Commonwealth Consolidated Acts

NATIONAL HEALTH ACT 1953 - SECT 135AA

Information to which this section applies

             (1)  Subject to subsection (2), this section applies to information that:

                     (a)  is information relating to an individual; and

                     (b)  is held by an agency (whether or not the information was obtained by that agency or any other agency after the commencement of this section); and

                     (c)  was obtained by that agency or any other agency in connection with a claim for payment of a benefit under the Medicare Benefits Program or the Pharmaceutical Benefits Program.

Information to which this section does not apply

             (2)  This section does not apply to such information:

                     (a)  so far as it identifies:

                              (i)  a person who provided the service or goods in connection with which the claim for payment is made; or

                             (ii)  a person who, in his or her capacity as the provider of services, made a referral or request to another person to provide the service or goods; or

                     (b)  so far as it is contained in a database that:

                              (i)  is maintained for the purpose of identifying persons who are eligible to be paid benefits under the Medicare Benefits Program or the Pharmaceutical Benefits Program; and

                             (ii)  does not contain information relating to claims for payment of such benefits; or

                     (c)  so far as it is not stored in a database.

Issuing guidelines

             (3)  The Privacy Commissioner must, by written notice, issue guidelines relating to information to which this section applies.

Replacing or varying guidelines

             (4)  At any time, the Privacy Commissioner may, by written notice, issue further guidelines that vary the existing guidelines .

Content of guidelines

             (5)  So far as practicable, the guidelines must:

                     (a)  specify the ways in which information may be stored and, in particular, specify the circumstances in which creating copies of information in paper or similar form is prohibited; and

                     (b)  specify the uses to which agencies may put information; and

                     (c)  specify the circumstances in which agencies may disclose information; and

                     (d)  prohibit agencies from storing in the same database:

                              (i)  information that was obtained under the Medicare Benefits Program; and

                             (ii)  information that was obtained under the Pharmaceutical Benefits Program; and

                     (e)  prohibit linkage of:

                              (i)  information that is held in a database maintained for the purposes of the Medicare Benefits Program; and

                             (ii)  information that is held in a database maintained for the purposes of the Pharmaceutical Benefits Program;

                            unless the linkage is authorised in the way specified in the guidelines; and

                      (f)  specify the requirements with which agencies must comply in relation to old information, in particular requirements that:

                              (i)  require the information to be stored in such a way that the personal identification components of the information are not linked with the rest of the information; and

                             (ii)  provide for the longer term storage and retrieval of the information; and

                            (iii)  specify the circumstances in which, and the conditions subject to which, the personal identification components of the information may later be re‑linked with the rest of the information.

          (5A)  Nothing in this section, or in the guidelines issued by the Privacy Commissioner, precludes the inclusion, in a database of information held by the Medicare Australia CEO and relating to claims for benefits under the Pharmaceutical Benefits Program, of the pharmaceutical entitlements number applicable to the person to whom each such claim relates:

                     (a)  as a person covered by a benefit entitlement card; or

                     (b)  as a person included within a class identified by the Minister in a determination under subsection 86E(1).

Consultation

             (6)  Before issuing guidelines, the Privacy Commissioner must take reasonable steps to consult with organisations (including agencies) whose interests would be affected by the guidelines .

Disallowance

             (7)  Guidelines are disallowable instruments for the purposes of section 46A of the Acts Interpretation Act 1901.

When guidelines take effect

             (8)  Despite section 46A and paragraph 48(1)(b) of the Acts Interpretation Act 1901 , guidelines take effect from:

                     (a)  the first day on which they are no longer liable to be disallowed; or

                     (b)  if the guidelines provide for their commencement after that day--in accordance with that provision.

Failure to table first guidelines within 6 months

             (9)  If guidelines issued under subsection (1) are not laid before each House of the Parliament under paragraph 48(1)(c) of the Acts Interpretation Act 1901 (as applied by section 46A of that Act) within 6 months after the commencement of this section, the Privacy Commissioner must report the failure to issue guidelines within that period to each House of the Parliament within 15 sitting days of that House after the end of the period.

Tabling first guidelines after 6 months

           (10)  Subsection (9) does not render invalid guidelines issued under subsection (3) that are not laid before each House of the Parliament within that period .

Definitions

           (11)  In this section:

"agency" has the same meaning as in the Privacy Act 1988 .

"benefit entitlement card" means:

                     (a)  a medicare card within the meaning of subsection 84(1); and

                     (b)  a card that evidences the person's status as a concessional beneficiary within the meaning of subsection 84(1).

"database" means a discrete body of information stored by means of a computer.

"Medicare Benefits Program" means the program for providing Medicare benefits under the Health Insurance Act 1973 .

"old information" means information to which this section applies that has been held by one or more agencies for at least the preceding 5 years.

"personal identification components" , in relation to information, means so much of the information as includes any of the following:

                     (a)  the name of the person to whom the information relates;

                     (b)  the person's address;

                     (c)  the person's Medicare card number;

                     (d)  the person's Pharmaceutical entitlements number.

"Pharmaceutical Benefits Program" means the program for supplying pharmaceutical benefits and special pharmaceutical products under Part VII of this Act.

"pharmaceutical entitlements number" , in relation to a person, means:

                     (a)  if the person is covered by a medicare card--a medicare number within the meaning of subsection 84(1) that is applicable to the person as a person covered by that card; and

                     (b)  if the person is covered by a card that evidences the person's status as a concessional beneficiary within the meaning of subsection 84(1)--the number applicable to that person as a person covered by that card.