Health (Cervical Cytology Register) Regulations 1991

Cervical Screening Register: the central database kept by the CEO under regulation 5. It comprises test results forwarded under repealed regulation 9 (before deletion), results disclosed by corresponding registers, and “other information” forwarded to the CEO under regulation 10A. The latter is a broad category that can include clinical history, demographic data and follow-up information, provided the CEO requests it and it relates to a woman whose test results are already on the register.

Cervical cancer test: defined in regulation 3 as a test to determine whether a woman has cervical cancer or its precursors, including a pathological examination of a specimen. This captures standard Pap smears and HPV testing, as well as any future test method. The definition is technology-neutral.

Corresponding register: a register established under Commonwealth or other State/Territory law that contains similar information. This allows cross-jurisdictional data sharing to track women who move between states. The CEO may authorise disclosure to a corresponding register if the woman resides in that jurisdiction and the information will be used for purposes similar to those in regulation 6(1)(a) or (b) - that is, to notify women of next test dates or to manage abnormal results.

Approved: means approved by the CEO. This appears in the definition of “approved” and in regulation 6(1)(e)(v) regarding comparative data compilation by any national organization approved by the CEO. It gives the CEO a gatekeeping power over which external bodies can receive aggregated data.

Removal of identifying data: a woman may request in writing that any data identifying her be removed. The CEO must comply as soon as practicable. However, non-identifying data may be retained. This is not a full deletion right; statistical data about the woman’s test results or condition can remain on the register in de-identified form. The regulation does not specify a time limit for “as soon as practicable” other than that non-compliance is an offence.

Compulsion to provide information: under regulation 10A, the CEO may write to a person (not merely a health professional) who the CEO believes has information about a woman, requesting that specific information be given to the CEO. The person must comply within 30 days or face an offence. The only defence is proving that the person did not have the requested information at the relevant time. This is a broad coercive power that can reach employers, insurers, family members or any third party, subject only to the CEO’s opinion and the condition that the woman already has test results on the register.

Women of screening age: the regulations directly affect every woman in Western Australia who undergoes a cervical cancer test, whether through the public screening program or privately. Their test results and associated information are collected, recorded, linked across tests, and used for notification and research without their active consent (though there is an opt-out from identifiable data retention). Women may not be aware that their data is being compiled, unless they read the fine print at the time of testing. They have a right to request removal of identifying data, but not the underlying test results in de-identified form. The regulations do not require that women be notified of their inclusion on the register, nor do they require consent for the initial collection.

Medical practitioners, nurses, midwives and laboratory staff: these professionals are listed in regulation 6(3) as people who can access a woman’s linked record of results for the purpose of assisting diagnosis or treatment or determining next test timing. However, they also may be recipients of a CEO request under regulation 10A, and if so, they must provide information about their patient within 30 days. This creates a tension with professional duties of confidentiality, though the regulations override that insofar as compelled disclosure is authorised by law. These professionals also have a duty not to disclose register information except as permitted.

Pathology laboratories: laboratories that process cervical cancer tests are a primary source of data. Before 2018, they were required to forward results automatically; now they may be asked by the CEO to provide information. They can also access register data for quality assurance purposes under regulation 6(1)(d) (comparative data for consistency of performance).

The CEO of WA Health: the CEO is the key operator. Responsibilities include keeping the register, using information for the purposes listed in regulation 6, responding to women’s removal requests, authorising disclosures to corresponding registers, requesting information from third parties, and approving entities for comparative data compilation. The CEO exercises significant discretion: approving research use under regulation 6(1)(e)(iii) and national organisations under (e)(v), and forming opinions about who has relevant information and whether collection is consistent with the objects of Part IXA.

Interstate and Commonwealth agencies: corresponding registers in other states and territories, and the National Cancer Screening Register under Commonwealth law, can receive information from the WA register. This facilitates national data linkage but also means that a woman’s data can flow across borders without her specific consent, as long as it is for the purposes described.

Third parties with information: any person who holds information about a woman - for example, a specialist clinic, a hospital, an insurer, a research database, or even a relative - could in theory be required by the CEO to provide that information. The regulation does not limit this to health practitioners. The only condition is that the CEO must have formed the opinion that the person has information about a woman and that collecting it is consistent with Part IXA objectives. This is a broad and potentially intrusive power.

Duty of the CEO to keep the register: regulation 5(1) mandates that the CEO keep the Cervical Screening Register. The register must contain the types of information listed, and be kept for the five purposes in regulation 5(3). The CEO must use the information for notification of women (normal results and next test timing), management of abnormal results, maintaining linked records, supplying comparative data to laboratories, providing epidemiological data, and monitoring HPV vaccination effectiveness (regulation 6(1)). This is a positive duty; the CEO is not merely authorised but required to use the information in these ways “where possible”.

CEO’s duty to comply with removal requests: under regulation 10(2), the CEO must ensure that a woman’s request for removal of identifying data is complied with as soon as is practicable. Failure is an offence. There is no duty to inform other databases (such as the National Cancer Screening Register) about the removal, and the regulation only applies to the WA register.

Right of women to request removal of identifying data: regulation 10(1) gives a woman an unconditional right to request removal of identifying data. The request must be in writing. There is no requirement to state a reason. The CEO must comply. However, de-identified data may be retained indefinitely. Women do not have a right to be notified of the register’s existence or of the collection of their data, nor a right to access their full record (though they can access it indirectly through their medical practitioner under regulation 6(3)(c)(i), since the linked record is available to the woman herself).

Duty of persons to comply with CEO information requests: regulation 10A(3) imposes a mandatory obligation on any person who receives a written request from the CEO to give the specified information within 30 days. The only defence is that the person did not have the information at the relevant time. This duty overrides ordinary privacy and confidentiality obligations, as the disclosure is authorised by law. There is no provision for compensation for time or cost, nor for objecting on grounds of privacy or burden.

Duty not to disclose register information: regulation 7(1) prohibits any person from disclosing information on the register except with the woman’s written consent, for the purposes of regulation 6 (use by CEO), for inclusion in the National Cancer Screening Register, or with CEO authorisation for disclosure to a corresponding register. Contravention is an offence. This duty applies to the CEO, staff, health practitioners and anyone else who accesses the register.

Right of certain practitioners to access linked records: regulation 6(3) gives medical practitioners (current or former), nurses/midwives engaged by the woman, persons in charge of engaged laboratories, and staff at those practices or laboratories a right to access the woman’s linked record of results for the purpose of assisting in diagnosis or treatment or determining next test timing. This is a permissive right, not a duty. It does not require the woman’s consent for access, but access is limited to those purposes.

The regulations create three specific criminal offences, each with a tiered penalty structure set out in regulation 11. The maximum penalty for any single offence is $1,000, with minimum penalties depending on the number of prior offences: $100 for a first offence, $200 for a second, and $500 for a third or subsequent offence. These are relatively low penalties by contemporary standards, reflecting the age of the regulations (1991) and the fact that many breaches involve non-compliance with administrative requests rather than deliberate harm.

The three offences are:

• Contravening the prohibition on disclosing register information (regulation 7(2)). This applies to any person who discloses information other than as permitted. Given the sensitivity of health data, this is the most significant offence, but the maximum fine of $1,000 may be trivial compared to the harm from a privacy breach.
• Failing to comply with a CEO request for information within 30 days (regulation 10A(4)). This is a strict liability offence with only one defence: proving the person did not have the requested information at the relevant time.
• The CEO contravening the duty to remove identifying data as soon as practicable after a woman’s request (regulation 10(4)). Again, a maximum $1,000 penalty.

Enforcement would typically be by prosecution in the Magistrates Court, initiated by the WA Health Department or the Director of Public Prosecutions. There is no provision for infringement notices or on-the-spot fines. The penalties are low enough that they may not provide a strong deterrent, especially for corporate or institutional actors (e.g., a laboratory failing to provide information faces a maximum $1,000 fine, which is a minor cost). However, the offence provisions also carry reputational risk and potential civil consequences (e.g., professional discipline for health practitioners).

The regulations do not create a private right of action for individuals harmed by disclosure or non-compliance. A woman whose data is improperly disclosed could pursue common law remedies (breach of confidence, negligence) or complaints under privacy legislation, but the regulations themselves do not provide a direct remedy.

These regulations are made under Part IXA of the Health (Miscellaneous Provisions) Act 1911 (WA). Section 289B of that Act allows the Governor to prescribe conditions of health for which a register may be kept; regulation 4 prescribes cervical cancer. The regulations sit within that enabling framework. Part IXA of the Act would contain provisions about the CEO’s powers, confidentiality, and the objects; these regulations fill in the detail.

The regulations explicitly interact with the National Cancer Screening Register Act 2016 (Commonwealth). Regulation 7(1)(ca) permits disclosure of information on the WA register for inclusion in the National Cancer Screening Register established under that Act, section 9. This allows seamless data flow to the national system, which supports the National Cervical Screening Program. However, this disclosure does not require the woman’s consent, only that it is for that purpose. It means WA women’s data can end up in a Commonwealth database even if they have requested removal from the WA register (though presumably the removal request would also need to be communicated to the national register, which is not addressed in these regulations).

Corresponding registers under the law of the Commonwealth or other states/territories are recognised in regulation 3, and regulation 7(1a) allows the CEO to authorise disclosure to those registers if the woman resides there and the information is used for substantially similar purposes. This creates a network of state-based registers sharing data. It does not require the woman’s consent, and the woman may not know her data has been transferred.

The regulations also intersect with state and federal privacy laws. The Privacy Act 1988 (Cth) generally exempts state government agencies from its provisions (except for credit reporting, tax file numbers etc.), so the WA health department is not subject to the Australian Privacy Principles under that Act. However, WA has its own public sector privacy regime, the Freedom of Information Act 1992 and possibly administrative schemes. The regulations’ disclosure restrictions are more specific but may not provide the same level of protection as a comprehensive privacy law. The low penalty for unauthorised disclosure may also be less than what might apply under other legislation (e.g., the Health Services Act 2016 (WA) or professional codes).

The regulations do not mention the Criminal Code or Spent Convictions schemes, so breaches are simple offences.

The regulations were originally made in 1991 as the Health (Cervical Cytology Register) Regulations 1991, coming into operation on 2 March 1992. The name was changed to “Cervical Screening Register” at some point, reflected in the compilation table and regulation 1. The table shows reprints in 2004 and 2009, but significant amendments occurred in 2006, 2007, 2014 and 2018.

In 2006, two sets of amendments: the first (21 Feb 2006) made minor changes, likely updating definitions (e.g., “CEO” replacing earlier references); the second (15 Dec 2006) further amended definitions and regulations 6 and 7. The 2007 amendments (effective 3 Oct 2007) expanded regulation 6(3) to include nurses and midwives as persons who could access linked records.

The 2014 amendments were substantial. They changed the name to “Cervical Screening Register” (hence the compilation title). They inserted a new regulation 5 (replacing the old one) to define the register’s contents more broadly, added regulation 10A giving the CEO power to request information, amended regulation 6 to include HPV vaccination monitoring, and amended regulation 10 on removal of identifying data. The 2014 amendments also expanded the list of people who could access records.

The 2018 amendments deleted regulations 8 and 9. Regulation 8 had dealt with the details of forwarding test results by pathology laboratories; regulation 9 had required laboratories to forward results to the CEO. Their deletion removed the automatic forwarding obligation. The 2018 amendments also updated regulation 5(2) to refer to forwards under old regulation 9 (before deletion) and inserted “other information forwarded under regulation 10A”. This shifted the data collection model from mandatory automatic disclosure to discretionary CEO requests. The heading of Part 2 was also amended.

This history reveals a trade-off: the 2014 and 2018 changes increased the CEO’s discretionary power to request information from any person, while removing the blanket obligation on laboratories to forward results. This may reduce the flow of data if the CEO does not actively request it, but also gives more flexibility. The inclusion of the National Cancer Screening Register pathway in 2018 (regulation 7(1)(ca)) also aligns the state register with the national program.

The regulations do not cite any court cases, and there is no readily apparent reported litigation specifically under these regulations. Given the low penalties and the administrative nature of the register, court challenges are likely rare. Potential litigation could arise from a prosecution for non-compliance with a CEO request (regulation 10A) or from a disclosure offence (regulation 7). A woman could also seek judicial review of a CEO decision, for example a refusal to remove identifying data (unlikely given the mandatory language) or an overbroad request for information.

The regulations have not been tested on constitutional grounds, such as the interaction with implied freedom of political communication (unlikely) or acquisition of property on just terms (possible if a compulsory request for information is seen as an acquisition of intellectual property or trade secrets). The WA Constitution does not have a just terms requirement like the Commonwealth, but the common law may provide some limits. No case law is noted.

The absence of litigation may also reflect the small stakes: with maximum penalties of $1,000, it is often cheaper to comply than to fight.

Broad CEO request power: regulation 10A allows the CEO to request information from a “person” who in the CEO’s opinion has information about a woman. This can include non-health professionals: employers, insurers, family members, researchers, schools. The only precondition is that the woman already has test results on the register and the CEO considers collection consistent with Part IXA objects. The person must comply within 30 days or face a criminal offence. There is no right to object, no exception for legal professional privilege or commercial confidentiality, and no compensation for time or expense. This is a powerful compulsory information-gathering tool with minimal safeguards.

No requirement for consent for initial data in register: while disclosure of register information is restricted, the regulations do not require a woman’s consent for her test results to be placed on the register in the first place. The pre-2018 system had automatic forwarding from laboratories; the current system relies on CEO requests, but if the CEO requests the laboratory, they must comply. Women may not be told that their data is being collected. The opt-out right (regulation 10) comes only after the fact.

Opt-out does not delete the record: a woman can have identifying data removed, but de-identified data (test results, dates, outcomes) may be retained indefinitely. The regulation says “may be retained” - the CEO has discretion to keep it. This means her screening history remains accessible for research and statistics even after she requests opt-out. There is no right to complete erasure of the record.

Data may be shared across borders without notice: the CEO can authorise disclosure to corresponding registers in other states and to the National Cancer Screening Register. Women may not be aware that their data has moved interstate or to the Commonwealth. The consent of the woman is not required for these disclosures. Once data leaves the WA register, it is subject to the laws of the receiving jurisdiction, which may have different protections.

History of automatic forwarding is gone but old data remains: the register still contains results forwarded under repealed regulation 9. Those women’s data are permanently on the register unless they request removal. The regulations do not require the CEO to inform those women that their data is held.

Penalties are low: maximum $1,000 for any offence. This may not deter a commercial laboratory from delaying compliance or a large hospital from mishandling data. The penalties are not tiered by harm or by number of individuals affected. A breach affecting thousands of women carries the same maximum as a single breach.

For the CEO (WA Health): ensure the register is maintained as required by regulation 5. Establish procedures for receiving and processing women’s requests for removal of identifying data under regulation 10, and act on them as soon as practicable. Maintain systems for disclosing information only as permitted: for regulation 6 purposes (use by CEO), with written consent, to the National Cancer Screening Register, or with authorisation for corresponding registers. Keep records of requests for information under regulation 10A and ensure that any such request is in writing, specifies the information sought, and is only made when the conditions in regulation 10A(2) are met. Implement data security measures to prevent unauthorised disclosure. Produce de-identified statistical data for public health purposes, ensuring no identifying information is included.

For pathology laboratories and health practitioners: when receiving information requests from the CEO under regulation 10A, comply within 30 days. If you do not have the requested information, you must be able to prove it (the defence under regulation 10A(5)). Keep records of compliance. Do not disclose information taken from the register to anyone except as authorised (e.g., for treatment of the woman, or for inclusion in the national register). If you are a practitioner listed in regulation 6(3), you may access the register to assist in diagnosis or treatment, but only for that purpose. Do not browse records of patients not under your care. Understand that the obligation to supply information to the CEO overrides patient confidentiality; you cannot refuse on that basis.

For women: you can request in writing that identifying data be removed. WA Health should have a form for this. Understand that de-identified data may remain, and that data may have already been shared interstate. If you are concerned about privacy, ask your health practitioner whether they plan to send your results to the register (they may not know the details). Note that you cannot prevent initial collection; your only recourse is later removal of identifiers.

For any person receiving a CEO request: treat it seriously. Confirm that the request is in writing and purports to be from the CEO. If you do not have the information, respond within 30 days stating that, and keep a record. If you do have the information, provide it as requested. Failure is a criminal offence. There is no exemption for small businesses or individuals, so plan for the administrative burden.

General compliance strategy: because the regulations are sparse and penalties low, entities should nonetheless treat the register’s data as sensitive health information and apply best-practice privacy protections. Train staff on the disclosure restrictions. Establish a point of contact for CEO requests. Review whether any information you hold about women who have had cervical cancer tests might be subject to a future request, and consider being proactive in preparing to comply quickly. For laboratories, maintain accurate records of test results and patient identifiers to facilitate compliance.