{"id":"F2020L01072","name":"Healthcare Identifiers Regulations 2020","slug":"healthcare-identifiers-regulations-2020","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":113499,"registerId":"commonwealth-F2020L01072-current","compilationNumber":null,"startDate":"2026-04-03","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Part 1","sectionType":"part","heading":"Preliminary","content":"## Part 1—Preliminary","sortOrder":0},{"sectionNumber":"1","sectionType":"section","heading":"Name","content":"#### 1 Name\n\n This instrument is the Healthcare Identifiers Regulations 2020.","sortOrder":1},{"sectionNumber":"3","sectionType":"section","heading":"Authority","content":"#### 3 Authority\n\n This instrument is made under the Healthcare Identifiers Act 2010.","sortOrder":2},{"sectionNumber":"5","sectionType":"section","heading":"Definitions","content":"#### 5 Definitions\n\n> Note: A number of expressions used in this instrument are defined in the Act, including the following:\n\n (a) healthcare provider organisation;\n (b) individual healthcare provider;\n (c) organisation maintenance officer;\n (d) responsible officer.\n In this instrument:\n\n> ABN has the meaning given by section 41 of the A New Tax System (Australian Business Number) Act 1999.\n\n> ACN has the same meaning as in the Corporations Act 2001.\n\n> Act means the Healthcare Identifiers Act 2010.\n\n> active script list means a prescription management system for healthcare recipients.\n\n> active script list registry means a system that provides services for, and provides for the management of, active script lists for healthcare recipients, including (but not limited to) the following:\n\n (a) facilitating a healthcare recipient to register for an active script list;\n (b) storing information submitted by a healthcare recipient, using a mobile or web application, during the registration process;\n (c) adding prescriptions, dispensing records and notifications to the active script list of a healthcare recipient;\n (d) enabling viewing of a healthcare recipient’s active prescriptions and tokens so they can be used to dispense electronic prescriptions for the healthcare recipient;\n (e) allowing mobile application vendors to provide mobile prescription applications.\n\n> active script list registry operator means an entity that operates an active script list registry.\n\n> electronic prescription has the same meaning as in the National Health (Pharmaceutical Benefits) Regulations 2017.\n\n> evidence of identity process means:\n\n (a) in relation to a healthcare provider organisation—the process to confirm the identity of the healthcare provider organisation’s responsible officer and organisation maintenance officer undertaken by:\n (i) if the responsible officer or organisation maintenance officer is an individual healthcare provider who is registered by a registration authority as a member of a health profession—the Australian Health Practitioner Regulation Agency established by the National Law; or\n (ii) in any other case—the service operator; or\n (b) in relation to a healthcare support service provider—the process to confirm the identity of the healthcare support service provider’s responsible officer, and organisation maintenance officer (if any), undertaken by one or more of the following:\n (i) the Aged Care Department;\n (ii) the National Disability Insurance Agency;\n (iii) the service operator;\n (iv) an entity prescribed for the purposes of column 1 of item 6 of the table in section 21 of the Act.\n\n> health facilitation program means a program that is operated or funded by one or more government bodies and that facilitates the provision of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients.\n\n> mobile intermediary service means a service that provides connection services for mobile prescription applications for the purpose of facilitating electronic prescriptions.\n\n> mobile prescription application means an application that enables a healthcare recipient to do either or both of the following:\n\n (a) to manage the healthcare recipient’s prescriptions using a mobile phone or other personal electronic device;\n (b) to view, and manage access to, the healthcare recipient’s active script list.\n\n> mobile prescription application service provider means an entity that operates and/or provides a mobile prescription application.\n\n> My Health Records Act means the My Health Records Act 2012.\n\n> National Law has the same meaning as in the My Health Records Act.\n\n> operator of a health facilitation program means the body, or any of the bodies, that operates the program.\n\n> System Operator has the same meaning as in the My Health Records Act.\n\n> token means a piece of information used to identify and access an electronic prescription or repeat authorisation.\n\n> verification service means a service (whether operated electronically or otherwise) that allows an entity to compare information relating to the identity of an entity with a government record.","sortOrder":3},{"sectionNumber":"6","sectionType":"section","heading":"Application of this instrument to partnerships, trusts and unincorporated associations","content":"#### 6 Application of this instrument to partnerships, trusts and unincorporated associations\n\n To avoid doubt, sections 36B, 36C and 36D of the Act apply to this instrument, and obligations, offences and civil penalty provisions in this instrument, in the same way as they apply to the Act, and obligations, offences and civil penalty provisions in the Act.","sortOrder":4},{"sectionNumber":"7","sectionType":"section","heading":"National registration authorities","content":"#### 7 National registration authorities\n\n For the purposes of section 8 of the Act, each of the following registration authorities is a national registration authority:\n (a) a National Health Practitioner Board established by the National Law;\n (b) if it is authorised under the National Law to assign healthcare identifiers to healthcare providers—the Australian Health Practitioner Regulation Agency established by the National Law.","sortOrder":5},{"sectionNumber":"8","sectionType":"section","heading":"Identifying information","content":"#### 8 Identifying information\n\n Identifying information—individual healthcare provider\n (1) For the purposes of paragraph 7(1)(g) of the Act, the following information is identifying information of an individual healthcare provider:\n (a) whether the healthcare provider is registered with a registration authority and the status of that registration (such as conditional, suspended, cancelled or lapsed);\n (b) whether the healthcare provider is represented by a professional body of a kind described in paragraph 9A(1)(b) of the Act and the status (such as conditional, suspended, cancelled or lapsed) of the credentials that are:\n (i) provided through the professional body to the healthcare provider; and\n (ii) required to practice the healthcare provider’s healthcare profession;\n (c) whether the healthcare provider is, or is likely to be, deceased;\n (d) whether the death of the healthcare provider has been verified;\n (e) whether the healthcare provider is linked to a healthcare provider organisation and, if so, the name of the organisation and the ABN or ACN of the organisation (whichever is applicable).\n Identifying information—healthcare provider organisation\n (2) For the purposes of paragraph 7(2)(e) of the Act, the following information is identifying information of a healthcare provider organisation:\n (a) whether the organisation is registered under Division 2 of Part 3 of the My Health Records Act;\n (b) whether the organisation has notified the service operator that the organisation does not wish to use a healthcare identifier, either temporarily or permanently;\n (c) if applicable, the organisation’s business name on the register established under section 22 of the Business Names Registration Act 2011;\n\nNote: Also see paragraph 7(2)(a) of the Act which states that the name of the healthcare provider is also identifying information.\n\n (d) the type of healthcare service the organisation provides to another healthcare provider or a healthcare recipient;\n\nNote: Examples of the type of healthcare service an organisation provides include general practice services, public hospital services or diagnostic imaging services.\n\n (e) the name, date of birth and date of death (if applicable) of the organisation’s responsible officer and organisation maintenance officer;\n (f) the work address, email address, telephone number and fax number of the organisation’s responsible officer and organisation maintenance officer;\n (g) the identifying number assigned to the organisation’s responsible officer and organisation maintenance officer by the service operator;\n (h) whether an evidence of identity process has been undertaken for the organisation’s responsible officer and organisation maintenance officer;\n (i) if an evidence of identity process is being undertaken for the organisation’s responsible officer and organisation maintenance officer—the name of the agency or service operator undertaking the process;\n (j) if an evidence of identity process has been undertaken for the organisation’s responsible officer and organisation maintenance officer—the name of the agency or service operator that undertook the process, the outcome of the process and when the process was undertaken;\n (k) the record that specifies the network address and technical requirements permitting electronic messages to be sent to the organisation;\n (l) any other network organisation or seed organisation (within the meaning of section 9A of the Act) that the healthcare provider organisation is linked to in a network;\n (m) whether any individual healthcare providers are linked to the organisation and, if so, the names and other identifying information of those individual healthcare providers.\n\n> Note: Other identifying information may be required by the service operator from a healthcare provider—see section 7 of the Act.\n\n Identifying information—healthcare support service providers\n (2A) For the purposes of paragraph 7(2)(e) of the Act, the following information is identifying information of a healthcare support service provider:\n (a) whether the provider has notified the service operator that the provider does not wish to use a healthcare identifier, either temporarily or permanently;\n (b) if applicable, the provider’s business name on the register established under section 22 of the Business Names Registration Act 2011;\n (c) the type of healthcare or support service the provider provides to a healthcare recipient;\n (d) the name, date of birth and date of death (if applicable) of the provider’s responsible officer and organisation maintenance officer (if any);\n (e) the work address, email address, telephone number and fax number of the provider’s responsible officer and organisation maintenance officer (if any);\n (f) the identifying number assigned to the provider’s responsible officer and organisation maintenance officer (if any) by the service operator;\n (g) whether an evidence of identity process has been undertaken for the provider’s responsible officer and organisation maintenance officer (if any);\n (h) if an evidence of identity process is being undertaken for the provider’s responsible officer and organisation maintenance officer (if any)—the name of the entity or service operator undertaking the process;\n (i) if an evidence of identity process has been undertaken for the provider’s responsible officer and organisation maintenance officer (if any)—the name of the entity or service operator that undertook the process, the outcome of the process and when the process was undertaken;\n (j) the record that specifies the network address and technical requirements permitting electronic messages to be sent to the provider.\n\n> Note 1: Also see paragraph 7(2)(a) of the Act which states that the name of the healthcare provider is also identifying information.\n\n> Note 2: The following are examples of the type of support service a provider can provide:\n\n (a) a funded aged care service through the service group home support;\n (b) a service provided by a registered NDIS provider, such as behavioural intervention supports.\n\n> Note 3: Other identifying information may be required by the service operator from a healthcare provider—see section 7 of the Act.\n\n Identifying information—healthcare recipient\n (3) For the purposes of paragraph 7(3)(i) of the Act, the following information is identifying information of a healthcare recipient:\n (a) the telephone number of the healthcare recipient;\n (b) the electronic address of the healthcare recipient;\n (c) whether the identity of the healthcare recipient has been verified;\n (d) whether a healthcare identifier assigned to the healthcare recipient has been assigned provisionally (for example, because it has not been possible to verify the identity of the healthcare recipient);\n (e) if information relating to the identity of the healthcare recipient has been, or is to be, verified using a particular form of identification document (such as a driver’s licence or passport), details of that document, including:\n (i) the document number; and\n (ii) the State or Territory in which the document was issued; and\n (iii) the name of the entity that issued the document;\n (f) if information relating to the identity of the healthcare recipient has been, or is to be, verified by using a verification service, the response of that service to any verification inquiry in relation to the healthcare recipient;\n (g) whether the healthcare recipient is, or is likely to be, deceased;\n (h) whether the death of the healthcare recipient has been verified;\n (i) whether the healthcare recipient is a registered healthcare recipient for the purposes of the My Health Records Act;\n (j) whether the healthcare recipient is an authorised representative, or nominated representative, of another healthcare recipient, and the identity of the other healthcare recipient;\n (k) whether the healthcare recipient, or an authorised representative or nominated representative of the healthcare recipient, has made an election under clause 5 of Schedule 1 to the My Health Records Act that the healthcare recipient not be registered under that Act;\n (l) the name of the healthcare recipient’s birth mother;\n (m) the date of birth of the healthcare recipient’s birth mother;\n (n) the healthcare identifier assigned to the healthcare recipient’s birth mother.","sortOrder":6},{"sectionNumber":"Part 2","sectionType":"part","heading":"Collection, use and disclosure of identifying information and healthcare identifiers","content":"## Part 2—Collection, use and disclosure of identifying information and healthcare identifiers","sortOrder":7},{"sectionNumber":"9","sectionType":"section","heading":"Authorisation of collection, use and disclosure—healthcare provider assisting a healthcare recipient to register for a My Health Record","content":"#### 9 Authorisation of collection, use and disclosure—healthcare provider assisting a healthcare recipient to register for a My Health Record\n\n (1) This section is made for the purposes of subsection 20(1) of the Act.\n (2) For the purposes of registering a healthcare recipient in the My Health Record system, a healthcare provider is authorised to do the following:\n (a) collect, from the healthcare recipient, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier of the healthcare recipient;\n (c) disclose, to the System Operator, the identifying information or healthcare identifier of the healthcare recipient.","sortOrder":8},{"sectionNumber":"9A","sectionType":"section","heading":"Authorisation of collection, use and disclosure—facilitating healthcare recipient to self‑register for an active script list","content":"#### 9A Authorisation of collection, use and disclosure—facilitating healthcare recipient to self‑register for an active script list\n\n (1) This section is made for the purposes of subsection 20(1) of the Act.\n Authorisation of service operator\n (2) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, the service operator is authorised to do the following:\n (a) collect, from an active script list registry operator, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier to verify whether the healthcare recipient has a healthcare identifier;\n (c) disclose the healthcare recipient’s healthcare identifier to the active script list registry operator.\n Authorisation of active script list registry operators\n (3) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, an active script list registry operator is authorised to:\n (a) collect the healthcare recipient’s healthcare identifier from the service operator; and\n (b) use the healthcare recipient’s healthcare identifier to register the healthcare recipient for an active script list.\n (4) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, an active script list registry operator is authorised to:\n (a) collect, from the healthcare recipient, the healthcare recipient’s identifying information or healthcare identifier using a mobile prescription application via a mobile intermediary service or a web application; and\n (b) disclose the identifying information or healthcare identifier to the service operator to verify the healthcare recipient’s healthcare identifier.\n Authorisation of mobile prescription application service providers\n (5) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, a mobile prescription application service provider is authorised to do the following:\n (a) collect, from the healthcare recipient, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier of the healthcare recipient to facilitate the registration of the healthcare recipient for an active script list;\n (c) disclose the identifying information or healthcare identifier of the healthcare recipient to a mobile intermediary service operator to facilitate the registration of the healthcare recipient for an active script list.\n Authorisation of mobile intermediary service operators\n (6) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, a mobile intermediary service operator is authorised to do the following:\n (a) collect, from a mobile prescription application, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier of the healthcare recipient to facilitate the registration of the healthcare recipient for an active script list;\n (c) disclose the identifying information or healthcare identifier of the healthcare recipient to an active script list registry operator to facilitate the registration of the healthcare recipient for an active script list.","sortOrder":9},{"sectionNumber":"10A","sectionType":"section","heading":"Collection, use and disclosure—healthcare provider and healthcare recipient information in relation to health facilitation program","content":"#### 10A Collection, use and disclosure—healthcare provider and healthcare recipient information in relation to health facilitation program\n\n (1) This section is made for the purposes of subsections 20(1) and 25D(1) of the Act.\n (2) An entity mentioned in column 1 of an item in the following table is authorised to take action of the kind described in column 2 of that item with information of the kind described in column 3 of that item in the circumstances described in column 4 of that item.\n\n```html\n

Collection, use and disclosure of healthcare provider and healthcare recipient information in relation to health facilitation program

Item

Column 1
Entity

Column 2
Permitted action

Column 3
Information

Column 4
Circumstances

1

healthcare provider

use

disclose to an operator of a health facilitation program or the service operator

healthcare identifier of the healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the use or disclosure is for the purpose of:

(a) determining the healthcare provider’s eligibility to participate in a health facilitation program; or

(b) registering the provider or the healthcare recipient to participate in a health facilitation program; or

(c) the provider or the healthcare recipient participating in a health facilitation program; or

(d) if the provider has provided healthcare to healthcare recipients through a healthcare facilitation program—supporting continuity of healthcare to the healthcare recipients

2

healthcare provider

collect

use

healthcare identifier of another healthcare provider

the collection or use is for the purpose of:

(a) supporting the other provider’s participation in a health facilitation program; or

(b) if the healthcare provider has provided healthcare to healthcare recipients through a healthcare facilitation program—supporting continuity of healthcare to the healthcare recipients

3

operator of a health facilitation program

collect from a healthcare provider

use

disclose to another healthcare provider or the service operator

healthcare identifier of a healthcare provider

identifying information of a healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the collection, use or disclosure is for the purpose of:

(a) determining the healthcare provider’s eligibility to participate in the health facilitation program; or

(b) registering the provider or the healthcare recipient to participate in the program; or

(c) managing the provider’s or the healthcare recipient’s participation in the program; or

(d) supporting the other provider’s participation in the program; or

(e) if the provider has provided healthcare to healthcare recipients through the program—supporting continuity of healthcare to the healthcare recipients

4

service operator

collect from a healthcare provider or operator of a health facilitation program

use

disclose to an operator of a health facilitation program

healthcare identifier of the healthcare provider

identifying information of the healthcare provider

the collection, use or disclosure is for the purpose of determining the healthcare provider’s eligibility to participate in the health facilitation program

5

service operator

collect from a healthcare provider or operator of a health facilitation program

use

disclose to an operator of a health facilitation program

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the collection, use or disclosure is for the purpose of:

(a) registering the healthcare recipient to participate in the health facilitation program; or

(b) managing the healthcare recipient’s participation in the program

6

operator of a health facilitation program

collect from service operator

use

healthcare identifier of a healthcare provider

identifying information of a healthcare provider

the collection or use is for the purpose of determining the healthcare provider’s eligibility to participate in the health facilitation program

7

operator of a health facilitation program

use

disclose

healthcare identifier of a healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the use or disclosure is for the purpose of evaluation, analysis or reporting relating to whether the program is supporting the delivery of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients

8

entity to whom healthcare identifier of a healthcare provider, or healthcare identifier of a healthcare recipient, is disclosed for a purpose mentioned in column 4 of item 7

collect

use

disclose

healthcare identifier of a healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the collection, use or disclosure is for the purpose of evaluation, analysis or reporting relating to whether a health facilitation program is supporting the delivery of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients

\n```","sortOrder":10},{"sectionNumber":"10B","sectionType":"section","heading":"Adopting the healthcare identifier of a healthcare provider or healthcare recipient—health facilitation program","content":"#### 10B Adopting the healthcare identifier of a healthcare provider or healthcare recipient—health facilitation program\n\n (1) This section is made for the purposes of subsections 20(2) and 25D(2) of the Act.\n (2) An operator of a health facilitation program may adopt the healthcare identifier of a healthcare provider for use as the operator’s own identifier for the purposes of the health facilitation program.\n (3) An operator of a health facilitation program may adopt the healthcare identifier of a healthcare recipient for use as the operator’s own identifier for the purposes of the health facilitation program.","sortOrder":11},{"sectionNumber":"Part 3","sectionType":"part","heading":"Requests by healthcare provider organisations and healthcare support service providers to access healthcare identifiers","content":"## Part 3—Requests by healthcare provider organisations and healthcare support service providers to access healthcare identifiers","sortOrder":12},{"sectionNumber":"11","sectionType":"section","heading":"Details of responsible officer and organisation maintenance officer","content":"#### 11 Details of responsible officer and organisation maintenance officer\n\n (1) This section is made for the purposes of subsections 20(4) and 25D(4) of the Act.\n Healthcare provider organisations\n (2) A healthcare provider organisation must not request the service operator to disclose a healthcare identifier to the organisation, unless:\n (a) the identity of the organisation’s responsible officer and the identity of the organisation maintenance officer have been verified through an evidence of identity process; and\n (b) information in relation to those officers of the kind mentioned in paragraphs 8(2)(e) to (j) of this instrument has been given to the service operator; and\n (c) the information is accurate, up to date and complete.\n (3) If:\n (a) the service operator receives a request to disclose a healthcare identifier from a healthcare provider organisation; and\n (b) the request was made in contravention of subsection (2);\n the service operator must refuse to comply with the request.\n Healthcare support service providers\n (4) A healthcare support service provider must not request the service operator to disclose a healthcare identifier to the provider, unless:\n (a) the identity of the organisation’s responsible officer and the identity of the organisation maintenance officer (if any) have been verified through an evidence of identity process; and\n (b) information in relation to those officers of the kind mentioned in paragraphs 8(2A)(d) to (i) of this instrument has been given to the service operator; and\n (c) the information is accurate, up to date and complete.\n (5) If:\n (a) the service operator receives a request to disclose a healthcare identifier from a healthcare support service provider; and\n (b) the request was made in contravention of subsection (4);\n the service operator must refuse to comply with the request.","sortOrder":13},{"sectionNumber":"12","sectionType":"section","heading":"Identity of individual making request","content":"#### 12 Identity of individual making request\n\n (1) This section is made for the purposes of subsections 20(4) and (5), and 25D(4) and (5), of the Act.\n Information identifying individual making a request\n (2) If a healthcare provider or health administration entity requests the service operator to disclose a healthcare identifier to the provider or entity, the provider or entity must, if it is reasonably practicable to do so, give the service operator enough information to ensure the service operator can identify, by name, the individual making the request on behalf of the provider or entity without having to seek further information.\n\n> Note: For example, the information may be given as part of the data transmitted to the service operator from a healthcare provider or health administration entity’s practice management software.\n\n Keeping retrievable records\n (3) If it is not reasonably practicable to give the service operator the information mentioned in subsection (2) at the time the request is made, the healthcare provider or health administration entity must:\n (a) keep a record of the identity of the individual who accessed the healthcare identifier for the provider or entity from the service operator; and\n (b) keep that record for the retrieval period for that individual; and\n (c) if, during the retrieval period for that individual, the service operator gives the provider or entity written notice requiring the provider or entity to identify the individual—identify the individual to the service operator by the end of the period of 14 days starting on the day after the notice is given.\n (4) Each of the following is a retrieval period for an individual:\n (a) any period during which the individual is authorised by the healthcare provider or health administration entity to access healthcare identifiers on the provider or entity’s behalf;\n (b) if the individual ceases to be authorised by the healthcare provider or health administration entity to access healthcare identifiers on the provider or entity’s behalf—the period of 7 years starting on the day after the person ceased to be authorised.\n (5) A healthcare provider or health administration entity is liable to a civil penalty if the provider or entity contravenes subsection (2) or (3).\n\nCivil penalty: 50 penalty units.","sortOrder":14},{"sectionNumber":"Part 4","sectionType":"part","heading":"Application, saving and transitional provisions","content":"## Part 1—Preliminary\n\n#### 1 Name\n\n This instrument is the Healthcare Identifiers Regulations 2020.\n\n#### 3 Authority\n\n This instrument is made under the Healthcare Identifiers Act 2010.\n\n#### 5 Definitions\n\n> Note: A number of expressions used in this instrument are defined in the Act, including the following:\n\n (a) healthcare provider organisation;\n (b) individual healthcare provider;\n (c) organisation maintenance officer;\n (d) responsible officer.\n In this instrument:\n\n> ABN has the meaning given by section 41 of the A New Tax System (Australian Business Number) Act 1999.\n\n> ACN has the same meaning as in the Corporations Act 2001.\n\n> Act means the Healthcare Identifiers Act 2010.\n\n> active script list means a prescription management system for healthcare recipients.\n\n> active script list registry means a system that provides services for, and provides for the management of, active script lists for healthcare recipients, including (but not limited to) the following:\n\n (a) facilitating a healthcare recipient to register for an active script list;\n (b) storing information submitted by a healthcare recipient, using a mobile or web application, during the registration process;\n (c) adding prescriptions, dispensing records and notifications to the active script list of a healthcare recipient;\n (d) enabling viewing of a healthcare recipient’s active prescriptions and tokens so they can be used to dispense electronic prescriptions for the healthcare recipient;\n (e) allowing mobile application vendors to provide mobile prescription applications.\n\n> active script list registry operator means an entity that operates an active script list registry.\n\n> electronic prescription has the same meaning as in the National Health (Pharmaceutical Benefits) Regulations 2017.\n\n> evidence of identity process means:\n\n (a) in relation to a healthcare provider organisation—the process to confirm the identity of the healthcare provider organisation’s responsible officer and organisation maintenance officer undertaken by:\n (i) if the responsible officer or organisation maintenance officer is an individual healthcare provider who is registered by a registration authority as a member of a health profession—the Australian Health Practitioner Regulation Agency established by the National Law; or\n (ii) in any other case—the service operator; or\n (b) in relation to a healthcare support service provider—the process to confirm the identity of the healthcare support service provider’s responsible officer, and organisation maintenance officer (if any), undertaken by one or more of the following:\n (i) the Aged Care Department;\n (ii) the National Disability Insurance Agency;\n (iii) the service operator;\n (iv) an entity prescribed for the purposes of column 1 of item 6 of the table in section 21 of the Act.\n\n> health facilitation program means a program that is operated or funded by one or more government bodies and that facilitates the provision of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients.\n\n> mobile intermediary service means a service that provides connection services for mobile prescription applications for the purpose of facilitating electronic prescriptions.\n\n> mobile prescription application means an application that enables a healthcare recipient to do either or both of the following:\n\n (a) to manage the healthcare recipient’s prescriptions using a mobile phone or other personal electronic device;\n (b) to view, and manage access to, the healthcare recipient’s active script list.\n\n> mobile prescription application service provider means an entity that operates and/or provides a mobile prescription application.\n\n> My Health Records Act means the My Health Records Act 2012.\n\n> National Law has the same meaning as in the My Health Records Act.\n\n> operator of a health facilitation program means the body, or any of the bodies, that operates the program.\n\n> System Operator has the same meaning as in the My Health Records Act.\n\n> token means a piece of information used to identify and access an electronic prescription or repeat authorisation.\n\n> verification service means a service (whether operated electronically or otherwise) that allows an entity to compare information relating to the identity of an entity with a government record.\n\n#### 6 Application of this instrument to partnerships, trusts and unincorporated associations\n\n To avoid doubt, sections 36B, 36C and 36D of the Act apply to this instrument, and obligations, offences and civil penalty provisions in this instrument, in the same way as they apply to the Act, and obligations, offences and civil penalty provisions in the Act.\n\n#### 7 National registration authorities\n\n For the purposes of section 8 of the Act, each of the following registration authorities is a national registration authority:\n (a) a National Health Practitioner Board established by the National Law;\n (b) if it is authorised under the National Law to assign healthcare identifiers to healthcare providers—the Australian Health Practitioner Regulation Agency established by the National Law.\n\n#### 8 Identifying information\n\n Identifying information—individual healthcare provider\n (1) For the purposes of paragraph 7(1)(g) of the Act, the following information is identifying information of an individual healthcare provider:\n (a) whether the healthcare provider is registered with a registration authority and the status of that registration (such as conditional, suspended, cancelled or lapsed);\n (b) whether the healthcare provider is represented by a professional body of a kind described in paragraph 9A(1)(b) of the Act and the status (such as conditional, suspended, cancelled or lapsed) of the credentials that are:\n (i) provided through the professional body to the healthcare provider; and\n (ii) required to practice the healthcare provider’s healthcare profession;\n (c) whether the healthcare provider is, or is likely to be, deceased;\n (d) whether the death of the healthcare provider has been verified;\n (e) whether the healthcare provider is linked to a healthcare provider organisation and, if so, the name of the organisation and the ABN or ACN of the organisation (whichever is applicable).\n Identifying information—healthcare provider organisation\n (2) For the purposes of paragraph 7(2)(e) of the Act, the following information is identifying information of a healthcare provider organisation:\n (a) whether the organisation is registered under Division 2 of Part 3 of the My Health Records Act;\n (b) whether the organisation has notified the service operator that the organisation does not wish to use a healthcare identifier, either temporarily or permanently;\n (c) if applicable, the organisation’s business name on the register established under section 22 of the Business Names Registration Act 2011;\n\nNote: Also see paragraph 7(2)(a) of the Act which states that the name of the healthcare provider is also identifying information.\n\n (d) the type of healthcare service the organisation provides to another healthcare provider or a healthcare recipient;\n\nNote: Examples of the type of healthcare service an organisation provides include general practice services, public hospital services or diagnostic imaging services.\n\n (e) the name, date of birth and date of death (if applicable) of the organisation’s responsible officer and organisation maintenance officer;\n (f) the work address, email address, telephone number and fax number of the organisation’s responsible officer and organisation maintenance officer;\n (g) the identifying number assigned to the organisation’s responsible officer and organisation maintenance officer by the service operator;\n (h) whether an evidence of identity process has been undertaken for the organisation’s responsible officer and organisation maintenance officer;\n (i) if an evidence of identity process is being undertaken for the organisation’s responsible officer and organisation maintenance officer—the name of the agency or service operator undertaking the process;\n (j) if an evidence of identity process has been undertaken for the organisation’s responsible officer and organisation maintenance officer—the name of the agency or service operator that undertook the process, the outcome of the process and when the process was undertaken;\n (k) the record that specifies the network address and technical requirements permitting electronic messages to be sent to the organisation;\n (l) any other network organisation or seed organisation (within the meaning of section 9A of the Act) that the healthcare provider organisation is linked to in a network;\n (m) whether any individual healthcare providers are linked to the organisation and, if so, the names and other identifying information of those individual healthcare providers.\n\n> Note: Other identifying information may be required by the service operator from a healthcare provider—see section 7 of the Act.\n\n Identifying information—healthcare support service providers\n (2A) For the purposes of paragraph 7(2)(e) of the Act, the following information is identifying information of a healthcare support service provider:\n (a) whether the provider has notified the service operator that the provider does not wish to use a healthcare identifier, either temporarily or permanently;\n (b) if applicable, the provider’s business name on the register established under section 22 of the Business Names Registration Act 2011;\n (c) the type of healthcare or support service the provider provides to a healthcare recipient;\n (d) the name, date of birth and date of death (if applicable) of the provider’s responsible officer and organisation maintenance officer (if any);\n (e) the work address, email address, telephone number and fax number of the provider’s responsible officer and organisation maintenance officer (if any);\n (f) the identifying number assigned to the provider’s responsible officer and organisation maintenance officer (if any) by the service operator;\n (g) whether an evidence of identity process has been undertaken for the provider’s responsible officer and organisation maintenance officer (if any);\n (h) if an evidence of identity process is being undertaken for the provider’s responsible officer and organisation maintenance officer (if any)—the name of the entity or service operator undertaking the process;\n (i) if an evidence of identity process has been undertaken for the provider’s responsible officer and organisation maintenance officer (if any)—the name of the entity or service operator that undertook the process, the outcome of the process and when the process was undertaken;\n (j) the record that specifies the network address and technical requirements permitting electronic messages to be sent to the provider.\n\n> Note 1: Also see paragraph 7(2)(a) of the Act which states that the name of the healthcare provider is also identifying information.\n\n> Note 2: The following are examples of the type of support service a provider can provide:\n\n (a) a funded aged care service through the service group home support;\n (b) a service provided by a registered NDIS provider, such as behavioural intervention supports.\n\n> Note 3: Other identifying information may be required by the service operator from a healthcare provider—see section 7 of the Act.\n\n Identifying information—healthcare recipient\n (3) For the purposes of paragraph 7(3)(i) of the Act, the following information is identifying information of a healthcare recipient:\n (a) the telephone number of the healthcare recipient;\n (b) the electronic address of the healthcare recipient;\n (c) whether the identity of the healthcare recipient has been verified;\n (d) whether a healthcare identifier assigned to the healthcare recipient has been assigned provisionally (for example, because it has not been possible to verify the identity of the healthcare recipient);\n (e) if information relating to the identity of the healthcare recipient has been, or is to be, verified using a particular form of identification document (such as a driver’s licence or passport), details of that document, including:\n (i) the document number; and\n (ii) the State or Territory in which the document was issued; and\n (iii) the name of the entity that issued the document;\n (f) if information relating to the identity of the healthcare recipient has been, or is to be, verified by using a verification service, the response of that service to any verification inquiry in relation to the healthcare recipient;\n (g) whether the healthcare recipient is, or is likely to be, deceased;\n (h) whether the death of the healthcare recipient has been verified;\n (i) whether the healthcare recipient is a registered healthcare recipient for the purposes of the My Health Records Act;\n (j) whether the healthcare recipient is an authorised representative, or nominated representative, of another healthcare recipient, and the identity of the other healthcare recipient;\n (k) whether the healthcare recipient, or an authorised representative or nominated representative of the healthcare recipient, has made an election under clause 5 of Schedule 1 to the My Health Records Act that the healthcare recipient not be registered under that Act;\n (l) the name of the healthcare recipient’s birth mother;\n (m) the date of birth of the healthcare recipient’s birth mother;\n (n) the healthcare identifier assigned to the healthcare recipient’s birth mother.\n\n## Part 2—Collection, use and disclosure of identifying information and healthcare identifiers\n\n#### 9 Authorisation of collection, use and disclosure—healthcare provider assisting a healthcare recipient to register for a My Health Record\n\n (1) This section is made for the purposes of subsection 20(1) of the Act.\n (2) For the purposes of registering a healthcare recipient in the My Health Record system, a healthcare provider is authorised to do the following:\n (a) collect, from the healthcare recipient, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier of the healthcare recipient;\n (c) disclose, to the System Operator, the identifying information or healthcare identifier of the healthcare recipient.\n\n#### 9A Authorisation of collection, use and disclosure—facilitating healthcare recipient to self‑register for an active script list\n\n (1) This section is made for the purposes of subsection 20(1) of the Act.\n Authorisation of service operator\n (2) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, the service operator is authorised to do the following:\n (a) collect, from an active script list registry operator, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier to verify whether the healthcare recipient has a healthcare identifier;\n (c) disclose the healthcare recipient’s healthcare identifier to the active script list registry operator.\n Authorisation of active script list registry operators\n (3) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, an active script list registry operator is authorised to:\n (a) collect the healthcare recipient’s healthcare identifier from the service operator; and\n (b) use the healthcare recipient’s healthcare identifier to register the healthcare recipient for an active script list.\n (4) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, an active script list registry operator is authorised to:\n (a) collect, from the healthcare recipient, the healthcare recipient’s identifying information or healthcare identifier using a mobile prescription application via a mobile intermediary service or a web application; and\n (b) disclose the identifying information or healthcare identifier to the service operator to verify the healthcare recipient’s healthcare identifier.\n Authorisation of mobile prescription application service providers\n (5) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, a mobile prescription application service provider is authorised to do the following:\n (a) collect, from the healthcare recipient, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier of the healthcare recipient to facilitate the registration of the healthcare recipient for an active script list;\n (c) disclose the identifying information or healthcare identifier of the healthcare recipient to a mobile intermediary service operator to facilitate the registration of the healthcare recipient for an active script list.\n Authorisation of mobile intermediary service operators\n (6) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, a mobile intermediary service operator is authorised to do the following:\n (a) collect, from a mobile prescription application, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier of the healthcare recipient to facilitate the registration of the healthcare recipient for an active script list;\n (c) disclose the identifying information or healthcare identifier of the healthcare recipient to an active script list registry operator to facilitate the registration of the healthcare recipient for an active script list.\n\n#### 10A Collection, use and disclosure—healthcare provider and healthcare recipient information in relation to health facilitation program\n\n (1) This section is made for the purposes of subsections 20(1) and 25D(1) of the Act.\n (2) An entity mentioned in column 1 of an item in the following table is authorised to take action of the kind described in column 2 of that item with information of the kind described in column 3 of that item in the circumstances described in column 4 of that item.\n\n```html\n

Collection, use and disclosure of healthcare provider and healthcare recipient information in relation to health facilitation program

Item

Column 1
Entity

Column 2
Permitted action

Column 3
Information

Column 4
Circumstances

1

healthcare provider

use

disclose to an operator of a health facilitation program or the service operator

healthcare identifier of the healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the use or disclosure is for the purpose of:

(a) determining the healthcare provider’s eligibility to participate in a health facilitation program; or

(b) registering the provider or the healthcare recipient to participate in a health facilitation program; or

(c) the provider or the healthcare recipient participating in a health facilitation program; or

(d) if the provider has provided healthcare to healthcare recipients through a healthcare facilitation program—supporting continuity of healthcare to the healthcare recipients

2

healthcare provider

collect

use

healthcare identifier of another healthcare provider

the collection or use is for the purpose of:

(a) supporting the other provider’s participation in a health facilitation program; or

(b) if the healthcare provider has provided healthcare to healthcare recipients through a healthcare facilitation program—supporting continuity of healthcare to the healthcare recipients

3

operator of a health facilitation program

collect from a healthcare provider

use

disclose to another healthcare provider or the service operator

healthcare identifier of a healthcare provider

identifying information of a healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the collection, use or disclosure is for the purpose of:

(a) determining the healthcare provider’s eligibility to participate in the health facilitation program; or

(b) registering the provider or the healthcare recipient to participate in the program; or

(c) managing the provider’s or the healthcare recipient’s participation in the program; or

(d) supporting the other provider’s participation in the program; or

(e) if the provider has provided healthcare to healthcare recipients through the program—supporting continuity of healthcare to the healthcare recipients

4

service operator

collect from a healthcare provider or operator of a health facilitation program

use

disclose to an operator of a health facilitation program

healthcare identifier of the healthcare provider

identifying information of the healthcare provider

the collection, use or disclosure is for the purpose of determining the healthcare provider’s eligibility to participate in the health facilitation program

5

service operator

collect from a healthcare provider or operator of a health facilitation program

use

disclose to an operator of a health facilitation program

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the collection, use or disclosure is for the purpose of:

(a) registering the healthcare recipient to participate in the health facilitation program; or

(b) managing the healthcare recipient’s participation in the program

6

operator of a health facilitation program

collect from service operator

use

healthcare identifier of a healthcare provider

identifying information of a healthcare provider

the collection or use is for the purpose of determining the healthcare provider’s eligibility to participate in the health facilitation program

7

operator of a health facilitation program

use

disclose

healthcare identifier of a healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the use or disclosure is for the purpose of evaluation, analysis or reporting relating to whether the program is supporting the delivery of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients

8

entity to whom healthcare identifier of a healthcare provider, or healthcare identifier of a healthcare recipient, is disclosed for a purpose mentioned in column 4 of item 7

collect

use

disclose

healthcare identifier of a healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the collection, use or disclosure is for the purpose of evaluation, analysis or reporting relating to whether a health facilitation program is supporting the delivery of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients

\n```\n\n#### 10B Adopting the healthcare identifier of a healthcare provider or healthcare recipient—health facilitation program\n\n (1) This section is made for the purposes of subsections 20(2) and 25D(2) of the Act.\n (2) An operator of a health facilitation program may adopt the healthcare identifier of a healthcare provider for use as the operator’s own identifier for the purposes of the health facilitation program.\n (3) An operator of a health facilitation program may adopt the healthcare identifier of a healthcare recipient for use as the operator’s own identifier for the purposes of the health facilitation program.\n\n## Part 3—Requests by healthcare provider organisations and healthcare support service providers to access healthcare identifiers\n\n#### 11 Details of responsible officer and organisation maintenance officer\n\n (1) This section is made for the purposes of subsections 20(4) and 25D(4) of the Act.\n Healthcare provider organisations\n (2) A healthcare provider organisation must not request the service operator to disclose a healthcare identifier to the organisation, unless:\n (a) the identity of the organisation’s responsible officer and the identity of the organisation maintenance officer have been verified through an evidence of identity process; and\n (b) information in relation to those officers of the kind mentioned in paragraphs 8(2)(e) to (j) of this instrument has been given to the service operator; and\n (c) the information is accurate, up to date and complete.\n (3) If:\n (a) the service operator receives a request to disclose a healthcare identifier from a healthcare provider organisation; and\n (b) the request was made in contravention of subsection (2);\n the service operator must refuse to comply with the request.\n Healthcare support service providers\n (4) A healthcare support service provider must not request the service operator to disclose a healthcare identifier to the provider, unless:\n (a) the identity of the organisation’s responsible officer and the identity of the organisation maintenance officer (if any) have been verified through an evidence of identity process; and\n (b) information in relation to those officers of the kind mentioned in paragraphs 8(2A)(d) to (i) of this instrument has been given to the service operator; and\n (c) the information is accurate, up to date and complete.\n (5) If:\n (a) the service operator receives a request to disclose a healthcare identifier from a healthcare support service provider; and\n (b) the request was made in contravention of subsection (4);\n the service operator must refuse to comply with the request.\n\n#### 12 Identity of individual making request\n\n (1) This section is made for the purposes of subsections 20(4) and (5), and 25D(4) and (5), of the Act.\n Information identifying individual making a request\n (2) If a healthcare provider or health administration entity requests the service operator to disclose a healthcare identifier to the provider or entity, the provider or entity must, if it is reasonably practicable to do so, give the service operator enough information to ensure the service operator can identify, by name, the individual making the request on behalf of the provider or entity without having to seek further information.\n\n> Note: For example, the information may be given as part of the data transmitted to the service operator from a healthcare provider or health administration entity’s practice management software.\n\n Keeping retrievable records\n (3) If it is not reasonably practicable to give the service operator the information mentioned in subsection (2) at the time the request is made, the healthcare provider or health administration entity must:\n (a) keep a record of the identity of the individual who accessed the healthcare identifier for the provider or entity from the service operator; and\n (b) keep that record for the retrieval period for that individual; and\n (c) if, during the retrieval period for that individual, the service operator gives the provider or entity written notice requiring the provider or entity to identify the individual—identify the individual to the service operator by the end of the period of 14 days starting on the day after the notice is given.\n (4) Each of the following is a retrieval period for an individual:\n (a) any period during which the individual is authorised by the healthcare provider or health administration entity to access healthcare identifiers on the provider or entity’s behalf;\n (b) if the individual ceases to be authorised by the healthcare provider or health administration entity to access healthcare identifiers on the provider or entity’s behalf—the period of 7 years starting on the day after the person ceased to be authorised.\n (5) A healthcare provider or health administration entity is liable to a civil penalty if the provider or entity contravenes subsection (2) or (3).\n\nCivil penalty: 50 penalty units.\n\n## Part 4—Application, saving and transitional provisions\n\n### Division 1—Application, saving and transitional provisions in relation to the commencement of this instrument\n\n#### 13 Definitions\n\n In this Division:\n\n> commencement day means the day this instrument commences.\n\n> old regulations means the Healthcare Identifiers Regulations 2010, as in force immediately before the commencement day.\n\n#### 14 Things done under the old regulations\n\n (1) If:\n (a) a thing was done for a particular purpose under the old regulations; and\n (b) the thing could be done for that purpose under this instrument;\n the thing has effect for the purposes of this instrument as if it had been done for that purpose under this instrument.\n (2) Without limiting subsection (1), a reference in that subsection to a thing being done includes a reference to a notice, request or other instrument being given or made.\n\n#### 16 Continued operation of certain provisions not affected\n\n (1) The repeal of the old regulations by this instrument does not affect the continuing operation of a provision of a version of the Healthcare Identifiers Regulations 2010 that was not in force immediately before the commencement day if, immediately before that day, the provision had continuing operation because of Schedule 1 to the old regulations.\n (2) This section does not limit the effect of section 7 of the Acts Interpretation Act 1901 (as it applies as a result of paragraph 13(1)(a) of the Legislation Act 2003).\n\n### Division 2—Application of the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025\n\n#### 17 Application of the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025\n\n (1) Section 9A, as inserted by the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025, applies in relation to the use and disclosure of information on or after the commencement of that instrument, regardless of whether the information was collected before, on or after that commencement.\n (2) This section does not limit the application of section 9A.\n\n### Division 3—Application of the Aged Care Legislation Consequential Amendments Regulations 2025\n\n#### 18 Use and disclosure of healthcare identifier of a healthcare provider disclosed before commencement\n\n (1) This section applies if a disclosure of the healthcare identifier of a healthcare provider is made to another entity under subsection 10(2) of this instrument, as in force before the commencement of this section.\n (2) Despite the repeal of section 10 of this instrument by the Aged Care Legislation Consequential Amendments Regulations 2025, subsection (3) of that section continues to apply to the other entity, in relation to the healthcare identifier of the healthcare provider, as if that repeal had not happened.\n\n#### 19 Use and disclosure of healthcare identifier of a healthcare provider or healthcare recipient\n\n (1) Section 10A, as amended by the Aged Care Legislation Consequential Amendments Regulations 2025, applies in relation to the use and disclosure of information on or after the commencement of that instrument, regardless of whether the information was collected before, on or after that commencement.\n (2) This section does not limit the application of section 10A.\n\n#### 20 Requests for disclosure of healthcare identifiers\n\n Section 12, as substituted by the Aged Care Legislation Consequential Amendments Regulations 2025, applies in relation to a request made on or after the commencement of that instrument.","sortOrder":15},{"sectionNumber":"Division 1","sectionType":"division","heading":"Application, saving and transitional provisions in relation to the commencement of this instrument","content":"## Part 1—Preliminary\n\n#### 1 Name\n\n This instrument is the Healthcare Identifiers Regulations 2020.\n\n#### 3 Authority\n\n This instrument is made under the Healthcare Identifiers Act 2010.\n\n#### 5 Definitions\n\n> Note: A number of expressions used in this instrument are defined in the Act, including the following:\n\n (a) healthcare provider organisation;\n (b) individual healthcare provider;\n (c) organisation maintenance officer;\n (d) responsible officer.\n In this instrument:\n\n> ABN has the meaning given by section 41 of the A New Tax System (Australian Business Number) Act 1999.\n\n> ACN has the same meaning as in the Corporations Act 2001.\n\n> Act means the Healthcare Identifiers Act 2010.\n\n> active script list means a prescription management system for healthcare recipients.\n\n> active script list registry means a system that provides services for, and provides for the management of, active script lists for healthcare recipients, including (but not limited to) the following:\n\n (a) facilitating a healthcare recipient to register for an active script list;\n (b) storing information submitted by a healthcare recipient, using a mobile or web application, during the registration process;\n (c) adding prescriptions, dispensing records and notifications to the active script list of a healthcare recipient;\n (d) enabling viewing of a healthcare recipient’s active prescriptions and tokens so they can be used to dispense electronic prescriptions for the healthcare recipient;\n (e) allowing mobile application vendors to provide mobile prescription applications.\n\n> active script list registry operator means an entity that operates an active script list registry.\n\n> electronic prescription has the same meaning as in the National Health (Pharmaceutical Benefits) Regulations 2017.\n\n> evidence of identity process means:\n\n (a) in relation to a healthcare provider organisation—the process to confirm the identity of the healthcare provider organisation’s responsible officer and organisation maintenance officer undertaken by:\n (i) if the responsible officer or organisation maintenance officer is an individual healthcare provider who is registered by a registration authority as a member of a health profession—the Australian Health Practitioner Regulation Agency established by the National Law; or\n (ii) in any other case—the service operator; or\n (b) in relation to a healthcare support service provider—the process to confirm the identity of the healthcare support service provider’s responsible officer, and organisation maintenance officer (if any), undertaken by one or more of the following:\n (i) the Aged Care Department;\n (ii) the National Disability Insurance Agency;\n (iii) the service operator;\n (iv) an entity prescribed for the purposes of column 1 of item 6 of the table in section 21 of the Act.\n\n> health facilitation program means a program that is operated or funded by one or more government bodies and that facilitates the provision of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients.\n\n> mobile intermediary service means a service that provides connection services for mobile prescription applications for the purpose of facilitating electronic prescriptions.\n\n> mobile prescription application means an application that enables a healthcare recipient to do either or both of the following:\n\n (a) to manage the healthcare recipient’s prescriptions using a mobile phone or other personal electronic device;\n (b) to view, and manage access to, the healthcare recipient’s active script list.\n\n> mobile prescription application service provider means an entity that operates and/or provides a mobile prescription application.\n\n> My Health Records Act means the My Health Records Act 2012.\n\n> National Law has the same meaning as in the My Health Records Act.\n\n> operator of a health facilitation program means the body, or any of the bodies, that operates the program.\n\n> System Operator has the same meaning as in the My Health Records Act.\n\n> token means a piece of information used to identify and access an electronic prescription or repeat authorisation.\n\n> verification service means a service (whether operated electronically or otherwise) that allows an entity to compare information relating to the identity of an entity with a government record.\n\n#### 6 Application of this instrument to partnerships, trusts and unincorporated associations\n\n To avoid doubt, sections 36B, 36C and 36D of the Act apply to this instrument, and obligations, offences and civil penalty provisions in this instrument, in the same way as they apply to the Act, and obligations, offences and civil penalty provisions in the Act.\n\n#### 7 National registration authorities\n\n For the purposes of section 8 of the Act, each of the following registration authorities is a national registration authority:\n (a) a National Health Practitioner Board established by the National Law;\n (b) if it is authorised under the National Law to assign healthcare identifiers to healthcare providers—the Australian Health Practitioner Regulation Agency established by the National Law.\n\n#### 8 Identifying information\n\n Identifying information—individual healthcare provider\n (1) For the purposes of paragraph 7(1)(g) of the Act, the following information is identifying information of an individual healthcare provider:\n (a) whether the healthcare provider is registered with a registration authority and the status of that registration (such as conditional, suspended, cancelled or lapsed);\n (b) whether the healthcare provider is represented by a professional body of a kind described in paragraph 9A(1)(b) of the Act and the status (such as conditional, suspended, cancelled or lapsed) of the credentials that are:\n (i) provided through the professional body to the healthcare provider; and\n (ii) required to practice the healthcare provider’s healthcare profession;\n (c) whether the healthcare provider is, or is likely to be, deceased;\n (d) whether the death of the healthcare provider has been verified;\n (e) whether the healthcare provider is linked to a healthcare provider organisation and, if so, the name of the organisation and the ABN or ACN of the organisation (whichever is applicable).\n Identifying information—healthcare provider organisation\n (2) For the purposes of paragraph 7(2)(e) of the Act, the following information is identifying information of a healthcare provider organisation:\n (a) whether the organisation is registered under Division 2 of Part 3 of the My Health Records Act;\n (b) whether the organisation has notified the service operator that the organisation does not wish to use a healthcare identifier, either temporarily or permanently;\n (c) if applicable, the organisation’s business name on the register established under section 22 of the Business Names Registration Act 2011;\n\nNote: Also see paragraph 7(2)(a) of the Act which states that the name of the healthcare provider is also identifying information.\n\n (d) the type of healthcare service the organisation provides to another healthcare provider or a healthcare recipient;\n\nNote: Examples of the type of healthcare service an organisation provides include general practice services, public hospital services or diagnostic imaging services.\n\n (e) the name, date of birth and date of death (if applicable) of the organisation’s responsible officer and organisation maintenance officer;\n (f) the work address, email address, telephone number and fax number of the organisation’s responsible officer and organisation maintenance officer;\n (g) the identifying number assigned to the organisation’s responsible officer and organisation maintenance officer by the service operator;\n (h) whether an evidence of identity process has been undertaken for the organisation’s responsible officer and organisation maintenance officer;\n (i) if an evidence of identity process is being undertaken for the organisation’s responsible officer and organisation maintenance officer—the name of the agency or service operator undertaking the process;\n (j) if an evidence of identity process has been undertaken for the organisation’s responsible officer and organisation maintenance officer—the name of the agency or service operator that undertook the process, the outcome of the process and when the process was undertaken;\n (k) the record that specifies the network address and technical requirements permitting electronic messages to be sent to the organisation;\n (l) any other network organisation or seed organisation (within the meaning of section 9A of the Act) that the healthcare provider organisation is linked to in a network;\n (m) whether any individual healthcare providers are linked to the organisation and, if so, the names and other identifying information of those individual healthcare providers.\n\n> Note: Other identifying information may be required by the service operator from a healthcare provider—see section 7 of the Act.\n\n Identifying information—healthcare support service providers\n (2A) For the purposes of paragraph 7(2)(e) of the Act, the following information is identifying information of a healthcare support service provider:\n (a) whether the provider has notified the service operator that the provider does not wish to use a healthcare identifier, either temporarily or permanently;\n (b) if applicable, the provider’s business name on the register established under section 22 of the Business Names Registration Act 2011;\n (c) the type of healthcare or support service the provider provides to a healthcare recipient;\n (d) the name, date of birth and date of death (if applicable) of the provider’s responsible officer and organisation maintenance officer (if any);\n (e) the work address, email address, telephone number and fax number of the provider’s responsible officer and organisation maintenance officer (if any);\n (f) the identifying number assigned to the provider’s responsible officer and organisation maintenance officer (if any) by the service operator;\n (g) whether an evidence of identity process has been undertaken for the provider’s responsible officer and organisation maintenance officer (if any);\n (h) if an evidence of identity process is being undertaken for the provider’s responsible officer and organisation maintenance officer (if any)—the name of the entity or service operator undertaking the process;\n (i) if an evidence of identity process has been undertaken for the provider’s responsible officer and organisation maintenance officer (if any)—the name of the entity or service operator that undertook the process, the outcome of the process and when the process was undertaken;\n (j) the record that specifies the network address and technical requirements permitting electronic messages to be sent to the provider.\n\n> Note 1: Also see paragraph 7(2)(a) of the Act which states that the name of the healthcare provider is also identifying information.\n\n> Note 2: The following are examples of the type of support service a provider can provide:\n\n (a) a funded aged care service through the service group home support;\n (b) a service provided by a registered NDIS provider, such as behavioural intervention supports.\n\n> Note 3: Other identifying information may be required by the service operator from a healthcare provider—see section 7 of the Act.\n\n Identifying information—healthcare recipient\n (3) For the purposes of paragraph 7(3)(i) of the Act, the following information is identifying information of a healthcare recipient:\n (a) the telephone number of the healthcare recipient;\n (b) the electronic address of the healthcare recipient;\n (c) whether the identity of the healthcare recipient has been verified;\n (d) whether a healthcare identifier assigned to the healthcare recipient has been assigned provisionally (for example, because it has not been possible to verify the identity of the healthcare recipient);\n (e) if information relating to the identity of the healthcare recipient has been, or is to be, verified using a particular form of identification document (such as a driver’s licence or passport), details of that document, including:\n (i) the document number; and\n (ii) the State or Territory in which the document was issued; and\n (iii) the name of the entity that issued the document;\n (f) if information relating to the identity of the healthcare recipient has been, or is to be, verified by using a verification service, the response of that service to any verification inquiry in relation to the healthcare recipient;\n (g) whether the healthcare recipient is, or is likely to be, deceased;\n (h) whether the death of the healthcare recipient has been verified;\n (i) whether the healthcare recipient is a registered healthcare recipient for the purposes of the My Health Records Act;\n (j) whether the healthcare recipient is an authorised representative, or nominated representative, of another healthcare recipient, and the identity of the other healthcare recipient;\n (k) whether the healthcare recipient, or an authorised representative or nominated representative of the healthcare recipient, has made an election under clause 5 of Schedule 1 to the My Health Records Act that the healthcare recipient not be registered under that Act;\n (l) the name of the healthcare recipient’s birth mother;\n (m) the date of birth of the healthcare recipient’s birth mother;\n (n) the healthcare identifier assigned to the healthcare recipient’s birth mother.\n\n## Part 2—Collection, use and disclosure of identifying information and healthcare identifiers\n\n#### 9 Authorisation of collection, use and disclosure—healthcare provider assisting a healthcare recipient to register for a My Health Record\n\n (1) This section is made for the purposes of subsection 20(1) of the Act.\n (2) For the purposes of registering a healthcare recipient in the My Health Record system, a healthcare provider is authorised to do the following:\n (a) collect, from the healthcare recipient, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier of the healthcare recipient;\n (c) disclose, to the System Operator, the identifying information or healthcare identifier of the healthcare recipient.\n\n#### 9A Authorisation of collection, use and disclosure—facilitating healthcare recipient to self‑register for an active script list\n\n (1) This section is made for the purposes of subsection 20(1) of the Act.\n Authorisation of service operator\n (2) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, the service operator is authorised to do the following:\n (a) collect, from an active script list registry operator, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier to verify whether the healthcare recipient has a healthcare identifier;\n (c) disclose the healthcare recipient’s healthcare identifier to the active script list registry operator.\n Authorisation of active script list registry operators\n (3) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, an active script list registry operator is authorised to:\n (a) collect the healthcare recipient’s healthcare identifier from the service operator; and\n (b) use the healthcare recipient’s healthcare identifier to register the healthcare recipient for an active script list.\n (4) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, an active script list registry operator is authorised to:\n (a) collect, from the healthcare recipient, the healthcare recipient’s identifying information or healthcare identifier using a mobile prescription application via a mobile intermediary service or a web application; and\n (b) disclose the identifying information or healthcare identifier to the service operator to verify the healthcare recipient’s healthcare identifier.\n Authorisation of mobile prescription application service providers\n (5) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, a mobile prescription application service provider is authorised to do the following:\n (a) collect, from the healthcare recipient, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier of the healthcare recipient to facilitate the registration of the healthcare recipient for an active script list;\n (c) disclose the identifying information or healthcare identifier of the healthcare recipient to a mobile intermediary service operator to facilitate the registration of the healthcare recipient for an active script list.\n Authorisation of mobile intermediary service operators\n (6) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, a mobile intermediary service operator is authorised to do the following:\n (a) collect, from a mobile prescription application, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier of the healthcare recipient to facilitate the registration of the healthcare recipient for an active script list;\n (c) disclose the identifying information or healthcare identifier of the healthcare recipient to an active script list registry operator to facilitate the registration of the healthcare recipient for an active script list.\n\n#### 10A Collection, use and disclosure—healthcare provider and healthcare recipient information in relation to health facilitation program\n\n (1) This section is made for the purposes of subsections 20(1) and 25D(1) of the Act.\n (2) An entity mentioned in column 1 of an item in the following table is authorised to take action of the kind described in column 2 of that item with information of the kind described in column 3 of that item in the circumstances described in column 4 of that item.\n\n```html\n

Collection, use and disclosure of healthcare provider and healthcare recipient information in relation to health facilitation program

Item

Column 1
Entity

Column 2
Permitted action

Column 3
Information

Column 4
Circumstances

1

healthcare provider

use

disclose to an operator of a health facilitation program or the service operator

healthcare identifier of the healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the use or disclosure is for the purpose of:

(a) determining the healthcare provider’s eligibility to participate in a health facilitation program; or

(b) registering the provider or the healthcare recipient to participate in a health facilitation program; or

(c) the provider or the healthcare recipient participating in a health facilitation program; or

(d) if the provider has provided healthcare to healthcare recipients through a healthcare facilitation program—supporting continuity of healthcare to the healthcare recipients

2

healthcare provider

collect

use

healthcare identifier of another healthcare provider

the collection or use is for the purpose of:

(a) supporting the other provider’s participation in a health facilitation program; or

(b) if the healthcare provider has provided healthcare to healthcare recipients through a healthcare facilitation program—supporting continuity of healthcare to the healthcare recipients

3

operator of a health facilitation program

collect from a healthcare provider

use

disclose to another healthcare provider or the service operator

healthcare identifier of a healthcare provider

identifying information of a healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the collection, use or disclosure is for the purpose of:

(a) determining the healthcare provider’s eligibility to participate in the health facilitation program; or

(b) registering the provider or the healthcare recipient to participate in the program; or

(c) managing the provider’s or the healthcare recipient’s participation in the program; or

(d) supporting the other provider’s participation in the program; or

(e) if the provider has provided healthcare to healthcare recipients through the program—supporting continuity of healthcare to the healthcare recipients

4

service operator

collect from a healthcare provider or operator of a health facilitation program

use

disclose to an operator of a health facilitation program

healthcare identifier of the healthcare provider

identifying information of the healthcare provider

the collection, use or disclosure is for the purpose of determining the healthcare provider’s eligibility to participate in the health facilitation program

5

service operator

collect from a healthcare provider or operator of a health facilitation program

use

disclose to an operator of a health facilitation program

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the collection, use or disclosure is for the purpose of:

(a) registering the healthcare recipient to participate in the health facilitation program; or

(b) managing the healthcare recipient’s participation in the program

6

operator of a health facilitation program

collect from service operator

use

healthcare identifier of a healthcare provider

identifying information of a healthcare provider

the collection or use is for the purpose of determining the healthcare provider’s eligibility to participate in the health facilitation program

7

operator of a health facilitation program

use

disclose

healthcare identifier of a healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the use or disclosure is for the purpose of evaluation, analysis or reporting relating to whether the program is supporting the delivery of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients

8

entity to whom healthcare identifier of a healthcare provider, or healthcare identifier of a healthcare recipient, is disclosed for a purpose mentioned in column 4 of item 7

collect

use

disclose

healthcare identifier of a healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the collection, use or disclosure is for the purpose of evaluation, analysis or reporting relating to whether a health facilitation program is supporting the delivery of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients

\n```\n\n#### 10B Adopting the healthcare identifier of a healthcare provider or healthcare recipient—health facilitation program\n\n (1) This section is made for the purposes of subsections 20(2) and 25D(2) of the Act.\n (2) An operator of a health facilitation program may adopt the healthcare identifier of a healthcare provider for use as the operator’s own identifier for the purposes of the health facilitation program.\n (3) An operator of a health facilitation program may adopt the healthcare identifier of a healthcare recipient for use as the operator’s own identifier for the purposes of the health facilitation program.\n\n## Part 3—Requests by healthcare provider organisations and healthcare support service providers to access healthcare identifiers\n\n#### 11 Details of responsible officer and organisation maintenance officer\n\n (1) This section is made for the purposes of subsections 20(4) and 25D(4) of the Act.\n Healthcare provider organisations\n (2) A healthcare provider organisation must not request the service operator to disclose a healthcare identifier to the organisation, unless:\n (a) the identity of the organisation’s responsible officer and the identity of the organisation maintenance officer have been verified through an evidence of identity process; and\n (b) information in relation to those officers of the kind mentioned in paragraphs 8(2)(e) to (j) of this instrument has been given to the service operator; and\n (c) the information is accurate, up to date and complete.\n (3) If:\n (a) the service operator receives a request to disclose a healthcare identifier from a healthcare provider organisation; and\n (b) the request was made in contravention of subsection (2);\n the service operator must refuse to comply with the request.\n Healthcare support service providers\n (4) A healthcare support service provider must not request the service operator to disclose a healthcare identifier to the provider, unless:\n (a) the identity of the organisation’s responsible officer and the identity of the organisation maintenance officer (if any) have been verified through an evidence of identity process; and\n (b) information in relation to those officers of the kind mentioned in paragraphs 8(2A)(d) to (i) of this instrument has been given to the service operator; and\n (c) the information is accurate, up to date and complete.\n (5) If:\n (a) the service operator receives a request to disclose a healthcare identifier from a healthcare support service provider; and\n (b) the request was made in contravention of subsection (4);\n the service operator must refuse to comply with the request.\n\n#### 12 Identity of individual making request\n\n (1) This section is made for the purposes of subsections 20(4) and (5), and 25D(4) and (5), of the Act.\n Information identifying individual making a request\n (2) If a healthcare provider or health administration entity requests the service operator to disclose a healthcare identifier to the provider or entity, the provider or entity must, if it is reasonably practicable to do so, give the service operator enough information to ensure the service operator can identify, by name, the individual making the request on behalf of the provider or entity without having to seek further information.\n\n> Note: For example, the information may be given as part of the data transmitted to the service operator from a healthcare provider or health administration entity’s practice management software.\n\n Keeping retrievable records\n (3) If it is not reasonably practicable to give the service operator the information mentioned in subsection (2) at the time the request is made, the healthcare provider or health administration entity must:\n (a) keep a record of the identity of the individual who accessed the healthcare identifier for the provider or entity from the service operator; and\n (b) keep that record for the retrieval period for that individual; and\n (c) if, during the retrieval period for that individual, the service operator gives the provider or entity written notice requiring the provider or entity to identify the individual—identify the individual to the service operator by the end of the period of 14 days starting on the day after the notice is given.\n (4) Each of the following is a retrieval period for an individual:\n (a) any period during which the individual is authorised by the healthcare provider or health administration entity to access healthcare identifiers on the provider or entity’s behalf;\n (b) if the individual ceases to be authorised by the healthcare provider or health administration entity to access healthcare identifiers on the provider or entity’s behalf—the period of 7 years starting on the day after the person ceased to be authorised.\n (5) A healthcare provider or health administration entity is liable to a civil penalty if the provider or entity contravenes subsection (2) or (3).\n\nCivil penalty: 50 penalty units.\n\n## Part 4—Application, saving and transitional provisions\n\n### Division 1—Application, saving and transitional provisions in relation to the commencement of this instrument\n\n#### 13 Definitions\n\n In this Division:\n\n> commencement day means the day this instrument commences.\n\n> old regulations means the Healthcare Identifiers Regulations 2010, as in force immediately before the commencement day.\n\n#### 14 Things done under the old regulations\n\n (1) If:\n (a) a thing was done for a particular purpose under the old regulations; and\n (b) the thing could be done for that purpose under this instrument;\n the thing has effect for the purposes of this instrument as if it had been done for that purpose under this instrument.\n (2) Without limiting subsection (1), a reference in that subsection to a thing being done includes a reference to a notice, request or other instrument being given or made.\n\n#### 16 Continued operation of certain provisions not affected\n\n (1) The repeal of the old regulations by this instrument does not affect the continuing operation of a provision of a version of the Healthcare Identifiers Regulations 2010 that was not in force immediately before the commencement day if, immediately before that day, the provision had continuing operation because of Schedule 1 to the old regulations.\n (2) This section does not limit the effect of section 7 of the Acts Interpretation Act 1901 (as it applies as a result of paragraph 13(1)(a) of the Legislation Act 2003).\n\n### Division 2—Application of the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025\n\n#### 17 Application of the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025\n\n (1) Section 9A, as inserted by the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025, applies in relation to the use and disclosure of information on or after the commencement of that instrument, regardless of whether the information was collected before, on or after that commencement.\n (2) This section does not limit the application of section 9A.\n\n### Division 3—Application of the Aged Care Legislation Consequential Amendments Regulations 2025\n\n#### 18 Use and disclosure of healthcare identifier of a healthcare provider disclosed before commencement\n\n (1) This section applies if a disclosure of the healthcare identifier of a healthcare provider is made to another entity under subsection 10(2) of this instrument, as in force before the commencement of this section.\n (2) Despite the repeal of section 10 of this instrument by the Aged Care Legislation Consequential Amendments Regulations 2025, subsection (3) of that section continues to apply to the other entity, in relation to the healthcare identifier of the healthcare provider, as if that repeal had not happened.\n\n#### 19 Use and disclosure of healthcare identifier of a healthcare provider or healthcare recipient\n\n (1) Section 10A, as amended by the Aged Care Legislation Consequential Amendments Regulations 2025, applies in relation to the use and disclosure of information on or after the commencement of that instrument, regardless of whether the information was collected before, on or after that commencement.\n (2) This section does not limit the application of section 10A.\n\n#### 20 Requests for disclosure of healthcare identifiers\n\n Section 12, as substituted by the Aged Care Legislation Consequential Amendments Regulations 2025, applies in relation to a request made on or after the commencement of that instrument.","sortOrder":16},{"sectionNumber":"13","sectionType":"section","heading":"Definitions","content":"#### 13 Definitions\n\n In this Division:\n\n> commencement day means the day this instrument commences.\n\n> old regulations means the Healthcare Identifiers Regulations 2010, as in force immediately before the commencement day.","sortOrder":17},{"sectionNumber":"14","sectionType":"section","heading":"Things done under the old regulations","content":"#### 14 Things done under the old regulations\n\n (1) If:\n (a) a thing was done for a particular purpose under the old regulations; and\n (b) the thing could be done for that purpose under this instrument;\n the thing has effect for the purposes of this instrument as if it had been done for that purpose under this instrument.\n (2) Without limiting subsection (1), a reference in that subsection to a thing being done includes a reference to a notice, request or other instrument being given or made.","sortOrder":18},{"sectionNumber":"16","sectionType":"section","heading":"Continued operation of certain provisions not affected","content":"#### 16 Continued operation of certain provisions not affected\n\n (1) The repeal of the old regulations by this instrument does not affect the continuing operation of a provision of a version of the Healthcare Identifiers Regulations 2010 that was not in force immediately before the commencement day if, immediately before that day, the provision had continuing operation because of Schedule 1 to the old regulations.\n (2) This section does not limit the effect of section 7 of the Acts Interpretation Act 1901 (as it applies as a result of paragraph 13(1)(a) of the Legislation Act 2003).","sortOrder":19},{"sectionNumber":"Division 2","sectionType":"division","heading":"Application of the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025","content":"## Part 1—Preliminary\n\n#### 1 Name\n\n This instrument is the Healthcare Identifiers Regulations 2020.\n\n#### 3 Authority\n\n This instrument is made under the Healthcare Identifiers Act 2010.\n\n#### 5 Definitions\n\n> Note: A number of expressions used in this instrument are defined in the Act, including the following:\n\n (a) healthcare provider organisation;\n (b) individual healthcare provider;\n (c) organisation maintenance officer;\n (d) responsible officer.\n In this instrument:\n\n> ABN has the meaning given by section 41 of the A New Tax System (Australian Business Number) Act 1999.\n\n> ACN has the same meaning as in the Corporations Act 2001.\n\n> Act means the Healthcare Identifiers Act 2010.\n\n> active script list means a prescription management system for healthcare recipients.\n\n> active script list registry means a system that provides services for, and provides for the management of, active script lists for healthcare recipients, including (but not limited to) the following:\n\n (a) facilitating a healthcare recipient to register for an active script list;\n (b) storing information submitted by a healthcare recipient, using a mobile or web application, during the registration process;\n (c) adding prescriptions, dispensing records and notifications to the active script list of a healthcare recipient;\n (d) enabling viewing of a healthcare recipient’s active prescriptions and tokens so they can be used to dispense electronic prescriptions for the healthcare recipient;\n (e) allowing mobile application vendors to provide mobile prescription applications.\n\n> active script list registry operator means an entity that operates an active script list registry.\n\n> electronic prescription has the same meaning as in the National Health (Pharmaceutical Benefits) Regulations 2017.\n\n> evidence of identity process means:\n\n (a) in relation to a healthcare provider organisation—the process to confirm the identity of the healthcare provider organisation’s responsible officer and organisation maintenance officer undertaken by:\n (i) if the responsible officer or organisation maintenance officer is an individual healthcare provider who is registered by a registration authority as a member of a health profession—the Australian Health Practitioner Regulation Agency established by the National Law; or\n (ii) in any other case—the service operator; or\n (b) in relation to a healthcare support service provider—the process to confirm the identity of the healthcare support service provider’s responsible officer, and organisation maintenance officer (if any), undertaken by one or more of the following:\n (i) the Aged Care Department;\n (ii) the National Disability Insurance Agency;\n (iii) the service operator;\n (iv) an entity prescribed for the purposes of column 1 of item 6 of the table in section 21 of the Act.\n\n> health facilitation program means a program that is operated or funded by one or more government bodies and that facilitates the provision of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients.\n\n> mobile intermediary service means a service that provides connection services for mobile prescription applications for the purpose of facilitating electronic prescriptions.\n\n> mobile prescription application means an application that enables a healthcare recipient to do either or both of the following:\n\n (a) to manage the healthcare recipient’s prescriptions using a mobile phone or other personal electronic device;\n (b) to view, and manage access to, the healthcare recipient’s active script list.\n\n> mobile prescription application service provider means an entity that operates and/or provides a mobile prescription application.\n\n> My Health Records Act means the My Health Records Act 2012.\n\n> National Law has the same meaning as in the My Health Records Act.\n\n> operator of a health facilitation program means the body, or any of the bodies, that operates the program.\n\n> System Operator has the same meaning as in the My Health Records Act.\n\n> token means a piece of information used to identify and access an electronic prescription or repeat authorisation.\n\n> verification service means a service (whether operated electronically or otherwise) that allows an entity to compare information relating to the identity of an entity with a government record.\n\n#### 6 Application of this instrument to partnerships, trusts and unincorporated associations\n\n To avoid doubt, sections 36B, 36C and 36D of the Act apply to this instrument, and obligations, offences and civil penalty provisions in this instrument, in the same way as they apply to the Act, and obligations, offences and civil penalty provisions in the Act.\n\n#### 7 National registration authorities\n\n For the purposes of section 8 of the Act, each of the following registration authorities is a national registration authority:\n (a) a National Health Practitioner Board established by the National Law;\n (b) if it is authorised under the National Law to assign healthcare identifiers to healthcare providers—the Australian Health Practitioner Regulation Agency established by the National Law.\n\n#### 8 Identifying information\n\n Identifying information—individual healthcare provider\n (1) For the purposes of paragraph 7(1)(g) of the Act, the following information is identifying information of an individual healthcare provider:\n (a) whether the healthcare provider is registered with a registration authority and the status of that registration (such as conditional, suspended, cancelled or lapsed);\n (b) whether the healthcare provider is represented by a professional body of a kind described in paragraph 9A(1)(b) of the Act and the status (such as conditional, suspended, cancelled or lapsed) of the credentials that are:\n (i) provided through the professional body to the healthcare provider; and\n (ii) required to practice the healthcare provider’s healthcare profession;\n (c) whether the healthcare provider is, or is likely to be, deceased;\n (d) whether the death of the healthcare provider has been verified;\n (e) whether the healthcare provider is linked to a healthcare provider organisation and, if so, the name of the organisation and the ABN or ACN of the organisation (whichever is applicable).\n Identifying information—healthcare provider organisation\n (2) For the purposes of paragraph 7(2)(e) of the Act, the following information is identifying information of a healthcare provider organisation:\n (a) whether the organisation is registered under Division 2 of Part 3 of the My Health Records Act;\n (b) whether the organisation has notified the service operator that the organisation does not wish to use a healthcare identifier, either temporarily or permanently;\n (c) if applicable, the organisation’s business name on the register established under section 22 of the Business Names Registration Act 2011;\n\nNote: Also see paragraph 7(2)(a) of the Act which states that the name of the healthcare provider is also identifying information.\n\n (d) the type of healthcare service the organisation provides to another healthcare provider or a healthcare recipient;\n\nNote: Examples of the type of healthcare service an organisation provides include general practice services, public hospital services or diagnostic imaging services.\n\n (e) the name, date of birth and date of death (if applicable) of the organisation’s responsible officer and organisation maintenance officer;\n (f) the work address, email address, telephone number and fax number of the organisation’s responsible officer and organisation maintenance officer;\n (g) the identifying number assigned to the organisation’s responsible officer and organisation maintenance officer by the service operator;\n (h) whether an evidence of identity process has been undertaken for the organisation’s responsible officer and organisation maintenance officer;\n (i) if an evidence of identity process is being undertaken for the organisation’s responsible officer and organisation maintenance officer—the name of the agency or service operator undertaking the process;\n (j) if an evidence of identity process has been undertaken for the organisation’s responsible officer and organisation maintenance officer—the name of the agency or service operator that undertook the process, the outcome of the process and when the process was undertaken;\n (k) the record that specifies the network address and technical requirements permitting electronic messages to be sent to the organisation;\n (l) any other network organisation or seed organisation (within the meaning of section 9A of the Act) that the healthcare provider organisation is linked to in a network;\n (m) whether any individual healthcare providers are linked to the organisation and, if so, the names and other identifying information of those individual healthcare providers.\n\n> Note: Other identifying information may be required by the service operator from a healthcare provider—see section 7 of the Act.\n\n Identifying information—healthcare support service providers\n (2A) For the purposes of paragraph 7(2)(e) of the Act, the following information is identifying information of a healthcare support service provider:\n (a) whether the provider has notified the service operator that the provider does not wish to use a healthcare identifier, either temporarily or permanently;\n (b) if applicable, the provider’s business name on the register established under section 22 of the Business Names Registration Act 2011;\n (c) the type of healthcare or support service the provider provides to a healthcare recipient;\n (d) the name, date of birth and date of death (if applicable) of the provider’s responsible officer and organisation maintenance officer (if any);\n (e) the work address, email address, telephone number and fax number of the provider’s responsible officer and organisation maintenance officer (if any);\n (f) the identifying number assigned to the provider’s responsible officer and organisation maintenance officer (if any) by the service operator;\n (g) whether an evidence of identity process has been undertaken for the provider’s responsible officer and organisation maintenance officer (if any);\n (h) if an evidence of identity process is being undertaken for the provider’s responsible officer and organisation maintenance officer (if any)—the name of the entity or service operator undertaking the process;\n (i) if an evidence of identity process has been undertaken for the provider’s responsible officer and organisation maintenance officer (if any)—the name of the entity or service operator that undertook the process, the outcome of the process and when the process was undertaken;\n (j) the record that specifies the network address and technical requirements permitting electronic messages to be sent to the provider.\n\n> Note 1: Also see paragraph 7(2)(a) of the Act which states that the name of the healthcare provider is also identifying information.\n\n> Note 2: The following are examples of the type of support service a provider can provide:\n\n (a) a funded aged care service through the service group home support;\n (b) a service provided by a registered NDIS provider, such as behavioural intervention supports.\n\n> Note 3: Other identifying information may be required by the service operator from a healthcare provider—see section 7 of the Act.\n\n Identifying information—healthcare recipient\n (3) For the purposes of paragraph 7(3)(i) of the Act, the following information is identifying information of a healthcare recipient:\n (a) the telephone number of the healthcare recipient;\n (b) the electronic address of the healthcare recipient;\n (c) whether the identity of the healthcare recipient has been verified;\n (d) whether a healthcare identifier assigned to the healthcare recipient has been assigned provisionally (for example, because it has not been possible to verify the identity of the healthcare recipient);\n (e) if information relating to the identity of the healthcare recipient has been, or is to be, verified using a particular form of identification document (such as a driver’s licence or passport), details of that document, including:\n (i) the document number; and\n (ii) the State or Territory in which the document was issued; and\n (iii) the name of the entity that issued the document;\n (f) if information relating to the identity of the healthcare recipient has been, or is to be, verified by using a verification service, the response of that service to any verification inquiry in relation to the healthcare recipient;\n (g) whether the healthcare recipient is, or is likely to be, deceased;\n (h) whether the death of the healthcare recipient has been verified;\n (i) whether the healthcare recipient is a registered healthcare recipient for the purposes of the My Health Records Act;\n (j) whether the healthcare recipient is an authorised representative, or nominated representative, of another healthcare recipient, and the identity of the other healthcare recipient;\n (k) whether the healthcare recipient, or an authorised representative or nominated representative of the healthcare recipient, has made an election under clause 5 of Schedule 1 to the My Health Records Act that the healthcare recipient not be registered under that Act;\n (l) the name of the healthcare recipient’s birth mother;\n (m) the date of birth of the healthcare recipient’s birth mother;\n (n) the healthcare identifier assigned to the healthcare recipient’s birth mother.\n\n## Part 2—Collection, use and disclosure of identifying information and healthcare identifiers\n\n#### 9 Authorisation of collection, use and disclosure—healthcare provider assisting a healthcare recipient to register for a My Health Record\n\n (1) This section is made for the purposes of subsection 20(1) of the Act.\n (2) For the purposes of registering a healthcare recipient in the My Health Record system, a healthcare provider is authorised to do the following:\n (a) collect, from the healthcare recipient, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier of the healthcare recipient;\n (c) disclose, to the System Operator, the identifying information or healthcare identifier of the healthcare recipient.\n\n#### 9A Authorisation of collection, use and disclosure—facilitating healthcare recipient to self‑register for an active script list\n\n (1) This section is made for the purposes of subsection 20(1) of the Act.\n Authorisation of service operator\n (2) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, the service operator is authorised to do the following:\n (a) collect, from an active script list registry operator, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier to verify whether the healthcare recipient has a healthcare identifier;\n (c) disclose the healthcare recipient’s healthcare identifier to the active script list registry operator.\n Authorisation of active script list registry operators\n (3) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, an active script list registry operator is authorised to:\n (a) collect the healthcare recipient’s healthcare identifier from the service operator; and\n (b) use the healthcare recipient’s healthcare identifier to register the healthcare recipient for an active script list.\n (4) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, an active script list registry operator is authorised to:\n (a) collect, from the healthcare recipient, the healthcare recipient’s identifying information or healthcare identifier using a mobile prescription application via a mobile intermediary service or a web application; and\n (b) disclose the identifying information or healthcare identifier to the service operator to verify the healthcare recipient’s healthcare identifier.\n Authorisation of mobile prescription application service providers\n (5) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, a mobile prescription application service provider is authorised to do the following:\n (a) collect, from the healthcare recipient, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier of the healthcare recipient to facilitate the registration of the healthcare recipient for an active script list;\n (c) disclose the identifying information or healthcare identifier of the healthcare recipient to a mobile intermediary service operator to facilitate the registration of the healthcare recipient for an active script list.\n Authorisation of mobile intermediary service operators\n (6) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, a mobile intermediary service operator is authorised to do the following:\n (a) collect, from a mobile prescription application, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier of the healthcare recipient to facilitate the registration of the healthcare recipient for an active script list;\n (c) disclose the identifying information or healthcare identifier of the healthcare recipient to an active script list registry operator to facilitate the registration of the healthcare recipient for an active script list.\n\n#### 10A Collection, use and disclosure—healthcare provider and healthcare recipient information in relation to health facilitation program\n\n (1) This section is made for the purposes of subsections 20(1) and 25D(1) of the Act.\n (2) An entity mentioned in column 1 of an item in the following table is authorised to take action of the kind described in column 2 of that item with information of the kind described in column 3 of that item in the circumstances described in column 4 of that item.\n\n```html\n

Collection, use and disclosure of healthcare provider and healthcare recipient information in relation to health facilitation program

Item

Column 1
Entity

Column 2
Permitted action

Column 3
Information

Column 4
Circumstances

1

healthcare provider

use

disclose to an operator of a health facilitation program or the service operator

healthcare identifier of the healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the use or disclosure is for the purpose of:

(a) determining the healthcare provider’s eligibility to participate in a health facilitation program; or

(b) registering the provider or the healthcare recipient to participate in a health facilitation program; or

(c) the provider or the healthcare recipient participating in a health facilitation program; or

(d) if the provider has provided healthcare to healthcare recipients through a healthcare facilitation program—supporting continuity of healthcare to the healthcare recipients

2

healthcare provider

collect

use

healthcare identifier of another healthcare provider

the collection or use is for the purpose of:

(a) supporting the other provider’s participation in a health facilitation program; or

(b) if the healthcare provider has provided healthcare to healthcare recipients through a healthcare facilitation program—supporting continuity of healthcare to the healthcare recipients

3

operator of a health facilitation program

collect from a healthcare provider

use

disclose to another healthcare provider or the service operator

healthcare identifier of a healthcare provider

identifying information of a healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the collection, use or disclosure is for the purpose of:

(a) determining the healthcare provider’s eligibility to participate in the health facilitation program; or

(b) registering the provider or the healthcare recipient to participate in the program; or

(c) managing the provider’s or the healthcare recipient’s participation in the program; or

(d) supporting the other provider’s participation in the program; or

(e) if the provider has provided healthcare to healthcare recipients through the program—supporting continuity of healthcare to the healthcare recipients

4

service operator

collect from a healthcare provider or operator of a health facilitation program

use

disclose to an operator of a health facilitation program

healthcare identifier of the healthcare provider

identifying information of the healthcare provider

the collection, use or disclosure is for the purpose of determining the healthcare provider’s eligibility to participate in the health facilitation program

5

service operator

collect from a healthcare provider or operator of a health facilitation program

use

disclose to an operator of a health facilitation program

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the collection, use or disclosure is for the purpose of:

(a) registering the healthcare recipient to participate in the health facilitation program; or

(b) managing the healthcare recipient’s participation in the program

6

operator of a health facilitation program

collect from service operator

use

healthcare identifier of a healthcare provider

identifying information of a healthcare provider

the collection or use is for the purpose of determining the healthcare provider’s eligibility to participate in the health facilitation program

7

operator of a health facilitation program

use

disclose

healthcare identifier of a healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the use or disclosure is for the purpose of evaluation, analysis or reporting relating to whether the program is supporting the delivery of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients

8

entity to whom healthcare identifier of a healthcare provider, or healthcare identifier of a healthcare recipient, is disclosed for a purpose mentioned in column 4 of item 7

collect

use

disclose

healthcare identifier of a healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the collection, use or disclosure is for the purpose of evaluation, analysis or reporting relating to whether a health facilitation program is supporting the delivery of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients

\n```\n\n#### 10B Adopting the healthcare identifier of a healthcare provider or healthcare recipient—health facilitation program\n\n (1) This section is made for the purposes of subsections 20(2) and 25D(2) of the Act.\n (2) An operator of a health facilitation program may adopt the healthcare identifier of a healthcare provider for use as the operator’s own identifier for the purposes of the health facilitation program.\n (3) An operator of a health facilitation program may adopt the healthcare identifier of a healthcare recipient for use as the operator’s own identifier for the purposes of the health facilitation program.\n\n## Part 3—Requests by healthcare provider organisations and healthcare support service providers to access healthcare identifiers\n\n#### 11 Details of responsible officer and organisation maintenance officer\n\n (1) This section is made for the purposes of subsections 20(4) and 25D(4) of the Act.\n Healthcare provider organisations\n (2) A healthcare provider organisation must not request the service operator to disclose a healthcare identifier to the organisation, unless:\n (a) the identity of the organisation’s responsible officer and the identity of the organisation maintenance officer have been verified through an evidence of identity process; and\n (b) information in relation to those officers of the kind mentioned in paragraphs 8(2)(e) to (j) of this instrument has been given to the service operator; and\n (c) the information is accurate, up to date and complete.\n (3) If:\n (a) the service operator receives a request to disclose a healthcare identifier from a healthcare provider organisation; and\n (b) the request was made in contravention of subsection (2);\n the service operator must refuse to comply with the request.\n Healthcare support service providers\n (4) A healthcare support service provider must not request the service operator to disclose a healthcare identifier to the provider, unless:\n (a) the identity of the organisation’s responsible officer and the identity of the organisation maintenance officer (if any) have been verified through an evidence of identity process; and\n (b) information in relation to those officers of the kind mentioned in paragraphs 8(2A)(d) to (i) of this instrument has been given to the service operator; and\n (c) the information is accurate, up to date and complete.\n (5) If:\n (a) the service operator receives a request to disclose a healthcare identifier from a healthcare support service provider; and\n (b) the request was made in contravention of subsection (4);\n the service operator must refuse to comply with the request.\n\n#### 12 Identity of individual making request\n\n (1) This section is made for the purposes of subsections 20(4) and (5), and 25D(4) and (5), of the Act.\n Information identifying individual making a request\n (2) If a healthcare provider or health administration entity requests the service operator to disclose a healthcare identifier to the provider or entity, the provider or entity must, if it is reasonably practicable to do so, give the service operator enough information to ensure the service operator can identify, by name, the individual making the request on behalf of the provider or entity without having to seek further information.\n\n> Note: For example, the information may be given as part of the data transmitted to the service operator from a healthcare provider or health administration entity’s practice management software.\n\n Keeping retrievable records\n (3) If it is not reasonably practicable to give the service operator the information mentioned in subsection (2) at the time the request is made, the healthcare provider or health administration entity must:\n (a) keep a record of the identity of the individual who accessed the healthcare identifier for the provider or entity from the service operator; and\n (b) keep that record for the retrieval period for that individual; and\n (c) if, during the retrieval period for that individual, the service operator gives the provider or entity written notice requiring the provider or entity to identify the individual—identify the individual to the service operator by the end of the period of 14 days starting on the day after the notice is given.\n (4) Each of the following is a retrieval period for an individual:\n (a) any period during which the individual is authorised by the healthcare provider or health administration entity to access healthcare identifiers on the provider or entity’s behalf;\n (b) if the individual ceases to be authorised by the healthcare provider or health administration entity to access healthcare identifiers on the provider or entity’s behalf—the period of 7 years starting on the day after the person ceased to be authorised.\n (5) A healthcare provider or health administration entity is liable to a civil penalty if the provider or entity contravenes subsection (2) or (3).\n\nCivil penalty: 50 penalty units.\n\n## Part 4—Application, saving and transitional provisions\n\n### Division 1—Application, saving and transitional provisions in relation to the commencement of this instrument\n\n#### 13 Definitions\n\n In this Division:\n\n> commencement day means the day this instrument commences.\n\n> old regulations means the Healthcare Identifiers Regulations 2010, as in force immediately before the commencement day.\n\n#### 14 Things done under the old regulations\n\n (1) If:\n (a) a thing was done for a particular purpose under the old regulations; and\n (b) the thing could be done for that purpose under this instrument;\n the thing has effect for the purposes of this instrument as if it had been done for that purpose under this instrument.\n (2) Without limiting subsection (1), a reference in that subsection to a thing being done includes a reference to a notice, request or other instrument being given or made.\n\n#### 16 Continued operation of certain provisions not affected\n\n (1) The repeal of the old regulations by this instrument does not affect the continuing operation of a provision of a version of the Healthcare Identifiers Regulations 2010 that was not in force immediately before the commencement day if, immediately before that day, the provision had continuing operation because of Schedule 1 to the old regulations.\n (2) This section does not limit the effect of section 7 of the Acts Interpretation Act 1901 (as it applies as a result of paragraph 13(1)(a) of the Legislation Act 2003).\n\n### Division 2—Application of the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025\n\n#### 17 Application of the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025\n\n (1) Section 9A, as inserted by the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025, applies in relation to the use and disclosure of information on or after the commencement of that instrument, regardless of whether the information was collected before, on or after that commencement.\n (2) This section does not limit the application of section 9A.\n\n### Division 3—Application of the Aged Care Legislation Consequential Amendments Regulations 2025\n\n#### 18 Use and disclosure of healthcare identifier of a healthcare provider disclosed before commencement\n\n (1) This section applies if a disclosure of the healthcare identifier of a healthcare provider is made to another entity under subsection 10(2) of this instrument, as in force before the commencement of this section.\n (2) Despite the repeal of section 10 of this instrument by the Aged Care Legislation Consequential Amendments Regulations 2025, subsection (3) of that section continues to apply to the other entity, in relation to the healthcare identifier of the healthcare provider, as if that repeal had not happened.\n\n#### 19 Use and disclosure of healthcare identifier of a healthcare provider or healthcare recipient\n\n (1) Section 10A, as amended by the Aged Care Legislation Consequential Amendments Regulations 2025, applies in relation to the use and disclosure of information on or after the commencement of that instrument, regardless of whether the information was collected before, on or after that commencement.\n (2) This section does not limit the application of section 10A.\n\n#### 20 Requests for disclosure of healthcare identifiers\n\n Section 12, as substituted by the Aged Care Legislation Consequential Amendments Regulations 2025, applies in relation to a request made on or after the commencement of that instrument.","sortOrder":20},{"sectionNumber":"17","sectionType":"section","heading":"Application of the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025","content":"#### 17 Application of the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025\n\n (1) Section 9A, as inserted by the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025, applies in relation to the use and disclosure of information on or after the commencement of that instrument, regardless of whether the information was collected before, on or after that commencement.\n (2) This section does not limit the application of section 9A.","sortOrder":21},{"sectionNumber":"Division 3","sectionType":"division","heading":"Application of the Aged Care Legislation Consequential Amendments Regulations 2025","content":"## Part 1—Preliminary\n\n#### 1 Name\n\n This instrument is the Healthcare Identifiers Regulations 2020.\n\n#### 3 Authority\n\n This instrument is made under the Healthcare Identifiers Act 2010.\n\n#### 5 Definitions\n\n> Note: A number of expressions used in this instrument are defined in the Act, including the following:\n\n (a) healthcare provider organisation;\n (b) individual healthcare provider;\n (c) organisation maintenance officer;\n (d) responsible officer.\n In this instrument:\n\n> ABN has the meaning given by section 41 of the A New Tax System (Australian Business Number) Act 1999.\n\n> ACN has the same meaning as in the Corporations Act 2001.\n\n> Act means the Healthcare Identifiers Act 2010.\n\n> active script list means a prescription management system for healthcare recipients.\n\n> active script list registry means a system that provides services for, and provides for the management of, active script lists for healthcare recipients, including (but not limited to) the following:\n\n (a) facilitating a healthcare recipient to register for an active script list;\n (b) storing information submitted by a healthcare recipient, using a mobile or web application, during the registration process;\n (c) adding prescriptions, dispensing records and notifications to the active script list of a healthcare recipient;\n (d) enabling viewing of a healthcare recipient’s active prescriptions and tokens so they can be used to dispense electronic prescriptions for the healthcare recipient;\n (e) allowing mobile application vendors to provide mobile prescription applications.\n\n> active script list registry operator means an entity that operates an active script list registry.\n\n> electronic prescription has the same meaning as in the National Health (Pharmaceutical Benefits) Regulations 2017.\n\n> evidence of identity process means:\n\n (a) in relation to a healthcare provider organisation—the process to confirm the identity of the healthcare provider organisation’s responsible officer and organisation maintenance officer undertaken by:\n (i) if the responsible officer or organisation maintenance officer is an individual healthcare provider who is registered by a registration authority as a member of a health profession—the Australian Health Practitioner Regulation Agency established by the National Law; or\n (ii) in any other case—the service operator; or\n (b) in relation to a healthcare support service provider—the process to confirm the identity of the healthcare support service provider’s responsible officer, and organisation maintenance officer (if any), undertaken by one or more of the following:\n (i) the Aged Care Department;\n (ii) the National Disability Insurance Agency;\n (iii) the service operator;\n (iv) an entity prescribed for the purposes of column 1 of item 6 of the table in section 21 of the Act.\n\n> health facilitation program means a program that is operated or funded by one or more government bodies and that facilitates the provision of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients.\n\n> mobile intermediary service means a service that provides connection services for mobile prescription applications for the purpose of facilitating electronic prescriptions.\n\n> mobile prescription application means an application that enables a healthcare recipient to do either or both of the following:\n\n (a) to manage the healthcare recipient’s prescriptions using a mobile phone or other personal electronic device;\n (b) to view, and manage access to, the healthcare recipient’s active script list.\n\n> mobile prescription application service provider means an entity that operates and/or provides a mobile prescription application.\n\n> My Health Records Act means the My Health Records Act 2012.\n\n> National Law has the same meaning as in the My Health Records Act.\n\n> operator of a health facilitation program means the body, or any of the bodies, that operates the program.\n\n> System Operator has the same meaning as in the My Health Records Act.\n\n> token means a piece of information used to identify and access an electronic prescription or repeat authorisation.\n\n> verification service means a service (whether operated electronically or otherwise) that allows an entity to compare information relating to the identity of an entity with a government record.\n\n#### 6 Application of this instrument to partnerships, trusts and unincorporated associations\n\n To avoid doubt, sections 36B, 36C and 36D of the Act apply to this instrument, and obligations, offences and civil penalty provisions in this instrument, in the same way as they apply to the Act, and obligations, offences and civil penalty provisions in the Act.\n\n#### 7 National registration authorities\n\n For the purposes of section 8 of the Act, each of the following registration authorities is a national registration authority:\n (a) a National Health Practitioner Board established by the National Law;\n (b) if it is authorised under the National Law to assign healthcare identifiers to healthcare providers—the Australian Health Practitioner Regulation Agency established by the National Law.\n\n#### 8 Identifying information\n\n Identifying information—individual healthcare provider\n (1) For the purposes of paragraph 7(1)(g) of the Act, the following information is identifying information of an individual healthcare provider:\n (a) whether the healthcare provider is registered with a registration authority and the status of that registration (such as conditional, suspended, cancelled or lapsed);\n (b) whether the healthcare provider is represented by a professional body of a kind described in paragraph 9A(1)(b) of the Act and the status (such as conditional, suspended, cancelled or lapsed) of the credentials that are:\n (i) provided through the professional body to the healthcare provider; and\n (ii) required to practice the healthcare provider’s healthcare profession;\n (c) whether the healthcare provider is, or is likely to be, deceased;\n (d) whether the death of the healthcare provider has been verified;\n (e) whether the healthcare provider is linked to a healthcare provider organisation and, if so, the name of the organisation and the ABN or ACN of the organisation (whichever is applicable).\n Identifying information—healthcare provider organisation\n (2) For the purposes of paragraph 7(2)(e) of the Act, the following information is identifying information of a healthcare provider organisation:\n (a) whether the organisation is registered under Division 2 of Part 3 of the My Health Records Act;\n (b) whether the organisation has notified the service operator that the organisation does not wish to use a healthcare identifier, either temporarily or permanently;\n (c) if applicable, the organisation’s business name on the register established under section 22 of the Business Names Registration Act 2011;\n\nNote: Also see paragraph 7(2)(a) of the Act which states that the name of the healthcare provider is also identifying information.\n\n (d) the type of healthcare service the organisation provides to another healthcare provider or a healthcare recipient;\n\nNote: Examples of the type of healthcare service an organisation provides include general practice services, public hospital services or diagnostic imaging services.\n\n (e) the name, date of birth and date of death (if applicable) of the organisation’s responsible officer and organisation maintenance officer;\n (f) the work address, email address, telephone number and fax number of the organisation’s responsible officer and organisation maintenance officer;\n (g) the identifying number assigned to the organisation’s responsible officer and organisation maintenance officer by the service operator;\n (h) whether an evidence of identity process has been undertaken for the organisation’s responsible officer and organisation maintenance officer;\n (i) if an evidence of identity process is being undertaken for the organisation’s responsible officer and organisation maintenance officer—the name of the agency or service operator undertaking the process;\n (j) if an evidence of identity process has been undertaken for the organisation’s responsible officer and organisation maintenance officer—the name of the agency or service operator that undertook the process, the outcome of the process and when the process was undertaken;\n (k) the record that specifies the network address and technical requirements permitting electronic messages to be sent to the organisation;\n (l) any other network organisation or seed organisation (within the meaning of section 9A of the Act) that the healthcare provider organisation is linked to in a network;\n (m) whether any individual healthcare providers are linked to the organisation and, if so, the names and other identifying information of those individual healthcare providers.\n\n> Note: Other identifying information may be required by the service operator from a healthcare provider—see section 7 of the Act.\n\n Identifying information—healthcare support service providers\n (2A) For the purposes of paragraph 7(2)(e) of the Act, the following information is identifying information of a healthcare support service provider:\n (a) whether the provider has notified the service operator that the provider does not wish to use a healthcare identifier, either temporarily or permanently;\n (b) if applicable, the provider’s business name on the register established under section 22 of the Business Names Registration Act 2011;\n (c) the type of healthcare or support service the provider provides to a healthcare recipient;\n (d) the name, date of birth and date of death (if applicable) of the provider’s responsible officer and organisation maintenance officer (if any);\n (e) the work address, email address, telephone number and fax number of the provider’s responsible officer and organisation maintenance officer (if any);\n (f) the identifying number assigned to the provider’s responsible officer and organisation maintenance officer (if any) by the service operator;\n (g) whether an evidence of identity process has been undertaken for the provider’s responsible officer and organisation maintenance officer (if any);\n (h) if an evidence of identity process is being undertaken for the provider’s responsible officer and organisation maintenance officer (if any)—the name of the entity or service operator undertaking the process;\n (i) if an evidence of identity process has been undertaken for the provider’s responsible officer and organisation maintenance officer (if any)—the name of the entity or service operator that undertook the process, the outcome of the process and when the process was undertaken;\n (j) the record that specifies the network address and technical requirements permitting electronic messages to be sent to the provider.\n\n> Note 1: Also see paragraph 7(2)(a) of the Act which states that the name of the healthcare provider is also identifying information.\n\n> Note 2: The following are examples of the type of support service a provider can provide:\n\n (a) a funded aged care service through the service group home support;\n (b) a service provided by a registered NDIS provider, such as behavioural intervention supports.\n\n> Note 3: Other identifying information may be required by the service operator from a healthcare provider—see section 7 of the Act.\n\n Identifying information—healthcare recipient\n (3) For the purposes of paragraph 7(3)(i) of the Act, the following information is identifying information of a healthcare recipient:\n (a) the telephone number of the healthcare recipient;\n (b) the electronic address of the healthcare recipient;\n (c) whether the identity of the healthcare recipient has been verified;\n (d) whether a healthcare identifier assigned to the healthcare recipient has been assigned provisionally (for example, because it has not been possible to verify the identity of the healthcare recipient);\n (e) if information relating to the identity of the healthcare recipient has been, or is to be, verified using a particular form of identification document (such as a driver’s licence or passport), details of that document, including:\n (i) the document number; and\n (ii) the State or Territory in which the document was issued; and\n (iii) the name of the entity that issued the document;\n (f) if information relating to the identity of the healthcare recipient has been, or is to be, verified by using a verification service, the response of that service to any verification inquiry in relation to the healthcare recipient;\n (g) whether the healthcare recipient is, or is likely to be, deceased;\n (h) whether the death of the healthcare recipient has been verified;\n (i) whether the healthcare recipient is a registered healthcare recipient for the purposes of the My Health Records Act;\n (j) whether the healthcare recipient is an authorised representative, or nominated representative, of another healthcare recipient, and the identity of the other healthcare recipient;\n (k) whether the healthcare recipient, or an authorised representative or nominated representative of the healthcare recipient, has made an election under clause 5 of Schedule 1 to the My Health Records Act that the healthcare recipient not be registered under that Act;\n (l) the name of the healthcare recipient’s birth mother;\n (m) the date of birth of the healthcare recipient’s birth mother;\n (n) the healthcare identifier assigned to the healthcare recipient’s birth mother.\n\n## Part 2—Collection, use and disclosure of identifying information and healthcare identifiers\n\n#### 9 Authorisation of collection, use and disclosure—healthcare provider assisting a healthcare recipient to register for a My Health Record\n\n (1) This section is made for the purposes of subsection 20(1) of the Act.\n (2) For the purposes of registering a healthcare recipient in the My Health Record system, a healthcare provider is authorised to do the following:\n (a) collect, from the healthcare recipient, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier of the healthcare recipient;\n (c) disclose, to the System Operator, the identifying information or healthcare identifier of the healthcare recipient.\n\n#### 9A Authorisation of collection, use and disclosure—facilitating healthcare recipient to self‑register for an active script list\n\n (1) This section is made for the purposes of subsection 20(1) of the Act.\n Authorisation of service operator\n (2) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, the service operator is authorised to do the following:\n (a) collect, from an active script list registry operator, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier to verify whether the healthcare recipient has a healthcare identifier;\n (c) disclose the healthcare recipient’s healthcare identifier to the active script list registry operator.\n Authorisation of active script list registry operators\n (3) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, an active script list registry operator is authorised to:\n (a) collect the healthcare recipient’s healthcare identifier from the service operator; and\n (b) use the healthcare recipient’s healthcare identifier to register the healthcare recipient for an active script list.\n (4) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, an active script list registry operator is authorised to:\n (a) collect, from the healthcare recipient, the healthcare recipient’s identifying information or healthcare identifier using a mobile prescription application via a mobile intermediary service or a web application; and\n (b) disclose the identifying information or healthcare identifier to the service operator to verify the healthcare recipient’s healthcare identifier.\n Authorisation of mobile prescription application service providers\n (5) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, a mobile prescription application service provider is authorised to do the following:\n (a) collect, from the healthcare recipient, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier of the healthcare recipient to facilitate the registration of the healthcare recipient for an active script list;\n (c) disclose the identifying information or healthcare identifier of the healthcare recipient to a mobile intermediary service operator to facilitate the registration of the healthcare recipient for an active script list.\n Authorisation of mobile intermediary service operators\n (6) For the purposes of facilitating the provision of adequate and appropriate healthcare to a healthcare recipient, a mobile intermediary service operator is authorised to do the following:\n (a) collect, from a mobile prescription application, the identifying information or healthcare identifier of the healthcare recipient;\n (b) use the identifying information or healthcare identifier of the healthcare recipient to facilitate the registration of the healthcare recipient for an active script list;\n (c) disclose the identifying information or healthcare identifier of the healthcare recipient to an active script list registry operator to facilitate the registration of the healthcare recipient for an active script list.\n\n#### 10A Collection, use and disclosure—healthcare provider and healthcare recipient information in relation to health facilitation program\n\n (1) This section is made for the purposes of subsections 20(1) and 25D(1) of the Act.\n (2) An entity mentioned in column 1 of an item in the following table is authorised to take action of the kind described in column 2 of that item with information of the kind described in column 3 of that item in the circumstances described in column 4 of that item.\n\n```html\n

Collection, use and disclosure of healthcare provider and healthcare recipient information in relation to health facilitation program

Item

Column 1
Entity

Column 2
Permitted action

Column 3
Information

Column 4
Circumstances

1

healthcare provider

use

disclose to an operator of a health facilitation program or the service operator

healthcare identifier of the healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the use or disclosure is for the purpose of:

(a) determining the healthcare provider’s eligibility to participate in a health facilitation program; or

(b) registering the provider or the healthcare recipient to participate in a health facilitation program; or

(c) the provider or the healthcare recipient participating in a health facilitation program; or

(d) if the provider has provided healthcare to healthcare recipients through a healthcare facilitation program—supporting continuity of healthcare to the healthcare recipients

2

healthcare provider

collect

use

healthcare identifier of another healthcare provider

the collection or use is for the purpose of:

(a) supporting the other provider’s participation in a health facilitation program; or

(b) if the healthcare provider has provided healthcare to healthcare recipients through a healthcare facilitation program—supporting continuity of healthcare to the healthcare recipients

3

operator of a health facilitation program

collect from a healthcare provider

use

disclose to another healthcare provider or the service operator

healthcare identifier of a healthcare provider

identifying information of a healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the collection, use or disclosure is for the purpose of:

(a) determining the healthcare provider’s eligibility to participate in the health facilitation program; or

(b) registering the provider or the healthcare recipient to participate in the program; or

(c) managing the provider’s or the healthcare recipient’s participation in the program; or

(d) supporting the other provider’s participation in the program; or

(e) if the provider has provided healthcare to healthcare recipients through the program—supporting continuity of healthcare to the healthcare recipients

4

service operator

collect from a healthcare provider or operator of a health facilitation program

use

disclose to an operator of a health facilitation program

healthcare identifier of the healthcare provider

identifying information of the healthcare provider

the collection, use or disclosure is for the purpose of determining the healthcare provider’s eligibility to participate in the health facilitation program

5

service operator

collect from a healthcare provider or operator of a health facilitation program

use

disclose to an operator of a health facilitation program

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the collection, use or disclosure is for the purpose of:

(a) registering the healthcare recipient to participate in the health facilitation program; or

(b) managing the healthcare recipient’s participation in the program

6

operator of a health facilitation program

collect from service operator

use

healthcare identifier of a healthcare provider

identifying information of a healthcare provider

the collection or use is for the purpose of determining the healthcare provider’s eligibility to participate in the health facilitation program

7

operator of a health facilitation program

use

disclose

healthcare identifier of a healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the use or disclosure is for the purpose of evaluation, analysis or reporting relating to whether the program is supporting the delivery of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients

8

entity to whom healthcare identifier of a healthcare provider, or healthcare identifier of a healthcare recipient, is disclosed for a purpose mentioned in column 4 of item 7

collect

use

disclose

healthcare identifier of a healthcare provider

healthcare identifier of a healthcare recipient

identifying information of a healthcare recipient

the collection, use or disclosure is for the purpose of evaluation, analysis or reporting relating to whether a health facilitation program is supporting the delivery of adequate and appropriate healthcare to healthcare recipients, or a class of healthcare recipients

\n```\n\n#### 10B Adopting the healthcare identifier of a healthcare provider or healthcare recipient—health facilitation program\n\n (1) This section is made for the purposes of subsections 20(2) and 25D(2) of the Act.\n (2) An operator of a health facilitation program may adopt the healthcare identifier of a healthcare provider for use as the operator’s own identifier for the purposes of the health facilitation program.\n (3) An operator of a health facilitation program may adopt the healthcare identifier of a healthcare recipient for use as the operator’s own identifier for the purposes of the health facilitation program.\n\n## Part 3—Requests by healthcare provider organisations and healthcare support service providers to access healthcare identifiers\n\n#### 11 Details of responsible officer and organisation maintenance officer\n\n (1) This section is made for the purposes of subsections 20(4) and 25D(4) of the Act.\n Healthcare provider organisations\n (2) A healthcare provider organisation must not request the service operator to disclose a healthcare identifier to the organisation, unless:\n (a) the identity of the organisation’s responsible officer and the identity of the organisation maintenance officer have been verified through an evidence of identity process; and\n (b) information in relation to those officers of the kind mentioned in paragraphs 8(2)(e) to (j) of this instrument has been given to the service operator; and\n (c) the information is accurate, up to date and complete.\n (3) If:\n (a) the service operator receives a request to disclose a healthcare identifier from a healthcare provider organisation; and\n (b) the request was made in contravention of subsection (2);\n the service operator must refuse to comply with the request.\n Healthcare support service providers\n (4) A healthcare support service provider must not request the service operator to disclose a healthcare identifier to the provider, unless:\n (a) the identity of the organisation’s responsible officer and the identity of the organisation maintenance officer (if any) have been verified through an evidence of identity process; and\n (b) information in relation to those officers of the kind mentioned in paragraphs 8(2A)(d) to (i) of this instrument has been given to the service operator; and\n (c) the information is accurate, up to date and complete.\n (5) If:\n (a) the service operator receives a request to disclose a healthcare identifier from a healthcare support service provider; and\n (b) the request was made in contravention of subsection (4);\n the service operator must refuse to comply with the request.\n\n#### 12 Identity of individual making request\n\n (1) This section is made for the purposes of subsections 20(4) and (5), and 25D(4) and (5), of the Act.\n Information identifying individual making a request\n (2) If a healthcare provider or health administration entity requests the service operator to disclose a healthcare identifier to the provider or entity, the provider or entity must, if it is reasonably practicable to do so, give the service operator enough information to ensure the service operator can identify, by name, the individual making the request on behalf of the provider or entity without having to seek further information.\n\n> Note: For example, the information may be given as part of the data transmitted to the service operator from a healthcare provider or health administration entity’s practice management software.\n\n Keeping retrievable records\n (3) If it is not reasonably practicable to give the service operator the information mentioned in subsection (2) at the time the request is made, the healthcare provider or health administration entity must:\n (a) keep a record of the identity of the individual who accessed the healthcare identifier for the provider or entity from the service operator; and\n (b) keep that record for the retrieval period for that individual; and\n (c) if, during the retrieval period for that individual, the service operator gives the provider or entity written notice requiring the provider or entity to identify the individual—identify the individual to the service operator by the end of the period of 14 days starting on the day after the notice is given.\n (4) Each of the following is a retrieval period for an individual:\n (a) any period during which the individual is authorised by the healthcare provider or health administration entity to access healthcare identifiers on the provider or entity’s behalf;\n (b) if the individual ceases to be authorised by the healthcare provider or health administration entity to access healthcare identifiers on the provider or entity’s behalf—the period of 7 years starting on the day after the person ceased to be authorised.\n (5) A healthcare provider or health administration entity is liable to a civil penalty if the provider or entity contravenes subsection (2) or (3).\n\nCivil penalty: 50 penalty units.\n\n## Part 4—Application, saving and transitional provisions\n\n### Division 1—Application, saving and transitional provisions in relation to the commencement of this instrument\n\n#### 13 Definitions\n\n In this Division:\n\n> commencement day means the day this instrument commences.\n\n> old regulations means the Healthcare Identifiers Regulations 2010, as in force immediately before the commencement day.\n\n#### 14 Things done under the old regulations\n\n (1) If:\n (a) a thing was done for a particular purpose under the old regulations; and\n (b) the thing could be done for that purpose under this instrument;\n the thing has effect for the purposes of this instrument as if it had been done for that purpose under this instrument.\n (2) Without limiting subsection (1), a reference in that subsection to a thing being done includes a reference to a notice, request or other instrument being given or made.\n\n#### 16 Continued operation of certain provisions not affected\n\n (1) The repeal of the old regulations by this instrument does not affect the continuing operation of a provision of a version of the Healthcare Identifiers Regulations 2010 that was not in force immediately before the commencement day if, immediately before that day, the provision had continuing operation because of Schedule 1 to the old regulations.\n (2) This section does not limit the effect of section 7 of the Acts Interpretation Act 1901 (as it applies as a result of paragraph 13(1)(a) of the Legislation Act 2003).\n\n### Division 2—Application of the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025\n\n#### 17 Application of the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025\n\n (1) Section 9A, as inserted by the Healthcare Identifiers Amendment (Active Script List Registration) Regulations 2025, applies in relation to the use and disclosure of information on or after the commencement of that instrument, regardless of whether the information was collected before, on or after that commencement.\n (2) This section does not limit the application of section 9A.\n\n### Division 3—Application of the Aged Care Legislation Consequential Amendments Regulations 2025\n\n#### 18 Use and disclosure of healthcare identifier of a healthcare provider disclosed before commencement\n\n (1) This section applies if a disclosure of the healthcare identifier of a healthcare provider is made to another entity under subsection 10(2) of this instrument, as in force before the commencement of this section.\n (2) Despite the repeal of section 10 of this instrument by the Aged Care Legislation Consequential Amendments Regulations 2025, subsection (3) of that section continues to apply to the other entity, in relation to the healthcare identifier of the healthcare provider, as if that repeal had not happened.\n\n#### 19 Use and disclosure of healthcare identifier of a healthcare provider or healthcare recipient\n\n (1) Section 10A, as amended by the Aged Care Legislation Consequential Amendments Regulations 2025, applies in relation to the use and disclosure of information on or after the commencement of that instrument, regardless of whether the information was collected before, on or after that commencement.\n (2) This section does not limit the application of section 10A.\n\n#### 20 Requests for disclosure of healthcare identifiers\n\n Section 12, as substituted by the Aged Care Legislation Consequential Amendments Regulations 2025, applies in relation to a request made on or after the commencement of that instrument.","sortOrder":22},{"sectionNumber":"18","sectionType":"section","heading":"Use and disclosure of healthcare identifier of a healthcare provider disclosed before commencement","content":"#### 18 Use and disclosure of healthcare identifier of a healthcare provider disclosed before commencement\n\n (1) This section applies if a disclosure of the healthcare identifier of a healthcare provider is made to another entity under subsection 10(2) of this instrument, as in force before the commencement of this section.\n (2) Despite the repeal of section 10 of this instrument by the Aged Care Legislation Consequential Amendments Regulations 2025, subsection (3) of that section continues to apply to the other entity, in relation to the healthcare identifier of the healthcare provider, as if that repeal had not happened.","sortOrder":23},{"sectionNumber":"19","sectionType":"section","heading":"Use and disclosure of healthcare identifier of a healthcare provider or healthcare recipient","content":"#### 19 Use and disclosure of healthcare identifier of a healthcare provider or healthcare recipient\n\n (1) Section 10A, as amended by the Aged Care Legislation Consequential Amendments Regulations 2025, applies in relation to the use and disclosure of information on or after the commencement of that instrument, regardless of whether the information was collected before, on or after that commencement.\n (2) This section does not limit the application of section 10A.","sortOrder":24},{"sectionNumber":"20","sectionType":"section","heading":"Requests for disclosure of healthcare identifiers","content":"#### 20 Requests for disclosure of healthcare identifiers\n\n Section 12, as substituted by the Aged Care Legislation Consequential Amendments Regulations 2025, applies in relation to a request made on or after the commencement of that instrument.","sortOrder":25}],"analysis":{"kimi_summary":{"_metrics":{"completionTokens":632},"content_quality":"ok","complexity_score":7,"scope_assessment":{"changed":true,"description":"The original 2020 regulations have expanded significantly through amendments. Section 9A (active script list registration) was added by the 2025 Amendment Regulations, and Division 3 of Part 4 contains extensive transitional provisions dealing with the Aged Care Legislation Consequential Amendments Regulations 2025. The scope now covers digital prescription management systems and aged care integration, going well beyond the original healthcare identifier framework."},"complexity_factors":["Extensive cross-referencing to the Healthcare Identifiers Act 2010, My Health Records Act 2012, Corporations Act 2001 and other legislation","Multiple nested definitions with conditional branches (e.g., 'evidence of identity process' has different rules depending on entity type and officer status)","Detailed tabular authorisation scheme in section 10A with 8 rows specifying different entities, actions, information types and circumstances","Duplicated content throughout the instrument (the full text appears to be repeated multiple times in the source)","Transitional provisions dealing with multiple amending instruments and their interaction with the principal regulations","Civil penalty provisions with specific retrieval periods and record-keeping requirements"],"plain_english_summary":"This regulation governs how healthcare identifiers are collected, used and shared in Australia, defining what counts as identifying information for patients, clinicians and organisations and authorising uses such as My Health Record registration, active script lists and health facilitation programs.\n\nIt requires identity verification for organisation officers and audit trails for identifier requests (with penalties), affecting patients, providers, hospitals, aged‑care/NDIS/support services, the service operator and prescription app and registry operators — balancing data‑sharing efficiency with protections for sensitive personal information."},"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"},"flash_summary":{"complexity_score":7,"scope_assessment":{"changed":true,"description":"This instrument extends the practical scope of rules governing healthcare identifiers beyond the narrow task of assigning and disclosing identifiers for My Health Record registration. Notable scope expansions: (a) it creates an express legal pathway for active script list registration and authorises mobile prescription applications and intermediary services to collect, use and disclose healthcare identifiers (cl.9A); (b) it authorises collection, use and disclosure of identifiers and identifying information by operators of government‑funded \"health facilitation programs\" for eligibility, registration, management and evaluation purposes, and allows those operators to adopt existing healthcare identifiers as their own (cls 10A–10B); and (c) it introduces transitional rules to preserve and manage the effects of later amendment instruments (Part 4, cls 17–20). Those additions broaden who may legally handle identifiers (commercial app vendors, intermediaries, program operators) and for what purposes (prescription management and program administration/evaluation), expanding the original operational footprint of the Healthcare Identifiers regime."},"complexity_factors":["Extensive definition section (reg 5) introducing ~20+ specialised defined terms used throughout (e.g. active script list, mobile intermediary service, evidence of identity process)","Multiple cross‑references to other statutes and instruments (Healthcare Identifiers Act 2010, My Health Records Act 2012, National Law, National Health (Pharmaceutical Benefits) Regulations 2017, Aged Care and NDIS agencies)","Nested authorisations with multiple actors and role‑specific permissions (cl.9A authorises service operators, registry operators, mobile app providers and intermediaries in separate subclauses)","A long multi‑row permissions table in cl.10A with distinct permitted actions and circumstances across eight items (adds conditional complexity for program operators, service operators and third parties)","Procedural conditions and exceptions (evidence of identity requirements in cl.11; recordkeeping and retrieval periods with different time triggers in cl.12)","Transitional and savings provisions plus explicit application of later amending instruments (Part 4, cls 13–20), increasing interpretive complexity across versions","Civil penalty attached (cl.12(5)) with a non‑trivial unit amount (50 penalty units) requiring administrators to map compliance risk to enforcement","Repeated and overlapping text across Parts (verbatim repetition in the provided copy) increases reading burden though not substantive novelty"],"plain_english_summary":"**What this instrument does (mechanically)\n\n- Establishes definitions and rules about what counts as identifying information and who may collect, use or disclose healthcare identifiers (see regs 5 and 8).\n- Authorises specific actors to collect, use and disclose healthcare identifiers or identifying information for narrowly stated purposes: registering people in My Health Record (cl.9), registering people for an \"active script list\" (cl.9A), and operating or evaluating government‑funded \"health facilitation programs\" (cl.10A). It also allows operators of those programs to adopt an existing healthcare identifier as their own identifier (cl.10B).\n- Imposes procedural preconditions before organisations can ask the System Operator for identifiers: verification of responsible officers through an \"evidence of identity\" process and provision of specified officer details (cl.11).\n- Requires health providers and health administration entities to supply, or be able to supply on request, the name of the individual making an identifier request and to retain records of who accessed identifiers for defined retention periods; failure to comply attracts a civil penalty (cl.12).\n- Contains transitional and savings provisions letting things done under the old 2010 regulations continue to have effect, and specifies how later amending instruments (notably the Active Script List Registration and Aged Care consequential amendments) interact with these regs (Div.1 & Divs.2–3 of Part 4).\n\nWho it affects\n\n- Patients/healthcare recipients: their identifying information and healthcare identifiers may be collected and shared by a range of actors for registration and program purposes (see cl.8 and cls 9, 9A, 10A).\n- Individual healthcare providers and healthcare provider organisations: the regs list what identifying information may be held and shared about them (cl.8) and require organisations to verify key officers before requesting identifiers (cl.11).\n- Service operator (System Operator) and entities that operate registries, mobile prescription apps and intermediary services: they are explicitly authorised to collect, use and disclose identifiers for active script list registration and related functions (cl.9A).\n- Operators and administrators of government‑funded health facilitation programs: they can collect, use, disclose and adopt identifiers for program administration and evaluation (cls 10A–10B).\n- Third‑party software vendors and intermediaries (mobile prescription app providers, mobile intermediary services, active script list registry operators): given authorisations in cl.9A, these commercial actors can participate in collection and verification flows.\n\nWhy it matters (stated purposes and practical consequences)\n\n- Official purpose-claims: the regulations repeatedly state they are intended to facilitate registration for My Health Record, enable electronic prescription/active script list registration, and support the operation, eligibility checking, enrolment and evaluation of \"health facilitation programs\" that facilitate adequate and appropriate healthcare (see cl.9, cl.9A and cl.10A).\n\n- Testing those claims against costs and trade‑offs:\n - Administrative and compliance costs fall mainly on healthcare provider organisations and health administration entities: they must verify responsible officers (an identity‑verification step described in the regulations), keep and produce records of who accessed identifiers, and ensure accuracy of data provided to the System Operator (cl.11–12). Small providers may face proportionally higher costs.\n - Privacy and security risks increase because the regs expand the classes of authorised actors who may handle identifiers: active script list registries, mobile app providers, intermediaries and program operators are expressly authorised to collect, use and disclose identifiers (cl.9A and cl.10A). The instrument sets out permitted purposes but does not itself prescribe technical security standards — those remain matters for implementing bodies or other instruments.\n - Market effects and incentives: the regs permit program operators to adopt existing healthcare identifiers as their own (cl.10B). That reduces duplicate account‑management overhead and can simplify linking across systems, but it also makes cross‑system linkage easier and concentrates value in entities that operate registries and apps. Commercial mobile app and intermediary operators receive explicit legal authority to participate in registration flows (cl.9A(5)–(6)), creating business opportunities for such vendors.\n - Enforcement and deterrence: non‑compliance with the obligation to identify the individual requester or to keep records attracts a civil penalty of 50 penalty units (cl.12(5)). That creates a measurable enforcement risk for organisations that do not maintain the records or supply the information when practicable.\n\nWho pays, who decides, and expected behaviour changes\n\n- Who pays: compliance/administrative costs are borne by healthcare providers and provider organisations (verification procedures, recordkeeping), and by service operators/registry operators to the extent they must implement verification and data‑handling workflows. Technology vendors (mobile app, intermediary) may incur costs to integrate with the System Operator and meet any contractual or technical requirements.\n- Who decides: the System Operator (as defined in related legislation) and the service operator play central roles in verification and in disclosures of identifiers. Operators of health facilitation programs decide whether to adopt identifiers for their internal use (cl.10B). Registration authorities listed (National Health Practitioner Boards, AHPRA where authorised) are specified as national registration authorities (cl.7).\n- Behaviour changes: organisations will need to implement identity‑verification processes before requesting identifiers, and to log and retain requester identities; mobile app and active‑script registry actors will be integrated into identifier flows and able to collect and pass identifiers for registration; program operators may reuse identifiers instead of issuing new internal IDs.\n\nImplementation risks and trade‑offs\n\n- Reliance on multiple identity‑verifiers (AHPRA, service operator, Aged Care Department, NDIA, or other prescribed entities — see defn of \"evidence of identity process\" in cl.5) creates operational complexity and potential delay.\n- Expanded authorised uses increase the surface area for privacy incidents; the regs control legal authorisation but do not themselves set technical security rules or data‑sharing oversight mechanisms beyond recordkeeping and purpose limits.\n- Allowing program operators to adopt identifiers simplifies administration but raises the risk of cross‑program linkage of records unless governed by contracts or other privacy protections.\n\nKey sections to look at quickly: definitions and identity items (cl.5, cl.8), My Health Record authorisation (cl.9), active script list and mobile app flows (cl.9A), health facilitation program table and adopting identifiers (cls 10A–10B), organisation verification before requests (cl.11), identity of individual requester and recordkeeping + penalty (cl.12), transitional and amendment interaction (Part 4, cls 13–20)."}},"importantCases":[],"_links":{"self":"/api/acts/healthcare-identifiers-regulations-2020","history":"/api/acts/healthcare-identifiers-regulations-2020/history","analysis":"/api/acts/healthcare-identifiers-regulations-2020/analysis","conflicts":"/api/acts/healthcare-identifiers-regulations-2020/conflicts","importantCases":"/api/acts/healthcare-identifiers-regulations-2020/important-cases","documents":"/api/acts/healthcare-identifiers-regulations-2020/documents"}}