{"id":"health-services-information-regulations-2017","name":"Health Services (Information) Regulations 2017","slug":"health-services-information-regulations-2017","collection":"regulation","jurisdiction":"wa","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":176806,"registerId":"wa-health-services-information-regulations-2017-current","compilationNumber":null,"startDate":"2026-04-05","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"Health Services (Information) Regulations 2017","content":"![Crest]()Western Australia\n\nHealth Services Act 2016\n\nHealth Services (Information) Regulations 2017\n\nWestern Australia\n\nHealth Services (Information) Regulations 2017\n\nContents\n\n1. Citation 1\n\n2. Commencement 1\n\n3. Disclosure of information by Department CEO (s. 216) 1\n\n4. Disclosure of information by health service provider (s. 217) 2\n\n5. Circumstances in which collection, use or disclosure of information is authorised (s. 220) 2\n\n6. Conditions on disclosure of information under Part 17 of Act 4\n\nNotes\n\nCompilation table 6\n\n  \n\nHealth Services Act 2016\n\nHealth Services (Information) Regulations 2017\n\n##### 1. Citation\n\n\t\tThese regulations are the *Health Services (Information) Regulations 2017*.\n\n##### 2. Commencement\n\nThese regulations come into operation as follows —\n\n(a) regulations 1 and 2 — on the day on which these regulations are published in the *Gazette*;\n\n(b) the rest of the regulations — on the day after that day.\n\n##### 3. Disclosure of information by Department CEO (s. 216)\n\n(1) In this regulation —\n\nHREC means a human research ethics committee constituted in accordance with, and acting in compliance with, the *National Statement on Ethical Conduct in Human Research*, as in force from time to time, issued under the *National Health and Medical Research Council Act 1992* (Commonwealth) section 7(1)(a).\n\n(2) The Department CEO must not disclose health information under section 216 unless —\n\n(a) the individual to whom the information relates consents to the disclosure; or\n\n(b) the Department CEO is satisfied that —\n\n(i) disclosure of the information is reasonably necessary for the purpose for which it is to be disclosed; and\n\n(ii) the purpose for which the information is to be disclosed cannot be achieved by providing information that is not personal information; and\n\n(iii) it is impracticable to obtain the consent of the individual to whom the information relates.\n\n(3) In addition to the requirements of subregulation (2), the Department CEO must not disclose health information under section 216 for the purpose of health related research unless the research has been approved by an HREC.\n\n[Regulation 3 amended: Gazette 10 Aug 2018 p. 2863 (disallowed: Gazette 6 Nov 2018 p. 4406).]\n\n##### 4. Disclosure of information by health service provider (s. 217)\n\nThe chief executive of a health service provider must not disclose health information to a person under section 217(2) if —\n\n(a) the chief executive reasonably believes that disclosure of the information would pose a serious threat to —\n\n(i) the life, health or safety of any individual; or\n\n(ii) public health or safety;\n\nor\n\n(b) disclosure of the information would have an unreasonable impact on the privacy of the patient or another person; or\n\n(c) the patient has requested that the information not be disclosed to the person.\n\n##### 5. Circumstances in which collection, use or disclosure of information is authorised (s. 220)\n\n(1) For the purposes of section 220(1), the collection, use or disclosure of information is authorised in the following circumstances —\n\n(a) the collection, use or disclosure is reasonably necessary to lessen or prevent a serious risk to the life, health or safety of any individual;\n\n(b) the collection, use or disclosure is reasonably necessary to lessen or prevent a real or immediate risk of danger to the public;\n\n(c) the collection, use or disclosure is for a purpose specified in a written agreement between the State and the Commonwealth, another State or a Territory entered into by a Minister of the State or the Department CEO;\n\n(d) the collection, use or disclosure is for the purposes of, or in connection with, obtaining legal advice or representation on behalf of —\n\n(i) the Department CEO or the State; or\n\n(ii) a health service provider; or\n\n(iii) an individual who is or was a staff member of a health service provider if the individual is indemnified by the State in respect of liability incurred by the individual as a staff member of the health service provider;\n\n(e) the collection, use or disclosure is for the purposes of, or in connection with, an application to the State Administration Tribunal for a guardianship order or an administration order under the *Guardianship and Administration Act 1990*.\n\n(2) For the purposes of section 220(1), the disclosure of information is also authorised in the following circumstances —\n\n(a) the disclosure is to an individual who is or was a staff member of a health service provider for the purposes of the individual’s compliance with reporting requirements under another law;\n\n(b) the information relates to an individual who is deceased and the disclosure is in response to a written request from —\n\n(i) a coroner, a coroner’s registrar, a coroner’s investigator or a member of the staff of a coroner’s court in connection with an investigation into the death of the individual; or\n\n(ii) a medical practitioner who is performing a post mortem on the body of the individual at the direction of a coroner.\n\n##### 6. Conditions on disclosure of information under Part 17 of Act\n\n(1) The disclosure of information under Part 17 of the Act is subject to the following conditions —\n\n(a) the information must not be used for a purpose other than the purpose for which it was disclosed unless —\n\n(i) the Department CEO or the chief executive of a health service provider who discloses the information authorises its use, in accordance with the Act, for that other purpose; or\n\n(ii) in the case of personal information — the individual to whom it relates consents to its use for that other purpose;\n\n(b) the person to whom the information is disclosed must take all reasonable steps to ensure that it is transported and stored in a way that protects it from misuse, interference, loss, unauthorised access or modification;\n\n(c) in the case of information that is not personal information — the person to whom the information is disclosed must not modify or use it, or link it to other information, in a way that identifies, or might lead to the identification of, an individual to whom it relates.\n\n(2) A person to whom information is disclosed under Part 17 of the Act must not contravene a condition to which the disclosure is subject.\n\nPenalty for this subregulation: a fine of $5 000.\n\nNotes\n\n1 This is a compilation of the *Health Services (Information) Regulations 2017* and includes the amendments made by the other written laws referred to in the following table.\n\nCompilation table\n\n| **Citation** | **Gazettal** | **Commencement** |\n| --- | --- | --- |\n| *Health Services (Information) Regulations 2017* | 28 Nov 2017 p. 5703‑5 | r. 1 and 2: 28 Nov 2017 (see r. 2(a));   Regulations other than r. 1 and 2: 29 Nov 2017 (see r. 2(b)) |\n| *Health Services (Information) Amendment Regulations 2018* 2 | 10 Aug 2018 p. 2862‑3 | r. 1 and 2: 10 Aug 2018 (see r. 2(a));   Regulations other than r. 1 and 2: 11 Aug 2018 (see r. 2(b)) |\n\n\n2 Disallowed on 1 Nov 2018 see *Gazette* 6 Nov 2018 p. 4406.\n","sortOrder":0}],"analysis":{"flash_summary":{"complexity_score":3,"scope_assessment":{"changed":false,"description":"The regulations provide operational rules and limits implementing Part 17 of the Health Services Act 2016 rather than expanding the statutory scope. They clarify when disclosures may occur, set conditions on recipients, and add an ethics approval requirement for research disclosures by the Department CEO (Reg 3(3)). An attempted 2018 amendment to Reg 3 was disallowed and therefore did not effect a lasting scope change. Overall, the instrument refines operational detail (tests, exceptions, protective conditions) but does not broaden the types of purposes for which the Act permits information handling beyond those already contemplated by Part 17."},"complexity_factors":["Short instrument (6 regulations) with limited sections to apply (Regs 3–6).","Only one defined term within the regulations (HREC in Reg 3(1)); however there are multiple external legal cross-references (Health Services Act 2016 Part 17, National Statement on Ethical Conduct in Human Research, Guardianship and Administration Act 1990, State Administrative Tribunal).","Three‑part discretionary test for Department CEO disclosure (Reg 3(2)) — introduces conditional complexity.","Separate refusal grounds for health service providers with three distinct criteria (Reg 4).","Enumerated authorised circumstances in Reg 5 with several subparagraphs and differing legal purposes (safety, intergovernmental agreements, legal advice, guardianship applications, statutory reporting, coronial requests).","Operational conditions on recipients (use‑limits, storage/transport security, re‑identification prohibition) and a monetary penalty ($5,000) for breach (Reg 6).","Some subjective standards (\"reasonably necessary\", \"impracticable\", \"unreasonable impact\") increasing interpretive complexity and need for guidance. "],"plain_english_summary":"**What these regulations do (mechanically)**\n\n- Set rules under the Health Services Act 2016 about when and how health information held by the Department of Health (the Department CEO) and by health service providers can be collected, used or disclosed. (Regs 3–6.)\n- Require the Department CEO to obtain the individual’s consent before disclosing health information, except where a three-part test is satisfied (disclosure is reasonably necessary for the purpose, the purpose cannot be achieved without personal information, and it is impracticable to obtain consent). For health-related research there is an additional requirement that the research be approved by a Human Research Ethics Committee (HREC). (Reg 3(2)–(3).)\n- Limit disclosures by a health service provider where disclosure would: pose a serious threat to life/health/safety or public health, unreasonably harm privacy, or where the patient has asked that the information not be disclosed. (Reg 4.)\n- List specific circumstances in which collection, use or disclosure is authorised without consent, including to prevent a serious risk to life/health/safety, comply with a written agreement with Commonwealth/State/Territory, obtain legal advice/representation for the State or an indemnified staff member, apply for guardianship/administration orders, satisfy statutory reporting by staff, or respond to coronial/post‑mortem requests. (Reg 5.)\n- Impose conditions on any disclosure under Part 17 of the Act: information must not be used for new purposes except with authorisation or consent; recipients must take reasonable steps to protect the information in transport and storage; and non-personal information must not be modified or linked in a way that could identify an individual. Breach of the conditions attracts a fine (up to $5,000). (Reg 6(1)–(2).)\n\n**Who this affects**\n\n- Patients and former patients whose health information is held by the Department or health service providers (privacy risk and access implications).\n- The Department CEO and chief executives of health service providers (decision‑makers who must apply the tests and conditions in these regulations).\n- Health service staff who may receive disclosed information for reporting or operational purposes (subject to protective conditions and limited permitted uses).\n- Researchers seeking health information for health-related research (must obtain HREC approval to receive disclosures from the Department CEO). (Reg 3(3).)\n\n**Why it matters (operational effects and legal mechanics)**\n\n- It sets the default rule that consent is required for disclosure by the Department CEO, but allows limited non‑consensual disclosure where a narrowly described test is met (Reg 3(2)). That creates a compliance decision—the Department must document the necessity, impracticability of obtaining consent, and the purpose. (Reg 3(2)(b)(i)–(iii)).\n- For health service providers, the regulations create explicit refusal grounds protecting patient safety and privacy (Reg 4). Decision-makers must assess threats to safety, public health, and privacy impacts before disclosing.\n- The regulations list permitted non‑consensual uses (Reg 5). These are operational exemptions for specific public health, legal, administrative and coronial functions, and for compliance with intergovernmental agreements.\n- Disclosure recipients acquire legal obligations: do not use the information for other purposes without new authorisation or consent; protect the data in transit and storage; and do not re-identify persons from de-identified material. There is a monetary penalty for breach. (Reg 6.)\n\n**Official purpose-claims and testing them against practical costs and trade-offs**\n\nThe regulations frame their purpose as enabling necessary information sharing for safety, legal and administrative needs while protecting privacy. Testing that against trade-offs:\n\n- Compliance and administrative costs: decision-makers (Department CEO and health service CE) must apply multi-part tests (Reg 3(2)) and document reasons. Staff need procedures to assess safety risks (Reg 4) and authorised circumstances (Reg 5). These are recurring administrative costs borne by the Department and providers.\n- Consent impracticability standard (Reg 3(2)(b)(iii)) and “reasonably necessary” tests (Reg 3(2)(b)(i), Reg 5) are fact‑sensitive and introduce discretion. That discretion reduces transaction costs in emergencies but raises implementation risk (inconsistent application, possible over‑ or under‑disclosure) and potential legal challenge if standards are applied poorly.\n- HREC approval requirement for health-related research (Reg 3(3)) protects research ethics but increases time and resource costs for researchers and may limit access to data for time-sensitive research. HREC capacity and differing interpretations of the National Statement can be bottlenecks.\n- Data‑security and use restrictions (Reg 6(1)(b)–(c)) shift costs to recipients who must secure transport, storage and controls; failure carries a modest monetary penalty (Reg 6(2)). The $5,000 fine is a deterrent but small relative to potential harms from large data breaches, which means reputational and contractual consequences may be the stronger enforcement lever.\n- Effects on private activity: these regulations do not create new fee or licensing regimes; they constrain how private parties who receive disclosures may use or re‑identify data (Reg 6(1)(c)). That limits downstream commercial uses of disclosed health information unless further authorisation or consent is obtained.\n\n**Who pays and who decides**\n\n- Who pays: health services and the Department pay the compliance and administrative costs of decision-making and record-keeping; recipients pay data‑security and handling costs; patients bear residual privacy risk where non‑consensual disclosure is authorised.\n- Who decides: Department CEO and chief executives of health service providers exercise the primary discretion under these regulations (Reg 3–4). HRECs (as defined) decide on ethics approval for research data releases (Reg 3(1), (3)).\n\n**Implementation risks and practical notes**\n\n- The regulations rely on several subjective standards (\"reasonably necessary\", \"impracticable\", \"unreasonable impact\") which increases need for operational guidance and training to ensure consistent application (Regs 3–5).\n- Cross-references to the National Statement, the Guardianship and Administration Act 1990, and the State Administrative Tribunal mean agencies must coordinate legal and procedural compliance across multiple instruments (Reg 3(1); Reg 5(1)(c),(e)).\n- An amendment to Reg 3 was made in 2018 but later disallowed; that attempt did not result in a lasting expansion of scope. Agencies should rely on the current text and existing cross-referenced standards.\n\n(References: Regs 3–6 of the Health Services (Information) Regulations 2017.)"},"summary":{"complexity_score":1,"scope_assessment":{"changed":false,"description":"Scope assessment is not possible as the legislative text could not be retrieved. No comparison between original intent and final form can be made."},"complexity_factors":["No legislative text was available for analysis — the source URL returned a 'page not found' error due to a website migration","The only content retrieved was a system notice and an Acknowledgement of Country, neither of which contains legal provisions","Complexity cannot be meaningfully assessed without access to the actual regulations"],"plain_english_summary":"**No legislation could be analysed.**\n\nThe link provided for the *Health Services (Information) Regulations 2017* (Western Australia) no longer works — the page has been taken down or moved as part of a website upgrade. The actual text of the regulations was not retrievable, meaning no meaningful analysis of the law's content, scope, or impact can be provided.\n\n**What you should do:**\n- Visit the [Western Australian Legislation website](https://www.legislation.wa.gov.au) directly and search for *Health Services (Information) Regulations 2017*.\n- Contact the Parliamentary Counsel's Office Helpdesk (linked on the WA legislation site) if you cannot locate the document.\n\nWithout the actual legislative text, it is impossible to determine who this law affects or what it requires."},"issue_detection":{"absurdities":[],"contradictions":[]},"kimi_summary":{"content_quality":"ok","complexity_score":3,"scope_assessment":{"changed":false,"description":"The regulations appear tightly focused on their original purpose of operationalising Part 17 of the Health Services Act 2016 regarding information disclosure. The single amendment noted (subsequently disallowed) related to regulation 3 but did not expand scope beyond health information disclosure controls."},"complexity_factors":["Only 6 regulations total, with straightforward structure","Single defined term (HREC) with clear external reference","Limited cross-referencing (primarily to sections 216, 217, 220 of parent Act)","Simple conditional logic using standard 'unless' and 'if' structures without nesting","No exceptions to exceptions","Clear penalty provision ($5,000 fine) in plain language"],"plain_english_summary":"These regulations set the rules for when and how health information can be shared under Western Australia's Health Services Act 2016. They apply to the Department of Health's CEO and health service providers (like hospitals and clinics).\n\n**Key things the regulations do:**\n\n**For the Department CEO:**\n- Generally cannot disclose your health information without your consent\n- Can only share it without consent if: it's really necessary for the purpose, the purpose can't be achieved with anonymous data, and it's impractical to get your consent\n- For health research, the research must first be approved by an ethics committee (HREC)\n\n**For health service providers (hospitals, etc.):**\n- Cannot disclose your information if it would seriously threaten someone's life, health or safety, or public health\n- Cannot disclose if it would unreasonably invade privacy\n- Must respect your request that information not be shared with specific people\n\n**When information CAN be collected, used or shared without consent:**\n- To prevent serious risk to someone's life, health or safety\n- To prevent immediate danger to the public\n- Under agreements between WA and other governments\n- For getting legal advice or representation\n- For guardianship or administration applications\n- To help staff comply with other reporting laws\n- To coroners or doctors doing post-mortems when someone has died\n\n**Conditions on anyone receiving information:**\n- Can only use it for the purpose it was given\n- Must protect it from misuse, loss, or unauthorised access\n- Cannot use non-personal information in ways that could identify individuals\n- Breaking these conditions attracts a $5,000 fine"},"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"}},"importantCases":[],"_links":{"self":"/api/acts/health-services-information-regulations-2017","history":"/api/acts/health-services-information-regulations-2017/history","analysis":"/api/acts/health-services-information-regulations-2017/analysis","conflicts":"/api/acts/health-services-information-regulations-2017/conflicts","importantCases":"/api/acts/health-services-information-regulations-2017/important-cases","documents":"/api/acts/health-services-information-regulations-2017/documents"}}