{"id":"F2021L00006","name":"National Health (Data-matching) Principles 2020","slug":"national-health-data-matching-principles-2020","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":440730,"registerId":"F2021L00006-fast-fetch-1775956266521","compilationNumber":null,"startDate":"2026-04-12","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"National Health (Data-matching) Principles 2020","content":"---\nmeta-content-style-type: text/css\nmeta-content-type: application/xhtml+xml; charset=utf-8\n---\n\n?xml version=\"1.0\" encoding=\"utf-8\" standalone=\"no\"?>\n\n![Commonwealth Coat of Arms of Australia](image.001.jpeg)\n\n \n\nNational Health (Data‑matching) Principles 2020\n\nI, Greg Hunt, Minister for Health, make the following principles.\n\nDated 22 December 2020\n\nGreg Hunt\n\nMinister for Health\n\n \n\n \n\n \n\n \n\nContents\n\nPart 1—Preliminary\n\n1 Name\n\n2 Commencement\n\n3 Authority\n\n4 Definitions\n\nPart 2—Good privacy practice\n\n5 Publishing information about authorised information‑matching\n\n6 Technical standards for authorised data‑matching programs\n\n7 Evaluation of privacy practices for authorised information‑matching\n\nPart 3—Publicly available register\n\n8 Publicly available register of kinds of information matched\n\n9 Information that must be included on the publicly available register\n\n10 Information that may be included on the publicly available register\n\nPart 4—Record‑keeping\n\n11 General\n\n12 Records for authorised data‑matching programs\n\n13 Records of destruction of information and results\n\n14 Sufficiency of records for assessment purposes\n\nPart 5—Destruction of personal information and results of matching\n\n15 Destruction of personal information when no longer needed after matching\n\n16 Destruction of results of matching when no longer needed\n\n17 Destruction of personal information not to be matched\n\nPart 6—Accuracy, completeness and currency of personal information\n\n18 Accuracy, completeness and currency of personal information\n\nPart 7—Decisions about matching of information\n\n19 Decisions about matching of information\n\n20 Decisions about necessary data fields and subjects\n\n \n\nPart 1—Preliminary\n\n \n\n1  Name\n\n  This instrument is the National Health (Data-matching) Principles 2020.\n\n2  Commencement\n\n (1) Each provision of this instrument specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.\n\n \n\n- Commencement information\n- Column 1 Column 2 Column 3\n- Provisions Commencement Date/Details\n- 1. The whole of this instrument The day after this instrument is registered. 5 January 2021\n\n\nNote: This table relates only to the provisions of this instrument as originally made. It will not be amended to deal with any later amendments of this instrument.\n\n (2) Any information in column 3 of the table is not part of this instrument. Information may be inserted in this column, or information in it may be edited, in any published version of this instrument.\n\n3  Authority\n\n  This instrument is made under section 132F of the National Health Act 1953.\n\n4  Definitions\n\n  In this instrument:\n\nAct means the National Health Act 1953.\n\nauthorised Commonwealth entity has the same meaning as in Part VIIIA of the Act.\n\nauthorised data‑matching program means a program of authorised information‑matching for one or more permitted purposes.\n\nauthorised information‑matching means the matching of information that is authorised by Part VIIIA of the Act.\n\nCommonwealth entity has the same meaning as in Part VIIIA of the Act.\n\nidentifier has the same meaning as in the Privacy Act 1988.\n\npermitted purpose has the same meaning as in Part VIIIA of the Act.\n\npersonal information has the same meaning as in Part VIIIA of the Act.\n\nPart 2—Good privacy practice\n\n \n\n5  Publishing information about authorised information‑matching\n\n  The Chief Executive Medicare must publish, on the internet, the following information about authorised information‑matching:\n\n (a) an overview of authorised information‑matching;\n\n (b) the objectives of authorised information‑matching;\n\n (c) a description of each of the following:\n\n (i) how Part VIIIA of the Act provides for authorised information‑matching;\n\n (ii) reasons why authorised information‑matching may be necessary for a permitted purpose;\n\n (iii) sources of information for authorised information‑matching;\n\n (iv) methods used for ensuring that information for authorised information‑matching is of sufficient quality;\n\n (v) processes involved in authorised information‑matching, including what the results of the processes may be and what may happen to those results;\n\n (vi) timing or frequency of authorised information‑matching;\n\n (vii) actions that may be taken as a result of authorised information‑matching;\n\n (viii) how public notice of authorised information‑matching is given;\n\n (ix) processes for review of authorised information‑matching;\n\n (x) the role of the Australian Information Commissioner in relation to authorised information‑matching;\n\n (xi) laws (other than the Act) that are relevant to authorised information‑matching (such as laws relating to the collection, use or disclosure of information or laws relating to compliance processes).\n\n6  Technical standards for authorised data‑matching programs\n\n (1) The Chief Executive Medicare must prepare and maintain, in writing, technical standards to govern the conduct of each authorised data‑matching program.\n\n (2) The technical standards for an authorised data‑matching program must include the following:\n\n (a) a description of data supplied by sources of information for the program;\n\n (b) the specification for each matching algorithm for the program;\n\n (c) any risks that have been identified in relation to the program and how those risks will be addressed;\n\n (d) controls to be used to ensure the continued integrity of:\n\n (i) the information used for the program; and\n\n (ii) the system for the program;\n\n (e) security features that control and minimise access to personal information.\n\n (3) In matching information under subsection 132B(1) of the Act for an authorised data‑matching program, the Chief Executive Medicare must comply with the technical standards for the program.\n\n (4) In matching information under subsection 132B(1) of the Act for an authorised data‑matching program, an authorised Commonwealth entity must comply with the technical standards for the program.\n\n7  Evaluation of privacy practices for authorised information‑matching\n\n  The Chief Executive Medicare must, within 3 years after the commencement of authorised information‑matching:\n\n (a) evaluate the privacy practices relating to authorised information‑matching; and\n\n (b) prepare a report of the evaluation; and\n\n (c) give a copy of the report to the Australian Information Commissioner.\n\nPart 3—Publicly available register\n\n \n\n8  Publicly available register of kinds of information matched\n\n  The Chief Executive Medicare must establish and maintain a publicly available register of the kinds of information matched by the Chief Executive Medicare or an authorised Commonwealth entity under subsection 132B(1) of the Act.\n\nNote: For the information that may be matched, see subsection 132B(1) of the Act.\n\n9  Information that must be included on the publicly available register\n\n  The Chief Executive Medicare must include the following information in the publicly available register for each kind of information matched by the Chief Executive Medicare or an authorised Commonwealth entity under subsection 132B(1) of the Act:\n\n (a) a description of the kind of information and the datasets from which the information was taken;\n\n (b) each permitted purpose for which the information was matched;\n\n (c) if any of the information that was matched was obtained by the Chief Executive Medicare from, or disclosed or provided to the Chief Executive Medicare by, another person or entity:\n\n (i) a description of that information; and\n\n (ii) if the other person or entity is not an individual—the name of the other person or entity;\n\n (d) if the information was matched by an authorised Commonwealth entity, and the matching is an act or practice to which the Privacy Act 1988 applies—the name of the entity;\n\n (e) if the information was matched by a person as delegate of the Chief Executive Medicare, and the person is not an individual—the name of the person.\n\nNote 1: For paragraph (d), for acts or practices to which the Privacy Act 1988 applies, see section 7 of that Act.\n\nNote 2: For paragraph (e), for delegation of powers by the Chief Executive Medicare, see subsections 6(9) to (12) of the Act.\n\n10  Information that may be included on the publicly available register\n\n  The Chief Executive Medicare may include in the publicly available register other information about the matching of information under subsection 132B(1) of the Act.\n\nPart 4—Record‑keeping\n\n \n\n11  General\n\n (1) The Chief Executive Medicare must keep records of information matched by the Chief Executive Medicare under subsection 132B(1) of the Act.\n\n (2) An authorised Commonwealth entity must keep records of information matched by the Commonwealth entity under subsection 132B(1) of the Act.\n\n12  Records for authorised data‑matching programs\n\n (1) The Chief Executive Medicare must keep records of the following for each authorised data‑matching program:\n\n (a) each permitted purpose for the program;\n\n (b) the matters considered under Part 7 of this instrument in relation to the program;\n\n (c) a description of the information that was matched for the program;\n\n (d) the timing or frequency of the matching of information for the program;\n\n (e) if the information that was matched for the program was obtained by the Chief Executive Medicare from, or disclosed or provided to the Chief Executive Medicare by, another person or entity for the purpose of facilitating the matching—the date the information was so obtained, disclosed or provided.\n\n (2) The records for a program must be sufficient to enable the replication of the matching of the information for the program while the datasets remain available.\n\n (3) Subsection (2) does not require the records to include the datasets.\n\n13  Records of destruction of information and results\n\n (1) The Chief Executive Medicare must keep records of the description of:\n\n (a) personal information destroyed under subsection 15(1) or 17(1); and\n\n (b) results of matching destroyed under subsection 16(1).\n\n (2) An authorised Commonwealth entity must keep records of the description of:\n\n (a) personal information destroyed under subsection 15(2) or 17(2); and\n\n (b) results of matching destroyed under subsection 16(2).\n\n14  Sufficiency of records for assessment purposes\n\n  The records mentioned in sections 11, 12 and 13 must be sufficient to enable the Australian Information Commissioner to conduct an assessment mentioned in paragraph 33C(1)(f) of the Privacy Act 1988 in relation to the matching of information and the handling of information relating to that matching.\n\nPart 5—Destruction of personal information and results of matching\n\n \n\n15  Destruction of personal information when no longer needed after matching\n\n (1) If personal information that has been matched by the Chief Executive Medicare under subsection 132B(1) of the Act is no longer needed for any purpose for which the information was matched, the Chief Executive Medicare must, within 90 days after the information ceases to be needed, take reasonable steps to destroy the information.\n\n (2) If personal information that has been matched by an authorised Commonwealth entity under subsection 132B(1) of the Act is no longer needed for any purpose for which the information was matched, the authorised Commonwealth entity must, within 90 days after the information ceases to be needed, take reasonable steps to destroy the information.\n\nNote: Each of subsections (1) and (2) is a requirement for the purposes of paragraph 24(2)(a) of the Archives Act 1983.\n\n (3) The requirements in subsections (1) and (2):\n\n (a) apply to personal information as held by the Chief Executive Medicare or the authorised Commonwealth entity for the purpose of the matching of that information under subsection 132B(1) of the Act; and\n\n (b) do not apply to that personal information as held by the Chief Executive Medicare or the authorised Commonwealth entity for another purpose; and\n\n (c) do not apply to that personal information as held by another person.\n\n16  Destruction of results of matching when no longer needed\n\n (1) If the results of the matching of information by the Chief Executive Medicare under subsection 132B(1) of the Act are no longer needed for any purpose for which the information was matched, the Chief Executive Medicare must, within 90 days after the results cease to be needed, take reasonable steps to destroy the results.\n\n (2) If the results of the matching of information by an authorised Commonwealth entity under subsection 132B(1) of the Act are no longer needed for any purpose for which the information was matched, the authorised Commonwealth entity must, within 90 days after the results cease to be needed, take reasonable steps to destroy the results.\n\nNote: Each of subsections (1) and (2) is a requirement for the purposes of paragraph 24(2)(a) of the Archives Act 1983.\n\n17  Destruction of personal information not to be matched\n\n (1) If:\n\n (a) the Chief Executive Medicare holds personal information that was obtained by the Chief Executive Medicare from, or disclosed or provided to the Chief Executive Medicare by, another person or entity for the purpose of facilitating the matching of that information under subsection 132B(1) of the Act; and\n\n (b) the information is not intended to be matched by the Chief Executive Medicare or an authorised Commonwealth entity under subsection 132B(1) of the Act;\n\nthe Chief Executive Medicare must, within 90 days after becoming aware that the information is not intended to be matched, take reasonable steps to destroy the information.\n\n (2) If:\n\n (a) an authorised Commonwealth entity holds personal information that was obtained by the Chief Executive Medicare from, or disclosed or provided to the Chief Executive Medicare by, another person or entity for the purpose of facilitating the matching of that information under subsection 132B(1) of the Act; and\n\n (b) the information is not intended to be matched by the authorised Commonwealth entity under subsection 132B(1) of the Act;\n\nthe authorised Commonwealth entity must, within 90 days after becoming aware that the information is not intended to be matched, take reasonable steps to destroy the information.\n\nNote: Each of subsections (1) and (2) is a requirement for the purposes of paragraph 24(2)(a) of the Archives Act 1983.\n\n (3) The requirements in subsections (1) and (2):\n\n (a) apply to personal information as held by the Chief Executive Medicare or the authorised Commonwealth entity for the purpose of facilitating the matching of that information under subsection 132B(1) of the Act; and\n\n (b) do not apply to that personal information as held by the Chief Executive Medicare or the authorised Commonwealth entity for another purpose; and\n\n (c) do not apply to that personal information as held by another person.\n\nPart 6—Accuracy, completeness and currency of personal information\n\n \n\n18  Accuracy, completeness and currency of personal information\n\nReasonable steps\n\n (1) The Chief Executive Medicare must take reasonable steps to ensure that personal information that is matched by the Chief Executive Medicare under subsection 132B(1) of the Act is accurate, complete and up to date.\n\n (2) An authorised Commonwealth entity must take reasonable steps to ensure that personal information that is matched by the Commonwealth entity under subsection 132B(1) of the Act is accurate, complete and up to date.\n\nQuality assurance checks\n\n (3) For the purposes of subsections (1) and (2), the steps must include the carrying out of quality assurance checks.\n\nAdvising Commonwealth entities about information that is not accurate, complete and up to date\n\n (4) Subsection (5) applies if the Chief Executive Medicare or an authorised Commonwealth entity becomes aware that personal information that was obtained by the Chief Executive Medicare from, or disclosed or provided to the Chief Executive Medicare by, a Commonwealth entity for the purpose of facilitating the matching of that information under subsection 132B(1) of the Act is not accurate, complete and up to date.\n\n (5) The Chief Executive Medicare or the authorised Commonwealth entity must tell the Commonwealth entity in writing that the information is not accurate, complete and up to date.\n\nCorrections\n\n (6) If:\n\n (a) information matched by the Chief Executive Medicare or an authorised Commonwealth entity under subsection 132B(1) of the Act is personal information about an individual; and\n\n (b) the individual requests the Chief Executive Medicare to correct the information;\n\nthe Chief Executive Medicare must take such steps (if any) as are reasonable in the circumstances to correct the information.\n\nPart 7—Decisions about matching of information\n\n \n\n19  Decisions about matching of information\n\n (1) The Chief Executive Medicare must not match information for a permitted purpose under subsection 132B(1) of the Act unless the Chief Executive Medicare is satisfied that the matching is reasonably necessary for that purpose.\n\n (2) An authorised Commonwealth entity must not match information for a permitted purpose under subsection 132B(1) of the Act unless the Chief Executive Medicare is satisfied that the matching is reasonably necessary for that purpose.\n\n20  Decisions about necessary data fields and subjects\n\n (1) If the Chief Executive Medicare is satisfied that it is reasonably necessary to match information for a permitted purpose, the Chief Executive Medicare must decide the following:\n\n (a) the data fields in a dataset containing the information that are necessary for the matching;\n\n (b) the data subjects (for example, individuals or classes of individuals) in a dataset containing the information that are necessary for the matching.\n\n (2) In making a decision mentioned in subsection (1), the Chief Executive Medicare must consider the following:\n\n (a) how the data fields and data subjects that are necessary for the matching can be minimised (for example, by validating existing data rather than seeking new data or by using predefined variables);\n\n (b) how the use of personal information can be minimised (for example, by using identifiers rather than personal information).\n","sortOrder":0}],"analysis":{"flash_summary_failed":{"failed":true,"reason":"Unauthenticated. Configure AI_GATEWAY_API_KEY or use a provider module. Learn more: https://ai-sdk.dev/unauthenticated-ai-gateway","source":"analysis-cron"},"kimi_summary":{"content_quality":"ok","complexity_score":4,"scope_assessment":{"changed":false,"description":"The legislation appears tightly scoped to its original purpose of governing data-matching under Part VIIIA of the National Health Act 1953. It does not expand beyond health-related data-matching programs and maintains the original framework's focus on privacy protection, transparency, and data minimisation. The instrument is a legislative instrument made under specific enabling powers (section 132F) and stays within those bounds."},"complexity_factors":["Heavy reliance on defined terms imported from the National Health Act 1953 (7 defined terms in section 4, all referencing external legislation)","Dual obligations structure: most rules apply separately to 'Chief Executive Medicare' and 'authorised Commonwealth entities', creating parallel but slightly different obligation tracks (e.g., sections 15-17 have subsections (1) and (2) with nearly identical text)","Cross-references to multiple external Acts: National Health Act 1953 (Part VIIIA), Privacy Act 1988, Archives Act 1983","Conditional logic with nested exceptions in Part 5 (destruction requirements): subsections 15(3) and 17(3) contain triple-nested qualifications ((a), (b), (c)) limiting when destruction obligations apply","Specific but vague standards: terms like 'reasonable steps' and 'reasonably necessary' appear throughout without internal definition, leaving interpretive gaps"],"plain_english_summary":"This law governs how Medicare and authorised Commonwealth agencies match personal data across government systems to detect fraud, overpayments and other issues. It requires transparency, technical and privacy standards, limits on what data can be used, mandatory destruction of unneeded data, accuracy checks, and record-keeping for audits.\n\nIt affects the Chief Executive Medicare, authorised agencies, Australian individuals whose data may be matched, and the Australian Information Commissioner who oversees compliance."},"flash_summary":{"complexity_score":5,"scope_assessment":{"changed":false,"description":"The instrument establishes procedural, transparency and record‑keeping obligations for authorised information‑matching under Part VIIIA of the National Health Act 1953. It does not itself expand or narrow the statutory permitted purposes or the kinds of information that may be matched (those are governed by the Act); instead it governs how matching must be conducted, documented and disclosed (see Authority s3 and definitions s4)."},"complexity_factors":["Cross-reference to Part VIIIA of the National Health Act 1953 (Authority in s3) — legal scope and permitted purposes are set by the Act rather than this instrument, requiring interpreters to read both instruments.","Multiple operational duties on the Chief Executive Medicare and authorised Commonwealth entities (publication, standards, registers, records, destruction, evaluations) creating dispersed compliance tasks (ss5–7, 8–13, 15–17, 19–20).","Technical standards requirement includes algorithm specifications, data descriptions, risk controls and security features (s6(2)(a)–(e)) — technical and IT expertise required to comply and audit.","Record‑keeping must be sufficient to enable replication of matches while datasets remain available (s12(2)) — operational burden to retain metadata and provenance without necessarily keeping original datasets.","Short, prescriptive destruction timelines (90 days) for personal information and matching results once no longer needed (ss15–17) — scheduling and evidence of destruction increase administrative processes.","Intersections with other regimes: Privacy Act 1988 (definition and applicability) and Archives Act 1983 (notes on requirements) — compliance requires reconciling obligations across statutes (see ss4, 13, notes to ss15–17).","Discretion and administrative decision points: Chief Executive Medicare must be \"satisfied\" of necessity before matching and must decide necessary data fields and subjects (ss19–20) — introduces centralised decision authority and discretionary judgment calls.","Transparency and oversight obligations: public register content and a required evaluation report to the Australian Information Commissioner within 3 years (ss8–10, 7) — enables external assessment but requires collating evaluative material."],"plain_english_summary":"This instrument sets operational, transparency and record‑keeping rules for authorised information‑matching under Part VIIIA of the National Health Act 1953. The Chief Executive Medicare must publish program details, set and enforce technical standards (including matching‑algorithm specs), keep a public register and replicable records, and destroy matched personal data and match results within 90 days when no longer needed. It also requires necessity checks, data minimisation, quality assurance and reporting of inaccuracies; compliance costs fall on Medicare and authorised Commonwealth entities."}},"importantCases":[],"_links":{"self":"/api/acts/national-health-data-matching-principles-2020","history":"/api/acts/national-health-data-matching-principles-2020/history","analysis":"/api/acts/national-health-data-matching-principles-2020/analysis","conflicts":"/api/acts/national-health-data-matching-principles-2020/conflicts","importantCases":"/api/acts/national-health-data-matching-principles-2020/important-cases","documents":"/api/acts/national-health-data-matching-principles-2020/documents"}}