Criminal and civil penalties
There are criminal and civil penalties that apply for intentional misuse of My Health Record. Under the My Health Records Act, it is an offence to deliberately or recklessly access, use or disclose My Health Record information without authorisation. Penalties can include imprisonment and financial penalties for individuals and organisations.
Accidental access is not punishable under the My Health Records Act but may still be a breach under the Privacy Act and may require internal reporting and possible notification to the Australian Digital Health Agency or the Office of the Australian Information Commissioner (OAIC).