{"id":"nsw:sl-2022-0467","name":"Health Records and Information Privacy Regulation 2022","slug":"health-records-and-information-privacy-regulation-2022","collection":"regulation","jurisdiction":"nsw","status":"in_force","isInForce":true,"actNumber":"467 of 2022","makingDate":null,"administeringDepartment":null,"currentVersion":{"id":176021,"registerId":"nsw-nsw:sl-2022-0467-current","compilationNumber":null,"startDate":"2026-04-05","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Part 1","sectionType":"part","heading":"Preliminary","content":"# Part 1 Preliminary\n\nPart 1 Preliminary","sortOrder":0},{"sectionNumber":"1","sectionType":"section","heading":"Name of Regulation","content":"#### 1 Name of Regulation\n\n1 Name of Regulation\n\n> This Regulation is the [Health Records and Information Privacy Regulation 2022](/view/html/inforce/current/sl-2022-0467).","sortOrder":1},{"sectionNumber":"2","sectionType":"section","heading":"Commencement","content":"#### 2 Commencement\n\n2 Commencement\n\n> This Regulation commences on the day on which it is published on the NSW legislation website.\n> \n> Note—\n> \n> This Regulation repeals and replaces the [Health Records and Information Privacy Regulation 2017](/view/html/repealed/current/sl-2017-0215), which would otherwise be repealed on 1 September 2022 by the [Subordinate Legislation Act 1989](/view/html/inforce/current/act-1989-146), section 10(2).","sortOrder":2},{"sectionNumber":"3","sectionType":"section","heading":"Definitions","content":"#### 3 Definitions\n\n3 Definitions\n\n> > (1) In this Regulation—\n> > \n> > accredited chaplain, in relation to a public hospital or health institution, means a person—\n> > \n> > > (a) who has been accredited for the purposes of providing chaplaincy services in the hospital or institution by the chief executive of the public health organisation that controls the hospital or institution, and\n> > \n> > > (b) whose accreditation has not been revoked.\n> > \n> > chief executive, in relation to a public health organisation, has the same meaning as in the [Health Services Act 1997](/view/html/inforce/current/act-1997-154).\n> > \n> > health institution, public health organisation and public hospital have the same meanings as in the [Health Services Act 1997](/view/html/inforce/current/act-1997-154).\n> > \n> > the Act means the [Health Records and Information Privacy Act 2002](/view/html/inforce/current/act-2002-071).\n> > \n> > Note—\n> > \n> > The Act and the [Interpretation Act 1987](/view/html/inforce/current/act-1987-015) contain definitions and other provisions that affect the interpretation and application of this Regulation.\n> \n> > (2) A reference in this Regulation to a public hospital or health institution controlled by a public health organisation includes a reference to a public hospital or health institution that is conducted by or on behalf of the organisation.","sortOrder":3},{"sectionNumber":"4","sectionType":"section","heading":"Definition of “health service”—the Act, s 4","content":"#### 4 Definition of “health service”—the Act, s 4\n\n4 Definition of “health service”—the Act, s 4\n\n> For the Act, section 4(1), definition of health service, paragraph (l), the following are prescribed—\n> \n> > (a) services provided by an accredited chaplain in a public hospital or health institution controlled by a public health organisation,\n> \n> > (b) research services conducted by or on behalf of the following—\n> > \n> > > (i) the Ministry of Health,\n> > \n> > > (ii) the Health Administration Corporation,\n> > \n> > > (iii) a public health organisation,\n> > \n> > > (iv) a public hospital,\n> > \n> > > (v) the Cancer Institute (NSW),\n> \n> > (c) research services conducted under an agreement with an organisation referred to in paragraph (b),\n> \n> > (d) services provided by the Centre for Health Record Linkage (CHeReL),\n> \n> > (e) services relating to the establishment and operation of the Single Digital Patient Record (the SDPR), including services to—\n> > \n> > > (i) provide and control access to the SDPR, and\n> > \n> > > (ii) create or manage records in or accessible via the SDPR, including archived records.\n> \n> **s 4:** Am 2023 (642), Sch 1; 2025 (240), Sch 1.","sortOrder":4},{"sectionNumber":"Part 2","sectionType":"part","heading":"Use or disclosure of health information—the Act, Sch 1, cll 10 and 11","content":"# Part 2 Use or disclosure of health information—the Act, Sch 1, cll 10 and 11\n\nPart 2 Use or disclosure of health information—the Act, Sch 1, cll 10 and 11","sortOrder":5},{"sectionNumber":"5","sectionType":"section","heading":"Chaplaincy services","content":"#### 5 Chaplaincy services\n\n5 Chaplaincy services\n\n> > (1) For the Act, Schedule 1, clauses 10(1)(k) and 11(1)(l), a public health organisation may use or disclose health information for the secondary purpose of providing the service of an accredited chaplain in a public hospital or health institution controlled by the public health organisation.\n> \n> > (2) Subsection (1) applies only if the individual to whom the health information relates would reasonably expect the public health organisation to use or disclose the health information for the secondary purpose.\n> \n> > (3) Subsection (1) applies only to the disclosure of health information if the disclosure is made to an accredited chaplain for the public hospital or health institution.","sortOrder":6},{"sectionNumber":"6","sectionType":"section","heading":"Professional misconduct","content":"#### 6 Professional misconduct\n\n6 Professional misconduct\n\n> > (1) For the Act, Schedule 1, clauses 10(1)(k) and 11(1)(l), an organisation may use or disclose health information for a secondary purpose if—\n> > \n> > > (a) the organisation has reasonable grounds to suspect a person has or may have engaged in conduct that may be unsatisfactory professional performance, professional misconduct or unprofessional conduct under the Health Practitioner Regulation National Law, and\n> > \n> > > (b) the use or disclosure is necessary as part of an investigation of the matter by, or in reporting concerns to, relevant persons or authorities, including a National Board or an investigator appointed under the Health Practitioner Regulation National Law by a National Board.\n> \n> > (2) In this section—\n> > \n> > Health Practitioner Regulation National Law means—\n> > \n> > > (a) the Health Practitioner Regulation National Law—\n> > > \n> > > > (i) as in force from time to time, set out in the Schedule to the Health Practitioner Regulation National Law Act 2009 of Queensland, and\n> > > \n> > > > (ii) as it applies, including with any modifications, as a law of a State or Territory other than New South Wales, or\n> > \n> > > (b) the law of another State or Territory that substantially corresponds to the law referred to in paragraph (a).\n> > \n> > National Board has the same meaning as in the Health Practitioner Regulation National Law.","sortOrder":7},{"sectionNumber":"7","sectionType":"section","heading":"Complaints","content":"#### 7 Complaints\n\n7 Complaints\n\n> > (1) For the Act, Schedule 1, clauses 10(1)(k) and 11(1)(l), an organisation may use or disclose health information for a secondary purpose if—\n> > \n> > > (a) the organisation has reasonable grounds to suspect a complaint has been made against a registered health practitioner, and\n> > \n> > > (b) the health information is only used or disclosed—\n> > > \n> > > > (i) at the request of a council established under the [Health Practitioner Regulation National Law (NSW)](/view/html/inforce/current/act-2009-86a), section 41B, and\n> > > \n> > > > (ii) to assist the council with the management of the registered health practitioner under the [Health Practitioner Regulation National Law (NSW)](/view/html/inforce/current/act-2009-86a), Part 8, and\n> > \n> > > (c) the health information only relates to a patient of the registered health practitioner.\n> \n> > (2) In this section—\n> > \n> > complaint, against a registered health practitioner, means a complaint made about the practitioner under—\n> > \n> > > (a) the [Health Practitioner Regulation National Law (NSW)](/view/html/inforce/current/act-2009-86a), Part 8, or\n> > \n> > > (b) the [Health Care Complaints Act 1993](/view/html/inforce/current/act-1993-105), Part 2.","sortOrder":8},{"sectionNumber":"7A","sectionType":"section","heading":"Disclosure for compassionate reasons","content":"#### 7A Disclosure for compassionate reasons\n\n7A Disclosure for compassionate reasons\n\n> For the Act, Schedule 1, clause 11(1)(l), an organisation may disclose health information for a secondary purpose if —\n> \n> > (a) the disclosure of the information for the secondary purpose is to provide the information to an immediate family member of the individual for compassionate reasons, and\n> \n> > (b) the disclosure is limited to the extent reasonable for those compassionate reasons, and\n> \n> > (c) the individual is deceased, and\n> \n> > (d) the disclosure is not contrary to a wish expressed by the individual, and not withdrawn, before the death of the individual of which the organisation was aware or could make itself aware by taking reasonable steps, and\n> \n> > (e) if the immediate family member is under the age of 18 years, the organisation reasonably believes that the family member has sufficient maturity in the circumstances to receive the information.\n> \n> **s 7A:** Ins 2022 (799), sec 3.","sortOrder":9},{"sectionNumber":"Part 3","sectionType":"part","heading":"Miscellaneous","content":"# Part 3 Miscellaneous\n\nPart 3 Miscellaneous","sortOrder":10},{"sectionNumber":"8","sectionType":"section","heading":"Exemption for My Health Record system—the Act, s 75(2)(c)","content":"#### 8 Exemption for My Health Record system—the Act, s 75(2)(c)\n\n8 Exemption for My Health Record system—the Act, s 75(2)(c)\n\n> > (1) The Act, Schedule 1, clause 15 does not apply to an organisation to the extent that the organisation includes in the My Health Record system health information about an individual registered for the My Health Record system.\n> \n> > (2) In this section—\n> > \n> > My Health Record system has the same meaning as in the [My Health Records Act 2012](http://www.legislation.gov.au/) of the Commonwealth.","sortOrder":11},{"sectionNumber":"9","sectionType":"section","heading":"Health records linkage systems—the Act, Sch 1, cl 15","content":"#### 9 Health records linkage systems—the Act, Sch 1, cl 15\n\n9 Health records linkage systems—the Act, Sch 1, cl 15\n\n> For the Act, Schedule 1, clause 15(3), definition of health records linkage system, the following systems administered by the Health Administration Corporation are prescribed as not being a health records linkage system—\n> \n> > (a) the system known as HealtheNet,\n> \n> > (b) the system known as Clinical Health Information Exchange,\n> \n> > (c) the system known as the Single Digital Patient Record.\n> \n> **s 9:** Am 2025 (623), Sch 1\\[1\\] \\[2\\].","sortOrder":12},{"sectionNumber":"10","sectionType":"section","heading":"Certain public sector agencies to be treated as single agency—the Act, s 75(2)(d)(i) and (iii)","content":"#### 10 Certain public sector agencies to be treated as single agency—the Act, s 75(2)(d)(i) and (iii)\n\n10 Certain public sector agencies to be treated as single agency—the Act, s 75(2)(d)(i) and (iii)\n\n> > (1) The following public sector agencies must be treated as a single agency for the purposes of the Health Privacy Principles and health privacy codes of practice—\n> > \n> > > (a) the Ministry of Health,\n> > \n> > > (b) the Health Administration Corporation,\n> > \n> > > (c) a local health district within the meaning of the [Health Services Act 1997](/view/html/inforce/current/act-1997-154),\n> > \n> > > (d) a statutory health corporation within the meaning of the [Health Services Act 1997](/view/html/inforce/current/act-1997-154),\n> > \n> > > (e) the Cancer Institute (NSW).\n> \n> > (2) The following public sector agencies must be treated as a single agency for the purposes of the Act—\n> > \n> > > (a) Corrective Services NSW,\n> > \n> > > (b) the Department of Communities and Justice.\n> \n> **s 10:** Am 2024 (508), Sch 1.3\\[1\\] \\[2\\].","sortOrder":13},{"sectionNumber":"11","sectionType":"section","heading":"Repeal and savings","content":"#### 11 Repeal and savings\n\n11 Repeal and savings\n\n> > (1) The [Health Records and Information Privacy Regulation 2017](/view/html/repealed/current/sl-2017-0215) is repealed.\n> \n> > (2) An act, matter or thing that, immediately before the repeal of the [Health Records and Information Privacy Regulation 2017](/view/html/repealed/current/sl-2017-0215), had effect under that Regulation continues to have effect under this Regulation.","sortOrder":14}],"analysis":{"summary":{"complexity_score":3,"scope_assessment":{"changed":false,"description":"Based on the available metadata, this regulation appears to remain within its original scope as a supporting instrument for the Health Records and Information Privacy Act 2002. The multiple amendments since August 2022 suggest administrative updates and refinements rather than any fundamental expansion or contraction of purpose. No evidence of scope drift is apparent from the information provided."},"complexity_factors":["The substantive content of the regulation itself is not visible in the provided text — only metadata, status information, and navigation elements are present, limiting full analysis","The regulation operates as subordinate legislation (rules made under a parent Act), requiring cross-referencing with the Health Records and Information Privacy Act 2002 to fully understand its effect","Multiple point-in-time versions (six since 2022) suggest the regulation has been amended repeatedly, which can create complexity in determining which version applies to a particular situation","Interaction between NSW privacy law and Commonwealth privacy frameworks (the Privacy Act 1988) can create jurisdictional complexity for organisations operating across borders","The staged repeal mechanism under the Subordinate Legislation Act 1989 adds a procedural layer that practitioners must track"],"plain_english_summary":"## Health Records and Information Privacy Regulation 2022 (NSW)\n\n**What is this?**\nThis is a NSW regulation (a set of detailed rules made under a parent Act) that supports the *Health Records and Information Privacy Act 2002* (NSW). That parent Act gives people rights over their own health information — things like medical records, test results, and treatment histories held by doctors, hospitals, and other health organisations.\n\n**What does it do?**\nThe regulation fills in the practical details of how the privacy protections in the parent Act are applied. This typically includes things like:\n- How organisations must handle requests from people wanting to access or correct their own health records\n- Fees that can be charged for accessing records\n- Specific exemptions or procedural requirements for health service providers\n\n**Who does it affect?**\n- **Ordinary people** — anyone in NSW who has health records held by a doctor, hospital, clinic, or other health service provider. You have rights to access and correct those records.\n- **Health service providers** — GPs, hospitals, specialists, allied health professionals, and even some private businesses that handle health information. They must follow these rules or risk complaints and enforcement action.\n\n**Why does it matter?**\nYour health information is among the most sensitive personal data about you. This regulation helps ensure organisations treat it with appropriate care, and that you have practical tools to enforce your privacy rights.\n\n**Important note:** This regulation is scheduled to be **automatically repealed (cancelled) on 1 September 2027** under NSW's standard sunset process for regulations (a system that forces regulations to be reviewed and remade periodically, rather than sitting on the books indefinitely). It has already been updated several times since 2022."},"flash_summary":{"complexity_score":6,"scope_assessment":{"changed":true,"description":"The Regulation replaces the 2017 Regulation (s 2 and s 11(1)) and prescribes additional categories of activity as \"health services\" (notably accredited chaplain services, research by or for named NSW health bodies, CHeReL services, and SDPR‑related services) (s 4). It also explicitly permits certain secondary uses/disclosures (chaplaincy (s 5), professional‑misconduct investigations (s 6), complaints‑related sharing (s 7), and compassionate disclosures about deceased individuals (s 7A)), creates an exemption for inclusion of information in the Commonwealth My Health Record system (s 8), and prescribes particular systems that are not \"health records linkage systems\" (s 9). The Regulation therefore changes the practical scope of the Act by clarifying and expanding which activities and systems are covered and by centralising agency treatment for compliance purposes (s 10), while preserving existing legal effects under the prior regulation until they operate under the new text (s 11(2))."},"complexity_factors":["Multiple cross‑references to the Health Records and Information Privacy Act 2002 and external laws (e.g. Health Practitioner Regulation National Law, My Health Records Act) (see s 3, s 6(2), s 8).","Conditional, fact‑sensitive tests that require judgement (\"reasonable expectation\", \"reasonable grounds\", \"reasonable steps\", assessment of maturity) spread across s 5, s 6, s 7 and s 7A.","Definitions that expand or alter the statutory meaning of key terms (notably \"health service\" in s 4), affecting which activities fall inside the Act.","Exemptions and negative prescriptions (e.g. s 8 exemption for My Health Record; s 9 prescription of systems not being linkage systems) that change the application of particular Act clauses depending on system or context.","Administrative consolidation of multiple agencies into single‑agency treatment for particular legal purposes (s 10), affecting compliance responsibility and points of contact.","Repeal and savings clause (s 11) that preserves prior effects while shifting the governing text, adding a transitional legal layer.","Interaction with nationally framed regulatory instruments (Health Practitioner Regulation National Law references in s 6 and s 7) which requires attention to external, varying instruments."],"plain_english_summary":"This Regulation sets detailed rules for how public health organisations and other entities subject to the Health Records and Information Privacy Act may use or disclose health information. It broadens what counts as a “health service” (including accredited hospital chaplains, certain research, CHeReL and SDPR activities), permits limited secondary uses (chaplaincy, misconduct and complaint processes, compassionate family access), and exempts My Health Record inputs and certain systems from specific Act limits.\n\nIt matters because it reallocates decision‑making and compliance duties to agencies, embeds several subjective legal tests (e.g. “reasonable grounds/steps”) and centralises agency responsibility for privacy enforcement."},"kimi_summary":{"content_quality":"ok","complexity_score":4,"scope_assessment":{"changed":true,"description":"The Regulation has expanded beyond its original 2017 scope through amendments. Section 7A (disclosure for compassionate reasons) was inserted in 2022, and section 4 has been amended twice (2023 and 2025) to expand the definition of 'health service' to include the Single Digital Patient Record (SDPR). Section 9 was amended in 2025 to update prescribed systems. The original Regulation primarily dealt with chaplaincy and professional misconduct; the current version now covers digital health infrastructure, compassionate disclosure to families of deceased patients, and updated agency groupings."},"complexity_factors":["Multiple cross-references to other Acts (Health Services Act 1997, Health Practitioner Regulation National Law, My Health Records Act 2012, Health Care Complaints Act 1993)","Nested conditional logic in sections 5-7A (secondary purpose disclosures require multiple cumulative conditions to be met)","Incorporation of external legislation by reference (Health Practitioner Regulation National Law as in force 'from time to time' across multiple jurisdictions)","Amendment history tracking (sections 4, 7A, 9, and 10 show amendment notes indicating evolving content)","Dual definitions section — primary definitions in section 3 plus section-specific definitions in sections 6(2), 7(2), and 8(2)","Technical exemptions that require understanding of the base Act's structure (Schedule 1 clauses 10, 11, 15)"],"plain_english_summary":"**What this legislation does:**\n\nThis Regulation sets out detailed rules for how health information can be handled in New South Wales under the *Health Records and Information Privacy Act 2002* (the main Act). It expands on the main Act by:\n\n- **Defining what counts as a \"health service\"** — adding specific services like hospital chaplaincy, medical research conducted by government health bodies, the Centre for Health Record Linkage, and the new Single Digital Patient Record (SDPR) system.\n\n- **Creating exceptions to privacy rules** — normally, health information can only be used for the purpose it was collected. This Regulation allows health organisations to use or share information for other purposes (called \"secondary purposes\") in specific situations:\n  - **Chaplaincy services** — accredited chaplains in public hospitals can access patient information if the patient would reasonably expect this\n  - **Professional misconduct investigations** — information can be shared when investigating concerns about a health practitioner's conduct\n  - **Complaints handling** — information can be disclosed to help manage complaints against registered health practitioners\n  - **Compassionate reasons** — information about a deceased person can be shared with immediate family members (added in 2022)\n\n- **Technical exemptions and groupings** — it exempts the My Health Record system from certain rules, excludes specific NSW health IT systems from being classified as \"linkage systems,\" and treats certain government agencies as single entities for privacy purposes (so information can flow between them more easily).\n\n**Who it affects:**\n- Public hospitals and health services in NSW\n- Patients receiving care in the public health system\n- Accredited hospital chaplains\n- Health practitioners under investigation\n- Government health agencies including local health districts and the Ministry of Health\n\n**Why it matters:**\nThis Regulation balances privacy protection with practical healthcare needs. It allows sensitive health information to be shared for legitimate purposes — like spiritual care, investigating dangerous practitioners, or helping grieving families — while setting clear limits on how that sharing happens. The 2022 version also modernises the rules to cover new digital health systems like the Single Digital Patient Record."},"issue_detection":{"absurdities":[],"contradictions":[]}},"importantCases":[],"_links":{"self":"/api/acts/health-records-and-information-privacy-regulation-2022","history":"/api/acts/health-records-and-information-privacy-regulation-2022/history","analysis":"/api/acts/health-records-and-information-privacy-regulation-2022/analysis","conflicts":"/api/acts/health-records-and-information-privacy-regulation-2022/conflicts","importantCases":"/api/acts/health-records-and-information-privacy-regulation-2022/important-cases","documents":"/api/acts/health-records-and-information-privacy-regulation-2022/documents"}}