 14 April 2025, can be found on the Department’s website using the following link: https://www.health.gov.au/resources/collections/hospital-data-resources.

 


Human rights implications

The Amendment Rules engage the human right to privacy under Article 17 of the International Covenant on Civil and Political Rights, but does not result in any limitation of that right.

 

Supply of the “HCP Data from Hospitals to Insurers” involves the disclosure of sensitive personal information of patients, including health information, from hospitals to private health insurers. However the information supplied is provided by hospitals with the patient’s consent as part of the patient’s contractual relationship with their hospital and private health insurer. There are protections for the information provided to insurers under the Privacy Act 1988 and/or state or territory privacy laws.  

 

Supply of the “PHDB Data from Private Hospitals to the Department” involves the disclosure of de-identified statistical information about the treatment of insured persons, from private hospitals to the Department. The information supplied could not be used by the Department to identify a patient. Further, this information is protected by subsection 323-1(1) of the Act, which makes it an offence to disclose the information where the disclosure is not authorised by the Act. 

 

Conclusion

The Amendment Rules are compatible with human rights as although it engages the right to privacy in relation to disclosure of personal information, it does not limit that right.

 

Brian Kelleher

Assistant Secretary

Private Hospitals Branch

Department of Health and Aged Care

Overview

The Private Health Insurance (Health Insurance Business) Amendment Rules 2025 update the kinds of statistical information required to be provided by hospitals to private health insurers, and by private hospitals to the Department of Health and Aged Care. Enacted under item 6 of the table in subsection 333-20(1) of the Private Health Insurance Act 2007, the Amendment Rules are made by the Minister for Health and Aged Care. The primary objective of these amendments is to align the data specifications with national metadata standards and improve data quality, ensuring the ongoing effectiveness and relevance of health insurance data reporting. The Amendment Rules will commence on 1 July 2025, replacing the previous data specifications with those approved on 14 April 2025, which can be found on the Department’s website. Although the amendments involve the disclosure of sensitive personal information, stringent privacy protections are in place under the Privacy Act 1988 and/or state or territory privacy laws.

Scope and Application

The Private Health Insurance (Health Insurance Business) Amendment Rules 2025 apply to hospitals and private health insurers within the Commonwealth of Australia. These rules are made under the authority of the Private Health Insurance Act 2007, specifically under item 6 of the table in subsection 333-20(1) of the Act. They amend the Private Health Insurance (Health Insurance Business) Rules 2018 to update the types of statistical information hospitals must provide to private health insurers and private hospitals must provide to the Department of Health and Aged Care. These rules incorporate, without modification, the "HCP Data from Hospitals to Insurers" and "PHDB Data from Private Hospitals to the Department" documents, approved by the Assistant Secretary of the Private Hospitals Branch on 14 April 2025. The Amendment Rules are effective from 1 July 2025, and include provisions for consultation with private health insurers and the hospital sector through existing working group arrangements. The rules also ensure compliance with privacy laws, including the Privacy Act 1988 and state or territory privacy laws, and protect against unauthorised disclosure of information. The Amendment Rules do not specify any exclusions, exemptions, or thresholds, but allow for further amendments or variations through subordinate instruments as necessary.

Key Provisions

The main operative sections of the Private Health Insurance (Health Insurance Business) Amendment Rules 2025 (Amendment Rules) involve amending the Private Health Insurance (Health Insurance Business) Rules 2018 (Rules). Specifically, Section 4 of the Amendment Rules outlines the Schedules, where Schedule 1, Item 1 repeals subrule 4(2) and substitutes a new subrule to define HCP Data from Hospitals to Insurers, and Schedule 1, Item 2 repeals subrule 7(3) and substitutes a new subrule to define PHDB Data from Private Hospitals to the Department. These changes are effective from the commencement of the Amendment Rules on 1 July 2025. The Amendment Rules impose obligations on hospitals, private health insurers, and the Department of Health and Aged Care. Hospitals are required to provide sensitive personal information, including health information, to private health insurers with patient consent, as stipulated by the HCP Data from Hospitals to Insurers. Private hospitals must supply de-identified statistical information about the treatment of insured persons to the Department, as outlined by the PHDB Data from Private Hospitals to the Department. These obligations are designed to ensure that accurate and relevant data is shared to support the administration and regulation of private health insurance. Any breach of the obligations outlined in the Amendment Rules could lead to civil or criminal consequences. For instance, under subsection 323-1(1) of the Private Health Insurance Act 2007, it is an offence to disclose information supplied under the PHDB Data from Private Hospitals to the Department where the disclosure is not authorised by the Act. Penalties for such offences can vary, but they may include substantial fines or imprisonment depending on the severity of the breach. Additionally, failure to provide the required data could result in regulatory actions against the non-compliant party, potentially impacting their ability to operate within the private health insurance sector.

Legal classification tags

Area of Law
Health Law
Privacy Law
Instrument
Regulation
Concepts
Definitions & Interpretation
Reporting & Disclosure Obligations
Offence Provisions
Compliance Obligations

Interactions

Authorises

All Versions

Sourced from the Federal Register of Legislation at 26 August 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au.