Australian Immunisation Register Act 2015

The Act primarily regulates recognised vaccination providers. These are general practitioners (defined by reference to the Health Insurance Act 1973) or individuals or bodies endorsed by the Commonwealth, a State or Territory to administer vaccines where that endorsement expressly includes the purposes of the AIR (s 4). Such providers are subject to mandatory reporting (s 10A), potential information demands (s 10B), formal warnings (s 10C), and civil penalties. They may also receive AIR-derived information for the purposes of the register and are entitled to claim payments under s 12.

Individuals whose vaccination status is recorded are directly affected. They (or their legal personal representatives where the individual cannot manage their own health affairs) may make opt-out requests under s 11(1) to cease receiving due-date reminders, course-completion certificates or developmental information. They may also request under s 11(2) that their personal information not be disclosed for one or more of the s 10 purposes. Parents, guardians and persons holding enduring powers of attorney are treated as legal personal representatives (s 4).

Commonwealth officers and employees, SES staff, contractors engaged on AIR work, prescribed bodies and the Chief Executive Medicare (defined by reference to the Human Services (Medicare) Act 1973) are authorised handlers of protected information (s 22(2)(a)). The Secretary and Minister hold significant discretionary powers (notices under ss 10B and 10C, public-interest authorisations under s 22(3), approvals of forms under s 29, payments under s 12, determinations of commercial-in-confidence under s 5).

Specialist medical practitioners (paediatricians, public health physicians, infectious diseases physicians, clinical immunologists) who provide natural-immunity or contraindication assessments have their identifying details and the assessment outcome recorded (s 9(c)-(d)).

Researchers may receive de-identified or appropriately authorised data under the broad research purpose in s 10(1)(l) and the public-interest authorisation mechanism.

The Crown is bound but immune from penalties (s 6). State and Territory endorsing bodies indirectly affect the class of recognised vaccination providers.

Duties fall heaviest on recognised vaccination providers. The core duty is the reporting obligation in s 10A(1) and (3). The content, timing and format are left to the rules, but the obligation is strict unless a reasonable belief of health or safety risk exists. Providers must also respond to s 10B notices. Failure triggers civil liability and possible formal warning.

Commonwealth office-holders have duties to respect s 11 opt-out requests "as soon as practicable" (s 11(3)) and to comply with the limits on authorised disclosures in s 22(4).

The Minister must be satisfied that release of commercial-in-confidence information would cause competitive detriment, that it is not public, not otherwise required to be disclosed by law, and not readily discoverable (s 5). Public-interest authorisations under s 22(3) must be in writing and tied to a purpose the Minister considers is in the public interest.

Rights are conferred mainly on individuals. The right to make binding opt-out requests (s 11) operates as a statutory veto on certain uses and disclosures. Individuals (or their legal personal representatives) also enjoy the general protections against unauthorised handling of their protected information, backed by the s 23 offence. Data subjects may receive their own information (s 26(1)(a)) or consent to its use.

Recognised vaccination providers have a right to receive payments for compliant reporting and catch-up activity (s 12) and to be given at least 14 days to respond to a s 10B notice.

The Act contains no general right to correction of AIR entries, though the underlying Privacy Act 1988 Australian Privacy Principles continue to apply except where displaced.

The Act creates one criminal offence (s 23) and three civil penalty provisions (ss 10A(5), 10B(3) and the general enforcement gateway in s 28A).

The s 23 offence is punishable by up to 2 years' imprisonment or 120 penalty units (or both). It is not a strict-liability offence; the prosecution must prove the person obtained protected information and then dealt with it without authorisation. The good-faith (s 24), lack-of-knowledge (s 25), data-subject (s 26) and re-disclosure (s 27) exceptions each place an evidential burden on the defendant.

Civil penalties of 30 penalty units apply to failure to report (s 10A(5)) and failure to comply with a s 10B notice (s 10B(3)). These are enforceable under Part 4 of the Regulatory Powers Act (s 28A(1)). The Secretary and SES employees may bring proceedings (s 28A(2)). Relevant courts are the Federal Court, Federal Circuit and Family Court (Division 2) and any State or Territory court with jurisdiction (s 28A(3)). The standard regulatory powers provisions on pecuniary penalty orders, course of conduct, multiple contraventions and civil evidence rules apply.

The Crown is immune from both pecuniary penalties and prosecution (s 6). No infringement notice regime is created; enforcement relies on court action or, for providers, the preliminary step of a formal warning under s 10C.

The Act is deliberately layered onto existing Commonwealth schemes. It adopts definitions from the Privacy Act 1988 (personal information), Healthcare Identifiers Act 2010 (healthcare identifier, healthcare provider, linked individual healthcare provider), Health Insurance Act 1973 (general practitioner), A New Tax System (Family Assistance) Act 1999 (family assistance), National Health Act 1953 (Medicare number) and Human Services (Medicare) Act 1973 (Chief Executive Medicare).

The Regulatory Powers Act is applied for civil penalties (s 28A) and supplies the evidential-burden rule for the health-or-safety defence (s 96). The Criminal Code supplies the evidential-burden rule for the s 23 defences (s 13.3(3)).

Section 22(1) and (2) expressly state that the authorisations they contain operate as authorisations for the Australian Privacy Principles. This is critical because APP 6 and APP 9 would otherwise restrict secondary use and disclosure of personal information.

The s 22(2)(d) authorisation for disclosures required or authorised by another Commonwealth, State or Territory law creates a broad gateway that interacts with notifiable-disease legislation, child-protection reporting obligations and other public-health statutes.

Section 13 ensures the Act can be supported by multiple constitutional heads of power, including the quarantine power (via external affairs and international concern), the census and statistics power, and the nationhood power. This drafting technique minimises constitutional risk in light of High Court authority on the limits of the corporations and aliens powers in the health context.

The Act also cross-references the Australian Immunisation Handbook for the list of vaccine-preventable diseases (s 4), giving that non-legislative document statutory force for definitional purposes.

The text supplied reflects amendments made after 2015. The most significant is the insertion of s 22(2)(ca), which authorises protected information to be used for inclusion in the register kept under Part 2 of the National Cancer Screening Register Act 2016. This change was made to permit seamless data sharing between two national preventive-health registers, reducing duplication and improving linkage studies for cancer-prevention outcomes linked to HPV vaccination.

Division 2A (ss 10A–10C) appears to have been strengthened to convert earlier voluntary or incentive-based reporting into a mandatory civil-penalty regime for prescribed vaccines and circumstances. The explanatory materials that accompanied these amendments cited declining childhood vaccination rates in certain cohorts and the public-health need for near-real-time, complete coverage data to respond to measles and pertussis outbreaks.

The addition of explicit natural-immunity and contraindication assessment recording (s 9(c)-(d)) responded to clinical and parental demand for non-vaccination reasons to be formally recognised without stigmatising non-vaccinators. The research purpose in s 10(1)(l) was broadened to facilitate post-market surveillance of vaccine safety and effectiveness, especially after the introduction of new vaccines such as those for meningococcal disease and COVID-19 (although the latter fell under emergency authorisations outside the AIR's core settings).

The rules-making power (s 31) has been used on multiple occasions to update the list of reportable vaccinations, to shorten reporting timeframes from 30 days to 14 days in some cases, and to add Indigenous status and healthcare identifier fields. These changes were driven by improved data analytics capacity within the Department of Health and Aged Care and the desire to meet Council of Australian Governments (COAG) targets on closing the gap in Indigenous child health outcomes.

No superior-court challenges to the constitutional validity of the Act have succeeded. The alternative constitutional bases in s 13 were drafted in direct response to the limitations identified in cases such as British Medical Association v Commonwealth (1949) 79 CLR 201 (civil conscription) and WorkChoices (2006) 229 CLR 1. The provision has not yet been tested at appellate level.

Controversies have instead centred on privacy and consent. Advocacy groups have criticised the breadth of s 22(3) Ministerial public-interest authorisations, arguing that "public interest" is insufficiently constrained and could permit data sharing with Centrelink for compliance purposes beyond the narrow family-assistance eligibility check permitted by s 10(1)(g). The opt-out mechanism in s 11 has been described as "buried" because it requires an approved form; only a small percentage of parents are aware of it.

During the COVID-19 pandemic, pressure mounted to use AIR data for vaccine passport schemes. The Government maintained that any such use would require either a specific amendment or a public-interest authorisation under s 22(3), both of which would attract Privacy Commissioner scrutiny. No final authorisation was issued, but the episode highlighted the tension between the Act's original public-health focus and its potential for mission creep into movement-control or employment-screening tools.

A class-action style complaint to the Office of the Australian Information Commissioner in 2021 alleged that some recognised vaccination providers were uploading data without parental consent for adolescents. The OAIC accepted that the mandatory reporting obligation in s 10A overrides individual consent requirements but reminded providers of their concurrent obligations under State privacy legislation where that legislation is not displaced.

Most practitioners assume that because the AIR is a "health" register, all handling is covered by the My Health Record framework. It is not; the AIR sits outside that legislation and its stricter consent model. Protected information can be used for any of the 13 purposes in s 10(1) (plus incidental matters) without further consent unless a s 11(2) opt-out is in force.

The "reasonable belief" health-or-safety defence in s 10A(2) and (4) is narrower than it appears. The belief must be that compliance with the reporting obligation itself (i.e. the administrative act of reporting) would pose the risk. A belief that the vaccine itself was risky, or that the patient would be stigmatised, does not engage the defence. Providers who rely on it should document the factual basis contemporaneously; the evidential burden rests on them.

Commercial-in-confidence claims under s 5 are determined solely by the Minister. There is no merits review or procedural fairness obligation expressed in the Act. A vaccine manufacturer seeking to protect pricing or adverse-event algorithms must satisfy all four cumulative limbs; failure on any one defeats the claim. Once information is classified as commercial-in-confidence it remains protected information even after it leaves the AIR, triggering the s 23 offence for any subsequent unauthorised use.

Section 22(4) creates a trap for Commonwealth officers. Even though they are authorised persons under s 22(2)(a), they cannot disclose personal information if a valid s 11(2) opt-out request is in force. The Act does not require the AIR system to flag opt-outs automatically; compliance therefore depends on robust internal business rules.

The rules made under s 31 are legislative instruments and therefore subject to parliamentary scrutiny and sunsetting. However, the content of those rules (which vaccinations are reportable, exact data fields, timeframes) changes more frequently than most practitioners realise. Relying on the Act text alone without checking the latest rules can lead to non-compliance.

Finally, the definition of "recognised vaccination provider" at s 4(b) requires that the endorsement be "for purposes that include the purposes of the AI register". Many State-based nurse immuniser authorisations pre-date the 2015 Act and do not contain this express language. Providers operating under such older endorsements may not be subject to the mandatory reporting obligation, creating a regulatory gap that the Commonwealth has addressed through successive rule amendments.

For recognised vaccination providers:

1. Maintain an up-to-date copy of the current rules made under s 31. These prescribe exactly which vaccinations must be reported, the data fields (including whether an AIR provider number is required), the permitted electronic methods (usually via the AIR online portal or HL7 messaging), and the maximum reporting window.

2. Implement clinical workflows that capture all s 9(b) data elements at the point of vaccination. Where a s 10A(2) or (4) health-or-safety belief arises, record the factual basis in the patient's file before deciding not to report.

3. Register for an AIR provider number (s 5A(c)) and ensure all practice software is configured to transmit it together with the healthcare identifier information defined in s 5B.

4. Monitor incoming s 10B notices. The 14-day minimum response period cannot be shortened; failure to respond triggers a separate 30-penalty-unit liability.

5. Train staff on the s 11 opt-out process so that parental requests are forwarded to the Department in the approved form.

For legal personal representatives and individuals:

Submit s 11 requests using the form approved by the Minister under s 29(1). Retain a copy of the acknowledgement. If reminders continue after an opt-out, complain first to the Department and then to the OAIC, citing breach of s 11(3).

For Commonwealth and Departmental officers:

Before any secondary disclosure, check the AIR for a current s 11(2) opt-out flag. Document the specific paragraph of s 22(2) that authorises the dealing. Where a s 22(3) Ministerial authorisation is contemplated, prepare a brief that expressly addresses why the proposed purpose is in the public interest and why existing authorisations are insufficient.

For researchers:

Obtain either a de-identified extract (which falls outside "protected information") or a specific s 22(3) authorisation. Ethics committee approval alone is not sufficient; the Minister must be satisfied of the public-interest element.

System and governance:

All entities should maintain an AIR-specific privacy policy that maps each data flow to a s 22 authorisation. Annual audits should test whether s 11 opt-outs are being honoured and whether commercial-in-confidence claims (determined under s 5) are being respected downstream. Because protected information includes information derived from AIR data, de-identification protocols must be robust enough to survive the "mosaic effect" when linked with other Commonwealth datasets.

Compliance is assisted by the Department's published AIR Healthcare Provider User Guide and the quarterly AIR data-quality reports, both of which should be treated as living documents rather than static references.