Other legal matters

• Ensure staff receive initial and ongoing training in the use of My Health Record
• Create and maintain My Health Record policies for the organisation
• Take reasonable steps to prevent misuse of/unauthorised access to Healthcare Identifiers with account management measures
• Do not discriminate against any individual because they do/do not have a My Health Record, or because of the access controls they have set in their My Health Record
• Take care to ensure information is accurate to the best of your knowledge before uploading it to My Health Record

Acts, Rules and Regulations governing My Health Record

• My Health Records Act 2012
• My Health Records Rule 2016
• My Health Records Regulation 2012
• Healthcare Identifiers Act 2010
• Healthcare Identifiers Regulations 2010
• Privacy Act 1988 and Privacy Amendment (Enhancing Privacy Protection) Act 2012
• My Health Records (Assisted Registration) Rule 2015

State based legislation

Authority under the law to upload information is subject to two exceptions:

1. where the healthcare recipient withdraws their consent to the document being uploaded
2. where the clinical document includes health information subject to certain confidentiality provisions in either the Public Health Acts of NSW, Queensland or the ACT, and the healthcare organisation is subject to the particular Public Health Act.

NSW

In NSW, the types of health information are ‘Category 5 medical conditions’, which are AIDS and HIV; as well as health information relating to a cervical cancer test. These Public Health Act confidentiality provisions apply to ‘a medical practitioner’, and could be from either the public or private sector. As such, a healthcare provider in NSW cannot rely on the authority under the law model to upload information relating to AIDS, HIV and/or results of a cervical cancer test, but must request additional consent of the healthcare recipient to upload such health information to My Health Record.

Queensland and ACT

In Queensland and the ACT, the types of health information is much broader, and includes notifiable conditions, contagious conditions, cancer notifications and Pap smear register information. However, these Public Health Act confidentiality provisions apply only to persons who collect the information as part of performing a function under the Act (eg those public sector individuals who maintain a notifiable conditions register). Unless these persons are participants in My Health Record these confidentiality provisions do not seem to apply to providers uploading healthcare information to My Health Record