Regulatory Reform Omnibus Act 2025 (73 of 2025)

Schedule 2 Amendments to improve or maintain access to government services

Part 5 Authorising appropriate information sharing to improve the integrity of medicare

Health Insurance Act 1973

70 After section 129A

Insert:

129B Authorisations - dealings with certain information relating to medicare benefits for program integrity etc.

(1) This section applies to information that:

(a) relates to a person; and

(b) is held by an agency (whether or not the information was obtained by that agency, or any other agency, after the commencement of this section); and

(i) information obtained by the agency, or any other agency, in connection with a claim for a medicare benefit;

(ii) information relating to a person's eligibility or purported eligibility to be paid a medicare benefit;

(iii) information relating to a person who rendered or purportedly rendered a service in respect of which a medicare benefit is payable or purportedly payable.

Authorised collection, use and disclosure of information

(2) Information to which this section applies may be collected, used or disclosed for one or more of the purposes specified in subsection (3) in any of the following circumstances:

(a) the disclosure is by an officer (within the meaning of section 130) to an entrusted public official;

(b) the collection, use or disclosure is by an entrusted public official;

(i) the disclosure of the information is by the recipient to an entrusted public official; or

(ii) the use of the information is by the recipient for the purpose for which it was previously disclosed; or

(iii) the disclosure of the information is by the recipient to any other person for the purpose for which it was previously disclosed.

Note 1: Certain disclosures by persons related to Professional Services Review under Part VAA are not authorised by this section (see subsection (6)).

Note 2: Collection, use or disclosure authorised by this subsection is not prohibited by subsection 130(1) (see subsection 130(1A)).

Note 3: This subsection also constitutes an authorisation for the purposes of other laws, such as the Privacy Act 1988.

(3) The collection, use or disclosure is authorised if it is for one or more of the following purposes:

(a) the integrity or sustainability of a medicare program;

(b) the protection of a person from a risk arising from, or in connection with, the provision of a benefit or service under a medicare program;

(d) medical research;

(e) research and development in relation to health, disability or aged care;

(f) development, analysis, administration and review of, and reporting related to, government policy and programs in relation to health, disability or aged care;

(g) a disclosure of information that is required or authorised under an Australian law.

Note 1: For paragraph (a), section 130AAB extends the meaning of the integrity or sustainability of a medicare program.

Note 2: For paragraphs (c), (d) and (e), additional requirements apply to disclosures for the purposes of statistical analysis, medical research, or research and development in relation to health, disability or aged care (see subsections (4) and (5)).

Additional matters for disclosures relating to research or statistics

(4) This section does not authorise a disclosure for the purposes of medical research if:

(a) a person (the identifiable person ) is reasonably identifiable from the information that is proposed to be disclosed; and

(b) the person disclosing the information is not satisfied that:

(i) the identifiable person has given informed consent to the use and disclosure of the information for that research; or

(ii) the research is to be conducted in accordance with guidelines issued by the National Health and Medical Research Council under section 95 of the Privacy Act 1988.

(5) Before disclosing information under this section for the purposes of statistical analysis, medical research, or research and development in relation to health, disability or aged care, the person disclosing the information must consider the extent to which the disclosure complies with the data minimisation principle.

Disclosures relating to Professional Services Review not authorised

(6) This section does not authorise the following disclosures:

(a) disclosure by any of the following persons of information obtained as a result of a review or investigation under Part VAA:

(i) a person appointed under Division 2 of that Part;

(ii) a member of staff or a consultant engaged under section 106ZM or 106ZP;

(iii) a person whose services are made available under section 106ZN;

(iv) a person providing services under section 106ZPL;

(v) any other person engaged (whether as an employee or otherwise) by the Professional Services Review to provide services in connection with the performance of duties or functions, or the exercise of powers, under Part VAA;

(b) disclosure, by a person consulted under section 90, of information obtained in connection with that consultation.

Note: For paragraph (a), such persons include the Director or an Associate Director of Professional Services Review or a Panel member of the Professional Services Review Panel (all within the meaning of Part VAA).

No interference with information handling for My Heath Record or data-matching

(7) Nothing in this section prevents:

(a) the My Health Record System Operator including information to which this section applies in the My Health Record of a healthcare recipient; or

(b) the matching of information under subsection 132B(1) of the National Health Act 1953 or the operation of Part VIIIA of that Act generally.

Definitions

(8) In this section:

agency has the same meaning as in the Privacy Act 1988.

data minimisation principle means the principle of only using or disclosing as much information to which this section applies as is reasonably needed to achieve the purpose of the use or disclosure of the information.

My Health Record has the same meaning as in the My Health Records Act 2012.

My Health Record System Operator has the same meaning as System Operator has in the My Health Records Act 2012.

129C Authorisations - dealings with officer obtained or generated information for program integrity etc.

(1) This section applies to information that:

(a) is obtained or generated by an officer (within the meaning of section 130) in the performance of duties or functions, or in the exercise of powers, under this Act; and

(b) relates to the affairs of a person.

(2) Information to which this section applies may be collected, used or disclosed for one or more of the purposes specified in subsection (3) in any of the following circumstances:

(a) the disclosure is by a person who is or has been an officer (within the meaning of section 130) to an entrusted public official;

(b) the collection, use or disclosure is by an entrusted public official;

(i) the disclosure of the information is by the recipient to an entrusted public official; or

(ii) the use of the information is by the recipient for the purpose for which it was previously disclosed; or

(iii) the disclosure of the information is by the recipient to any other person for the purpose for which it was previously disclosed.

Note 1: Collection, use or disclosure authorised by this subsection is not prohibited by subsection 130(1) (see subsection 130(1A)).

Note 2: This subsection also constitutes an authorisation for the purposes of other laws, such as the Privacy Act 1988.

(3) The collection, use or disclosure is authorised if it is for one or more of the following purposes:

(a) the integrity or sustainability of a medicare program;

(b) the protection of a person from a risk arising from, or in connection with, the provision of a benefit or service under a medicare program;

(d) the administration of the following Acts:

(i) the Child Support (Assessment) Act 1989;

(ii) the Child Support (Registration and Collection) Act 1988.

Note: For paragraph (a), section 130AAB extends the meaning of the integrity or sustainability of a medicare program.

(4) However, this section does not authorise the following disclosures:

(a) disclosure by any of the following persons of information obtained as a result of a review or investigation under Part VAA:

(i) a person appointed under Division 2 of that Part;

(ii) a member of staff or a consultant engaged under section 106ZM or 106ZP;

(iii) a person whose services are made available under section 106ZN;

(iv) a person providing services under section 106ZPL;

(b) disclosure, by a person consulted under section 90, of information obtained in connection with that consultation.

129D Authorisations - dealings with information for enforcement, public revenue or integrity purposes

(1) This section applies to information that:

(a) is obtained or generated by an officer (within the meaning of section 130) in the performance of duties or functions, or in the exercise of powers, under this Act; and

(b) relates to the affairs of a person.

(2) An entrusted public official may use or disclose information for a purpose specified in subsection (3) if:

(a) the official reasonably believes that using or disclosing the information is necessary for that purpose; and

(b) for a disclosure of information - the disclosure is to an agency (within the meaning of the Privacy Act 1988) whose functions are directed at that purpose.

(3) The use or disclosure is authorised if it is for one or more of the following purposes:

(a) the enforcement of the criminal law;

(b) the enforcement of a law imposing a pecuniary penalty;

(d) an integrity purpose (within the meaning of the Crimes Act 1914).

129E Authorisation - disclosure of information by Director of Professional Services Review

(1) This section applies to information that:

(a) is obtained or generated by an officer (within the meaning of section 130) in the performance of duties or functions, or in the exercise of powers, under this Act; and

(b) relates to the affairs of a person.

Disclosure to certain professional bodies

(2) The Director of Professional Services Review appointed under section 83 (the Director ) may disclose to a person or body information to which this section applies if:

(a) the person or body has received from the Director:

(i) a statement under subsection 106XA(2) or (3), stating concerns that conduct by a practitioner (including a person who has been a practitioner) has caused, is causing, or is likely to cause, a significant threat to the life or health of any other person; or

(ii) a statement under subsection 106XB(2), stating concerns that a practitioner (including a person who has been a practitioner) has failed to comply with professional standards; and

(b) the information relates to any of the following:

(i) the review or investigation in connection with which the statement is given;

(ii) any matter covered by the review or investigation or the statement;

(iii) the services or benefits provided, or purportedly provided, by the practitioner under a medicare program; and

(i) necessary for the purposes of the National Law; and

(ii) in the public interest.

Disclosure for program integrity, patient safety etc.

(3) The Director may disclose information to which this section applies if:

(a) the disclosure is for the purposes of any of the following:

(i) the integrity or sustainability of a medicare program;

(ii) the protection of a person from a risk arising from, or in connection with, the provision of a benefit or service under a medicare program;

(iii) proceedings to recover an amount that is recoverable under this Act, the Dental Benefits Act 2008 or the National Health Act 1953 as a debt due to the Commonwealth, or is otherwise required by or under those Acts to be repaid to the Commonwealth;

(iv) any other proceedings in relation to compliance with a requirement under this Act; and

(b) the Director is satisfied that the disclosure is in the public interest.

Note: For subparagraph (a)(i), section 130AAB extends the meaning of the integrity or sustainability of a medicare program.

Disclosure for duties, functions or powers under any Act

(4) The Director may disclose information to which this section applies to facilitate the performance of duties or functions, or the exercise of powers, by the Director or any other person under this Act or any other Act.

Note 1: Subsections (2), (3) and (4) constitute permissions or authorisations for the purposes of section 106ZR or 130 (see subsection 106ZR(1) (which exempts disclosures required or permitted under this Act) and subsection 130(1A)).

Note 2: Subsections (2), (3) and (4) also constitute authorisations for the purposes of other laws, such as the Privacy Act 1988.

Terms and conditions applicable to recipients

(5) If the Director discloses information to a person or body (the recipient ) under subsection (2), (3) or (4), the Director may, by instrument in writing, specify terms and conditions subject to which the information may be used or disclosed by the recipient.

(6) Without limiting subsection (5), the instrument may require the recipient to give an undertaking in writing with respect to the use or disclosure of the information by the recipient, which may include an undertaking not to disclose any of the information to any other person or body.

(7) An instrument under subsection (5) is not a legislative instrument.

129F Authorisation - use for authorised disclosure

(1) This section applies to information that:

(a) is obtained or generated by an officer (within the meaning of section 130) in the performance of duties or functions, or in the exercise of powers, under this Act; and

(b) relates to the affairs of a person.

(2) A person may use information to which this section applies for the purpose of disclosing the information under section 129B, 129C, 129D, 129E or 130.

Copyright notice

You are free to copy, adapt, modify, transmit and distribute material on this website as you wish (but not in any way that suggests the ATO or the Commonwealth endorses you or any of your services or products).