Health (Cervical Screening Register) Regulations 1991

The key concept is the Register itself: a statutory database managed by the CEO of the WA Department of Health, dedicated to cervical cancer test results and associated information. The definition of cervical cancer is precise: it means the malignant growth of human tissue in the uterine cervix which, if unchecked, is likely to spread and has a tendency to recur (regulation 3). This is a clinical definition that distinguishes cervical cancer from its precursors, though cervical cancer test is defined broadly to include tests for cancer or any of its precursors, and includes pathological examination of a specimen from the woman (regulation 3). The register is explicitly not an opt-in system; women are included by default if their test results are forwarded (historically by laboratories under deleted regulation 9) or if the CEO receives results from a corresponding register. The concept of a corresponding register is critical: it means a register established under Commonwealth or another State or Territory law that contains information of the kind held on the WA Register (regulation 3). This enables cross-jurisdictional data sharing without the woman’s consent, as long as the CEO authorises disclosure and the woman resides in the other jurisdiction (regulation 7(1a)). The purposes for which the register is kept are listed in regulation 5(3): reducing illness and death from cervical cancer, reducing the number of cases, planning and evaluating services, compiling statistical information, and carrying out research. These purposes are broad and include research, which is not limited to government-funded research; the CEO may approve research by any organisation, but the regulation does not require the researcher to be a public body or to have ethics approval, though external approval mechanisms may apply under other laws. The concept of use of information under regulation 6 imposes mandatory duties on the CEO, not discretionary powers. The CEO must use the information to notify women of normal results and appropriate recall times, and must ensure appropriate procedures for abnormal or unsatisfactory results. This creates a positive obligation on the state to actively manage recall and follow-up, which has implications for privacy and for the woman’s choice to opt out of identification only (not out of inclusion). The linked record of results is available to the woman herself and to a defined set of practitioners: current or former medical practitioners, nurses or midwives engaged by the woman to conduct a test, the person in charge of a laboratory engaged by the woman, and staff at those practices or laboratories (regulation 6(3)). This is a limited list but is not restricted to those currently treating the woman; it includes formerly engaged practitioners. The concept of approved means approved by the CEO (regulation 3), giving the CEO wide discretion over which organisations may receive comparative data under regulation 6(1)(e)(v). Authorisation is also a CEO power for interstate disclosures (regulation 7(1a)). The opt-out mechanism is limited: a woman may only request removal of data that identifies her; non-identifying data may be retained (regulation 10(3)). This means demographic or epidemiological data stripped of identifiers can persist even against the woman’s wish, and the register may still contain a de-identified record linked to a unique identifier. The concept of a prescribed condition (regulation 4) brings the whole regulatory scheme under Part IXA of the Health (Miscellaneous Provisions) Act 1911, which is not reproduced here but likely contains additional provisions about the CEO’s powers and the interaction with other health information laws.

These regulations directly affect several categories of persons. First, every woman in Western Australia who undergoes a cervical cancer test is affected, because her test results may end up on the Register without her explicit consent if they are forwarded by a laboratory under the old regime or if the CEO obtains them from a corresponding register for a woman who has moved from another jurisdiction. The regulations do not require a woman’s consent to be included, only to have identifying data removed after inclusion (and even then, the non-identifying data remains). This means women have a mandatory inclusion unless they take active steps to assert their opt-out right. Second, medical practitioners, nurses, and midwives who conduct cervical cancer tests are affected because they may receive requests from the CEO for information about their patients under regulation 10A, and they are under a legal duty to comply within 30 days. They also have a right, but not a duty, to access the linked record of results for their current or former patients (regulation 6(3)). That access is not conditioned on the woman’s consent for that specific access; rather, the regulation itself provides the authority. Third, laboratories that perform cervical cancer testing are affected. Although the pre-2018 mandatory forwarding obligation (regulation 9) has been deleted, laboratories may still hold historical results that were forwarded, and they are among the persons who may receive a CEO request for information about a woman. The person in charge of a laboratory also has access to the linked record for women who engaged that laboratory. Fourth, members of staff at medical practices, nursing practices, midwifery practices, and laboratories are affected because they too may access the linked record of results for the purposes of assisting diagnosis or treatment or determining when a woman should have her next test (regulation 6(3)(d)). This is a relatively wide class: any staff member, not just clinicians, can access the data. Fifth, the Commonwealth National Cancer Screening Register is affected because regulation 7(ca) permits disclosure of WA Register information to that register for inclusion under s 9 of the National Cancer Screening Register Act 2016. This creates a flow of data from WA to the national system without requiring the woman’s specific consent for that transfer. Sixth, corresponding registers in other Australian states and territories are affected because they can receive information from the WA Register under CEO authorisation (regulation 7(1a)) and can also provide information to the WA Register (regulation 5(2)(a)(ii)). Seventh, researchers are affected because the regulations provide a database of epidemiological data that can be used for approved research, but only with CEO approval and after stripping identifiers (regulation 6(2)). Eighth, the CEO of the WA Department of Health is the central administrative actor with duties and powers under nearly every regulation. Finally, any person who possesses information about a woman that relates to her cervical cancer testing or treatment is potentially subject to a CEO request under regulation 10A, which could include pathology companies, hospitals, screening clinics, or even individual clinicians. The breadth of who may be requested is notable: it is not limited to healthcare providers but includes any person in the CEO’s opinion who has information. This could theoretically include insurers, employers, or family members, though in practice health information is likely held by health professionals.

The regulations impose specific duties and grant specific rights to different actors. The CEO has the duty to keep the Register (regulation 5(1)) and to use the information in the ways set out in regulation 6(1). Those uses include the mandatory duties to provide notification to women with normal results of the appropriate time for their next test, to ensure appropriate follow-up for abnormal or unsatisfactory results, and to maintain a linked record of results. The CEO also has the duty to ensure that a woman’s request for removal of identifying data is complied with as soon as is practicable (regulation 10(2)). Non-compliance with that duty is itself an offence. The CEO has the power to request information from any person about a woman, but that power is qualified: the request must be in writing, the information must relate to a woman whose test results are already on the register (or were forwarded under the old regulation), and the CEO must be satisfied that collecting the information is consistent with achieving the objects of Part IXA of the Act (regulation 10A(2)). The CEO also has the power to authorise disclosure to a corresponding register (regulation 7(1a)) and to approve organisations for receipt of comparative data (regulation 6(1)(e)(v)). For persons who receive a CEO request under regulation 10A, they have a duty to comply within 30 days (regulation 10A(3)). This duty is backed by an offence with a penalty of up to $1,000 but with a statutory defence: it is a defence to prove that the person did not have the requested information at the relevant time (regulation 10A(5)). That defence is limited; it does not extend to inconvenience or cost, and the person bears the evidentiary burden. Right of access: women have the right to request removal of identifying data (regulation 10(1)), but they do not have a right to opt out of inclusion altogether, nor a right to have all their data deleted (non-identifying data may be retained). Women also have the right to access their own linked record of results (regulation 6(1)(c)(i)). It is not stated explicitly how they access it, but it must be available to them. Medical practitioners, nurses, midwives, and laboratory heads have a right to access the linked record of results for women they have treated or tested, without needing the woman’s consent each time (regulation 6(3)). That right is not absolute; it is for the purpose of assisting in diagnosis or treatment or determining when the woman should have her next test. Staff members at the practices or laboratories of these practitioners also have access rights. The general public has no right of access to identifiable data, but the CEO must publish statistical profiles that do not identify individuals (regulation 6(1)(e)(iv)). The woman’s right to give or withhold consent for disclosure is recognised in regulation 7(1)(a): a person may disclose information on the Register with the written consent of the woman to whom it relates. That is a permissive provision; it does not limit other permitted disclosures. A person has the right, but not the duty, to disclose for the purposes of regulation 6 or to the Commonwealth register or to a corresponding register with CEO authorisation. The key duty not to disclose is imposed on all persons in regulation 7(1): a person must not disclose information on the Register other than as permitted. Breach is an offence. This duty applies to any person, not just those who handle the register, but it only attaches to information that is on the Register (i.e., that has been collected into the Register). It does not apply to information that has not yet been added. The practical effect is that once information is on the Register, its redisclosure is tightly controlled. There is also a duty on the CEO not to publish identifying data under regulation 6(2) when providing statistical profiles or comparative data.

The penalties under these regulations are set out in regulation 11 and are notably modest. A person who commits an offence under these regulations is liable to a penalty that is not more than $1,000 and not less than a sliding scale: for a first offence, the minimum is $100; for a second offence, $200; for a third or subsequent offence, $500. The maximum is always $1,000. These are criminal penalties, not civil penalties. The specific offences created by the regulations are as follows. Contravening the prohibition on disclosure of information on the Register (regulation 7(1)) is an offence under regulation 7(2). Non-compliance with a CEO request for information within 30 days (regulation 10A(3)) is an offence under regulation 10A(4). The CEO failing to comply with a woman’s request to remove identifying data as soon as practicable (regulation 10(2)) is an offence under regulation 10(4). Notably, the offence in regulation 10(4) applies to a person who contravenes subregulation (2); that subregulation imposes the duty on the CEO, so the offence applies to the CEO as a person. This means the CEO or their department could theoretically be prosecuted for failure to remove identifying data. However, in practice, the penalty is low, and enforcement is likely rare. The penalty range is fixed dollar amounts, not penalty units, so they are not indexed to inflation unless amended. The $1,000 cap means the offences are summary in nature and unlikely to attract significant legal contest. There is no provision for a civil penalty, injunctive relief, or damages. The enforcement mechanism is prosecution in a court of summary jurisdiction, presumably by the Department of Health or the police. There is no express provision for internal review, merits review, or appeal of a CEO decision to request information, to authorise disclosure, or to refuse to remove data. A woman whose request for removal is not complied with could complain to the Health Services Commissioner or potentially seek judicial review, but the regulations themselves provide only the criminal offence for non-compliance. The defence for non-compliance with a CEO request (regulation 10A(5)) - that the person did not have the information at the relevant time - is the only statutory defence. It places the evidentiary burden on the defendant. There is no defence of unreasonable burden, cost, or that the request was too broad or not for a proper purpose (though the CEO must be satisfied the request is consistent with Part IXA objects, that is a precondition to the request, not a defence). The absence of an explicit obligation on the CEO to specify a time limit beyond 30 days means the request must be complied with within 30 days of receipt; if the request is ambiguous, the recipient bears the risk of non-compliance. Given the low penalties, the practical enforcement risk for non-compliance may be low, but the offence remains on the statute book and could be used strategically. The penalty for disclosure offences may also be low relative to the potential harm, though it is likely that professional disciplinary bodies would impose separate sanctions for misconduct. The interaction with other privacy laws is not addressed in the penalties section.

The regulations are made under the Health (Miscellaneous Provisions) Act 1911 (WA), specifically under Part IXA of that Act. The primary Act is not reproduced here, but regulation 4 expressly prescribes cervical cancer under section 289B of the Act as a condition to which Part IXA applies. This means the broader provisions of Part IXA governing health registers, data collection, and confidentiality likely apply and may contain additional protections, powers, and penalties. The regulations must be read in conjunction with that parent Act. The regulations also explicitly interact with the National Cancer Screening Register Act 2016 (Commonwealth). Regulation 7(ca) permits disclosure of information on the WA Register for the purpose of including it in the National Cancer Screening Register established under s 9 of that Commonwealth Act. This creates a direct data-sharing pathway without requiring the woman’s consent for that specific transfer, though the Commonwealth Act will have its own privacy and use provisions. There is also interaction with corresponding registers in other Australian states and territories. The definition of corresponding register in regulation 3 includes registers established under the law of the Commonwealth or of another State or a Territory that contain information of the kind held on the WA Register. Regulation 7(1a) allows the CEO to authorise disclosure to the person in charge of such a register if the woman resides in that jurisdiction and the information is to be used solely for purposes substantially similar to the recall and follow-up purposes in regulation 6(1)(a) and (b). This means information can flow across borders without the woman’s consent, as long as she is a resident of the other jurisdiction. There is no apparent requirement to notify the woman of such transfers. The regulations also interact with general health privacy laws in Western Australia, such as the Health Services (Quality Improvement) Act 1994 (which may apply to quality assurance data) and the common law duty of confidentiality. The regulations do not purport to override those laws entirely; they provide a specific statutory authority for certain uses and disclosures that would otherwise be a breach of confidence. However, the interaction is not explicit. For example, a medical practitioner who accesses a woman’s linked record under regulation 6(3) is protected from a claim of breach of confidence if the access is for the authorised purpose, but the regulation does not address whether the practitioner must inform the woman that such access occurred. There is also potential interaction with the Privacy Act 1988 (Cth) if the WA Department of Health is an organisation covered by that Act, but state health departments are generally exempt from the Commonwealth Privacy Act in respect of their health functions under s 7B(2) of that Act (unless they are a contracted service provider for the Commonwealth). The WA Department of Health is also subject to the Freedom of Information Act 1992 (WA), which may allow individuals to access their own records held on the Register, but the regulations themselves provide a specific right of access. The regulations do not address data breach notification, record retention periods, or destruction of data. There is no express sunset clause or review requirement. The regulations also do not interact with any specific therapeutic goods or pathology accreditation laws, but laboratories that forward results or receive CEO requests are likely also regulated under the Pathology Services Accreditation Scheme and the Health Insurance Act 1973 (Cth) for Medicare billing. The deletion of regulation 9 (the former mandatory forwarding obligation for laboratories) in 2018 means that there is no longer a direct statutory duty on laboratories to report results to the register; instead, the CEO relies on requests and on data from the Commonwealth register. This shift may reduce the compliance burden on laboratories but increases the CEO’s discretion and the reliance on individual requests.

The regulations were originally made in 1991 under the title Health (Cervical Cytology Register) Regulations 1991. They commenced on 2 March 1992 (regulation 2). The first reprint was as at 2 April 2004. The first substantive amendment was in 2006 via the Health (Cervical Cytology Register) Amendment Regulations 2006, gazetted 21 February 2006, which amended regulation 3 (terms used) and regulation 7 (disclosure). Later in 2006, the Health (Cervical Cytology Register) Amendment Regulations (No. 2) 2006 (gazetted 15 December 2006) further amended regulations 3, 6, 7, and 10. In 2007, the Health (Cervical Cytology Register) Amendment Regulations 2007 (gazetted 2 October 2007) amended regulation 6 and 7, with most provisions commencing 3 October 2007. A second reprint was as at 20 February 2009 incorporating these changes. In 2014, the Health (Cervical Cytology Register) Amendment Regulations 2014 (gazetted 23 May 2014) made substantial changes: they amended the citation in regulation 1 to change the name to Health (Cervical Screening Register) Regulations 1991, amended regulation 3 (inserting a definition of cervical cancer), substituted a new regulation 5 (Cervical Screening Register) with expanded purposes, amended regulation 6 (use of information, adding new paragraph (f) for monitoring HPV vaccination effectiveness and expanding the list of persons who can access records), amended regulation 7 (adding paragraph (ca) for disclosure to the Commonwealth National Cancer Screening Register), inserted new regulation 10A (CEO may request information), and amended regulation 10 (removal of identifying data). The most recent amendment came in 2018 via the Health Regulations Amendment (Cervical Screening Register) Regulations 2018 Part 2 (gazetted 10 April 2018, commencing 11 April 2018). That amendment deleted the heading of Part 2 (originally “Cervical Cytology Register” replaced by “Cervical Screening Register”), amended regulation 5(2) to reflect the deletion of regulation 9, deleted regulations 8 and 9 entirely, and made minor amendments to regulations 7 and 10A. The deletion of regulations 8 and 9 removed the former obligation on laboratories and others to forward results to the register. The table in the Notes shows that regulation 9 concerned forwarding results; its deletion means the current regulations rely on CEO requests and data sharing with corresponding registers. The regulation 10A introduced in 2014 became the primary mechanism for data collection. The compilation table also notes that the original 1991 regulations were published in the Gazette on 3 January 1992, not 1991; the year in the title refers to the year of the parent Act. The series of amendments shows a shift from an automatic reporting model to a discretionary request model, and an increasing integration with national screening registers. The addition of HPV vaccination monitoring in 2014 reflects the evolution of cervical cancer prevention. The removal of the word “Cytology” and replacement with “Screening” in the title in 2014 reflects the broader scope, as cervical screening now includes HPV testing, not just cytology.

The source text provided does not reference any litigation history. There are no reported cases cited in the regulations, and the compilation table does not list any court decisions. Given the nature of the regulations - administrative health records with low penalties and limited public profile - it is plausible that there has been little or no reported litigation directly under these regulations. Possible areas of dispute could include challenges to CEO requests for information (on grounds of unreasonableness or privacy), disputes over access to linked records, or failure to remove identifying data, but no such cases are recorded in the provided source. A practical search of Australian legal databases (not conducted here) would be needed to confirm. The absence of litigation history does not mean no disputes have arisen; they may have been resolved internally or through privacy complaints rather than court proceedings. The regulations do not create a private right of action for breach, only criminal offences, which reduces the incentive for civil litigation. The modest penalties also reduce the stakes for a court challenge. The interaction with the Commonwealth National Cancer Screening Register might generate disputes under that Act rather than under these state regulations. The lack of litigation history is a notable feature: it suggests that the regulatory scheme is not heavily contested, perhaps because compliance is straightforward or because the enforcement is low. However, the broad CEO discretion to request information from any person without a warrant or judicial oversight could be subject to a future test under administrative law, such as a challenge that a request was not made bona fide or was for an improper purpose. The regulations do not provide for a merits review of a CEO decision, so judicial review would be the only avenue. As of the date of the source (which is a compilation as at 2018), no such case is recorded.

The regulations contain several traps for the unwary. First, the definition of person in regulation 10A is not limited to healthcare providers. The CEO may request information from any person who in the CEO’s opinion has information about a woman. This could include a family member, an employer, or a school, though in practice it would likely be limited to those with health information. But the phrase is broad, and there is no requirement that the person have a professional or legal relationship with the woman. Second, the duty to comply with a CEO request within 30 days is absolute, subject only to the defence of not having the information. There is no defence that the request is overly broad, that complying would breach another law (such as privacy laws in other jurisdictions), or that compliance would be unreasonably burdensome or costly. A person who receives a request but believes the information is not relevant or is excessive still must comply or risk an offence. Third, the woman’s opt-out right is limited to removal of identifying data. She cannot require that her information be removed entirely from the register. Even after a request, non-identifying data may be retained under regulation 10(3). This means that epidemiological or de-identified records persist. There is no provision for the woman to opt out of inclusion in the first place; inclusion is automatic if results are forwarded or if the CEO receives them from another register. Fourth, the disclosure prohibition in regulation 7 applies to information on the Register, not to information that has not yet been added. A laboratory that receives a test result before it is on the register is not covered by the prohibition, but once it is forwarded to the CEO (whether voluntarily or under request), that information becomes part of the Register and its further disclosure is restricted. Fifth, the penalties are low, but the offence is criminal, and a conviction may have consequences for professional registration even if the fine is small. A healthcare professional convicted of an offence under these regulations may need to report the conviction to the Australian Health Practitioner Regulation Agency. Sixth, the CEO has no explicit obligation to notify a woman when information about her is requested from a third party or when it is disclosed to a corresponding register. The woman may never know that her information has been shared across borders. Seventh, the access rights for practitioners under regulation 6(3) extend to former practitioners and to any member of staff at the practice or laboratory. This could include receptionists, billing staff, or administration personnel who have no clinical need to see the results. The regulation does not require that the staff member be specifically authorised or trained in privacy. Eighth, the phrase where possible in regulation 6(1)(a) and (b) gives the CEO some discretion about the notification and follow-up duties. If the CEO deems it not possible to notify a woman, there is no breach. Ninth, the regulations do not specify how long data is retained. There is no destruction schedule or archive rule. The accumulation of data indefinitely may create long-term privacy risks. Tenth, the CEO may approve organisations for receipt of comparative data under regulation 6(1)(e)(v) without any published criteria. This is a broad, unreviewable discretion. Finally, the interaction with the Commonwealth National Cancer Screening Register means that personal information may flow to a federal database that is governed by a different set of rules, potentially with different opt-out or deletion rights.

Compliance obligations under these regulations depend on the role of the entity or individual. For healthcare providers (medical practitioners, nurses, midwives) who conduct cervical cancer tests, the primary obligation is to respond to any CEO request for information within 30 days. If no request is received, there is no positive duty to forward results (since regulation 9 was deleted). However, if a provider receives a request, they must ensure that the information requested is provided accurately and within the timeframe. They should maintain records showing what information was provided and when, to demonstrate compliance. They should also ensure that any information they receive from the Register (via the linked record access) is used only for the authorised purpose of assisting in diagnosis, treatment, or determining next test timing. They must not redisclose that information except as permitted by regulation 7. For laboratories, the obligations are similar: respond to CEO requests, and ensure that any access to linked records is limited to authorised staff for authorised purposes. Laboratories should also ensure that any historical data that was forwarded under the old regulation 9 remains accurate and that they do not disclose register information to third parties without consent or a specific statutory authority. For managers of practices and laboratories, they must train staff on the limits of access: only staff members at that practice or laboratory may access the linked record, and only for the purpose of assisting in diagnosis or treatment or setting recall dates. Staff must not use the information for any other purpose, such as marketing or research. There should be policies to ensure that access logs are kept and that staff understand that unauthorised disclosure is an offence. For the CEO and the Department of Health, compliance involves maintaining the Register in accordance with regulation 5, actively using the information for the purposes in regulation 6 (including recall notifications and follow-up), ensuring that identifying data is not published in statistical reports, and ensuring that requests for removal of identifying data are processed as soon as is practicable. The CEO should also establish clear procedures for authorising disclosures to corresponding registers under regulation 7(1a) and for approving organisations for comparative data. For any person who receives a CEO request and does not hold the requested information, they should document that fact and respond within 30 days stating that they do not have the information, as the defence requires proof that they did not have it at the relevant time. It would be prudent to respond in writing even if the person believes they have no relevant information, to avoid a charge of failing to comply. For women who wish to exercise their opt-out right, they must make a written request to the CEO. The regulations do not specify a format, but a signed letter or email would suffice. The request is for removal of identifying data only; the woman should be aware that de-identified data may persist. There is no mechanism to object to inclusion in the first place, so women should discuss with their healthcare provider whether their test results will be forwarded (though forwarding is no longer mandatory, providers may voluntarily send results, or the CEO may request them later). Finally, all persons should be aware that the offence provisions apply to any person, not just those within the health system. A person who inadvertently comes into possession of Register information (for example, through a data breach or misdirected communication) must not disclose it except as permitted. Compliance with the Commonwealth National Cancer Screening Register Act 2016 is also relevant if information is disclosed to that register. Entities should have data breach response plans that address notification obligations under both state and Commonwealth law, especially given that the regulations themselves do not mandate breach notification. Overall, compliance is not onerous for most actors, but the trap is the breadth of the CEO request power and the narrow defence, combined with the relatively low but nevertheless criminal penalties.