Health Insurance (Quality Assurance Activity – Australian Breast Device Registry) Declaration 2024

Several discrete legal and operational concepts are central to the instrument.

• Declaration under the Health Insurance Act 1973: The instrument is made under subsection 124X(1) of the Health Insurance Act 1973 (s 3). The declaration mechanism is the means by which an activity is formally identified as a "quality assurance activity" so that Part VC applies (s 5). The declaration is thus an enabling or designatory instrument rather than a direct regulatory code.

• Scope limited to Australian health services: The declaration applies "to the extent that the quality assurance activity relates to health services provided in Australia" (s 5). The instrument therefore limits the statutory application geographically and functionally to the nexus between the registry activity and Australian-provided health services.

• Commencement and repeal rules: The instrument commences the day after registration for the whole instrument (s 2(1) table, row 1). It is repealed when it ceases to be in force in accordance with subsection 124X(4) of the Health Insurance Act 1973 (s 4). The instrument also contains a formal note that the commencement table, and the information in its third column, are not part of the instrument and may be edited in published versions (s 2(2)).

• Registrar operator and activity description: The Schedule names the operator: the Monash University School of Public Health and Preventive Medicine (Schedule 1, item 2). The Schedule also describes the registry’s substantive function: tracking the performance of high-risk implantable breast devices (including implants, tissue expanders and matrices used in reconstructive and cosmetic breast surgery), and collecting data on implantation, revision or explantation of such devices from participating hospitals and surgeons (Schedule 1, item 2).

• Data outputs and audiences: The Schedule specifies outputs and dissemination channels. De-identified results are reported back to participating clinicians, health service providers and other key stakeholders (Schedule 1, item 2). De-identified aggregated data is published in the ABDR’s annual reports, in academic surgical journals and in quality and safety reports provided to device companies (Schedule 1, item 2).

• Quality assurance aims: The Schedule articulates the registry’s aims in three linked strands: (1) to collect population-level data to assist patients, surgeons and hospitals if the TGA issues a device warning or recall; (2) to monitor and report long-term device performance and provide performance information to the TGA to assist regulatory action; and (3) to monitor and report trends and complications associated with breast device surgery (Schedule 1, item 2).

These concepts show the instrument’s role as a legal designation linking an operational registry to the statutory framework of the Health Insurance Act 1973. The instrument conveys the identity of the operator, the narrow clinical focus (high-risk implantable breast devices), the data sources used, the audiences for de-identified and aggregated data, and the safety and regulatory aims oriented towards patients, clinicians and the TGA.

The instrument identifies particular actors by role and shows who will receive outputs from the ABDR, but it is sparse on prescriptive obligations. The Schedule expressly identifies the following affected parties.

• Registry operator: The Monash University School of Public Health and Preventive Medicine is named as the operator of the ABDR (Schedule 1, item 2). As the operator, Monash University will act as the entity running the quality assurance activity described, including tracking devices, collecting data and producing reports. The instrument does not specify funding, governance, contracting arrangements or statutory powers for the operator; it only names the operator and describes the activity.

• Participating hospitals and surgeons: The Schedule states that "Data relating to implantation, revision or explantation of breast devices is collected from participating hospitals and surgeons" (Schedule 1, item 2). These entities are data sources and primary participants in the registry’s data collection operations. The instrument does not stipulate whether participation is compulsory or voluntary; the phrase "participating hospitals and surgeons" implies that coverage will depend on participation, and therefore those entities are operationally central to the registry’s data completeness and utility.

• Patients: While not named as an actor providing data, the Schedule identifies patients as beneficiaries of the registry’s aims. The Schedule states the overall aim is to "improve the safety of breast devices for patients" through population-level data collection and monitoring (Schedule 1, item 2). The instrument also contemplates assisting patients in the event of a TGA warning or recall (Schedule 1, item 2).

• The Therapeutic Goods Administration (TGA): The Schedule expressly links the registry to the TGA as a recipient of performance information and as an actor whose regulatory capacity may be assisted by registry outputs. The Schedule notes that performance information will be provided to the TGA "to assist it in its regulatory capacity" and that population-level data is to assist stakeholders "should a device warning or recall be made by the Therapeutic Goods Administration (TGA)" (Schedule 1, item 2).

• Device companies: The Schedule explicitly lists device companies as recipients of quality and safety reports containing de-identified aggregated data (Schedule 1, item 2). Device companies are therefore stakeholders with direct access to aggregate findings reported by the registry.

• Clinicians and health service providers: De-identified results are reported back to "participating clinicians, health service providers and other key stakeholders" (Schedule 1, item 2). Reporting back to clinicians and providers creates an informational relationship between the registry and these parties.

• Academic publishers and scientific community: The Schedule anticipates the publication of de-identified aggregated data in academic surgical journals and annual reports produced by the ABDR (Schedule 1, item 2), which affects researchers, journals and readers of those publications.

• Entities affected by Part VC: Because the instrument declares the ABDR as a quality assurance activity "to which Part VC of the Health Insurance Act 1973 applies" (s 5), any entity whose conduct falls within the operation of Part VC (the precise content of which is not set out in this instrument) may be affected as a matter of law by the application of that Part to the ABDR. The instrument itself does not define those consequences; its effect is to bring the ABDR under Part VC.

Absent from the instrument are express duties on private parties to provide data, specified consent regimes, enforcement mechanisms against non-participation, or any explicit funding beneficiaries other than the named operator and listed recipients of outputs. The practical effect on coverage and comprehensiveness will therefore depend on the registry’s operational relationships with participating hospitals and surgeons and on any obligations or protections in Part VC or in other instruments or contracts outside the declaration.

The declaration and its Schedule set out descriptive operational points but do not themselves create a detailed list of statutory duties, rights, offences or penalties beyond the effect of bringing the activity within Part VC. The instrument describes tasks performed by the registry and described outputs; it does not impose explicit new statutory obligations on hospitals, surgeons, patients, device companies or Monash University within the text of the instrument itself.

• Declaration as the legal hinge: Section 5 declares that the described activity "is declared to be a quality assurance activity to which Part VC of the Health Insurance Act 1973 applies." That statement is the principal legal act in the instrument. Any duties, protections or rights that flow from being a declared "quality assurance activity" will derive from Part VC of the Health Insurance Act 1973. The instrument does not reproduce Part VC or its terms, and therefore the declaration functions to extend the legal regime of Part VC to the ABDR where it relates to Australian health services (s 5).

• Operational duties described by the Schedule: The Schedule identifies activities performed by the registry operator, which operationally function as duties the operator undertakes: tracking performance of high-risk implantable breast devices; collecting data on implantation, revision or explantation from participating hospitals and surgeons; monitoring and reporting on device performance and associated trends and complications; and reporting de-identified results back to clinicians, health service providers and stakeholders (Schedule 1, item 2). These are presented as the registry’s functions rather than as statutory duties imposed on third parties.

• Data handling practice stated in Schedule: The Schedule specifies that results and published data are "de-identified" and "de-identified aggregated data" respectively (Schedule 1, item 2). Those terms indicate the operator’s approach to reporting and publication, signalling a rights- and privacy-related choice to avoid identifying individuals in outputs. The instrument does not define "de-identified" or set standards for de-identification; it therefore provides a statement of practice without statutory detail on the threshold for identifiability, data retention, re-identification risk or data security.

• Rights to receive information: The Schedule specifies who receives outputs: participating clinicians, health service providers, other key stakeholders, device companies, academic journals and the public (via annual reports). Those recipients have rights as informational beneficiaries of the registry’s outputs in that they will be provided with de-identified results and de-identified aggregated data. The instrument does not create an enforceable entitlement for any particular third party to receive customised data beyond the channels listed.

• Absence of explicit compulsion or consent clauses: The instrument does not create explicit statutory obligations requiring hospitals or surgeons to participate or to supply data, nor does it articulate patient consent procedures. It also does not state whether patients can opt out or how opt-outs would be handled. These matters are left unstated in the declaration.

• Temporal and legal limits: The declaration is limited to activities that relate to health services provided in Australia (s 5). Rights and obligations that might flow from Part VC will therefore apply only to the extent of that relationship.

Practically, the instrument’s key legal duty is the application of Part VC to the ABDR; the rest of the Schedule describes the registry’s operational duties and outputs. Entities seeking to know their statutory duties should consult Part VC itself in the Health Insurance Act 1973, since this instrument does not set out the content of those duties or the mechanism by which non-compliance would be addressed.

The instrument contains no express penalties, compliance sanctions, enforcement powers, or administrative enforcement mechanisms within its four operative sections and Schedule. The text sets out a declaration and a descriptive Schedule; it does not prescribe offences, fines, or enforcement pathways.

• No penalties in the instrument: None of the instrument’s numbered sections or the Schedule specify criminal or civil penalties, monitoring powers beyond the operator’s monitoring role, or enforcement arrangements against hospitals, surgeons or other entities. The absence of such provisions means the instrument does not itself generate a standalone penalty regime.

• Enforcement by reference to Part VC: Because the instrument declares the ABDR to be a quality assurance activity "to which Part VC of the Health Insurance Act 1973 applies" (s 5), any enforcement consequences are to be found in the provisions of Part VC. The instrument does not reproduce or summarise those provisions; it merely brings the ABDR within their scope. Therefore, any statutory penalties, confidentiality protections, admissibility rules or regulatory enforcement mechanisms that are part of Part VC (whether protective or prohibitive) will apply to the ABDR as a declared quality assurance activity to the extent relevant to Australian health services. The instrument itself, however, does not explain or detail enforcement mechanics or sanctions.

• Reporting obligations vs. sanctions: The Schedule sets out reporting outputs (de-identified reports to clinicians, providers, device companies; annual reports; academic publications). The instrument does not state that failure to produce such reports gives rise to any sanction under the instrument itself. Any remedy, right of action, or enforcement mechanism (including whether outputs must be produced on a set timetable) is not set out here.

• Practical enforcement implications: Practitioners and affected entities should note that legal consequences or protections that hinge on the ABDR’s declared status will be determined by Part VC and by any contracts, data-sharing agreements or grant conditions that govern the relationship between the registry operator and participating hospitals, surgeons or device companies. The instrument’s silence on enforcement means that the operational legal regime will be a composite of Part VC provisions and any other binding instruments external to this declaration.

In short, the declaration creates no standalone penalties or enforcement regimes in this instrument; any such mechanisms will be located in Part VC of the Health Insurance Act 1973 or in other legal agreements or statutes.

The instrument expressly links the ABDR to the Health Insurance Act 1973 and to the Therapeutic Goods Administration (TGA) via the Schedule’s stated aims. Beyond these explicit references, the instrument is silent on interactions with other specific Commonwealth, state or territory laws, or with privacy legislation. The Schedule and operative text nonetheless imply several points of legal interaction that require attention.

• Primary statutory interaction: Health Insurance Act 1973, Part VC. The instrument is made under subsection 124X(1) of the Health Insurance Act 1973 (s 3) and declares the ABDR to be a quality assurance activity "to which Part VC of the Health Insurance Act 1973 applies" (s 5). Therefore, the principal statutory interaction is direct: the ABDR's declared status means that the substantive content, protections, limitations, admissibility rules or other legal effects found in Part VC will apply to the ABDR where it relates to Australian health services. The instrument does not summarise Part VC, so users must examine that Part to understand concrete interactions such as evidentiary rules, confidentiality protections, or legal exceptions that Part VC provides or removes.

• Relationship with TGA regulatory functions: The Schedule makes the registry’s outputs available to the TGA and links registry objectives to the TGA's role. The Schedule states that data should assist stakeholders "should a device warning or recall be made by the Therapeutic Goods Administration (TGA)" and that the registry will provide "performance information to the TGA, to assist it in its regulatory capacity" (Schedule 1, item 2). This indicates an operational interface between registry outputs and the TGA’s regulatory activities with implications for device surveillance and recall actions. The instrument does not set out any formal reporting pipeline or statutory obligation to notify the TGA, nor does it alter the TGA’s statutory powers; it indicates that the registry’s monitoring and reporting is intended to inform the TGA.

• Privacy and data protection law: The Schedule states the registry reports "de-identified results" and publishes "de-identified aggregated data" (Schedule 1, item 2). The instrument does not reference the Privacy Act 1988, state privacy laws, or other data protection regimes, nor does it define "de-identified." As such, the interaction between the registry’s data-handling practices and federal or state privacy laws is not articulated here. Stakeholders must therefore determine whether and how de-identification conforms to privacy legislation and how any exceptions or protections in Part VC interact with privacy obligations.

• Contractual and institutional interactions: The Schedule identifies participating hospitals, surgeons, the registry operator, academic journals and device companies as participants or recipients of outputs (Schedule 1, item 2). Operationally, those interactions will likely be governed by data-sharing agreements, contracts, grant conditions or institutional governance instruments. The declaration itself does not create or modify such agreements but brings the activity within Part VC, which may alter legal obligations under those agreements depending on Part VC content.

• Geographic scope and extraterritorial interactions: The declaration applies only "to the extent that the quality assurance activity relates to health services provided in Australia" (s 5). This qualification limits the statutory reach of Part VC to Australian health services for the ABDR. The instrument does not address data flows that cross borders or how foreign data subjects or providers are treated.

• No express amendment of other laws: The instrument does not purport to amend, suspend or override other Commonwealth or state statutes beyond applying Part VC. Any direct statutory conflicts would need to be resolved by reference to the Health Insurance Act and relevant laws; the declaration itself does not specify conflict-resolution mechanisms.

Overall, the instrument’s most significant legal interaction is the placement of the ABDR within the Part VC regime of the Health Insurance Act 1973 and the operational reporting relationship it envisages with the TGA. Other interactions, particularly with privacy law and contractual arrangements with participating hospitals and surgeons, are left to be determined outside the instrument.

The instrument contains limited amendment history because it is short and self-contained. The operative content documents the initial commencement arrangements and includes a formal note about the commencement table. There are no presented statutory amendments, repeal dates beyond the automatic mechanism tied to subsection 124X(4) of the Health Insurance Act 1973, or subsequent modifications in the supplied text.

• Commencement: The commencement provision states that the whole of the instrument commences "the day after this instrument is registered" (s 2(1) table, provision 1). The table is labelled "Commencement information" and includes three columns; the instrument emphasises that the information in column 3 is not part of the instrument and may be edited in published versions (s 2(2)). The instrument therefore documents only the initial commencement day and reserves the right to present or edit supplementary information in published versions without amending the instrument.

• Repeal mechanism: Section 4 states that "This instrument is repealed when it ceases to be in force in accordance with subsection 124X(4) of the Health Insurance Act 1973." This ties the instrument's expiration to the statutory mechanics in the parent Act rather than to a fixed calendar date within the instrument itself.

• Note on the commencement table: Section 2 contains an express note that the commencement table "relates only to the provisions of this instrument as originally made" and will not be amended to deal with later amendments of the instrument. The section also clarifies that information in column 3 of the table is not part of the instrument and may be edited in any published version (s 2(2)). This indicates that published versions may carry editorial material that is not legally operative.

• No recorded amendments in supplied text: The supplied text contains no subsequent amendment entries, no replacement provisions, and no historical notes of amendment. This means that, based on this instrument alone, there is no amendment history to summarise beyond the original commencement and the automatic repeal reference. Any later amendments or re-declarations would be outside the supplied instrument.

Users interested in amendment history should check the register entry where the instrument is recorded and any subsequent legislative instruments or notices that expressly amend, extend, re-declare or repeal this declaration by reference to subsection 124X(4) of the Health Insurance Act 1973. The declaration itself, as supplied, contains only the original commencement and the statutory repeal link to the parent Act.

The instrument contains no litigation history. There are no references to judicial decisions, disputes, injunctions, or precedent in the text supplied. The Schedule and sections describe the registry and the legal declaration but do not reference any case law or past litigation related to the ABDR or to similar declarations.

Because the instrument does not itself create penalties or detail procedural rights, and because it operates by application of Part VC of the Health Insurance Act 1973, any litigation that might arise in the future would likely concern the interpretation or application of Part VC to the ABDR, the adequacy of de-identification, disputes about access to data, or contractual disputes between the operator and participating hospitals or surgeons. None of those hypothetical litigation points are contained in the instrument, and accordingly the instrument supplies no litigation record.

To discover any litigation that engages the ABDR, the registry operator, or the application of Part VC to particular quality assurance activities, one would need to search court records, administrative tribunal decisions, or other public registers. The instrument itself does not record any such matters.

The declaration and Schedule are concise; the brevity leaves several practical legal and operational gaps that practitioners and affected parties should be alert to. The instrument contains explicit statements that give rise to particular legal and operational considerations.

• The instrument does not define the legal effects of being a "quality assurance activity": The declaration brings the ABDR within Part VC of the Health Insurance Act 1973 (s 5). The concrete legal implications of that status , for example, evidentiary rules, confidentiality protections, admissibility of material in litigation, or limits on disclosure , are not stated in this instrument. Users should not assume the declaration itself creates specific privileges or immunities; those will be located in Part VC.

• "To the extent that" qualification narrows application: Section 5 applies Part VC "to the extent that the quality assurance activity relates to health services provided in Australia." This qualifier limits Part VC’s application to the activity’s nexus with Australian health services. For data or activities that are extraterritorial or involve non-Australian health services, the statutory protection or regime of Part VC may not apply under this declaration.

• Participation coverage depends on "participating hospitals and surgeons": The Schedule states data is collected from "participating hospitals and surgeons" (Schedule 1, item 2). The instrument does not specify whether participation is compulsory, nor does it prescribe sanctions for non-participation. The registry’s data completeness and representativeness therefore depend on the scope and terms of participation agreements. Entities should not assume universal coverage as a legal fact; it will be a feature of operational arrangements.

• "De-identified" is stated but not defined: The Schedule uses the terms "de-identified results" and "de-identified aggregated data" (Schedule 1, item 2). The instrument does not define "de-identified" or set standards for de-identification, retention, re-identification safeguards or related privacy controls. This raises questions about the legal threshold for identifiability and whether such outputs align with applicable privacy laws or with the standards expected by data custodians and participants.

• No operational detail on data governance, access, consent, or retention: The Schedule describes data collection and reporting but does not specify patient consent processes, data-sharing arrangements, governance structures, data security measures, retention periods or audit rights. Those practical governance elements will be found, if at all, in separate documentation or under Part VC.

• Potential tension between publication and confidentiality protections: The Schedule envisages publication in annual reports and academic journals, and provision of quality and safety reports to device companies (Schedule 1, item 2). If Part VC contains confidentiality or admissibility protections for quality assurance activities, parties must reconcile those protections with the registry’s publication commitments. The declaration does not address that interplay.

• Unspecified funding and resource allocation: The instrument names the operator (Monash University School of Public Health and Preventive Medicine) but does not indicate funding arrangements, whether hospitals or surgeons are remunerated, nor whether device companies contribute to registry costs. Funding and resourcing arrangements can affect the registry’s sustainability and the incentive structures for participation; the declaration is silent on these points.

• Repeal tied to parent Act provision: The instrument is repealed when it ceases to be in force under subsection 124X(4) of the Health Insurance Act 1973 (s 4). Stakeholders should not assume permanence; the instrument’s legal life depends on the statutory mechanism in the parent Act, which may include fixed-term or other termination conditions not set out here.

• Published commencement table notes are non-operative: Section 2(2) warns that information in Column 3 of the commencement table is not part of the instrument and can be edited in published versions. Readers should be cautious about relying on editorial material in published versions of the instrument as if it were legally operative.

These practical "gotchas" are not cast as legal conclusions about the ABDR; they are drawn from the instrument’s silence or limited statements and highlight areas where additional documents, Part VC provisions, contracts or policy statements will determine the day-to-day legal and operational consequences.

This declaration does not itself set granular compliance steps; instead, it places the ABDR within the Part VC regime of the Health Insurance Act 1973 and describes the registry’s operational practice. Compliance therefore involves three layers: (1) understanding how Part VC applies to the ABDR; (2) conforming to the operational description in the Schedule (data collection and de-identification practices); and (3) meeting the requirements of any contracts, institutional policies or privacy laws that govern participation in or interaction with the ABDR.

Practical compliance pointers grounded in the instrument:

• Review Part VC of the Health Insurance Act 1973: The declaration’s central legal effect is to make Part VC apply to the ABDR (s 5). Entities (hospitals, surgeons, the operator, device companies, legal advisers) should read Part VC to determine statutory obligations, evidentiary rules, immunities, permissible disclosures and penalties that may now apply to the registry activity. This instrument does not reproduce those provisions; compliance advice must be aligned with Part VC text and any regulations made under the Health Insurance Act 1973.

• Confirm the operator’s protocols and agreements: The Schedule names the Monash University School of Public Health and Preventive Medicine as the operator (Schedule 1, item 2). Parties interacting with the registry should obtain the operator’s data-sharing agreements, participant agreements, governance charters and standard operating procedures. Those documents will likely set out obligations regarding data submission, timelines, data formats, de-identification standards, consent procedures and remedies for breaches.

• Understand participation mechanics and obligations: The Schedule indicates data collection from "participating hospitals and surgeons" (Schedule 1, item 2). Entities should seek documentation on how participation is defined, whether participation is voluntary or mandated via contract or funding condition, what data fields are required, and what internal approvals are necessary (for example clinical governance sign-offs). Hospitals and surgeons should verify who in their organisation is responsible for registry submissions and whether internal patient-consent processes are required.

• Clarify the meaning and standard of "de-identified": The Schedule repeatedly describes outputs as "de-identified" (Schedule 1, item 2). Entities should request the registry’s de-identification policy, including techniques used, re-identification risk assessments, linkage controls, and any independent audits. Compliance with privacy laws will turn on whether the registry’s de-identification meets statutory or regulatory standards.

• Ascertain reporting channels and recipients: The Schedule lists recipients of outputs: participating clinicians, health service providers, "other key stakeholders", the TGA, device companies, annual reports and academic journals (Schedule 1, item 2). Parties should establish which reports they will receive, the frequency and format of reports, and whether there are obligations to act on reports (for example internal quality improvements or notification to regulators).

• Coordinate with TGA reporting expectations: The Schedule explicitly links registry reporting to assisting the TGA (Schedule 1, item 2). Where the registry produces performance information that might be relevant to regulatory action, entities should clarify if and how reporting to the TGA occurs, whether there are legal obligations to report adverse events independently to the TGA, and how registry outputs interact with mandatory adverse-event reporting requirements under other statutes or guidance.

• Check funding, contractual and institutional conditions: The instrument does not state funding sources. Hospitals, surgeons and the operator should check whether participation is tied to funding agreements, research grants, or institutional obligations that create compliance obligations beyond the declaration.

• Prepare for academic publication processes: The Schedule contemplates publication in annual reports and academic journals (Schedule 1, item 2). Clinicians and institutions should ensure ethical approvals, authorship practices and data-use agreements allow for academic publication of de-identified aggregated data, and that publication processes align with institutional research governance requirements.

• Monitor the instrument’s lifespan: Because the declaration is repealed when it ceases to be in force under subsection 124X(4) (s 4), affected entities should track the instrument’s legal status in the register to know whether and when the designation will lapse or be renewed, and plan for continuity of data governance and legal protections accordingly.

• Document records and audit trails: Even without explicit penalties stated in this instrument, participants should maintain records of data submissions, consents or approvals, de-identification processes, and notices received from the registry, to support compliance with Part VC, privacy laws, and institutional audit requirements.

In short, compliance steps under this declaration are largely procedural and contingent on external legal text and operational agreements. Entities should obtain the registry’s operating policies and Part VC text, and align institutional and privacy practices to the operational description in the Schedule.