Regulatory Reform Omnibus Act 2025 (73 of 2025)

Schedule 2   Amendments to improve or maintain access to government services

Part 5   Authorising appropriate information sharing to improve the integrity of medicare

National Health Act 1953

153   Sections 135AA and 135AB

Repeal the sections, substitute:

135ABA Authorisations - dealings with certain information relating to pharmaceutical benefits for program integrity etc.

(1) This section applies to information that:

(a) relates to a person; and

(b) is held by an agency (whether or not the information was obtained by that agency, or any other agency, after the commencement of this section); and

(c) is any of the following:

(i) information obtained by the agency, or any other agency, in connection with a claim for payment of a benefit under the Pharmaceutical Benefits Program;

(ii) information obtained by the agency, or any other agency, in connection with a supply of a pharmaceutical benefit;

(iii) information relating to a person's eligibility or entitlement to receive a pharmaceutical benefit, to receive payment in respect of the supply of a pharmaceutical benefit or to be paid a benefit under the Pharmaceutical Benefits Program.

Authorised collection, use and disclosure of information

(2) Information to which this section applies may be collected, used or disclosed for one or more of the purposes specified in subsection (3) in any of the following circumstances:

(a) the disclosure is by an officer (within the meaning of section 135A) to an entrusted public official;

(b) the collection, use or disclosure is by an entrusted public official;

(c) if the information was previously disclosed to a person (the recipient ) by an entrusted public official:

(i) the disclosure of the information is by the recipient to an entrusted public official; or

(ii) the use of the information is by the recipient for the purpose for which it was previously disclosed; or

(iii) the disclosure of the information is by the recipient to any other person for the purpose for which it was previously disclosed.

Note 1: Collection, use or disclosure authorised by this subsection is not prohibited by subsection 135A(1) (see subsection 135A(1A)).

Note 2: This subsection also constitutes an authorisation for the purposes of other laws, such as the Privacy Act 1988.

(3) The collection, use or disclosure is authorised if it is for one or more of the following purposes:

(a) the integrity or sustainability of a medicare program;

(b) the protection of a person from a risk arising from, or in connection with, the provision of a benefit or service under a medicare program;

(c) statistical analysis;

(d) medical research;

(e) research and development in relation to health, disability or aged care;

(f) development, analysis, administration and review of, and reporting related to, government policy and programs in relation to health, disability or aged care;

(g) a disclosure of information that is required or authorised under an Australian law.

Note 1: For paragraph (a), section 135ACC extends the meaning of the integrity or sustainability of a medicare program.

Note 2: For paragraphs (c), (d) and (e), additional requirements apply to disclosures for the purposes of statistical analysis, medical research, or research and development in relation to health, disability or aged care (see subsections (4) and (5)).

Additional matters for disclosures relating to research or statistics

(4) However, this section does not authorise a disclosure for the purposes of medical research if:

(a) a person (the identifiable person ) is reasonably identifiable from the information that is proposed to be disclosed; and

(b) the person disclosing the information is not satisfied that:

(i) the identifiable person has given informed consent to the use and disclosure of the information for that research; or

(ii) the research is to be conducted in accordance with guidelines issued by the National Health and Medical Research Council under section 95 of the Privacy Act 1988.

(5) Before disclosing information under this section for the purposes of statistical analysis, medical research, or research and development in relation to health, disability or aged care, the person disclosing the information must consider the extent to which the disclosure complies with the data minimisation principle.

No interference with information handling for My Heath Record or data-matching

(6) Nothing in this section prevents:

(a) the My Health Record System Operator including information to which this section applies in the My Health Record of a healthcare recipient; or

(b) the matching of information under subsection 132B(1) or the operation of Part VIIIA generally.

Definitions

(7) In this section:

agency has the same meaning as in the Privacy Act 1988.

data minimisation principle means the principle of only using or disclosing as much information to which this section applies as is reasonably needed to achieve the purpose of the use or disclosure of the information.

My Health Record has the same meaning as in the My Health Records Act 2012.

My Health Record System Operator has the same meaning as System Operator has in the My Health Records Act 2012.

Pharmaceutical Benefits Program means the program for supplying pharmaceutical benefits under Part VII of this Act.

135ABB Authorisations - dealings with officer obtained or generated information for program integrity etc.

(1) This section applies to information that:

(a) is obtained or generated by an officer (within the meaning of section 135A) in the performance of duties or functions, or in the exercise of powers, under this Act; and

(b) relates to the affairs of a person.

(2) Information to which this section applies may be collected, used or disclosed for one or more of the purposes specified in subsection (3) in any of the following circumstances:

(a) the disclosure is by a person who is or has been an officer (within the meaning of section 135A) to an entrusted public official;

(b) the collection, use or disclosure is by an entrusted public official;

(c) if the information was previously disclosed to a person (the recipient ) by an entrusted public official:

(i) the disclosure of the information is by the recipient to an entrusted public official; or

(ii) the use of the information is by the recipient for the purpose for which it was previously disclosed; or

(iii) the disclosure of the information is by the recipient to any other person for the purpose for which it was previously disclosed.

Note 1: Collection, use or disclosure authorised by this subsection is not prohibited by subsection 135A(1) (see subsection 135A(1A)).

Note 2: This subsection also constitutes an authorisation for the purposes of other laws, such as the Privacy Act 1988.

(3) The collection, use or disclosure is authorised if it is for one or more of the following purposes:

(a) the integrity or sustainability of a medicare program;

(b) the protection of a person from a risk arising from, or in connection with, the provision of a benefit or service under a medicare program;

(c) the administration of a centrelink program (within the meaning of the Human Services (Centrelink) Act 1997);

(d) the administration of the following Acts:

(i) the Child Support (Assessment) Act 1989;

(ii) the Child Support (Registration and Collection) Act 1988.

Note: For paragraph (a), section 135ACC extends the meaning of the integrity or sustainability of a medicare program.

(4) However, this section does not authorise the following disclosures:

(a) disclosure by any of the following persons of information obtained as a result of a review or investigation under Part VAA of the Health Insurance Act 1973:

(i) a person appointed under Division 2 of that Part;

(ii) a member of staff or a consultant engaged under section 106ZM or 106ZP of that Act;

(iii) a person whose services are made available under section 106ZN of that Act;

(iv) a person providing services under section 106ZPL of that Act;

(v) any other person engaged (whether as an employee or otherwise) by the Professional Services Review to provide services in connection with the performance of duties or functions, or the exercise of powers, under that Part;

(b) disclosure, by a person consulted under section 90 of that Act, of information obtained in connection with that consultation.

Note: For paragraph (a), such persons include the Director or an Associate Director of Professional Services Review or a Panel member of the Professional Services Review Panel (all within the meaning of Part VAA of the Health Insurance Act 1973).

135ABC Authorisations - dealings with information for enforcement, public revenue or integrity purposes

(1) This section applies to information that:

(a) is obtained or generated by an officer (within the meaning of section 135A) in the performance of duties or functions, or in the exercise of powers, under this Act; and

(b) relates to the affairs of a person.

(2) An entrusted public official may use or disclose information for a purpose specified in subsection (3) if:

(a) the official reasonably believes that using or disclosing the information is necessary for that purpose; and

(b) for a disclosure of information - the disclosure is to an agency (within the meaning of the Privacy Act 1988) whose functions are directed at that purpose.

(3) The use or disclosure is authorised if it is for one or more of the following purposes:

(a) the enforcement of the criminal law;

(b) the enforcement of a law imposing a pecuniary penalty;

(c) the protection of the public revenue;

(d) an integrity purpose (within the meaning of the Crimes Act 1914).