168Protection of personal information

168  Protection of personal information

 (1) A registered provider must ensure the protection of personal information, relating to an individual to whom the registered provider delivers funded aged care services, including as follows:

 (a) the personal information must not be used other than:

 (i) for a purpose connected with the delivery of a funded aged care service to the individual by the registered provider; or

 (ii) for a purpose for which the personal information was given by or on behalf of the individual to the registered provider;

 (b) except with the consent of the individual, the personal information must not be disclosed to any other person other than:

 (i) for a purpose connected with the delivery of a funded aged care service to the individual by the registered provider; or

 (ii) for a purpose connected with the delivery of a funded aged care service to the individual by an associated provider of the registered provider or another registered provider; or

 (iii) for a purpose for which the personal information was given by or on behalf of the individual; or

 (iv) for the purpose of complying with an obligation under this Act;

 (c) the personal information must be protected by security safeguards that it is reasonable in the circumstances to take against the loss or misuse of the information.

 (2) This section does not prevent personal information being given to a court, or to a tribunal, authority or person having the power to require the production of documents or the answering of questions, in accordance with a requirement of that court, tribunal, authority or person.

Subdivision B—Obligations relating to suitability of responsible persons