{"id":"a-1997-125","name":"Health Records (Privacy and Access) Act 1997","slug":"health-records-privacy-and-access-act-1997","collection":"act","jurisdiction":"act","status":"in_force","isInForce":true,"actNumber":"125 of 1997","makingDate":null,"administeringDepartment":null,"currentVersion":{"id":23701,"registerId":"act-a-1997-125-current","compilationNumber":null,"startDate":"2026-04-01","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"16","sectionType":"section","heading":"November 2025. It also includes any commencement, amendment, repeal or expiry affecting","content":"16 November 2025. It also includes any commencement, amendment, repeal or expiry affecting\nthis republished law to 16 November 2025.\nThe legislation history and amendment history of the republished law are set out in endnotes 3\nand 4.\nKinds of republications\nThe Parliamentary Counsel’s Office prepares 2 kinds of republications of ACT laws (see the ACT\nlegislation register at www.legislation.act.gov.au):\n• authorised republications to which the Legislation Act 2001 applies\n• unauthorised republications.\nThe status of this republication appears on the bottom of each page.\nEditorial changes\nThe Legislation Act 2001, part 11.3 authorises the Parliamentary Counsel to make editorial\namendments and other changes of a formal nature when preparing a law for republication.\nEditorial changes do not change the effect of the law, but have effect as if they had been made by\nan Act commencing on the republication date (see Legislation Act 2001, s 115 and s 117). The\nchanges are made if the Parliamentary Counsel considers they are desirable to bring the law into\nline, or more closely into line, with current legislative drafting practice.\nThis republication includes amendments made under part 11.3 (see endnote 1).\nUncommenced provisions and amendments\nIf a provision of the republished law has not commenced, the symbol U appears immediately\nbefore the provision heading. Any uncommenced amendments that affect this republished law\nare accessible on the ACT legislation register (www.legislation.act.gov.au). For more\ninformation, see the home page for this law on the register.\nModifications\nIf a provision of the republished law is affected by a current modification, the symbol M appears\nimmediately before the provision heading. The text of the modifying provision appears in the\nendnotes. For the legal status of modifications, see the Legislation Act 2001, section 95.\nPenalties\nAt the republication date, the value of a penalty unit for an offence against this law is $160 for an\nindividual and $810 for a corporation (see Legislation Act 2001, s 133).\n\ncontents 1\nPage\n1 Name of Act 2\n3 Objects of Act 2\n4 Dictionary 2\n4A Notes 3\n4B Offences against Act—application of Criminal Code etc 3\n5 The privacy principles 4\n6 Compliance with privacy principles 4\n7 Consent by consumer to obtaining health status report 4\n\nPage\ncontents 2 Health Records (Privacy and Access) Act 1997\n8 Access otherwise than under pt 3 6\n9 Pt 3 not to prevent alternative arrangements 6\n10 Statement of principle regarding right of access 7\n10A Statement of principle regarding right of access—children and young\npeople 9\n11 Provision of health services and keeping of records—terms and\nconditions 10\n12 Requests for access 11\n13 Response to request for access 12\n13A Disclosure in accordance with consent 13\n13B Giving access to health records—generally 14\n13BA Giving access to health records—children and young people 15\n13C How access to health record given 17\n13D Access taken to have been refused 18\n14 Grounds for nonproduction 19\n14A No access to health record relating to Children and Young People Act\ncomplaint etc 20\n15 No access to health record where risk to life or health of consumer or\nanother person 21\n16 Refusal for risk to life or health of consumer—offer by record keeper 21\n16A Refusal for risk to life or health of consumer—nomination by consumer 22\n16B Record keeper to give nominated health service provider health record 23\n16C Functions of nominated health service provider 23\n16D Unsuitable consumer-nominated health service provider 24\n17 No access to health record where material given in confidence 25\nPart 4 Complaints\n18 Grounds for complaint 27\n20 Unlawfully requiring consent etc 28\n21 Destroying etc health records and related material 29\n22 Unlawfully requesting or obtaining access to health records 29\n23 People not to be unlawfully penalised 30\n24 Acts and omissions of representatives 31\n\nPage\ncontents 3\n25 Children and young people 33\n26 Legally incompetent persons 33\n27 Deceased consumers 33\n29 Defect or invalidity—protection if person acts in good faith etc 34\n30 Unqualified record keeper to obtain and act on expert advice 34\n31 Jurisdiction of Magistrates Court 35\n32 Appeals 36\n33 Court orders under other laws 36\n34 Determination of fees 37\n36 Regulation-making power 37\n37 Saving 37\nSchedule 1 The privacy principles 38\nDictionary 62\n1 About the endnotes 68\n2 Abbreviation key 68\n3 Legislation history 69\n4 Amendment history 74\n5 Earlier republications 80\n\nAn Act to provide for the privacy and integrity of, and access to, personal health\ninformation, and for related purposes\n\n","sortOrder":0},{"sectionNumber":"1","sectionType":"section","heading":"Name of Act","content":"1 Name of Act\nThis Act is the Health Records (Privacy and Access) Act 1997.\n","sortOrder":1},{"sectionNumber":"3","sectionType":"section","heading":"Objects of Act","content":"3 Objects of Act\nThe objects of this Act are—\n(a) to provide for privacy rights in relation to personal health\ninformation; and\n(b) to provide for the integrity of records containing personal health\ninformation; and\n(c) to provide for access to personal health information contained in\nhealth records; and\n(d) to provide for a consumer to receive an explanation of the\nconsumer’s personal health information; and\n(e) to encourage agreement, concerning the exercise of a right or\nperformance of an obligation under this Act, between the\npersons concerned.\n","sortOrder":2},{"sectionNumber":"4","sectionType":"section","heading":"Dictionary","content":"4 Dictionary\nThe dictionary at the end of this Act is part of this Act.\nNote 1 The dictionary at the end of this Act defines certain terms used in this\nAct, and includes references (signpost definitions) to other terms defined\nelsewhere.\nFor example, the signpost definition ‘disability—see the Human Rights\nCommission Act 2005, section 8 (2).’ means that the term ‘disability’ is\ndefined in that subsection and the definition applies to this Act.\nNote 2 A definition in the dictionary (including a signpost definition) applies to\nthe entire Act unless the definition, or another provision of the Act,\nprovides otherwise or the contrary intention otherwise appears (see\nLegislation Act, s 155 and s 156 (1)).\n\nPreliminary Part 1\n","sortOrder":3},{"sectionNumber":"4A","sectionType":"section","heading":"Notes","content":"4A Notes\nA note included in this Act is explanatory and is not part of this Act.\nNote See the Legislation Act, s 127 (1), (4) and (5) for the legal status of notes.\n","sortOrder":4},{"sectionNumber":"4B","sectionType":"section","heading":"Offences against Act—application of Criminal Code etc","content":"4B Offences against Act—application of Criminal Code etc\nOther legislation applies in relation to offences against this Act.\nNote 1 Criminal Code\nThe Criminal Code, ch 2 applies to all offences against this Act (see\nCode, pt 2.1):\nThe chapter sets out the general principles of criminal responsibility\n(including burdens of proof and general defences), and defines terms used\nfor offences to which the Code applies (eg conduct, intention,\nrecklessness and strict liability).\nNote 2 Penalty units\nThe Legislation Act, s 133 deals with the meaning of offence penalties\nthat are expressed in penalty units.\n\n","sortOrder":5},{"sectionNumber":"5","sectionType":"section","heading":"The privacy principles","content":"5 The privacy principles\nSubject to this Act, the privacy principles mentioned in schedule 1\nhave the force of law.\n","sortOrder":6},{"sectionNumber":"6","sectionType":"section","heading":"Compliance with privacy principles","content":"6 Compliance with privacy principles\n(1) A person to whom a privacy principle applies must not, without\nlawful authority, contravene the privacy principle.\n(2) A person is taken not to have lawful authority to contravene a privacy\nprinciple unless the person proves that, in the circumstances,\ncompliance with the privacy principle would have contravened—\n(c) an order of a court of competent jurisdiction.\n","sortOrder":7},{"sectionNumber":"7","sectionType":"section","heading":"Consent by consumer to obtaining health status report","content":"7 Consent by consumer to obtaining health status report\n(1) A person must not, without a consumer’s consent—\n(a) ask someone other than the consumer for a health status report\nabout the consumer; or\n(b) give someone other than the consumer a health status report\nabout the consumer.\n(2) A person must not obtain a health status report about a consumer from\na health service provider without the consumer’s consent.\n(3) If a person obtains the consumer’s consent for subsection (1) or (2)\nthe person must—\n(a) tell the consumer in writing of the consumer’s right to ask for a\ncopy of the health status report and to give the person a\nstatement commenting on the health status report; and\n\nPrivacy provisions Part 2\n(b) if the consumer asks for a copy of the report—give a copy of the\nreport to the consumer as soon as practicable; and\n(c) if the consumer gives the person a statement commenting on the\nhealth status report—\n(i) consider the comments; and\n(ii) keep the statement with the report for as long as the person\nkeeps the report.\n(4) A consent given by a consumer for subsection (1) or (2) must—\n(a) be in writing and signed—\n(i) if the consumer is a legally incompetent person—by a\n(ii) if the consumer is a child or young person—by the person\nwith parental responsibility for the child or young person;\nor\n(iii) in any other case—by the consumer; and\n(b) if the health service report is to be, or has been, prepared or\nsubstantially prepared by a health service provider—name the\nhealth service provider.\n(5) This section does not apply to the extent (if any) that a health status\nreport is asked for, obtained or provided in accordance with—\n(c) an order of a court.\n\n","sortOrder":8},{"sectionNumber":"Part 3","sectionType":"part","heading":"Access to personal health","content":"Part 3 Access to personal health\ninformation\n","sortOrder":9},{"sectionNumber":"8","sectionType":"section","heading":"Access otherwise than under pt 3","content":"8 Access otherwise than under pt 3\n(1) A health service provider may allow a consumer to have access\notherwise than in accordance with this part to a health record relating\nto the consumer.\n(2) Subsection (1) applies—\n(a) subject to any prohibition on giving access to the health record\nunder any of the following provisions:\n(i) section 14A (No access to health record relating to\nChildren and Young People Act complaint etc);\n(ii) section 15 (No access to health record where risk to life or\nhealth of consumer or another person);\n(iii) section 17 (No access to health record where material given\nin confidence); and\n(b) except as stated in paragraph (a)—despite any other provision\nof this part.\n","sortOrder":10},{"sectionNumber":"9","sectionType":"section","heading":"Pt 3 not to prevent alternative arrangements","content":"9 Pt 3 not to prevent alternative arrangements\n(1) Where, under a provision of this part, a person has a right or\nobligation to—\n(a) do an act in relation to another person in a specified way, or\nwithin a specified period; or\n(b) give a notice to another person in a specified way, or within a\nspecified period;\nthe firstmentioned person and the other person may make an\nagreement for the act to be done or the notice to be given, as the case\nmay be, in another way or within a longer period.\n\n(2) If such an agreement is made, and—\n(a) the act is done in accordance with the agreement; or\n(b) the notice is given in accordance with the agreement;\nthe firstmentioned person is taken—\n(c) to have performed the act in the way specified in the provision;\nor\n(d) to have given the notice within the time specified in the\nprovision;\nas the case may be.\n","sortOrder":11},{"sectionNumber":"10","sectionType":"section","heading":"Statement of principle regarding right of access","content":"10 Statement of principle regarding right of access\n(1) A consumer has a right of access, in accordance with this Act, to a\nhealth record that is—\n(a) a health record held by a health service provider; or\n(b) to the extent that it contains personal health information relating\nto the consumer, any other health record;\nas follows:\n(c) to the extent that the record contains factual matters, whenever\nthe record was made;\n(d) to the extent that the record contains matters of opinion, if the\nrecord was created on or after the date of commencement of this\nAct.\n(2) Subsection (1) does not apply—\n(a) in relation to a health record to the extent that access to the\nrecord would contravene—\n\n(iii) an order of a court of competent jurisdiction; or\n(b) to the extent that any of the following provisions has a contrary\napplication:\n(i) section 14 (Grounds for nonproduction);\n(ii) section 14A (No access to health record relating to\nChildren and Young People Act complaint etc);\n(iii) section 15 (No access to health record where risk to life or\nhealth of consumer or another person);\n(iv) section 17 (No access to health record where material given\nin confidence).\n(3) A right of access may be exercised in any of the following ways:\n(a) by inspecting the health record or, if the health record is stored\nin electronic form, a print-out of the health record, and having\nthe opportunity to take notes of its contents;\n(b) by receiving a copy of the health record;\n(c) by viewing the health record, and having its content explained\nby—\n(i) if the relevant record keeper is a suitably qualified health\nservice provider, and is willing to do so—the record\nkeeper; or\n(ii) in any other case—a suitably qualified health service\nprovider who practises in the Territory, is nominated by the\nrecord keeper and has consented to being so nominated.\n(4) Subject to subsection (7), where the record keeper receives a request\nunder section 12, the record keeper must—\n(a) in the case of a request that specifies access of a kind mentioned\nin subsection (3) (a) or (b)—provide access in accordance with\nthe relevant paragraph; or\n\n(b) in the case of a request that specifies access of the kind\nmentioned in subsection (3) (c)—\n(i) if subsection (3) (c) (i) applies—provide access in\naccordance with subsection (3) (c); or\n(ii) if subsection (3) (c) (i) does not apply—nominate a suitable\nhealth service provider for subsection (3) (c).\n(5) However, if the health services commissioner receives a request\nunder section 12 in relation to a health record prepared by a health\nservice provider, the health services commissioner—\n(a) need not give access in accordance with subsection (3) (a), (b)\nor (c); and\n(b) may instead refer the request to the health service provider.\n(6) If the health services commissioner refers a request to a health service\nprovider under subsection (5) (b), the health service provider is taken\nto have received it under section 12.\n(7) The right of access is subject, in the case of access in a way mentioned\nin subsection (3) (b) or (c), to the payment of any fee or charge\npayable under this Act.\n(8) Where the consumer is a legally incompetent person, the right of\naccess conferred by subsection (1) is exercisable on behalf of the\nconsumer by a guardian of the consumer.\n","sortOrder":12},{"sectionNumber":"10A","sectionType":"section","heading":"Statement of principle regarding right of access—","content":"10A Statement of principle regarding right of access—\nchildren and young people\nThe right of access to a health record conferred by section 10 (1) is\nexercisable—\n(a) for a consumer who is a child—on behalf of the child by the\nperson with parental responsibility for the child; and\n\n(b) for a consumer who is a young person—\n(i) if the young person has sufficient maturity and\ndevelopmental capacity to understand the nature of the\nyoung person’s request to access a health record and the\nnature of the record—by the young person personally; or\n(ii) in any other case—on behalf of the young person by the\nperson with parental responsibility for the young person.\n","sortOrder":13},{"sectionNumber":"11","sectionType":"section","heading":"Provision of health services and keeping of records—","content":"11 Provision of health services and keeping of records—\nterms and conditions\n(1) It is a term of a contract, whether oral or in writing, for the provision\nof a health service to a consumer that the health service provider will\nallow the consumer to have access, in accordance with this Act, to a\nhealth record relating to the consumer that relates to, or is made in\nconsequence of the provision of, the service.\n(2) Subsection (1) applies to a contract—\n(a) only if the contract is made on or after the date of\ncommencement of this Act, and at least 1 of the following\ncircumstances applies:\n(i) the contract is made in the ACT;\n(ii) the contract has been, or is to be, performed wholly or\npartly in the ACT;\n(iii) the consumer is present, or resides, in the ACT when the\ncontract is made; and\n(b) whether or not the consumer is a party to the contract.\n(3) Where a health record relating to a consumer is kept or located in the\nACT, the record keeper must allow the consumer to have access, in\naccordance with this Act, to the record.\n\n(4) Where a health service provider provides a health service to a\nconsumer, the provider must allow the consumer to have access, in\naccordance with this Act, to a health record relating to the consumer\nthat relates to, or is made in consequence of the provision of, the\nservice.\n(5) The application of subsection (3) or (4) in a particular instance is not\naffected by the application or otherwise of subsection (1) in that\ninstance.\n(6) For this section, it is immaterial whether—\n(a) the health service in question was provided in the ACT; or\n(b) except in the case of subsection (3)—the health record in\nquestion is kept or located in the ACT.\n(7) If a contract or other agreement purports to exclude, or is inconsistent\nwith, a provision of this section, the contract or agreement is, to that\nextent, void.\n(8) This section applies subject to section 10.\n","sortOrder":14},{"sectionNumber":"12","sectionType":"section","heading":"Requests for access","content":"12 Requests for access\n(1) A consumer who has a right of access under section 10 or section 10A\nto a health record may ask the record keeper for access to the record.\n(2) A request must—\n(a) state the name and, unless it is already known to the record\nkeeper, the address, of the consumer; and\n(b) sufficiently identify the health record to which access is sought;\nand\n(c) specify the way in which the consumer wishes to have access,\nbeing a way mentioned in section 10 (3); and\n\n(d) be in writing if it is—\n(i) a request by a person with parental responsibility for a\nchild or young person unless, in the 12 months before\nmaking the request, the person with parental responsibility\nconsented to the treatment of the child or young person that\ngave rise to the health record that is the subject of the\nrequest; or\n(ii) a request by a guardian of a legally incompetent person; or\n(iii) a request by a legal representative of a deceased consumer.\n(3) In the case of an oral request, the record keeper—\n(a) may ask the consumer to make the request in writing; and\n(b) if the record keeper does so—need not take any further action in\nrespect of the oral request.\n","sortOrder":15},{"sectionNumber":"13","sectionType":"section","heading":"Response to request for access","content":"13 Response to request for access\n(1) This section—\n(a) applies if a record keeper receives a request for access to a health\nrecord under section 12; but\n(b) does not apply to an oral request if the record keeper has asked\nunder section 12 (3) (a) for the request to be made in writing.\n(2) Within 2 weeks after the day the record keeper receives the request,\nthe record keeper must—\n(a) if the health services commissioner is the record keeper and\nrefers the request to a health service provider under\nsection 10 (5)—give the consumer written notice that the\nrequest has been referred to the health service provider who\nprepared the health record; or\n\n(b) if the record keeper relies on a ground mentioned in section 14\nfor nonproduction of the record or part of the record—give the\nconsumer written notice that the record keeper will not give\naccess to the record; or\n(c) if the record keeper is prohibited from giving access to the\nrecord or part of the record under section 14A, section 15 or\nsection 17—give the consumer written notice that the record\nkeeper is prohibited from giving access to the record; or\n(d) either—\n(i) give access to the record in accordance with section 13A;\nor\n(ii) if a fee has been determined under section 34 for access—\ngive the consumer written notice that the record keeper will\ngive access to the record on payment of a stated fee that is\nnot more than the determined fee.\n(3) A notice under subsection (2) (b) must state the ground on which the\nrecord keeper relies for nonproduction of the record or part of the\n(4) A notice under subsection (2) (c) must state the section under which\nthe record keeper is prohibited from giving access to the record or\npart of the record.\n(5) If the record keeper gives a notice under subsection (2) (b) or (c) that\nrelates to only part of the record, the record keeper must comply with\nsubsection (2) (d) in relation to the rest of the record.\n","sortOrder":16},{"sectionNumber":"13A","sectionType":"section","heading":"Disclosure in accordance with consent","content":"13A Disclosure in accordance with consent\n(a) a consumer has a right of access to a health record; and\n\n(b) the consumer consents under schedule 1, principle 10,\nclause 2 (c) to the disclosure of personal health information\nabout the consumer from the record to an entity.\n(2) The record keeper must disclose the information to the entity.\n(3) For the purpose of accessing the information in the record, the entity\nis taken to be the consumer.\n(4) To remove any doubt and without limiting subsection (3), the entity\nhas the same right of access to the information in the record as the\n","sortOrder":17},{"sectionNumber":"13B","sectionType":"section","heading":"Giving access to health records—generally","content":"13B Giving access to health records—generally\n(1) This section applies if a record keeper must give a person (other than\na child or young person) access to a health record.\n(2) Access to the health record must be given—\n(a) if the record keeper has given a notice under section 13 (2) (d)\n(ii) and the fee stated in the notice has been paid—no later than\nthe later of the following:\n(i) 1 week after the day the fee is paid;\n(ii) 30 days after the day the record keeper received the request\nfor access to the health record; or\n(b) if the record keeper has not given a notice under\nsection 13 (2) (d) (ii)—no later than 30 days after the day the\nrecord keeper receives the request for access to the health\n(3) However, before giving access to the record to a person (the relevant\nperson), the record keeper must take reasonable steps to require\nevidence of, and be satisfied about—\n(a) the relevant person’s identity; and\n\n(b) if someone else has authorised the access to be given to the\nrelevant person—the identity and authority of the other person;\nand\n(c) if the consumer is a legally incompetent person or dead—the\nfact that the relevant person (or, if paragraph (b) applies, the\nperson authorising the relevant person) is—\n(i) for a legally incompetent person—a guardian of the\n(ii) for a deceased consumer—\n(A) a legal representative of the deceased consumer; or\n(B) if there is no legal representative of the deceased\nconsumer—an immediate family member of the\ndeceased consumer.\n(4) If the record keeper requires evidence under subsection (3) before\ngiving access to a health record and the evidence is not provided or\ndoes not satisfy the record keeper, the record keeper need not provide\naccess to the health record.\n13BA Giving access to health records—children and young\npeople\n(1) This section applies if a record keeper must give a child or young\nperson access to a health record.\n(2) Access to a health record must be given—\n(a) if the record keeper has given a notice under section 13 (2) (d)\n(ii) and the fee stated in the notice has been paid—no later than\nthe later of the following:\n(i) 1 week after the day the fee is paid;\n(ii) 30 days after the day the record keeper received the request\nfor access to the health record; or\n\n(b) if the record keeper has not given a notice under\nsection 13 (2) (d) (ii)—no later than 30 days after the day the\nrecord keeper receives the request for access to the health\n(3) However, before giving access to the record to a person (the relevant\nperson), the record keeper must take reasonable steps to require\nevidence of, and be satisfied about—\n(a) the relevant person’s identity; and\n(b) if someone else has authorised the access to be given to the\nrelevant person—the identity and authority of the other person;\nand\n(c) if the consumer is a child or young person who does not have\nsufficient maturity and developmental capacity to understand\nthe nature of the young person’s request to access the record and\nthe nature of the record—the fact that the relevant person (or, if\nparagraph (b) applies, the person authorising the relevant\nperson) is the person with parental responsibility for the child or\nyoung person.\n(4) Before giving access to a relevant person who is a young person, the\nrecord keeper may require that the young person—\n(a) meet with the record keeper so that the record keeper can explain\nthe nature of the record to the young person; or\n(b) consent to a person with parental responsibility for the young\nperson attending that meeting.\n(5) Before giving access to a relevant person who has parental\nresponsibility for a young person, the record keeper may—\n(a) require that the young person consent to the access; or\n(b) discuss the access with the young person.\n\n(6) If the record keeper requires evidence under this section before giving\naccess to a health record and the evidence is not provided or does not\nsatisfy the record keeper, the record keeper need not provide access\nto the health record.\n","sortOrder":18},{"sectionNumber":"13C","sectionType":"section","heading":"How access to health record given","content":"13C How access to health record given\n(1) This section applies if a record keeper must give a person access to a\nhealth record.\n(2) Access to the health record must be given as follows:\n(a) for a request to inspect the record or, if the health record is stored\nin electronic form, a print-out of the record—by making the\nrecord or print-out available to the consumer at a time, and at a\nplace in the ACT, stated in a written notice given to the\nconsumer;\n(b) for a request to receive a copy of the record—by giving the\nconsumer—\n(i) a copy of the record; or\n(ii) if the consumer agrees—an accurate summary of the\nrecord; or\n(iii) if the record, or part of the record, was made before the\ncommencement of this Act and the record keeper does not\ngive a copy of the record to the consumer—a written\nsummary of the factual matters contained in the record or\npart of the record;\n(c) for a request to view the record and have its content explained—\nby giving the consumer a written notice stating—\n(i) if the record keeper is a suitably qualified health service\nprovider, and is willing to do so—that the record keeper\nwill be available to explain the record at a time, and at a\nplace in the ACT, stated in the notice; or\n\n(ii) in any other case—the name and address of a suitably\nqualified health service provider who practises in the ACT\nand will be available in the ACT with the record, by\narrangement with the consumer, to explain the record.\n","sortOrder":19},{"sectionNumber":"13D","sectionType":"section","heading":"Access taken to have been refused","content":"13D Access taken to have been refused\nA record keeper is taken to have refused access to a health record—\n(a) if the record keeper fails to comply with a requirement of—\n(i) section 13 (Response to request for access); or\n(ii) section 13A (Disclosure in accordance with consent); or\n(iii) section 13B (Giving access to health records—generally);\nor\n(iv) section 13C (How access to health record given); or\n(b) if the record keeper has given a notice under section 13C (2) (a)\nabout the record—\n(i) if the notice does not state a date and time that is reasonable\nfor making the record or print-out available for inspection\nby the consumer; or\n(ii) if the record keeper unreasonably fails to make the record\nor print-out available to the consumer for inspection in\naccordance with the notice; or\n(c) if the record keeper has given a notice under section 13C (2) (c)\n(i) about the record—\n(i) if the notice does not state a time that is reasonable for the\nrecord keeper to be available; or\n(ii) if the record keeper unreasonably fails to explain the\ncontent of the record in accordance with the notice; or\n\n(d) if the record keeper has given a notice under section 13C (2) (c)\n(ii) about the record—if the health service provider named in the\nnotice unreasonably fails—\n(i) to make an arrangement with the consumer to explain the\ncontent of the record; or\n(ii) to comply with an arrangement made to explain the content\nof the record.\n","sortOrder":20},{"sectionNumber":"14","sectionType":"section","heading":"Grounds for nonproduction","content":"14 Grounds for nonproduction\nThe grounds for nonproduction of the whole or any part of a health\nrecord are as follows:\n(a) that the record or part of the record is not in the possession,\ncustody or control of the person alleged to be the record keeper;\n(b) that the record or part of the record does not relate in any respect\nto the consumer;\n(c) that the production of, or the giving of access to, the record or\npart of the record would contravene—\n(iii) an order of a court of competent jurisdiction.\n\n","sortOrder":21},{"sectionNumber":"14A","sectionType":"section","heading":"No access to health record relating to Children and","content":"14A No access to health record relating to Children and\nYoung People Act complaint etc\nA record keeper must not give access to a health record or part of a\nhealth record under section 10 if—\n(a) the record or part of a record relates to—\n(i) a child concern report under the Children and Young\nPeople Act 2008, section 353 as in force immediately\nbefore the commencement of the Children and Young\nPeople Amendment Act 2023, section 29; or\n(ii) a voluntary report or a mandatory report under the Children\nand Young People Act 2008, section 354 (2) or\nsection 356 (1) (e); or\n(iii) a prenatal report under the Children and Young People\nAct 2008, section 362; or\n(iv) information that is care and protection report information\nwithin the meaning of the Children and Young People\nAct 2008, section 845 (2), definition of care and protection\nreport information, paragraph (b); or\n(v) a report under the Children and Young People Act 1999,\nsection 158 or section 159; or\n(vi) a notification under the Children’s Services Act 1986,\nsection 103; and\n(b) either—\n(i) the record or part of a record identifies the person who\nmade the report; or\n(ii) the record keeper is satisfied that the record or part of the\nrecord allows the identity of the person who made the\nreport to be worked out.\n\n","sortOrder":22},{"sectionNumber":"15","sectionType":"section","heading":"No access to health record where risk to life or health of","content":"15 No access to health record where risk to life or health of\nconsumer or another person\nA record keeper must not give access to a health record or part of a\nhealth record under section 10 if the record keeper believes, on\nreasonable grounds, that the provision of information in the record or\npart of the record would constitute a significant risk to the life or the\nphysical, mental or emotional health of—\n(a) the consumer; or\n(b) any other person.\n16 Refusal for risk to life or health of consumer—offer by\nrecord keeper\n(a) a record keeper has given a notice under section 13 (2) (c) about\na health record on the ground mentioned in section 15 (a); and\n(b) the record keeper considers that it would be desirable for a\nsuitably qualified health service provider to discuss the health\nrecord with the consumer.\n(2) The record keeper may include in, or attach to, the notice to the\nconsumer under section 13 (2) (c) an offer—\n(a) if the record keeper is a suitably qualified health service\nprovider—to discuss the record with the consumer; or\n(b) whether or not paragraph (a) applies, to arrange for a named\nhealth service provider who practises in the ACT, is suitably\nqualified and has consented to the arrangement, to discuss the\ncontent of the record with the consumer.\n\n","sortOrder":23},{"sectionNumber":"16A","sectionType":"section","heading":"Refusal for risk to life or health of consumer—nomination","content":"16A Refusal for risk to life or health of consumer—nomination\nby consumer\n(a) a record keeper has given a notice under section 13 (2) (c) about\na health record on the ground mentioned in section 15 (a); and\n(b) any of the following apply:\n(i) the record keeper has not made an offer under section 16;\n(ii) the record keeper has made an offer under section 16 but\nthe consumer has not accepted it;\n(iii) the consumer has had a discussion with the health service\nprovider named by the record keeper in an offer under\nsection 16, but is not satisfied with the outcome of the\ndiscussion.\n(2) The consumer may give a written notice (a nomination) to the record\nkeeper nominating a health service provider for this section if the\nhealth service provider has consented to being nominated.\n(3) The nomination lapses if—\n(a) the record keeper gives the consumer a notice under section 16B\nabout the health record; or\n(b) the nominated health service provider—\n(i) dies or otherwise stops being a health service provider; or\n(ii) refuses to act or fails to act within a reasonable time.\n(4) If a nomination lapses, the consumer may make another nomination\nunder this section.\n\n","sortOrder":24},{"sectionNumber":"16B","sectionType":"section","heading":"Record keeper to give nominated health service provider","content":"16B Record keeper to give nominated health service provider\nhealth record\n(1) This section applies if a record keeper receives a nomination under\nsection 16A in relation to a health record.\n(2) The record keeper must give the health record, or a copy of it, to the\nnominated health service provider within 2 weeks after the day the\nrecord keeper receives the nomination.\n(3) However, the record keeper need not comply with subsection (2) if,\nwithin the 2-week period—\n(a) the record keeper gives a notice under section 16D in relation to\nthe nomination; or\n(b) the nomination lapses.\n","sortOrder":25},{"sectionNumber":"16C","sectionType":"section","heading":"Functions of nominated health service provider","content":"16C Functions of nominated health service provider\nThe functions of a health service provider nominated by a notice\nunder section 16A are—\n(a) to form an opinion about the validity of the notice under\nsection 13 (2) (c); and\n(b) if the nominated health service provider considers it\nappropriate—to explain the grounds of the claim to the\n(c) to discuss the content of the health record with the consumer;\nand\n(d) if the provider is satisfied that to allow the consumer to inspect\nthe record would not be a significant risk to the life or the\nphysical, mental or emotional health of the consumer—to allow\nthe consumer to inspect the record or, if the consumer wishes to\nhave a copy of the record and the record keeper agrees, to have\na copy of the record; and\n\n(e) if the provider is not satisfied as mentioned in paragraph (d)—\nto decline to allow the consumer to have access to the record.\n","sortOrder":26},{"sectionNumber":"16D","sectionType":"section","heading":"Unsuitable consumer-nominated health service provider","content":"16D Unsuitable consumer-nominated health service provider\n(a) a record keeper receives a notice under section 16A nominating\na health service provider; and\n(b) the record keeper believes, on reasonable grounds, that the\nnominated health service provider is not a suitable person to act\nas the nominated health service provider.\n(2) Within 2 weeks after the day the record keeper receives the\nnomination, the record keeper may give the consumer a written notice\nstating that the record keeper objects to the nominated health service\n(3) The notice—\n(a) must state the ground of the objection; and\n(b) may suggest the class of health service providers from which a\nhealth service provider should be nominated.\n(4) However, the record keeper must not give a notice under\nsubsection (2)—\n(a) if—\n(i) the health service provider who wrote the health record is\nregistered with a registration board; and\n(ii) the nominated health service provider is registered by the\nsame board; or\n\n(b) if the nominated health service provider is registered with the\nregistration board established for the medical profession (other\nthan as a student) and has the ability to understand and interpret\nthe health record; or\n(c) if the nominated health service provider—\n(i) provides the same kind of service as the health service\nprovider who wrote the health record; and\n(ii) has the ability to understand and interpret the health record.\n(5) In this section:\nregistration board means a national board established under the\nHealth Practitioner Regulation National Law (ACT), section 31.\n","sortOrder":27},{"sectionNumber":"17","sectionType":"section","heading":"No access to health record where material given in","content":"17 No access to health record where material given in\nconfidence\n(1) A record keeper must not give access to a health record or part of a\nhealth record if, under this section, the health record or part of the\nrecord is subject to confidentiality.\n(2) A health record, or part of a health record, in relation to a consumer\nis subject to confidentiality if it consists of or includes material or\ninformation given in confidence, to the person who wrote the record,\nby a person other than—\n(a) the consumer; or\n(b) a guardian of the consumer; or\n(c) a person with parental responsibility for the consumer; or\n(d) a health service provider in the course of, or otherwise in relation\nto, the provider’s treatment of the consumer.\n\n(3) A health record, or part of a health record, in relation to a consumer\nis subject to confidentiality if—\n(a) the consumer notifies a record keeper to the effect that the\nconsumer wants the health record or part of the record, or\ninformation contained in the record or part, to remain\nconfidential; and\n(b) the record keeper marks the record or part of the record\naccordingly; and\n(c) the consumer—\n(i) becomes a legally incompetent person; or\n(ii) dies.\n(4) In subsection (3):\nconsumer, for a consumer who has died, does not include a legal\nrepresentative of the deceased consumer.\n\nComplaints Part 4\n","sortOrder":28},{"sectionNumber":"Part 4","sectionType":"part","heading":"Complaints","content":"Part 4 Complaints\n","sortOrder":29},{"sectionNumber":"18","sectionType":"section","heading":"Grounds for complaint","content":"18 Grounds for complaint\n(1) A person may make a complaint about an act or omission to the\ncommission on the following grounds:\n(a) the act or omission contravenes the privacy principles in relation\nto a consumer;\n(b) the act or omission is a refusal to give access in accordance with\nthis Act to a health record relating to a consumer;\n(c) the act or omission is a refusal by a record keeper of a health\nrecord to give access to the health record under this Act.\n(2) A complaint on a ground mentioned in subsection (1) (a) in relation\nto a dead consumer may be made whether or not the act or omission\nhappened in the lifetime or after the death of the consumer.\nNote Complaints about unlawful discrimination are made under the HRC Act\n(see s 42).\n\n","sortOrder":30},{"sectionNumber":"20","sectionType":"section","heading":"Unlawfully requiring consent etc","content":"20 Unlawfully requiring consent etc\n(1) A person commits an offence if the person threatens or intimidates\nsomeone else with the intention of causing the other person—\n(a) to give a consent under this Act; or\n(b) to do something without the consent required for it under this\nAct.\n(b) the representation is false; and\nand\n(d) the person makes the representation with the intention of\ncausing the other person—\n(i) to give a consent under this Act; or\n(ii) to do something without the consent required for it under\nthis Act.\n(3) Subsection (2) does not apply if the representation is not false in a\nmaterial particular.\n\nOffences Part 5\n(4) A person commits an offence if—\n(a) the person represents to a consumer that the consumer is legally\nrequired to consent to the provision of a health status report to\nanyone; and\n(b) the representation is false.\n","sortOrder":31},{"sectionNumber":"21","sectionType":"section","heading":"Destroying etc health records and related material","content":"21 Destroying etc health records and related material\n(1) A person commits an offence if the person destroys, defaces or\ndamages a health record or related material with the intention of\nevading or frustrating the operation of this Act.\n(2) A person commits an offence if the person removes a health record\nfrom the ACT with the intention of evading or frustrating the\noperation of this Act.\n","sortOrder":32},{"sectionNumber":"22","sectionType":"section","heading":"Unlawfully requesting or obtaining access to health","content":"22 Unlawfully requesting or obtaining access to health\nrecords\n(1) A person commits an offence if—\n(a) the person threatens or intimidates someone else with the\nintention of—\n(i) causing the other person to give the person access to a\nhealth record; or\n(ii) otherwise obtaining access to a health record; and\n\n(b) the person is not entitled to access to the health record.\n(b) the representation is false; and\nand\n(d) the person makes the representation with the intention of—\n(i) causing the other person to give the person access to a\nhealth record; or\n(ii) otherwise obtaining access to a health record; and\n(e) the person is not entitled to access to the health record.\n(3) Subsection (2) does not apply if the representation is not false in a\nmaterial particular.\n","sortOrder":33},{"sectionNumber":"23","sectionType":"section","heading":"People not to be unlawfully penalised","content":"23 People not to be unlawfully penalised\n(1) A person commits an offence if the person threatens or intimidates\nsomeone else with the intention of causing the other person—\n(a) not to make or pursue a request under part 3 for access; or\n(b) to withdraw a request.\n\nOffences Part 5\n(b) the representation is false in a material particular; and\nand\n(d) the person makes the representation with the intention of\ncausing the other person—\n(i) not to make or pursue a request under part 3 for access; or\n(ii) to withdraw a request.\n(3) It is a defence to a prosecution for an offence against subsection (2)\nif the defendant proves that—\n(a) the defendant had another ground for engaging in the conduct\ncomplained of; and\n(b) the ground was a reasonable one.\n","sortOrder":34},{"sectionNumber":"24","sectionType":"section","heading":"Acts and omissions of representatives","content":"24 Acts and omissions of representatives\n(1) In this section:\nperson means an individual.\nNote See the Criminal Code, pt 2.5 for provisions about corporate criminal\nresponsibility.\nrepresentative, of a person, means an employee or agent of the\nperson.\nstate of mind, of a person, includes—\n(a) the person’s knowledge, intention, opinion, belief or purpose;\nand\n\n(b) the person’s reasons for the intention, opinion, belief or purpose.\n(2) This section applies to a prosecution for any offence against this Act.\n(3) If it is relevant to prove a person’s state of mind about an act or\nomission, it is enough to show—\n(a) the act was done or omission made by a representative of the\nperson within the scope of the representative’s actual or\napparent authority; and\n(b) the representative had the state of mind.\n(4) An act done or omitted to be done on behalf of a person by a\nrepresentative of the person within the scope of the representative’s\nactual or apparent authority is also taken to have been done or omitted\nto be done by the person.\n(5) However, subsection (4) does not apply if the person establishes that\nreasonable precautions were taken and appropriate diligence was\nexercised to avoid the act or omission.\n(6) A person who is convicted of an offence cannot be punished by\nimprisonment for the offence if the person would not have been\nconvicted of the offence without subsection (3) or (4).\n\nNote for pt 6\nThe Legislation Act 2001, s 170 and s 171 deal with the application of the\nprivilege against self-incrimination and client legal privilege.\n","sortOrder":35},{"sectionNumber":"25","sectionType":"section","heading":"Children and young people","content":"25 Children and young people\nSubject to this Act, if a consumer is a child or young person, a right\nor power conferred on consumers by this Act—\n(a) is exercisable on behalf of the consumer by a person with\nparental responsibility for the consumer; and\n(b) is not exercisable by the consumer on the consumer’s own\nbehalf.\n","sortOrder":36},{"sectionNumber":"26","sectionType":"section","heading":"Legally incompetent persons","content":"26 Legally incompetent persons\n(1) Subject to this Act, where a consumer is a legally incompetent person,\na right or power conferred on consumers by this Act—\n(a) is exercisable on behalf of the consumer by a guardian of the\n(b) is not exercisable by the consumer on the consumer’s own\nbehalf.\n(2) A purported consent by a guardian of a legally incompetent person is\nvoid if, when giving it, the guardian knows or believes it to be at\nvariance with the wishes expressed, and not changed or withdrawn,\nby the person before the person became a legally incompetent person.\n","sortOrder":37},{"sectionNumber":"27","sectionType":"section","heading":"Deceased consumers","content":"27 Deceased consumers\n(1) The privacy principles apply in relation to a deceased consumer, so\nfar as they are reasonably capable of doing so, in the same way as\nthey apply in relation to a consumer who is not deceased.\n\n(2) Subject to subsection (3), where a consumer has died, a right or power\nconferred on consumers by a provision of this Act is exercisable in\nrelation to the deceased consumer, so far as the circumstances\nreasonably permit, by a legal representative of the deceased\n(3) A purported consent by a legal representative of a deceased consumer\nis void if, when giving it, the legal representative knows or believes\nit to be at variance with the wishes expressed, and not changed or\nwithdrawn, by the consumer in the consumer’s lifetime.\n","sortOrder":38},{"sectionNumber":"29","sectionType":"section","heading":"Defect or invalidity—protection if person acts in good","content":"29 Defect or invalidity—protection if person acts in good\nfaith etc\nIf a person takes any action in respect of, or in consequence of having\nreceived—\n(a) a notice or request, made or apparently made under this Act; or\n(b) a consent or authorisation, given or apparently given under this\nAct;\nthat is void or defective, the person is not liable in respect of the action\nby reason only that the notice, request, consent or authorisation was\nvoid or defective, if the person proves that they—\n(c) took the action in good faith; and\n(d) did not know, and had no reason to be aware, when taking the\naction, that the notice, request, consent or authorisation was void\nor defective (as the case may be).\n","sortOrder":39},{"sectionNumber":"30","sectionType":"section","heading":"Unqualified record keeper to obtain and act on expert","content":"30 Unqualified record keeper to obtain and act on expert\nadvice\nIf a record keeper lacks the skill or training necessary to perform a\nfunction under this Act, the record keeper must, for the purpose of\nperforming the function, obtain and act on the advice, in respect of\nthe function, of a person possessing such skill and training.\n\n","sortOrder":40},{"sectionNumber":"31","sectionType":"section","heading":"Jurisdiction of Magistrates Court","content":"31 Jurisdiction of Magistrates Court\n(1) Application may be made to the Magistrates Court (the court) for—\n(a) a declaration that, for this Act, a person has, or does not have,\nthe status under this Act of—\n(i) a legally incompetent person; or\n(ii) a guardian of a legally incompetent person; or\n(iii) a child or young person; or\n(iv) a young person who has or does not have sufficient\nnature of the young person’s request to access a health\nrecord relating to the young person and the nature of the\nrecord; or\n(v) a person with parental responsibility for a child or young\n(vi) a legal representative of a deceased person; or\n(b) a declaration that, for this Act, anything done or purportedly\ndone under this Act was, or was not, validly done; or\n(c) any other order in relation to a matter arising under this Act that\nthe court considers appropriate.\n(2) An application may be made by—\n(a) the health services commissioner; or\n(b) any person who has a sufficient interest in the matter to warrant\nthe making by the person of the application.\n(3) The court may make, vary or revoke a declaration or order of a kind\nreferred to in subsection (1).\n\n","sortOrder":41},{"sectionNumber":"32","sectionType":"section","heading":"Appeals","content":"32 Appeals\n(1) An appeal to the Supreme Court may be brought as of right from—\n(a) the making, variation or revocation of a declaration or order\nunder section 31; or\n(b) a refusal of the Magistrates Court to make, vary or revoke such\na declaration or order.\n(2) The Magistrates Court Act 1930, part 4.5 (Civil appeals), other than\nsection 274 (Cases in which appeal may be brought), applies in\nrelation to the appeal.\nNote A reference to an Act includes a reference to the statutory instruments\nmade or in force under the Act, including rules (see Legislation Act,\ns 104).\n(3) Despite subsection (1), an appeal does not lie (whether as of right or\nby leave) from—\n(a) the making, variation or revocation of an interim restraining\norder under section 31; or\n(b) a refusal of the Magistrates Court to make, vary or revoke such\nan order.\n","sortOrder":42},{"sectionNumber":"33","sectionType":"section","heading":"Court orders under other laws","content":"33 Court orders under other laws\n(1) This Act does not prevent a court of competent jurisdiction from\nmaking, or continuing in force, under a law of the Territory an order\nin such terms that compliance with it would, apart from the order,\nconstitute a contravention of this Act.\n(2) Nevertheless, in deciding whether to make, or continue in force, an\norder in such terms the court must have regard to the relevant\nprovisions of this Act.\n\n","sortOrder":43},{"sectionNumber":"34","sectionType":"section","heading":"Determination of fees","content":"34 Determination of fees\n(1) The Minister may determine fees for this Act.\n(2) A determination is a disallowable instrument.\n","sortOrder":44},{"sectionNumber":"36","sectionType":"section","heading":"Regulation-making power","content":"36 Regulation-making power\n(1) The Executive may make regulations for this Act.\n(2) The regulations may—\n(a) extend, by not more than 21 days, the time within which\nsomething must or may be done for this Act; or\n(b) make provision about the keeping and transfer of health records;\nor\n(c) prescribe qualifications to be held, or other requirements to be\nmet, by record keepers in relation to possession or control of\nhealth records.\n(3) A regulation may make provision about a matter by applying,\nadopting or incorporating an instrument as in force from time to time\nfor the privacy principles, principle 10, clause 3 (which is about the\ndisclosure of a health record for the purpose of research or the\ncompilation or analysis of statistics).\nNote A reference to an instrument includes a reference to a provision of an\ninstrument (see Legislation Act, s 14 (2)).\n(4) The regulations may also prescribe offences for contraventions of the\nregulations and may prescribe maximum penalties of not more than\n10 penalty units for offences against the regulations.\n","sortOrder":45},{"sectionNumber":"37","sectionType":"section","heading":"Saving","content":"37 Saving\nThis Act is not to be read as affecting, except to the extent that it does\nso expressly or by necessary implication, the operation of a law of the\nTerritory that relates to access to, or privacy or confidentiality in\nrelation to, a document or a kind or class of document.\n\n(see s 5)\nPrinciple 1: Manner and purpose of collection of personal health\ninformation\n1 A collector must not collect personal health information for inclusion\nin a health record or in a generally available publication unless—\n(a) the information is collected for a lawful purpose that is directly\nrelated to a function or activity of the collector; and\n(b) the collection of the information is necessary for or directly\nrelated to that purpose.\n","sortOrder":46},{"sectionNumber":"2","sectionType":"section","heading":"A collector must not collect personal health information by unlawful","content":"2 A collector must not collect personal health information by unlawful\nor unfair means.\n3 Where personal health information or health records are required to\nbe collected by someone as part of their employment for the\nmanagement, funding or quality of a health service received by the\nconsumer, then that person is allowed access to the information only\nfor those purposes, unless these principles otherwise provide.\nPrinciple 2: Purpose of collection of personal health information\nto be made known\n1 Subject to clause 2 of this principle, where—\n(a) a collector collects personal health information for inclusion in\na health record or in a generally available publication; and\n(b) the information is solicited by the collector from the consumer\nconcerned;\nthe collector must take such steps (if any) as are reasonable in the\ncircumstances to ensure that, before the information is collected or, if\nthat is not practicable, as soon as practicable after the information is\ncollected, the consumer is generally aware of—\n\n(c) the purpose for which the information is being collected; and\n(d) if the collection of the information is required or authorised by\nlaw—the fact that the collection of the information is so required\nor authorised; and\n(e) unless it is obvious from the circumstances of any health service\nprovided—the identity of all members of the treating team who\nwill have access to the consumer’s personal health information;\nand\n(f) the identity of any person to whom, or agency to which, the\ncollector would, in accordance with the collector’s usual\npractice, disclose the information for inclusion in a health record\nor in a generally available publication; and\n(g) if it is, to the knowledge of the collector, the usual practice of\nany such person or agency to pass on such information to other\npersons or agencies—the identity of each of those other persons\nor agencies.\n2 The collector is not required to notify the consumer of the identity of\nindividuals, or classes of individuals, who are employed by the\ncollector and who are required for the management, funding or\nquality of the health service received by the consumer to handle\nhealth records or personal health information as part of their\nemployment.\nPrinciple 3: Solicitation of personal health information generally\nWhere—\n(a) a collector collects personal health information about a\nconsumer for inclusion in a record or in a generally available\npublication; and\n(b) the information is solicited by the collector;\n\nthe collector must take such steps (if any) as are reasonable in the\ncircumstances to ensure that, having regard to the purpose for which\nthe information is collected—\n(c) the information is relevant, up to date and accurate; and\n(d) the collection of the information does not intrude to an\nunreasonable extent upon the personal affairs of the consumer.\nPrinciple 4.1: Storage, security and destruction of personal health\ninformation—safekeeping requirement\nensure that—\n(a) the record is protected, by reasonable security safeguards,\nagainst each of the following:\n(i) loss;\n(ii) unauthorised access, use, modification or disclosure;\n(iii) other misuse; and\n(b) if the record is given to another entity—everything reasonably\nwithin the power of the record keeper is done to prevent\nunauthorised use or disclosure of any information contained in\nthe record.\n2 A record keeper must keep, and must not destroy, a health record\nabout a consumer, even if it is later found or claimed to be inaccurate.\n3 However, clause 2 does not apply to the destruction of a health record\nabout a consumer if—\n(a) the destruction is required or allowed under a law of the\nTerritory; or\nNote Law of the Territory—see dict.\n\n(b) the destruction is not prohibited under any other law and\nhappens after—\n(i) if the consumer is under 18 years old when the information\nis collected—the day the consumer turns 25 years old; or\n(ii) if the consumer is an adult when the information is\ncollected—7 years after the day a service was last provided\nto the consumer by the record keeper; or\n(c) an electronic copy of the record has been generated—\n(i) by a method described in the Electronic Transactions\nAct 2001, section 11 (2) (b); and\n(ii) when the record is destroyed it is reasonable to expect that\nthe information contained in the electronic copy will be\nreadily accessible so as to be useable for subsequent\nreference; or\nNote The Electronic Transactions Act 2001, section 11 (Retention of\ninformation and documents) provides that, if a person is required\nto retain a document, the requirement is taken to be met if the\nperson retains an electronic form of the document.\n(d) the record is a video recording of images captured by an\nautomated security or surveillance camera (surveillance\nfootage) located at premises from which a health service\nprovider provides services or in an area surrounding the\npremises.\nExample—surveillance footage\na recording of images captured by a closed-circuit television security camera\n4 In this principle:\nsurveillance footage—\n(a) includes an automated video recording made for the purposes of\nsecurity, public safety, monitoring of activities or community\neducation; but\n\n(b) does not include a video recording, whether or not automated,\nmade for the purpose of a clinical procedure or investigation.\nExamples—par (b)\n1 a video recording of a surgery made for quality assurance\n2 an automated video recording monitoring use of an MRI machine\nPrinciple 4.2: Storage, security and destruction of personal health\ninformation—register of destroyed or transferred\nrecords\n1 A record keeper must keep a register of records that have been\ndestroyed or transferred to another entity.\nNote Entity includes a person (see Legislation Act, dict, pt 1).\n2 The register must identify the following for records that have been\ndestroyed or transferred:\n(a) the consumer to whom the record relates;\n(b) the period of time the record covers;\n(c) for a destroyed record—the date the record was destroyed;\n(d) for a transferred record—the entity to which the record has been\ntransferred.\n3 A record keeper need not keep a record on the register under clause 1\nfor longer than 7 years after the day the record is made.\n4 A record keeper need not keep a record on the register under clause 1\nif the record destroyed is surveillance footage.\n5 In this principle:\nsurveillance footage—see principle 4.1, clause 4.\n\nPrinciple 4.3: Storage, security and destruction of personal health\ninformation—destruction of health information\n1 Health information may be kept by a health service provider if it is\nneeded for the purpose for which it was collected, or another purpose\nallowed under a law of the Territory, even if its destruction is allowed\nunder principle 4.1.\n2 An entity other than a health service provider must take reasonable\nsteps to destroy, or permanently deidentify, health information if it is\nno longer needed for the purpose for which it was collected or for any\nother purpose allowed under a law of the Territory.\nPrinciple 5: Information relating to records kept by record\nkeeper\n1 A record keeper who has possession or control of health records must,\nsubject to clause 2 of this principle, take such steps as are reasonable\nin the circumstances to enable any consumer to ascertain—\n(a) whether the record keeper has possession or control of any\nhealth records, or personal health information, relating to the\n(b) if so—\n(i) the nature of the records or information; and\n(ii) the main purposes for which the records are, or the\ninformation is, used; and\n(iii) the steps that the person should take if the person wishes to\nobtain access to the records or the information.\n2 A record keeper is not required to give a person information if, under\na law of the Territory (including this Act) or a law of the\nCommonwealth, the record keeper is required or authorised to refuse\nto give that information to the person.\n\nPrinciple 6: Access to health records by people other than the\nconsumer\n1 A health service provider who is a member of a treating team for a\nconsumer may have access to the personal health information about\nthe consumer so far as necessary for the provision by the provider of\na health service to the consumer.\n2 If a person reasonably requires access to personal health information\nabout a consumer for the purpose of the management, funding or\nquality of a health service received, or being received, by the\nconsumer, the person may have access to the extent necessary for that\npurpose without the consumer’s consent.\n3 A treating health service provider for a consumer may disclose\npersonal health information about the consumer to an immediate\nfamily member if—\n(a) the disclosure is made for compassionate reasons; and\n(b) the provider believes, on reasonable grounds, that the disclosure\nwould be expected by the consumer; and\n(c) the disclosure is not contrary to any wishes previously expressed\nby the consumer that the provider is, or ought reasonably to be,\naware of.\nNote Section 17 deals with information subject to confidentiality.\n4 An entity must not require a consumer, directly or indirectly, to obtain\nor grant access to a health record about the consumer unless the entity\nis required or allowed to make the requirement under—\n(c) an order of a court.\n\nPrinciple 7: Alteration of health records\n1 A person must not delete information from a health record, even\nwhere it is later found or claimed to be inaccurate, unless the deletion\nis part of a program of archival destruction.\n2 A record keeper who has possession or control of a health record must\ntake such steps, by way of making appropriate corrections and\nadditions as are reasonable in the circumstances, to ensure that the\nrecord is—\n(a) up to date and accurate; and\n(b) relevant to the purpose for which the information was collected\nor is to be used and to any other purpose that is directly related\nto that purpose.\n3 Where—\n(a) the record keeper of a health record is not willing to amend that\nrecord, by making a correction or an addition, in accordance\nwith a request by the consumer concerned; and\n(b) no decision or recommendation to the effect that the record\nshould be amended wholly or partly in accordance with that\nrequest is pending, or has been made, under a law of the\nTerritory (including this Act) or a law of the Commonwealth;\nthe record keeper must, if the consumer gives to the record keeper a\nwritten statement concerning the requested correction or addition,\ntake such steps as are reasonable in the circumstances to include the\nstatement in the record.\n4 Where the record keeper accepts the need to amend the health record\nbut—\n(a) the record keeper considers it likely that leaving incorrect\ninformation on a health record, even if corrected, could cause\nharm to the consumer or result in incorrect health care treatment\nor assistance being provided; or\n\n(b) the form in which the record is held makes correction\nimpossible; or\n(c) the corrections required are sufficiently complex or numerous\nfor a real possibility of confusion or error to arise in relation to\ninterpreting or reading the record if it were to be so amended;\nthe record keeper must place the incorrect information on a record\nwhich is not generally available to the consumer’s treating\npractitioner or treating team, and to which access is restricted, and\ntake such steps as are reasonable in the circumstances to ensure that\nonly the corrected copy is generally available to the practitioner or\ntreating team.\nPrinciple 8: Record keeper to check accuracy etc of personal\nhealth information before use etc\nnot use personal health information in that record without taking such\nsteps (if any) as are reasonable in the circumstances to ensure that,\nhaving regard to the purpose for which the information is proposed to\nbe used, the information is up to date and accurate.\n2 Where a person gives information in confidence to a health service\nprovider about a consumer, the provider must—\n(a) encourage the person to waive the requirement of\nconfidentiality; and\n(b) if the information remains confidential—\n(i) record the information only if it is likely to assist in the\ntreatment or care of the consumer; and\n(ii) take such steps (if any) as are reasonable in the\ncircumstances to ensure that the information is accurate\nand not misleading.\n\nPrinciple 9: Limits on use of personal health information\n1 Except where personal health information is being shared between\nmembers of a treating team to the extent necessary to improve or\nmaintain the consumer’s health or to manage a disability of the\nconsumer, a record keeper who has possession or control of a health\nrecord that was obtained for a particular purpose must not use the\ninformation for any other purpose unless—\n(a) the consumer has consented to use of the information for that\nother purpose; or\n(b) the record keeper believes on reasonable grounds that use of the\ninformation for that other purpose is necessary to prevent or\nlessen a significant risk to the life or physical, mental or\nemotional health of the consumer or another person; or\n(c) use of the information for that other purpose is required or\nauthorised by—\n(iii) an order of a court of competent jurisdiction;\n(d) the purpose for which the information is used is directly related\nto the purpose for which the information was obtained; or\n(e) the use of the information is related to the management, funding\nor quality of the health service received by the consumer.\n2 In relation to the sharing of information among a treating team, unless\nit is obvious from the circumstances or context of the health service,\nthe person in charge of the treating team must inform the consumer\nof the identity of all members of the treating team who will have\naccess to the consumer’s personal health information.\n\n3 The treating team leader is not required to notify the consumer of the\nidentity of individuals, or of classes of individuals, who are required\nfor the management, funding or quality of the health service received\nby the consumer to handle health records or personal health\ninformation.\nPrinciple 10: Limits on disclosure of personal health information\nnot disclose personal health information about a consumer from the\nrecord to an entity other than the consumer.\n2 Clause 1 does not apply to the disclosure of personal health\ninformation about a consumer to an entity if—\n(a) the information is being shared between members of a treating\nteam for the consumer only to the extent necessary to improve\nor maintain the consumer’s health or manage a disability of the\n(b) the consumer is reasonably likely to have been aware, or to have\nbeen made aware under principle 2, that information of the kind\ndisclosed is usually disclosed to the entity; or\n(c) the consumer has consented to the disclosure; or\n(d) the record keeper believes, on reasonable grounds, that the\ndisclosure is necessary to prevent or lessen a serious and\nimminent risk to the life or physical, mental or emotional health\nof the consumer or someone else; or\n(e) the disclosure is required or allowed under—\n(i) a law of the Territory (including this Act); or\nNote Disclosure is allowed under cl 8, cl 9 and cl 10.\n(iii) an order of a court; or\n\n(f) the disclosure of the information is necessary for the\nmanagement, funding or quality of the health service received,\nor being received, by the consumer.\n3 Clause 1 also does not apply to the disclosure of personal health\ninformation about a consumer to an entity if—\n(a) the disclosure is necessary for the purpose of research or the\ncompilation or analysis of statistics, in the public interest; and\n(b) it is impracticable to seek the consumer’s consent before\ndisclosure; and\n(c) the purpose mentioned in paragraph (a) cannot be achieved by\nthe disclosure of information that does not identify the consumer\nand from which the consumer’s identity cannot reasonably be\nworked out; and\n(d) the entity is required for any disclosed information (identifiable\ninformation) that identifies the consumer, or from which the\nconsumer’s identity can be reasonably worked out—\n(i) to provide protection that is at least equal to that of this Act\nand that prevents any further disclosure of it; and\n(ii) to take reasonable steps to deidentify the information and\ndestroy identifiable information at the earliest possible\nopportunity; and\n(iii) to ensure that identifiable information is not made publicly\navailable.\n(e) the disclosure is in accordance with guidelines prescribed by\nregulation for this clause; and\n(f) the record keeper believes, on reasonable grounds, that the\nrecipient of the health information will not disclose the personal\nhealth information.\n\n4 Clause 1 also does not apply to the disclosure of personal health\ninformation about a consumer to the consumer’s carer if—\nwhether or not because the consumer is a—\n(i) child or a young person who does not have sufficient\nnature of the young person’s request to access a health\nrecord and the nature of the record; or\n(ii) legally incompetent person; and\n(b) in the record keeper’s opinion, the disclosure is necessary to\nenable the carer to safely and effectively provide appropriate\nservices to, or care for, the consumer.\n5 In relation to the sharing of information among the treating team\nunder clause 2 (a), unless it is obvious from the circumstances and\ncontext of the health service, the person in charge of the treating team\nmust tell the consumer about the identity of each member of the\ntreating team who will have access to the personal health information\nabout the consumer.\n6 However, the treating team leader need not tell the consumer about\nthe identity of individuals who are required to handle health records,\nor personal health information about the consumer, for the\nmanagement, funding or quality of the health service received, or\nbeing received, by the consumer.\n7 A consent given by a consumer for clause 2 (c) must—\n(a) be in writing and signed—\n(i) if the consumer is a child or young person who does not\nhave sufficient maturity and developmental capacity to\nunderstand the nature of the young person’s request to\naccess a health record and the nature of the record—by a\nperson with parental responsibility for the consumer; or\n\n(ii) if the consumer is a legally incompetent person—by a\n(iii) in any other case—by the consumer; and\n(b) name the health service provider who made the record.\n8 An entity to which information is disclosed under clause 2, clause 3\nor clause 4 must not use or disclose the information for a purpose\nother than the purpose for which the information was given to the\nentity.\n9 If there is an emergency and a consumer cannot give or withhold\nconsent to the disclosure of personal health information about the\nconsumer, the treating health service provider may discuss relevant\npersonal health information with an immediate family member of the\nconsumer to the extent reasonable and necessary for the proper\ntreatment of the consumer.\n10 A treating health service provider for a consumer may disclose\npersonal health information about the consumer to the consumer’s\ncarer if—\nwhether or not because the consumer is a child, young person\nwho does not have sufficient maturity and developmental\ncapacity to understand the nature of the young person’s request\nto access the health record and the nature of the record or legally\nincompetent person; and\n(b) in the provider’s opinion, the disclosure is necessary to enable\nthe carer to safely and effectively provide appropriate services\nto, or care for, the consumer.\n\n11 A treating health service provider for a consumer may disclose\npersonal health information about the consumer to an immediate\nfamily member if—\nwhether or not because the consumer is—\n(i) a child or young person who does not have sufficient\nnature of the young person’s request to access the health\nrecord and the nature of the record; or\n(ii) a legally incompetent person; and\n(b) the disclosure is made for compassionate reasons; and\n(c) the provider believes, on reasonable grounds, that the disclosure\nwould be, or would have been, expected by the consumer; and\n(d) the disclosure is not contrary to any wishes previously expressed\nby the consumer of which the provider is aware or ought\nreasonably to be aware.\nExample for par (a)\nJo has died, and Jo’s daughter who has looked after him for many years cannot\nunderstand why he died when he seemed to have recovered from a recent illness.\nShe is extremely distressed. Subject to clause 11 (c) and (d), the treating health\nservice provider may disclose personal health information about Jo’s illness if she\nconsiders that the disclosure would help Jo’s daughter.\n12 In this principle:\ncarer, of a consumer, means a person who gives care, support or\nassistance to the consumer but does not include—\n(a) a person who gives short-term care, support or assistance to the\n\n(b) a person who gives care, support or assistance to the\nconsumer—\n(i) under a commercial arrangement, or an arrangement that is\nsubstantially commercial; or\n(ii) in the course of doing voluntary work for a charitable,\nwelfare or community organisation; or\n(iii) as part of a course of education or training; or\n(c) a person just because the person—\n(i) is the domestic partner, parent, child or other relative, or\n(ii) lives with the consumer.\nExamples—people not included as carers\n1 Yiannis is the principal of Haig Park Primary School. Although Yiannis\nowes a duty of care to the students at Haig Park Primary School, Yiannis\nis not a carer for the purposes of principle 10.\n2 The ACAT makes an order under the Guardianship and Management\nof Property Act 1991, s 7 (3) appointing Tash as a guardian for Olympia.\nEven though Tash has a guardianship order in relation to Olympia, Tash\nis not a carer for the purposes of principle 10. Tash would need to give\nOlympia care, support or assistance to be a carer.\nPrinciple 11: Relocation and closure of health service practice\n1 This principle applies if a health service practice is or is proposed to\nbe—\n(a) relocated; or\n(b) permanently closed.\n2 Not later than 30 days before the proposed relocation or closure, the\nprovider must—\n(a) give public notice of the relocation or closure (a transfer\nnotice); and\n\n(b) take other practicable steps to inform each consumer who has\nattended the health service practice of the matters mentioned in\nthe transfer notice.\nNote Public notice means notice on an ACT government website or in a daily\nnewspaper circulating in the ACT (see Legislation Act, dict, pt 1).\n3 The transfer notice must state—\n(a) that the consumer may request (a transfer request) that a copy\nor written summary of the consumer’s health record be given to\nthe consumer or a health service provider nominated by the\n(b) that the transfer request must be made not later than 14 days after\nthe day the transfer notice (the transfer request period) is\npublished; and\n(c) if a fee has been determined under section 34 for this principle—\nthat there is a fee that the consumer must pay before the provider\nwill give a copy or written summary of the record to the\nconsumer or health service provider nominated by the\n(d) that if the consumer does not make a transfer request within the\ntransfer request period, a copy of the consumer’s health record\nwill be given to a stated health service provider or record keeper;\nand\n(e) the stated health service provider’s or record keeper’s address\nand contact details.\n4 As soon as practicable after publishing the transfer notice, the\nprovider must give a copy of the transfer notice, or written notice of\nthe information in the transfer notice, to the director-general.\nNote 1 Director-general means the director-general of the administrative unit\nresponsible for this Act (see Legislation Act, s 163). Administrative units\nare established under the administrative arrangements (see Public Sector\nManagement Act 1994, s 13).\n\nNote 2 Notice may be given electronically in certain circumstances (see\nElectronic Transactions Act 2001, s 8).\n5 If a consumer has made a transfer request, the provider must give the\nconsumer or the consumer’s nominated health service provider the\nrequested copy or written summary of the consumer’s health record\nas soon as practicable but not later than the later of—\n(a) if a fee is payable for this principle—7 days after the day the fee\nis paid; and\n(b) 30 days after the day the provider receives the transfer request.\n6 If, however, the consumer is receiving or needs urgent health\nservices, the provider must give the consumer or the consumer’s\nnominated health service provider the requested copy or written\nnot later than 7 days after the day the provider receives the transfer\nNote Urgent health services—see cl 11 and cl 12.\n7 If a consumer does not make a transfer request within the transfer\nrequest period, the provider must, within 30 days after the end of the\ntransfer request period, give a copy of the consumer’s health records\nto the health service provider or record keeper stated in the transfer\nnotice.\nNote 1 If the original or copy of a consumer’s health record is given to another\nhealth service provider (the new provider) or other record keeper\n(the new record keeper)—\n• the consumer may ask the new provider or new record keeper for\naccess to the consumer’s health record (see s 10 and s 12); and\n• the new provider or new record keeper must give the consumer\naccess to the consumer’s health records in accordance with the Act\n(for example, see s 13 to s 13D).\nNote 2 A fee may be payable by the consumer for certain types of access (see\ns 10 (7) and s 13 (2) (d) (ii)).\n\n8 If a record keeper holds health records following the relocation or\nclosure of a health service practice, the record keeper must promptly\nnotify the director-general of any change to—\n(a) the record keeper’s contact details; or\n(b) the location of the stored health records.\n9 The director-general must promptly give a copy of a notice under\nclause 4 or clause 8 to the health services commissioner.\n10 If this principle applies because a sole provider in a health service\npractice dies or becomes legally incompetent, a legal representative\nor guardian of the provider must comply with the requirements of this\nprinciple as soon as practicable.\n11 It is sufficient to establish that a consumer is receiving or needs\nurgent health services for prioritising the giving of records by a\nprovider (the record holder) if another health service provider advises\nthe record holder that the consumer is receiving or needs urgent health\nservices.\n12 However—\n(a) an advice under clause 11 need not be in writing; and\nclause 11.\n13 The requirement under clause 5, clause 6 or clause 7 to give a copy\nof the consumer’s health record is taken to be satisfied if the original\nof the record is given.\n14 To remove doubt, clause 13 does not require a provider to give the\noriginal of the consumer’s health record.\n15 In this principle:\nhealth record means a health record held by, or on behalf of, the\n\nhealth service practice means the business or premises where a health\nservice provider provides health services.\nprovider means—\n(a) the provider of a health service practice; or\n(b) if the provider is legally incompetent—the guardian of the\nprovider; or\n(c) if the provider is dead—the legal representative of the provider.\nrelocate, a practice, includes—\n(a) relocate to another premises or location; or\n(b) stop, temporarily or otherwise, the provision of health services\nat a particular location.\ntransfer notice—see clause 2 (a).\ntransfer request—see clause 3 (a).\ntransfer request period—see clause 3 (b).\nPrinciple 12.1: Consumer moves to another health service provider\n1 If a consumer moves from 1 health service provider (the first\nprovider) to another health service provider (the second provider),\nthe consumer may ask the first provider to give the second provider a\ncopy or written summary of the consumer’s health record.\n2 If the first provider receives a request under clause 1 (a transfer\nrequest), the first provider must—\n(a) if a fee has been determined under section 34 for this principle—\nnot later than 7 days after the day the first provider receives the\ntransfer request, give the consumer notice that the consumer\nmust pay a stated fee before the first provider will give the\nsecond provider the requested copy or written summary of the\nconsumer’s health record; or\n\n(b) not later than 30 days after the day the first provider receives the\ntransfer request, give the second provider the requested copy or\nwritten summary of the consumer’s health record.\n3 If the consumer pays the fee stated in a notice under clause 2 (a), the\nfirst provider must give the second provider the requested copy or\nwritten summary of the consumer’s health record not later than the\nlater of—\n(a) 7 days after the day the fee is paid; and\n(b) 30 days after the day the first provider receives the transfer\n4 If the consumer is receiving or needs urgent health services, the first\nprovider must give the second provider the requested copy or written\nnot later than 7 days after the day the first provider receives the\ntransfer request.\n5 It is sufficient to establish that a consumer is receiving or needs\nurgent health services for prioritising the giving of records by the\nfirst provider (the record holder) if another health service provider\nadvises the record holder that the consumer is receiving or needs\nurgent health services.\n6 However—\n(a) an advice under clause 5 need not be in writing; and\nclause 5.\n7 The requirement under clause 2 (b), clause 3 or clause 4 to give a copy\nof the consumer’s health record to the second provider is taken to be\nsatisfied if the original of the record is given.\n8 To remove doubt, clause 7 does not require the first provider to give\nthe original of the consumer’s health record to the second provider.\n\n9 In this principle:\nfirst provider—\n(a) see clause 1; and\n(b) includes—\n(i) if the first provider becomes legally incompetent—a\nguardian of the provider; or\n(ii) if the first provider dies—a legal representative of the\nhealth record means a health record held by, or on behalf of, the first\nsecond provider—see clause 1.\ntransfer request—see clause 2.\nPrinciple 12.2: Health service provider moves to another health\nservice practice\n1 If a health service provider (the provider) moves from 1 health service\npractice (the first practice) to another health service practice and a\nconsumer continues to see the provider, the consumer may ask the\nfirst practice to give the provider a copy or written summary of the\nconsumer’s health record.\n2 If the first practice receives a request under clause 1 (a transfer\nrequest), the first practice must—\n(a) if a fee has been determined under section 34 for this principle—\nnot later than 7 days after the day the first practice receives the\ntransfer request, give the consumer notice that the consumer\nmust pay a stated fee before the first practice will give the\nprovider the requested copy or written summary of the\nconsumer’s health record; or\n\n(b) not later than 30 days after the day the first practice receives the\ntransfer request, give the provider the requested copy or written\nsummary of the consumer’s health record.\n3 If the consumer pays the fee stated in a notice under clause 2 (a), the\nfirst practice must give the provider the requested copy or written\nsummary of the record not later than the later of—\n(a) 7 days after the day the fee is paid; and\n(b) 30 days after the day the first practice receives the transfer\n4 If the consumer is receiving or needs urgent health services, the first\npractice must give the provider the requested copy or written\nnot later than 7 days after the day the first practice receives the\ntransfer request.\n5 It is sufficient to establish that a consumer is receiving or needs\nurgent health services for prioritising the giving of records by the\nfirst practice (the record holder) if another health service provider\nadvises the first practice that the consumer is receiving or needs\nurgent health services.\n6 However—\n(a) an advice under clause 5 need not be in writing; and\nclause 5.\n7 The requirement under clause 2 (b), clause 3 or clause 4 to give a copy\nof the consumer’s health record to the provider is taken to be satisfied\nif the original of the record is given.\n8 To remove doubt, clause 7 does not require the first practice to give\nthe original of the consumer’s health record to the provider.\n\n9 In this principle:\nfirst practice—see clause 1.\nhealth record means a health record held by, or on behalf of, the first\nhealth service practice means the business or premises where a health\nservice provider provides health services.\nprovider—see clause 1.\ntransfer request—see clause 2.\n\n(see s 4)\nNote 1 The Legislation Act contains definitions relevant to this Act. For\nexample: the Legislation Act, dict, pt 1 defines the following terms:\n• adult\n• Commonwealth\n• contravene\n• director-general (see s 163)\n• domestic partner (s 169)\n• entity\n• health services commissioner\n• human rights commission\n• individual.\nchild—\n(a) means a person who is under 12 years old; and\n(b) in relation to a person, includes an adopted child or stepchild of\nthat person.\ncollector means a person who, in the course of their profession,\nemployment or official duty, collects personal health information.\ncommission means the human rights commission.\nconsent includes implied consent.\nconsumer means an individual who uses, or has used, a health\nservice, or in relation to whom a health record has been created, and\nincludes—\n(a) if the consumer is a child or young person—a person with\nparental responsibility for the consumer; and\n(b) if the consumer is a legally incompetent person—a guardian of\nthe consumer; and\n\n(c) if the consumer has died and there is a legal representative of the\ndeceased consumer—a legal representative of the deceased\n(d) if the consumer has died and there is no legal representative of\nthe deceased consumer—an immediate family member of the\ndeceased consumer.\nNote Under s 13A an entity is taken to be the consumer for the purpose of\naccessing certain information if the consumer has consented to disclosure\nof the information to the entity.\ndeceased consumer means a deceased person who, before their death,\nwas a consumer.\ndestroy a record includes delete the record.\ndisability—see the Human Rights Commission Act 2005,\nsection 8 (2).\nfactual matter, in relation to a consumer, means—\n(a) a history of the health, an illness or a disability of the consumer;\nor\n(b) any findings on an examination of the consumer in relation to\nthe health, an illness or a disability of the consumer; or\n(c) the results of any investigation into the health, an illness or a\ndisability of the consumer; or\n(d) a diagnosis, or preliminary diagnosis, of an illness or disability\nof the consumer; or\n(e) a plan of management, or proposed plan of management, of the\ntreatment or care of an illness or disability of the consumer; or\n(f) any action taken (whether or not in accordance with a plan of\nmanagement) by or under the direction or referral of a health\nservice provider in relation to the consumer.\n\nguardian, for a legally incompetent person, means—\n(a) a person who is—\n(i) a legally appointed guardian of the legally incompetent\n(ii) an attorney, appointed under an enduring power of attorney\nthat has become operative, of the legally incompetent\nperson; and\n(b) a person who has power to make decisions about the medical\ntreatment or health care of the legally incompetent person.\nhealth record means any record, or any part of a record—\n(a) held by a health service provider and containing personal\ninformation; or\n(b) containing personal health information.\nhealth service means—\n(a) any activity that is intended or claimed (expressly or by\nimplication), by the person providing it, to assess, record,\nimprove or maintain the physical, mental or emotional health of\na consumer or to diagnose or treat an illness or disability of a\n(b) a disability, palliative care or aged care service that involves the\nmaking or keeping of personal health information;\nbut does not include any service declared by regulation to be an\nexempt service.\nhealth service provider means an entity that provides a health service.\nhealth status report means a report—\n(a) that is prepared or substantially prepared—\n(i) by a health service provider; and\n\n(ii) in respect of a consumer who, at the time of the preparation\nof the report, resides or is present in the ACT; and\n(b) that relates to the physical, mental or emotional health of a\nconsumer, or a disability or disease of a consumer; and\n(c) whose purpose, or main purpose, is not a health service for the\nillness means a physical, mental or emotional illness, and includes a\nsuspected illness.\nimmediate family member, of a consumer, means a person who—\n(a) is—\n(i) a parent of the consumer; or\n(ii) a domestic partner of the consumer; or\n(iii) an adult child or sibling of the consumer; or\nNote For the meaning of domestic partner, see the Legislation Act, s 169.\n(b) is a member of the same household as the consumer and is—\n(i) another relative of the consumer; or\n(ii) a close friend of the consumer.\nlaw of the Territory does not include this Act or the common law.\nlegally incompetent person means a person who is subject—\n(a) to an enduring power of attorney that has become operative; or\n(b) otherwise than as a person under the age of majority to a\nguardianship order.\nlegal representative, in relation to a deceased person, means a\nperson—\n(a) holding office as executor of the will of the deceased person\nwhere probate of the will has been granted or resealed in\nAustralia; or\n\n(b) holding office in Australia as administrator of the estate of the\ndeceased person.\norder of a court of competent jurisdiction includes a subpoena or\nsimilar process of such a court.\nparent, in relation to a person, includes a step-parent or adoptive\nparent of the person.\npersonal information, in relation to a consumer, means any\ninformation, recorded or otherwise, about the consumer where the\nidentity of the consumer is apparent, whether the information is—\n(a) fact or opinion; or\n(b) true or false.\npersonal health information, of a consumer, means any personal\ninformation, whether or not recorded in a health record—\n(a) relating to the health, an illness or a disability of the consumer;\nor\n(b) collected by a health service provider in relation to the health,\nan illness or a disability of the consumer.\nperson with parental responsibility, for a child or young person,\nmeans a parent or someone else with parental responsibility for the\nchild or young person under the Children and Young People\nAct 2008, division 1.3.2.\nprivacy principles means the privacy principles under schedule 1.\nrecord means a record in documentary or electronic form that consists\nof or includes personal health information in relation to a consumer\n(other than research material that does not disclose the identity of the\nconsumer), and includes—\n(a) a photograph or other pictorial or digital representation of any\npart of the consumer; and\n(b) test results, medical imaging materials and reports, and clinical\nnotes, relating to the consumer; and\n\n(c) any part of a record; and\n(d) a copy of a record or any part of a record.\nrecord keeper means an entity that has possession or control of a\nhealth record.\nsibling, in relation to a person, means a brother, sister, half-brother,\nhalf-sister, adoptive brother, adoptive sister, stepbrother or stepsister\nof the person.\ntreating health service provider, in relation to a consumer, means a\nhealth service provider who is involved in diagnosis, care or treatment\nof the consumer for the purpose of improving or maintaining the\nconsumer’s health.\ntreating team, in relation to a consumer, means health service\nproviders involved in diagnosis, care or treatment for the purpose of\nimproving or maintaining the consumer’s health for a particular\nepisode of care, and includes—\n(a) if the consumer named another health service provider as the\nconsumer’s current treating practitioner—that other health\nservice provider; and\n(b) if another health service provider referred the consumer to the\ntreating team for that episode of care—that other health service\nyoung person—see the Children and Young People Act 2008,\nsection 12.\n\n1 About the endnotes\n1 About the endnotes\nAmending and modifying laws are annotated in the legislation history and the\namendment history. Current modifications are not included in the republished law\nbut are set out in the endnotes.\nNot all editorial amendments made under the Legislation Act 2001, part 11.3 are\nannotated in the amendment history. Full details of any amendments can be\nobtained from the Parliamentary Counsel’s Office.\nUncommenced amending laws are not included in the republished law. The details\nof these laws are underlined in the legislation history. Uncommenced expiries are\nunderlined in the legislation history and amendment history.\nIf all the provisions of the law have been renumbered, a table of renumbered\nprovisions gives details of previous and current numbering.\nThe endnotes also include a table of earlier republications.\n2 Abbreviation key\nA = Act NI = Notifiable instrument\nAF = Approved form o = order\nam = amended om = omitted/repealed\namdt = amendment ord = ordinance\nAR = Assembly resolution orig = original\nch = chapter par = paragraph/subparagraph\nCN = Commencement notice pres = present\ndef = definition prev = previous\nDI = Disallowable instrument (prev...) = previously\ndict = dictionary pt = part\ndisallowed = disallowed by the Legislative r = rule/subrule\nAssembly reloc = relocated\ndiv = division renum = renumbered\nexp = expires/expired R[X] = Republication No\nGaz = gazette RI = reissue\nhdg = heading s = section/subsection\nIA = Interpretation Act 1967 sch = schedule\nins = inserted/added sdiv = subdivision\nLA = Legislation Act 2001 SL = Subordinate law\nLR = legislation register sub = substituted\nLRA = Legislation (Republication) Act 1996 underlining = whole or part not commenced\nmod = modified/modification or to be expired\n\nHealth Records (Privacy and Access) Act 1997 A1997-125\nnotified 24 December 1997 (Gaz 1997 No S420)\ncommenced 1 February 1998 (s 2)\nas amended by\nLegislation (Consequential Amendments) Act 2001 A2001-44 pt 181\nnotified 26 July 2001 (Gaz 2001 No 30)\ns 1, s 2 commenced 26 July 2001 (IA s 10B)\npt 181 commenced 12 September 2001 (s 2 and see Gaz 2001 No\nS65)\nLegislation Amendment Act 2002 A2002-11 pt 2.26\nnotified LR 27 May 2002\ns 1, s 2 commenced 27 May 2002 (LA s 75)\npt 2.26 commenced 28 May 2002 (s 2 (1))\nLegislation (Gay, Lesbian and Transgender) Amendment Act 2003\nA2003-14 sch 1 pt 1.19\nnotified LR 27 March 2003\ns 1, s 2 commenced 27 March 2003 (LA s 75)\nsch 1 pt 1.19 commenced 28 March 2003 (s 2)\nCriminal Code (Theft, Fraud, Bribery and Related Offences)\nAmendment Act 2004 A2004-15 sch 1 pt 1.22\nnotified LR 26 March 2004\ns 1, s 2 commenced 26 March 2004 (LA s 75 (1))\nsch 1 pt 1.22 commenced 9 April 2004 (s 2 (1))\nHealth Professionals Legislation Amendment Act 2004 A2004-39\nsch 5 pt 5.8\nnotified LR 8 July 2004\ns 1, s 2 commenced 8 July 2004 (LA s 75 (1))\nsch 5 pt 5.8 commenced 7 July 2005 (s 2 and see Health Professionals\nAct 2004 A2004-38, s 2 and CN2005-11)\n\nCourt Procedures (Consequential Amendments) Act 2004 A2004-60\nsch 1 pt 1.30\nnotified LR 2 September 2004\ns 1, s 2 commenced 2 September 2004 (LA s 75 (1))\nsch 1 pt 1.30 commenced 10 January 2005 (s 2 and see Court\nProcedures Act 2004 A2004-59, s 2 and CN2004-29)\nHealth Records (Privacy and Access) Amendment Act 2005 A2005-4\nnotified LR 22 February 2005\ns 1, s 2 commenced 22 February 2005 (LA s 75 (1))\nremainder commenced 23 February 2005 (s 2)\nDomestic Violence and Protection Orders Amendment Act 2005\nA2005-13 sch 1 pt 1.11\nnotified LR 24 March 2005\ns 1, s 2 commenced 24 March 2005 (LA s 75 (1))\nsch 1 pt 1.11 commenced 25 March 2005 (s 2)\nHuman Rights Commission Legislation Amendment Act 2005\nA2005-41 sch 1 pt 1.6 (as am by A2006-3 sch 1 pt 1.3)\nnotified LR 1 September 2005\ns 1, s 2 commenced 1 September 2005 (LA s 75 (1))\namdts 1.92-1.95, amdt 1.97, amdt 1.100 commenced 23 February\n2006 (s 2 (2) as am by A2006-3 amdt 1.3)\nsch 1 pt 1.6 remainder commenced 1 November 2006 (s 2 (3) (as am\nby A2006-3 amdt 1.3) and see Human Rights Commission Act 2005\nA2005-40, s 2 (as am by A2006-3 s 4) and CN2006-21)\nHealth Records (Privacy and Access) Amendment Act 2005 (No 2)\nA2005-63\nnotified LR 21 December 2005\ns 1, s 2 commenced 21 December 2005 (LA s 75 (1))\ns 19, sch 1 amdt 1.1 commenced 23 February 2006 (LA s 79A and\nA2005-41)\nremainder commenced 17 January 2006 (s 2 and CN2006-1)\n\nHuman Rights Commission Legislation Amendment Act 2006\nA2006-3 sch 1 pt 1.1, pt 1.3\nnotified LR 22 February 2006\ns 1, s 2 commenced 22 February 2006 (LA s 75 (1))\nsch 1 pt 1.1, pt 1.3 commenced 23 February 2006 (s 2)\nNote Sch 1 pt 1.3 only amends the Human Rights Commission\nLegislation Amendment Act 2005 A2005-41.\nHealth Legislation Amendment Act 2006 (No 2) A2006-46 sch 2 pt 2.9\nnotified LR 17 November 2006\ns 1, s 2 commenced 17 November 2006 (LA s 75 (1))\nsch 2 pt 2.9 commenced 18 November 2006 (s 2 (1))\nChildren and Young People (Consequential Amendments) Act 2008\nA2008-20 sch 3 pt 3.15\nnotified LR 17 July 2008\ns 1, s 2 commenced 17 July 2008 (LA s 75 (1))\ns 3 commenced 18 July 2008 (s 2 (1))\nsch 3 pt 3.15 commenced 27 October 2008 (s 2 (4) and see Children\nand Young People Act 2008 A2008-19, s 2 and CN2008-13)\nStatute Law Amendment Act 2009 A2009-20 sch 3 pt 3.40\nnotified LR 1 September 2009\ns 1, s 2 commenced 1 September 2009 (LA s 75 (1))\nsch 3 pt 3.40 commenced 22 September 2009 (s 2)\nHealth Legislation Amendment Act 2010 A2010-2 pt 3\nnotified LR 16 February 2010\ns 1, s 2 commenced 16 February 2010 (LA s 75 (1))\npt 3 commenced 16 August 2010 (s 2 and LA s 79)\nHealth Practitioner Regulation National Law (ACT) Act 2010 A2010-10\nsch 2 pt 2.11\nnotified LR 31 March 2010\ns 1, s 2 commenced 31 March 2010 (LA s 75 (1))\nsch 2 pt 2.11 commenced 1 July 2010 (s 2 (1) (a))\nHealth Legislation Amendment Act 2010 (No 2) A2010-11\nnotified LR 30 March 2010\ns 1, s 2 commenced 30 March 2010 (LA s 75 (1))\nremainder commenced 30 September 2010 (s 2 and LA s 79)\n\nStatute Law Amendment Act 2010 A2010-18 sch 3 pt 3.7\nnotified LR 13 May 2010\ns 1, s 2 commenced 13 May 2010 (LA s 75 (1))\nsch 3 pt 3.7 commenced 3 June 2010 (s 2)\nStatute Law Amendment Act 2011 A2011-3 sch 3 pt 3.23\nnotified LR 22 February 2011\ns 1, s 2 commenced 22 February 2011 (LA s 75 (1))\nsch 3 pt 3.23 commenced 1 March 2011 (s 2)\nAdministrative (One ACT Public Service Miscellaneous Amendments)\nAct 2011 A2011-22 sch 1 pt 1.77\nnotified LR 30 June 2011\ns 1, s 2 commenced 30 June 2011 (LA s 75 (1))\nsch 1 pt 1.77 commenced 1 July 2011 (s 2 (1))\nStatute Law Amendment Act 2014 A2014-18 sch 3 pt 3.10\nnotified LR 20 May 2014\ns 1, s 2 commenced 20 May 2014 (LA s 75 (1))\nsch 3 pt 3.10 commenced 10 June 2014 (s 2 (1))\nStatute Law Amendment Act 2014 (No 2) A2014-44 sch 1 pt 1.1\nnotified LR 5 November 2014\ns 1, s 2 commenced 5 November 2014 (LA s 75 (1))\nsch 1 pt 1.1 commenced 19 November 2014 (s 2)\nVeterinary Surgeons Act 2015 A2015-29 sch 2 pt 2.6\nnotified LR 20 August 2015\ns 1, s 2 commenced 20 August 2015 (LA s 75 (1))\nsch 2 pt 2.6 commenced 1 December 2015 (s 2 (1) and CN2015-22)\nRed Tape Reduction Legislation Amendment Act 2015 A2015-33\nsch 1 pt 1.34\nnotified LR 30 September 2015\ns 1, s 2 commenced 30 September 2015 (LA s 75 (1))\nsch 1 pt 1.34 commenced 14 October 2015 (s 2)\nHealth Legislation Amendment Act 2016 A2016-11 pt 4\nnotified LR 1 March 2016\ns 1, s 2 commenced 1 March 2016 (LA s 75 (1))\npt 4 commenced 2 March 2016 (s 2)\n\nProtection of Rights (Services) Legislation Amendment Act 2016\n(No 2) A2016-13 sch 1 pt 1.24\nnotified LR 16 March 2016\ns 1, s 2 commenced 16 March 2016 (LA s 75 (1))\nsch 1 pt 1.24 commenced 1 April 2016 (s 2 and see Protection of\nRights (Services) Legislation Amendment Act 2016 A2016-1 s 2)\nStatute Law Amendment Act 2021 A2021-12 sch 3 pt 3.23\nnotified LR 9 June 2021\ns 1, s 2 commenced 9 June 2021 (LA s 75 (1))\nsch 3 pt 3.23 commenced 23 June 2021 (s 2 (1))\nStatute Law Amendment Act 2022 A2022-14 sch 3 pt 3.21\nnotified LR 10 August 2022\ns 1, s 2 commenced 10 August 2022 (LA s 75 (1))\nsch 3 pt 3.21 commenced 24 August 2022 (s 2)\nChildren and Young People Amendment Act 2023 A2023-49 sch 1\npt 1.2 (as am by A2024-3 s 4)\nnotified LR 15 November 2023\ns 1, s 2 commenced 15 November 2023 (LA s 75 (1))\nsch 1 pt 1.2 commenced 1 July 2024 (s 2 (2) as am by\nA2024-3 s 4)\nChildren and Young People Amendment Act 2024 A2024-3\nnotified LR 19 February 2024\ns 1, s 2 commenced 19 February 2024 (LA s 75 (1))\nremainder commenced 20 February 2024 (s 2)\nNote This Act only amends the Children and Young People\nAmendment Act 2023 A2023-49.\nHealth Legislation Amendment Act 2024 A2024-42 pt 4\nnotified LR 17 September 2024\ns 1, s 2 commenced 17 September 2024 (LA s 75 (1))\npt 4 commenced 18 September 2024 (s 2 (1))\nStatute Law Amendment Act 2025 A2025-29 sch 3 pt 3.46, sch 4\npt 4.91 notified LR 6 November 2025\ns 1, s 2 commenced 6 November 2025 (LA s 75 (1))\nsch 3 pt 3.46, sch 4 pt 4.91 commenced 16 November 2025 (s 2 (1),\n(9))\n\nName of Act\ns 1 sub A2005-41 amdt 1.92\nCommencement\ns 2 om A2001-44 amdt 1.2068\ns 4 defs reloc to dict A2005-41 amdt 1.94\nsub A2005-41 amdt 1.95\ndef false representation om A2005-63 amdt 1.3\ndef health record om A2005-41 amdt 1.93\ndef health service om A2005-41 amdt 1.93\ndef health service provider om A2005-41 amdt 1.93\ndef immediate family member am A2003-14 amdt 1.65,\namdt 1.66\nom A2005-41 amdt 1.93\ndef medical board sub A2004-39 amdt 5.12\nom A2005-41 amdt 1.93 (as am by A2006-3 amdt 1.4)\ndef personal health information om A2005-41 amdt 1.93\ndef record om A2005-41 amdt 1.93\ndef record keeper om A2005-41 amdt 1.93\ndef registration board om A2005-41 amdt 1.93\ndef this Act om A2001-44 amdt 1.2069\nNotes\ns 4A ins A2005-41 amdt 1.95\nOffences against Act—application of Criminal Code etc\ns 4B ins A2005-41 amdt 1.95 (as am by A2006-3 amdt 1.5)\nam A2005-63 amdt 1.1\nThe privacy principles\ns 5 am A2005-63 ss 4-7\nprivacy principles reloc to sch 1 by A2005-63 s 8\nCompliance with privacy principles\ns 6 am A2011-3 amdt 3.232\nConsent by consumer to obtaining health status report\ns 7 sub A2005-63 s 9\nam A2016-11 s 9, s 10; pars renum R26 LA; A2021-12\namdt 3.53\nAccess otherwise than under pt 3\ns 8 am A2005-63 s 10\nStatement of principle regarding right of access\ns 10 am A2005-63 s 11; A2011-3 amdt 3.232; A2016-11 s 11, s 12;\nss renum R26 LA\n\nStatement of principle regarding right of access—children and young people\ns 10A ins A2016-11 s 13\nProvision of health services and keeping of records—terms and conditions\ns 11 am A2011-3 amdt 3.232; A2014-18 amdt 3.46\nRequests for access\ns 12 am A2011-3 amdt 3.232; A2016-11 s 14, s 15\nResponse to request for access\ns 13 am A2005-4 s 4\nsub A2005-63 s 12\nam A2014-18 amdt 3.40; A2016-11 s 16; pars renum R26 LA\nDisclosure in accordance with consent\ns 13A ins A2005-63 s 12\nGiving access to health records—generally\ns 13B hdg sub A2016-11 s 17\ns 13B ins A2005-63 s 12\nam A2016-11 ss 18-20\nGiving access to health records—children and young people\ns 13BA ins A2016-11 s 21\nHow access to health record given\ns 13C ins A2005-63 s 12\nam A2025-29 amdt 4.91\nAccess taken to have been refused\ns 13D ins A2005-63 s 12\nam A2016-11 s 22\nNo access to health record relating to Children and Young People Act\ncomplaint etc\ns 14A hdg sub A2005-63 s 13\ns 14A ins A2005-4 s 5\nam A2005-63 s 14; A2008-20 amdt 3.29; A2023-49 amdt 1.4;\npars renum R30 LA; A2025-29 amdt 3.153\nNo access to health record where risk to life or health of consumer or\nanother person\ns 15 am A2005-4 s 6; A2011-3 amdt 3.232\nRefusal for risk to life or health of consumer—offer by record keeper\ns 16 sub A2005-63 s 15\nRefusal for risk to life or health of consumer—nomination by consumer\ns 16A ins A2005-63 s 15\nam A2014-18 amdt 3.40\nRecord keeper to give nominated health service provider health record\ns 16B ins A2005-63 s 15\n\nFunctions of nominated health service provider\ns 16C ins A2005-63 s 15\nUnsuitable consumer-nominated health service provider\ns 16D ins A2005-63 s 15\nam A2010-10 amdt 2.54; A2014-18 amdt 3.40, amdt 3.41;\nA2015-29 amdt 2.40\nNo access to health record where material given in confidence\ns 17 am A2005-63 s 16; A2011-3 amdt 3.232; A2016-11 s 23;\npars renum R26 LA\nComplaints\npt 4 hdg sub A2005-41 amdt 1.96\nGrounds for complaint\ns 18 sub A2005-41 amdt 1.96\nApplication of Community and Health Services Complaints Act 1993\ns 19 om A2005-41 amdt 1.96\nUnlawfully requiring consent etc\ns 20 sub A2005-63 amdt 1.2\nDestroying etc health records and related material\ns 21 sub A2005-63 amdt 1.2\nUnlawfully requesting or obtaining access to health records\ns 22 sub A2005-63 amdt 1.2\nPeople not to be unlawfully penalised\ns 23 sub A2005-41 amdt 1.97\nActs and omissions of representatives\ns 24 sub A2004-15 amdt 1.26\nMiscellaneous\npt 6 note ins A2002-11 amdt 2.50\nChildren and young people\ns 25 hdg sub A2016-11 s 24\ns 25 am A2016-11 s 25, s 26; A2022-14 amdt 3.107\nLegally incompetent persons\ns 26 am A2022-14 amdt 3.107, amdt 3.108\nDeceased consumers\ns 27 am A2022-14 amdt 3.109\nLegal professional privilege not affected by this Act\ns 28 om A2002-11 amdt 2.51\nDefect or invalidity—protection if person acts in good faith etc\ns 29 am A2022-14 amdt 3.110\n\nUnqualified record keeper to obtain and act on expert advice\ns 30 am A2011-3 amdt 3.232\nJurisdiction of Magistrates Court\ns 31 am A2005-13 amdt 1.41, amdt 1.42; A2005-41 amdt 1.98;\nA2016-11 s 27; pars renum R26 LA\nAppeals\ns 32 am A2004-60 amdt 1.156; ss renum R5 LA; A2009-20\namdt 3.96; A2010-18 amdt 3.7, amdt 3.8; ss renum R16 LA\nCourt orders under other laws\ns 33 am A2011-3 amdt 3.232\nDetermination of fees\ns 34 sub A2001-44 amdt 1.2070\nam A2011-3 amdt 3.228; A2025-29 amdt 4.91\nApproved forms\ns 35 sub A2001-44 amdt 1.2070\nam A2005-41 amdt 1.99; A2011-3 amdt 3.229\nom A2021-12 amdt 3.54\nRegulation-making power\ns 36 sub A2001-44 amdt 1.2070\nam A2005-63 s 17; ss renum R9 LA; A2014-18 amdt 3.42,\namdt 3.43: A2025-29 amdt 4.91\nSaving\ns 37 am A2011-3 amdt 3.230\nTransitional—Human Rights Commission Legislation Amendment Act 2006\npt 10 hdg ins A2006-3 amdt 1.1\nexp 24 February 2006 (s 51)\nTransitional—effect of Health Records (Privacy and Access) Amendment Act\n2005 (No 2)\ns 50 ins A2006-3 amdt 1.1\nexp 24 February 2006 (s 51 (LA s 88 declaration applies))\nExpiry—pt 10\ns 51 ins A2006-3 amdt 1.1\nexp 24 February 2006 (s 51)\nAmendments of other Acts\nsch om A2001-44 amdt 1.2071\n\nThe privacy principles\nsch 1 hdg ins A2005-63 s 18\nsch 1 privacy principles reloc from s 5 by A2005-63 s 8\nam A2006-46 amdt 2.26; A2010-10 amdt 2.55; A2010-2 s 13;\nA2010-11 s 4; A2011-22 amdt 1.240; A2014-18 amdt 3.44,\namdt 3.46; A2015-33 amdt 1.105; A2016-11 ss 28-35; pars\nrenum R26 LA; A2021-12 amdt 3.55, amdt 3.56; A2022-14\namdt 3.111; A2024-42 s 8, s 9; A2025-29 amdt 3.154\ndict ins A2005-41 amdt 1.100\nam A2005-63 s 19; A2010-11 s 5; A2011-22 amdt 1.241,\namdt 1.242; A2016-13 amdt 1.68; A2022-14 amdt 3.112\ndef child reloc from s 4 A2005-41 amdt 1.94\nsub A2016-11 s 36\ndef collector reloc from s 4 A2005-41 amdt 1.94;\nam A2022-14 amdt 3.113\ndef commission ins A2005-41 amdt 1.100 (om A2006-3\namdt 1.6)\nins A2005-41 amdt 1.100B (as ins by A2006-3 amdt 1.7)\ndef commissioner reloc from s 4 A2005-41 amdt 1.94 (as am\nby A2006-3 amdt 1.4)\nom A2005-41 amdt 1.100A (as ins by A2006-3 amdt 1.7)\ndef consent reloc from s 4 A2005-41 amdt 1.94\ndef consumer sub A2005-63 s 20\nreloc from s 4 A2005-41 amdt 1.94 (as am by A2006-3\namdt 1.4 and see amdt 1.6)\nam A2016-11 s 37; pars renum R26 LA\ndef deceased consumer reloc from s 4 A2005-41 amdt 1.94\nam A2022-14 amdt 3.113\ndef destroy ins A2005-63 s 21\nreloc from s 4 A2005-41 amdt 1.94\ndef disability reloc from s 4 A2005-41 amdt 1.94 (as am by\nA2006-3 amdt 1.4 and see amdt 1.6)\nsub A2005-41 amdt 1.100C (as ins by A2006-3 amdt 1.7)\ndef factual matter reloc from s 4 A2005-41 amdt 1.94\ndef guardian sub A2005-63 s 22\nreloc from s 4 A2005-41 amdt 1.94 (as am by A2006-3\namdt 1.4 and see amdt 1.6)\nam A2008-20 amdt 3.30\nsub A2016-11 s 38\ndef health record ins A2005-41 amdt 1.100\ndef health service ins A2005-41 amdt 1.100\ndef health service provider ins A2005-41 amdt 1.100\nam A2014-44 amdt 1.1\ndef health status report reloc from s 4 A2005-41 amdt 1.94\ndef illness reloc from s 4 A2005-41 amdt 1.94\ndef immediate family member ins A2005-41 amdt 1.100\n\ndef law of the Territory reloc from s 4 A2005-41 amdt 1.94\ndef legally incompetent person reloc from s 4 A2005-41\namdt 1.94\ndef legal representative reloc from s 4 A2005-41 amdt 1.94\ndef order of a court of competent jurisdiction reloc from s 4\nA2005-41 amdt 1.94\ndef parent reloc from s 4 A2005-41 amdt 1.94\ndef personal health information ins A2005-41 amdt 1.100\nam A2011-3 amdt 3.231\ndef personal information reloc from s 4 A2005-41 amdt 1.94\ndef person with parental responsibility ins A2016-11 s 39\ndef privacy principles ins A2005-63 s 23\nreloc from s 4 A2005-41 amdt 1.94\ndef record ins A2005-41 amdt 1.100\ndef record keeper ins A2005-41 amdt 1.100\ndef registration board ins A2005-41 amdt 1.100\nsub A2010-10 amdt 2.56\nom A2014-18 amdt 3.45\ndef sibling reloc from s 4 A2005-41 amdt 1.94\ndef treating health service provider reloc from s 4 A2005-41\namdt 1.94\ndef treating team reloc from s 4 A2005-41 amdt 1.94\nam A2022-14 amdt 3.114\ndef young person reloc from s 4 A2005-41 amdt 1.94\nsub A2016-11 s 40\n\n5 Earlier republications\n5 Earlier republications\nSome earlier republications were not numbered. The number in column 1 refers to\nthe publication order.\nSince 12 September 2001 every authorised republication has been published in\nelectronic pdf format on the ACT legislation register. A selection of authorised\nrepublications have also been published in printed format. These republications are\nmarked with an asterisk (*) in column 1. Electronic and printed versions of an\nauthorised republication are identical.\nRepublication No Amendments to Republication date\n1 A2001-44 24 January 2002\n2 A2002-11 30 May 2002\n3 A2003-14 28 March 2003\n4 A2004-15 9 April 2004\n5 A2004-60 10 January 2005\n6 A2005-4 23 February 2005\n7 A2005-13 25 March 2005\n8 A2005-13 7 July 2005\n9 A2005-63 17 January 2006\n10 A2006-3 23 February 2006\n11 A2006-3 25 February 2006\n12 A2006-3 1 November 2006\n13 A2006-46 18 November 2006\n14 A2008-20 27 October 2008\n15* A2009-20 22 September 2009\n16 A2010-18 3 June 2010\n17 A2010-18 1 July 2010\n18 A2010-18 16 August 2010\n19 A2010-18 30 September 2010\n20 A2011-3 1 March 2011\n21 A2011-22 1 July 2011\n22 A2014-18 10 June 2014\n\nEarlier republications 5\nRepublication No Amendments to Republication date\n23 A2014-44 19 November 2014\n24 A2015-33 14 October 2015\n25 A2015-33 1 December 2015\n26 A2016-11 2 March 2016\n27 A2016-13 1 April 2016\n28 A2021-12 23 June 2021\n29 A2022-14 24 August 2022\n30 A2024-3 1 July 2024\n31 A2024-42 18 September 2024","sortOrder":47}],"analysis":{"kimi_summary":{"_metrics":{"completionTokens":875},"content_quality":"ok","complexity_score":7,"scope_assessment":{"changed":true,"description":"The legislation has expanded significantly from its original 1997 form. Major additions include: detailed principles for practice relocation and closure (Principle 11), consumer-initiated transfers between providers (Principles 12.1 and 12.2), specific protections for children and young people with maturity assessments (ss 10A, 13BA), nominated health service provider processes for sensitive records (ss 16A-16D), and enhanced record destruction and register requirements. The 2023-2024 amendments also integrated changes from the Children and Young People Act amendments, showing ongoing expansion into adjacent regulatory areas."},"complexity_factors":["Extensive cross-referencing between Parts 2, 3 and Schedule 1 (privacy principles)","Multiple nested exceptions to access rights (ss 14-17, 14A) with their own sub-exceptions","Complex age-based and capacity-based rules for children (under 12), young people (12-17), and adults with differing maturity thresholds","Detailed procedural requirements with multiple timeframes (2 weeks for response, 30 days for access, 7 days after fee payment)","Schedule 1 contains 12 principles with multiple clauses each, many containing their own exceptions and conditions","Extensive definitions in dictionary (62+ defined terms) with signpost definitions to other legislation","Interaction with multiple other ACT laws (Children and Young People Act, Human Rights Commission Act, etc.)","Specific rules for deceased consumers, legally incompetent persons, and practice relocations/closures"],"plain_english_summary":"This ACT law protects your medical privacy and gives you rights to access your own health records.\n\n**What it does:**\n\n**Privacy protections (Schedule 1)** — Health service providers must follow 12 privacy principles covering:\n- **Collection**: They can only collect health information for lawful purposes directly related to their work, and must tell you why they're collecting it and who will see it\n- **Storage & security**: Records must be kept secure and protected from loss or unauthorised access. Records generally cannot be destroyed until 7 years after your last visit (or until you turn 25 if you were under 18 when treated)\n- **Accuracy**: Providers must keep records up-to-date and accurate, and let you add corrections if you disagree with something\n- **Use & disclosure**: Your information can generally only be used for the purpose it was collected, with exceptions for your treating team, emergencies, or where required by law\n- **Access**: You have a right to see your records, with some exceptions\n\n**Your right to access your records (Part 3):**\n- You can **inspect** your records, get a **copy**, or have them **explained** by a qualified health professional\n- Requests must be in writing in some cases (requests by guardians, legal representatives, or parents who haven't consented to recent treatment)\n- Providers must respond within **2 weeks**, and provide access within **30 days** (or 1 week after paying any fee)\n\n**When access can be refused:**\n- If the record doesn't exist or doesn't relate to you\n- If it would reveal who made a child protection report\n- If it would create a **significant risk to life or health** (yours or someone else's)\n- If the information was given in **confidence** by someone other than you or your guardian\n\n**Special rules for children and young people:**\n- Parents generally access records on behalf of children under 12\n- Young people (12-17) can access their own records if they have \"sufficient maturity and developmental capacity\" to understand what they're requesting\n- Record keepers can require meetings with young people to explain records before releasing them\n\n**Offences:** It's illegal to destroy records to evade this law, threaten people to get access, or penalise someone for requesting their records. Maximum penalties are 50 penalty units (currently $8,000 for individuals) and/or 6 months imprisonment.\n\n**Who it affects:** Anyone who receives health services in the ACT, health service providers, and record keepers (including after a provider dies or closes practice)."},"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"},"flash_summary":{"complexity_score":7,"scope_assessment":{"changed":true,"description":"The Act as republished shows scope expansion and added procedural detail compared with its original enactment.  The core objects remain (s 3), but the text now includes a dedicated schedule of privacy principles (s 5; Schedule 1) and specific provisions for children and young people (s 10A; s 13BA), explicit rules about transfers, relocation and closure of practices (Schedule 1, principle 11), and more detailed offence and enforcement provisions (Part 5).  The power for the Minister to determine fees (s 34) and an expanded regulation-making head (s 36) also increase the Act’s practical reach.  These changes are evident in the structure and content of the republished Act (see s 5; Schedule 1; ss 10–13; ss 14A–17; s 34; s 36) and the amendment history recorded in the endnotes shows successive insertions and amendments that produced this broader, more detailed regime."},"complexity_factors":["Extensive cross-references to other laws and instruments (for example, references to the Criminal Code, Children and Young People Act and the Legislation Act) which affect application and exceptions (see s 4B; s 14A; sch 1 cl 1 references).","Lengthy, detailed privacy principles contained in Schedule 1 with multiple operational rules (collection, storage, disclosure, correction, transfers and closure obligations) increasing procedural complexity (Schedule 1, principles 1–12.2).","Multiple procedural pathways and time limits for access requests and responses (ss 12–13; ss 13B–13C; ss 13BA–13D) with separate regimes for children, young people and legally incompetent persons (s 10A; s 25; s 26).","Numerous, specifically enumerated grounds for refusal and exclusion (ss 14–17; sch 1 principle 10(2)–(4)), requiring fact-specific assessments and record-keeper discretion.","Interaction of criminal offences, complaint mechanisms and civil court remedies (Part 5; s 18; ss 31–32) which create parallel enforcement tracks.","Regulation-making powers that allow future specification of qualifications, fees and guidelines (s 36), adding potential future complexity.","Detailed definitions and an extensive dictionary (Dictionary) that affect interpretation and scope across many provisions."],"plain_english_summary":"Mechanically, this Act:\n\n- Makes a set of privacy rules legally enforceable for health records (see s 5 and Schedule 1).  These rules cover how personal health information may be collected, stored, used, disclosed, corrected and destroyed (Schedule 1, principles 1–12.2). \n- Gives individuals (\"consumers\") a statutory right to access their health records and sets out how to request access, time limits and methods of access (see s 10; ss 12–13; ss 13B–13C; ss 13BA).  The Act also sets specific procedures for children, young people and legally incompetent persons (see s 10A; s 25; s 26). \n- Creates criminal offences and penalties for certain conduct (for example, unlawful coercion to obtain consent, destroying records to evade the Act, and falsely obtaining access) (Part 5, ss 20–23).  The republication notes the penalty unit values current at the republication date (front matter).\n- Requires record keepers to safeguard records, keep registers of destroyed/transferred records, retain records for specified periods (Schedule 1, principles 4.1–4.3 and 4.2), and to take reasonable steps to ensure accuracy and relevance (principles 7–8). \n- Gives a Minister power to determine fees for access and related matters (s 34) and allows the Executive to make regulations, including prescribing qualifications for record keepers and extending timeframes by up to 21 days (s 36).\n- Provides complaint and dispute routes: complaints to the Human Rights Commission (s 18), and declaratory or other orders from the Magistrates Court with appeals to the Supreme Court (ss 31–32).\n\nOfficial purpose claims (as stated in the Act): to provide privacy rights for personal health information; protect the integrity of health records; secure access to those records and explanations for consumers; and to encourage agreement between parties about exercising rights or performing obligations (s 3).\n\nTesting those purpose-claims against key mechanics, costs and incentives in the Act:\n\n- Who pays and where costs fall:\n  - Consumers may be required to pay a fee for certain kinds of access or transfer (see s 10(7); s 13(2)(d)(ii); Schedule 1, principle 11(3) and principle 12.1(2)(a)).  The Minister sets fees (s 34).  \n  - Record keepers bear compliance costs: security and retention safeguards (Schedule 1, principle 4.1); registers of destroyed or transferred records (principle 4.2); procedures for identity checks before disclosure (s 13B(3)); and time- and staffing-related costs to meet access deadlines (s 13B; s 13BA; s 13C).  \n  - People who commit offences may face penalties (Part 5).  \n\n- Incentives created by the Act:\n  - Record keepers have an incentive to document and secure records (Schedule 1, principles 4.1–4.3) because noncompliance can lead to complaints and, where applicable, prosecution (Part 5) or civil orders (ss 31–32).  \n  - Consumers are given formal procedural routes (written requests, time limits, complaint rights) that incentivise exercising access and correction rights (ss 12–13; s 18).  \n  - The Act allows disclosure for research/statistics under strict conditions (Schedule 1, principle 10(3) and s 36(3) about adopting instruments), which creates a regulated pathway for secondary uses while requiring protections.\n\n- Trade-offs and opportunity costs evident in the text:\n  - The Act balances access against confidentiality and safety: record keepers may refuse access where production would breach a law or court order (s 14(c)), where disclosure could pose a significant risk to life or health (s 15), or where material was given in confidence by third parties (s 17).  That balance reduces risk of harm but can delay or deny consumers’ access in specific circumstances.  \n  - Maintaining detailed registers and long retention periods (Schedule 1, principles 4.1–4.3) improves auditability but increases storage and administrative costs for record keepers.\n\n- Implementation risk and bureaucratic discretion:\n  - The Act gives record keepers discretionary powers to refuse access on enumerated grounds (ss 14–17), and to object to consumer-nominated health service providers in limited circumstances (s 16D).  Those discretions require record keepers to form reasonable-ground beliefs and to state reasons (see s 13(3), s 16D(2)–(3)).  \n  - Where a record keeper lacks necessary skill, they must obtain and act on expert advice (s 30), creating an administrative duty that mitigates but does not eliminate the risk of improper decisions.  \n  - The Executive may make regulations that affect operational detail (s 36), so some implementation specifics may be set later by regulation.\n\n- Compliance burden and procedural details to note:\n  - Time limits: a record keeper must respond to an access request with specified notices within 2 weeks (s 13(2)) and must provide access generally within 30 days or sooner in defined circumstances (s 13B(2)–(3); s 13BA(2)).  \n  - Identity verification and authority checks are mandatory before disclosure (s 13B(3); s 13BA(3)).  \n  - Contract term: contracts for provision of health services made on or after commencement must include a term allowing access as required by the Act (s 11).  This makes compliance a contractual obligation for many providers.\n\n- Effects on private enterprise and independent providers:\n  - The Act embeds access obligations into service contracts (s 11) and requires record-handling standards and notification obligations on relocation/closure of practices (Schedule 1, principle 11).  These are direct operational requirements for private providers.  \n  - Regulations may prescribe qualifications or other requirements for record keepers (s 36(2)(c)), which can affect who can hold records and how they are managed.\n\n- Concentrated benefits and diffuse costs (as shown in the text):\n  - Consumers get concentrated, enforceable access and correction rights (s 10; principle 7).  \n  - Costs and administrative burdens of implementing safeguards, retention, registers and responding to requests are spread across all record keepers who hold health records (Schedule 1, principles 4.1–4.3, 4.2; ss 13B–13C; s 11). \n\n- Dispute and enforcement channels:\n  - Complaints about breaches of the privacy principles or refusals to give access are made to the Human Rights Commission (s 18).  Court declaration and other orders can be sought in the Magistrates Court and appealed to the Supreme Court (ss 31–32). \n\nIn short: the Act creates a layered compliance framework that gives individuals enforceable access and privacy rights over health records, sets procedural timeframes and identity/qualification checks, establishes limited but specified grounds for refusal, and imposes record-keeping, security and retention duties on record keepers. These mechanics generate direct access benefits to consumers and measurable compliance and administrative costs for record keepers and health service providers (see ss 5; 10; 11; 12–13; Schedule 1 principles 4.1–4.3; 7; s 34; s 36)."}},"importantCases":[],"_links":{"self":"/api/acts/health-records-privacy-and-access-act-1997","history":"/api/acts/health-records-privacy-and-access-act-1997/history","analysis":"/api/acts/health-records-privacy-and-access-act-1997/analysis","conflicts":"/api/acts/health-records-privacy-and-access-act-1997/conflicts","importantCases":"/api/acts/health-records-privacy-and-access-act-1997/important-cases","documents":"/api/acts/health-records-privacy-and-access-act-1997/documents"}}