Health Practitioner Regulation National Law Regulation 2018

The Regulation relies on a small set of recurring structural concepts. Understanding these is essential to follow who carries obligations and how Commonwealth statutory mechanisms are relocated into the national scheme.

• National Agency and Agency Board: those entities are treated as “agencies” for the purposes of FOI, Privacy and Ombudsman Acts where the Regulation specifies, and the Agency Fund assumes payment obligations that would otherwise fall on the Commonwealth (see ss 15(b), 19(a), 35(a), 38(a)). The Regulation substitutes references to Commonwealth offices and Ministers with members of the Ministerial Council nominated by that Council or the Ministerial Council itself (see ss 7(b)-(c), 14(e), 25(a)-(b), 34(b)).
• National Health Practitioner Privacy Commissioner and National Health Practitioner Ombudsman: each is treated as the cognate office-holder for information, privacy and complaint-handling functions within the national scheme. The AIC Act, FOI Act, Ombudsman Act and Privacy Act apply as if their references to Commonwealth officers are references to these national office-holders (see ss 7(a), 14(a), 25(c), 34(a)). Each Commissioner/Ombudsman is subject to bespoke appointment, staffing, delegation and reporting rules set by the Ministerial Council (see ss 8, 27, 9-10, 28-29, 36).
• Agencies, National Boards, accreditation authorities and specified examiners: the Regulation narrows the entities caught as agencies under the Commonwealth Acts to the National Agency, the Agency Board, National Boards, accreditation authorities, persons appointed to conduct particular exams/assessments, and specialist medical colleges in limited circumstances (see ss 15(b), 26(b), 35(b)). That determines which bodies are subject to FOI, Ombudsman and Privacy obligations under the applied Acts.
• Contracted/agency service providers: persons who contract to provide services on behalf of the National Agency or who subcontract under those arrangements are brought within Ombudsman and Privacy Act application (s 23; s 32; see also ss 26 and 35 which treat such providers as prescribed authorities/contracted service providers). That extends complaint handling and privacy obligations beyond the core statutory agencies to private contractors serving the scheme.
• Public registers and transparency obligations: section 5 prescribes the public registers each National Board must keep for the purposes of the Law (s 5). The Regulation also sets publication deadlines and transitional dates for FOI information publication requirements (see s 15(d); s 22).
• Modifications and disapplications: the instrument repeatedly disapplies specific provisions and subordinate regulations of the Commonwealth Acts where they do not fit the national scheme (for example ss 11(c), 12, 19(c), 20, 30(a), 31, 39). It also prescribes adjustments to reporting, audits and the form and timing of public interest determinations under the Privacy Act (s 37).

Mechanically, then, the main concepts are substitution of Commonwealth actors by national scheme actors, redefinition of which entities count as agencies, extension of Ombudsman and Privacy applicability to contracted providers, specification of audit and reporting processes, and selective disapplication of Commonwealth regulatory instruments.

This Regulation allocates duties, rights and costs across a set of clearly identified actors. Below I list the primary categories and the key statutory interactions.

• National Boards (s 4): Each named Board (for example the Medical Board of Australia, Pharmacy Board of Australia, Nursing and Midwifery Board of Australia) is continued in existence under the Regulation. They are required to keep public national registers as specified (s 5). Boards therefore carry duties to maintain publicly accessible registers (s 5) and are agencies (in the modified sense) for FOI, Privacy and Ombudsman Acts (see ss 15(b), 26(b), 35(b)).
• National Agency and Agency Board: treated as agencies for FOI and Privacy purposes (ss 15(b), 35(b)). The Agency Fund becomes the payer where Commonwealth payments would otherwise be required (s 19(a), s 38(a)). The chief executive officer of the National Agency is the principal officer for FOI and Privacy framing (ss 15(c)(ii), 35(c)(ii)).
• National Health Practitioner Privacy Commissioner (ss 7(a), 8-11, 36-37): takes on the functions mapped from the AIC Act and Privacy Act in the national scheme. The Commissioner must ensure efficient, economical operations, keep proper books and records, prepare financial statements under Australian Accounting Standards and arrange audits, and submit an annual report to the Ministerial Council (ss 9-10, 36). The Commissioner may employ staff, engage contractors, enter resource arrangements and delegate functions (s 8(d)).
• National Health Practitioner Ombudsman (ss 14(a), 25(c), 27-31): mapped to the Ombudsman Act functions for the scheme. The Ombudsman may employ staff, engage contractors and delegate functions (s 27(f)), must maintain financial controls and prepare audited financial statements and an annual report (ss 28-29), and may be suspended or removed by the Ministerial Council under the terms set by the Regulation without certain parliamentary procedures (s 27(e)).
• Contracted service providers and agency service providers (ss 23, 32): private firms that contract with the National Agency, or subcontractors, are brought within the scope of Ombudsman and Privacy application. They become the operational subjects of complaint-handling and privacy inspection powers when providing services to the scheme (see ss 23(1)-(2); 32(1)-(2); s 26(b) and s 35(b)).
• Accreditation authorities, examiners and specialist medical colleges: entities who conduct examinations or assessments where appointed by a National Board, and colleges delivering approved programs, are included as prescribed authorities or agencies under the modifications (ss 26(b)(vi)-(viii); 35(b)(vi)-(viii)). This brings them into the FOI, Ombudsman and Privacy frameworks for specified activities.
• Individuals interacting with the scheme (registrants, applicants, complainants): affected by changes in review pathways (Administrative Appeals Tribunal references mapped to state/territory tribunals - ss 14(d); 17(a)), FOI commencement dates for Part VII (s 18), and transitional provisions preserving rights of review where applications were outstanding at commencement (s 21). People seeking access to documents under the previously applied FOI Act have their applications decided under the applied FOI Act (s 48) and internal reviews are to be decided under Part VI of the applied FOI Act (s 49).

Who pays: the Regulation substitutes the Agency Fund for Commonwealth payments under several Acts (s 19(a); s 38(a); see also ss 9(c), 28(c) requiring expenditure only for lawful purposes from the funds held by the Commissioner/Ombudsman). The Ministerial Council determines remuneration and terms for the Privacy Commissioner and Ombudsman (s 8(b); s 27(d)). Who decides: the Ministerial Council nominates members for statutory roles, appoints the Commissioner and Ombudsman, may suspend/remove the Ombudsman, and receives and circulates annual reports (s 7(b)-(c); s 8(b); s 10(c); s 27(e)-(f); s 29(c)).

In short, the Regulation affects public regulators (Boards, Agency), private contractors providing services to the scheme, specialised education and accreditation providers, and individuals engaging in registration and review processes. It reallocates fiscal responsibility to the Agency Fund and centralises some appointment and oversight functions in the Ministerial Council.

The Regulation imposes express duties and establishes specific rights by modifying Commonwealth Acts and creating operational obligations within the national scheme. Key ones are below, with section references.

Duties placed on National Boards and registers

• Maintain the public national registers specified in s 5 for each Board for the purposes of s 222(5) of the Law (s 5). The exact content of each register is not set out in the Regulation; the duty is to keep the registers named.

Duties on the National Health Practitioner Privacy Commissioner (AIC Act and Privacy Act modifications)

• Act only in respect of privacy functions conferred under the Privacy Act as applied (s 11(1)(a)).
• Disclose any material personal interest in matters relating to the Commissioner’s responsibilities (s 11(1)(b)). The Regulation defines material personal interest broadly to include various family members and spouses (s 11(2)).
• Ensure efficient, effective and economic operation, keep proper books and records for funds held, ensure lawful expenditure and reasonable value for amounts expended, provide internal controls to safeguard payments and receipts and to prevent fraud or mistake, prepare financial statements under Australian Accounting Standards and facilitate audits (s 9(a)-(f); s 36(a)-(f)).
• Submit an annual report within three months after the end of each financial year to the Ministerial Council, the report to include audited financial statements and a performance report on functions under the Act, and each Ministerial Council member must lay the annual report before the relevant Parliament (s 10(a)-(c); s 36(e)-(g)).

Duties on the National Health Practitioner Ombudsman (Ombudsman Act modifications)

• Ensure efficient, effective and economic operations and maintain comparable financial controls, prepare audited financial statements and submit an annual report within three months to the Ministerial Council including financial statements and performance report (s 28(a)-(f); s 29(a)-(c)).
• Employ staff, engage contractors, enter resource arrangements and delegate functions as the Ombudsman considers appropriate (s 27(f)(i)-(iv)).

Duties and powers affecting agencies, contracted and agency service providers

• Contracted service providers and subcontractors who provide services to the National Agency are treated as contracted service providers (s 32(1)-(2)); similarly, agency service providers and subcontractors are captured under s 23(1)-(2).
• The Privacy Commissioner’s power to authorise persons to enter premises and inspect documents occupied by an agency extends to a person the Commissioner considers appropriate (s 38(b)). This expands inspection authorisation beyond specified classes of officers.
• Under the FOI and Ombudsman Act modifications, agencies (National Agency, Agency Board, National Boards, accreditation authorities, appointed examiners, specialist medical colleges in limited situations) are subject to FOI and Ombudsman provisions as modified (ss 15(b), 26(b), 35(b)).

Rights retained or altered for individuals

• Rights of access to documents and rights to review are preserved but redirected into the applied regime: the FOI Act applies with modifications and Part VII of the FOI Act commences on 1 February 2019 (s 18). Transitional protections permit someone who had a right to AAT review immediately before commencement to apply to a relevant tribunal under Part VIIA of the FOI Act, with the application treated as if it were under s 57A of the FOI Act (s 21(1)-(3)). Applications made under the previously applied FOI Act remain to be decided under the applied FOI Act (s 48), and internal review applications are to be decided under Part VI of the applied FOI Act (s 49).

Procedural substitutions and tribunal mapping

• References to Commonwealth administrative review bodies and courts are replaced by local equivalents (for example, Administrative Appeals Tribunal references become references to a relevant State/Territory tribunal; Federal Court references become references to the Supreme Court of a participating jurisdiction or another court of competent jurisdiction) (ss 7(c), 14(d), 17(a), 25(g)).

Other operational duties

• Where the Privacy Act requires a public interest determination to be made by legislative instrument, that requirement does not apply under the national scheme; instead, the Commissioner may make such determinations and must notify the Ministerial Council and publish determinations on the Commissioner’s website, subject to the commencement rules and registration rules in s 37 (s 37(a)-(g)).

Collectively, the Regulation creates financial accountability duties on the Commissioner and Ombudsman, operational delegation and staffing flexibilities for those offices, reporting duties to the Ministerial Council, FOI and privacy obligations mapped to the national participants named in the instrument (Boards, Agency, accreditation and examining entities), and transitional protections for existing applications and decisions. Who decides: the Ministerial Council appoints and sets remuneration and terms for the Commissioner and Ombudsman and receives the annual reports (ss 8(b), 27(d), 10(c), 29(c)).

The Regulation itself largely effects structural and procedural modifications and does not create a new bespoke penalty regime. Enforcement and penalties flow from the Commonwealth Acts as they are applied with the Regulation’s modifications. Key enforcement mechanisms and where they will land are:

• Application of Commonwealth enforcement regimes as modified: the FOI Act, AIC Act, Ombudsman Act and Privacy Act contain investigation, review and review-pathway mechanisms and penalty teeth. The Regulation changes which entities and office-holders are within scope and how those Acts operate for the national scheme (see ss 6, 13, 24, 33). Any penalty or enforcement provision in those Acts applies as modified by the Regulation.
• Ombudsman enforcement role: the Ombudsman Act’s investigation and report functions apply to the entities the Regulation designates as prescribed authorities (which include the National Agency, Agency Board, National Boards, accreditation authorities and certain examiners and colleges) (s 26(b)). The Ombudsman’s findings and reports are enforced through the Act’s usual reporting and recommendations framework, as modified by the Regulation (see s 26 note describing inapplicability of some provisions).
• Administrative review: references to the Administrative Appeals Tribunal and Federal Court are substituted by relevant State/Territory tribunals and courts for the purposes of judicial review and appeal (ss 14(d), 17(a), 25(g), 34(e)-(f)). That alters the enforcement forum for certain decisions and may affect remedies and procedural rules, since different courts and tribunals have jurisdictional and procedural distinctions.
• Audits and financial accountability: the Regulation requires audited financial statements prepared under Australian Accounting Standards and audited by a State/Territory Auditor-General or an auditor engaged by an Auditor-General (s 10(b)(i); s 29(b)(i)). The Ministerial Council can direct further qualified audits of records kept by the Commissioner or Ombudsman (ss 9(g); 28(g)). Failure to comply with financial obligations would therefore expose the entities to audit findings and the accountability regime of the Ministerial Council and the relevant Parliament through the laying of annual reports (s 10(c); s 29(c)).
• Ministerial Council powers over appointments: the Ministerial Council has suspension and removal power over the Ombudsman that does not require laying statements or parliamentary addresses in some circumstances (s 27(e)). That is an enforcement tool within the supervisory structure of the national scheme rather than a penal sanction.
• FOI fees and review pathways: the FOI Act’s fees provisions largely remain as in the FOI Act but the Regulations under the FOI Act other than those providing for fees do not apply (s 20). Enforcement of FOI decisions, and penalties for non-compliance with FOI obligations (where applicable), fall under the applied FOI Act as modified.
• No express new civil/criminal penalties in the Regulation: the instrument does not itself create discrete new offences or monetary penalties; instead it remaps existing Commonwealth Act regimes into the national context and prescribes operational and reporting obligations that are enforced through those Acts, Ministerial Council oversight and parliamentary laying requirements (see ss 9-10; 28-29).

In practice, enforcement will mainly occur through: (1) the supervisory and investigatory functions of the Ombudsman and Privacy Commissioner applied within the national scheme; (2) judicial or tribunal review in the State/Territory Courts and relevant tribunals into which references are mapped (ss 14(d), 17(a)); and (3) audit and parliamentary accountability following the annual report and audit obligations (ss 10, 29). The Regulation also enables the Ministerial Council to exercise appointment and removal powers that operate as governance enforcement levers (s 27(e)-(f)).

The Regulation is explicitly designed to make specified Commonwealth Acts operate in the legal architecture of the national registration and accreditation scheme. It therefore interacts with multiple statutes by substitution, omission and reinterpretation.

Primary interactions

• The Law: each Part of the Regulation is expressly “for the purposes of” particular sections of the Law (for example, Part 3 for s 212A(2)(c) of the Law (s 6); Part 4 for s 215(2)(c) (s 13); Part 5 for s 235(2)(b) (s 24); Part 6 for s 213(2)(b) (s 33)). The effect is that these Commonwealth Acts apply as modified when the Law requires them to be treated as laws of participating jurisdictions.
• AIC Act (Australian Information Commissioner Act 2010): applied as modified in Part 3. The Regulation substitutes references to Commonwealth information office-holders with the National Health Practitioner Privacy Commissioner and changes appointment and remuneration arrangements (ss 7-11). It disapplies many provisions about national-level functions (s 11(1)(c)) and makes the Regulations under the AIC Act not apply (s 12).
• FOI Act (Freedom of Information Act 1982): applied as modified in Part 4. Key substitutions include renaming the Ombudsman as the National Health Practitioner Ombudsman, mapping Commonwealth and Federal references to participating jurisdictions, replacing the Administrative Appeals Tribunal and Federal Court with relevant state/territory tribunals and courts for review, and restricting the agencies to which the FOI Act applies to the National Agency, Agency Board and National Boards (ss 14-15, 17). The FOI Regulations generally do not apply except for fees (s 20).
• Ombudsman Act 1976: applied as modified in Part 5. The Regulation maps Commonwealth references to the national scheme (s 25), extends the Act to prescribed authorities that are specific to the national scheme (s 26(b)), and modifies appointment, suspension and removal processes for the Ombudsman (s 27). Regulations under the Ombudsman Act do not apply other than witness expenses provisions (s 31).
• Privacy Act 1988: applied as modified in Part 6. The Regulation remaps Commonwealth references to participating jurisdiction counterparts, narrows the Act’s application to agencies and contracted service providers as defined, and modifies public interest determination requirements (ss 34-37). It also disapplies many Privacy Act provisions including those relating to privacy codes, certain monitoring and guidance functions, and specified Commonwealth legislative interactions (s 38(c)). The Privacy Act Regulations do not apply (s 39).
• State and Territory laws: the Regulation intentionally imports state/territory bodies as the relevant review and court institutions (ss 3 definition of relevant tribunal; ss 14(d), 17(a), 25(g), 34(e)-(f)). That means the practical mechanics of judicial review and tribunal procedures will be governed by the procedural and jurisdictional rules of those State/Territory courts and tribunals rather than Commonwealth forums.
• Public Governance, Performance and Accountability Act 2013 and other Commonwealth statutes: the Regulation disapplies listing provisions to prevent certain national scheme entities being “listed entities” under the PGPA Act (s 26(c)), and disapplies other specified Commonwealth law interactions under the Privacy Act (s 38(c)(vii)).

Subordinate instruments and regulatory reach

• The Regulation removes the automatic operation of many subordinate regulatory instruments attached to Commonwealth Acts (for example ss 12, 20, 31, 39). This changes which regulatory details apply to the national scheme and concentrates the relevant details within the Regulation and the Law.
• For Public Interest Determinations under the Privacy Act, the Regulation removes the requirement that they be legislative instruments and sets out a stand-alone process (s 37). It also requires publication on the Commissioner’s website and notification to the Ministerial Council, and treats determinations as if they were regulations to the extent sections 246 and 247 of the Law apply (s 37(g)).

Transitional and preservation interactions

• Repeal of earlier Regulations and transitional saving provisions preserve decisions, appointments and ongoing applications commenced under those earlier instruments (s 42; ss 44-49). The Regulation explicitly carries forward appointments of the Commissioner and Ombudsman and allows existing acting appointments to continue (ss 45-47). FOI applications made under the previously applied FOI Act are to be decided under the applied FOI Act (s 48), preserving the substantive right to decision.

Net effect The Regulation retools particular Commonwealth Acts so they operate within a federated administrative architecture overseen by the Ministerial Council and serviced by the National Agency, Agency Board and National Boards. It replaces some Commonwealth procedural and oversight structures with scheme-specific arrangements and redirects payments and auditing responsibilities to the Agency Fund and State/Territory Auditors-General. The interaction is one of textual substitution and selective disapplication rather than wholesale repeal or novel statutory obligations.

The Regulation’s text shows several amendments noted in-line. The instrument itself includes temporal details about commencement and later amendments. The following items are in the Regulation text:

• Commencement: The Regulation commenced on 1 December 2018 with the exception of section 41 which commenced on different dates for Western Australia (on publication in the Gazette) and other participating jurisdictions (on publication by the Victorian Government Printer) (s 2(1)-(2)).
• s 3: The definitions provision was amended in 2023, annotated as "s 3: Am 2023 (38), Sch 1[1]". That indicates at least a 2023 amendment to the definitions.
• s 15: An amendment in 2023 is recorded: "s 15: Am 2023 (38), Sch 12 (2)". This suggests modifications to the FOI Act-related provisions were made in 2023.
• s 19: A 2023 amendment is recorded "s 19: Am 2023 No 7, Sch 2.30." indicating changes to miscellaneous FOI Act modifications were made in 2023.
• s 22: Annotated "s 22: Am 2019 (633), sec 4." This section, about transitional publication obligations, was amended in 2019.
• s 40: Records multiple amendments across 2019, 2021, 2023, and 2025: "s 40: Am 2019 (633), sec 5; 2021 (157), sec 4; 2023 (127), sec 4; 2025 (26), sec 4." The transition period end-date for professional indemnity insurance arrangements for midwives practising private midwifery has therefore been altered over time, with the current text setting the transition period to end on 31 December 2026.
• s 41A: Inserted in 2023: "s 41A: Ins 2023 (39), sec 4." This prescribes the Diploma of Emergency Health Care as a prescribed qualification for general registration in paramedicine (s 41A).
• s 26: Amendments in 2023 recorded: "s 26: Am 2023 (38), Sch 13-(5)". This modifies the Ombudsman Act application provisions, likely expanding or clarifying the list of prescribed authorities and principal officer mappings.
• s 35: Amendments in 2023 recorded: "s 35: Am 2023 (38), Sch 14-(4)". This indicates the Privacy Act application modifications were revised in 2023.
• Several sections are explicitly repeals or replacements of previous Regulations: s 42 repeals the earlier Health Practitioner Regulation National Law Regulation and the WA variant. Transitional sections 43-49 contain amendments and transitional preservation clauses with an amendment in 2019 annotated at s 43: "s 43: Am 2019 (633), sec 6."

The text indicates periodic updates to align the Regulation with changes in policy and implementation detail. The annotations record the instrument and schedule numbers for each amending instrument; the Regulation itself carries the authoritative text and these notes indicate where earlier versions were changed. The most materially evident change is the layered amendments to s 40 (transition end date) and the 2023 package of amendments that adjusted the application of the FOI, Ombudsman and Privacy Acts to the national scheme.

The Regulation text does not include case law, judicial interpretations or any litigated disputes. It contains no judicial decisions or references to litigation. It does, however, modify forums and review pathways by mapping references to the Administrative Appeals Tribunal, the Federal Court and other Commonwealth tribunals to relevant State/Territory tribunals and courts (see ss 14(d), 17(a), 25(g), 34(e)-(f)). That will have consequence for future litigation because:

• Judicial review and merits review proceedings that would otherwise have sat in Commonwealth tribunals or Federal Court are redirected into State/Territory Supreme Courts and the listed State/Territory civil and administrative tribunals (s 3 definition of “relevant tribunal”; ss 14(d), 17(a)). Any litigation history will therefore accumulate in those jurisdictional courts and tribunals rather than Commonwealth courts.
• Transitional provisions preserve existing rights where proceedings were not yet commenced at the time of commencement (s 21 and ss 48-49), which limits opportunities for challenge on transitional fairness grounds because applications pending were preserved and mapped into the applied regimes.

Because the Regulation itself does not list cases, no court decisions are cited in the text. Any litigation about the meaning, application or constitutionality of these modifications would therefore be external to the Regulation and is not recorded here.

This Regulation contains numerous operational and drafting details that create risks of misinterpretation or implementation hiccups. Below are concrete items to watch for.

• Centralised appointment, remuneration and removal powers: the Ministerial Council sets remuneration and terms for the Privacy Commissioner and Ombudsman (s 8(b); s 27(d)) and may suspend or remove the Ombudsman without requiring the standard parliamentary laying of statement or address (s 27(e)). This places significant personnel discretion with the Ministerial Council and may affect independence perceptions. It is a governance mechanism, not a penalty, but its exercise will change internal incentives and risk calculations for those offices.
• Extensive delegation and contracting powers: the Commissioner and Ombudsman may employ staff, engage contractors and delegate “all or any” of their functions or powers to persons they consider appropriate (s 8(d)(i)-(iv); s 27(f)(i)-(iv)). That increases operational flexibility but also raises risks about oversight of delegated functions, procurement transparency, contract management and potential reliance on private contractors that are defined as contracted service providers and agency service providers (ss 23, 32).
• Audit and reporting obligations pinned to State/Territory auditors: audited financial statements must be audited by a State/Territory Auditor-General or an auditor engaged by one (s 10(b)(i); s 29(b)(i)). Entities must ensure compliance with Australian Accounting Standards and be audit-ready; failure could expose them to adverse audit findings and parliamentary scrutiny via laying requirements (s 10(c); s 29(c)).
• Substitution of Commonwealth forums with State/Territory bodies: references to the Administrative Appeals Tribunal and Federal Court are mapped to relevant State/Territory tribunals and Supreme Courts (ss 14(d), 17(a), 25(g), 34(e)-(f)). Practitioners must not assume Commonwealth procedural rules apply; different time limits, standing rules and remedies may obtain. The definition of relevant tribunal in s 3 sets out specific tribunals and courts, which is crucial to identify for appeals.
• Narrowing of applied regulations and provisions: many subordinate instrument provisions do not apply to the scheme (for example, Regulations under the AIC Act, Privacy Act and FOI Act mostly do not apply,ss 12, 20, 39; also ss 11(c), 19(c), 30(a), 38(c)). Parties cannot assume guidance, codes or monitoring functions under those Acts are available to the same extent as under Commonwealth application; alternative scheme-specific arrangements may be required.
• Public interest determinations process altered: the Regulation removes the requirement that public interest determinations be legislative instruments (s 37(a)). The Commissioner must notify the Ministerial Council and publish determinations on the Commissioner’s website (s 37(b), (d)). Sections 246 and 247 of the Law apply to determinations as if they were regulations (s 37(g)). Practitioners should not assume the same parliamentary oversight or registration pathways that apply to Commonwealth legislative instruments exist automatically.
• Extension of inspection authorisations to persons the Commissioner “considers appropriate”: the Privacy Commissioner’s power to authorise persons to enter premises and inspect documents extends to any person the Commissioner considers appropriate (s 38(b)). That broad authorisation may increase compliance burdens on agencies and contracted providers and raises immediate operational questions about vetting, security and confidentiality obligations.
• Multiple transitional dates and expiry points: transitional protections have fixed expiry dates (for example, the FOI transitional provision in s 21 expires on 1 February 2019 (s 21(4)); publication obligations were maintained until 31 May 2019 in s 22 which has been amended). Section 40 contains a transition period end-date for midwives that has been amended multiple times and currently ends on 31 December 2026 (s 40). Practitioners must track current text and amendment annotations to determine whether transitional arrangements remain in force.
• Contracted and agency service provider definitions include subcontracting: both s 23 and s 32 extend coverage to subcontractors who provide goods or services under a head contract. Contract-drafters must consider flow-down obligations and the potential for their subcontractors to be subject to Ombudsman and Privacy investigations.
• Disapplication of certain oversight and advisory functions: the Regulation disapplies some advisory, guidance and monitoring functions of the Commonwealth Acts (for example s 11(1)(c) disapplies AIC Act provisions such as establishment of the Office, the Information Advisory Committee, and certain reporting and guidance roles; s 38(c) disapplies Privacy Advisory Committee functions and privacy code-making). That reduces the availability of some Commonwealth tools and may require scheme-specific alternatives.

Each of these “gotchas” is grounded in the Regulation text. Practitioners should map each to operational procedures: appointment and termination clauses, procurement and delegation policies, audit-ready accounting practices, tribunal and court choice-of-forum analysis, and contract clause drafting to ensure flow-down and compliance with privacy and Ombudsman obligations.

Compliance under the Regulation requires practical steps by each affected actor. Below are targeted, actionable measures mapped to relevant sections of the Regulation.

For National Boards (ss 4-5)

• Maintain the named public national register for your Board (s 5). Establish or update processes to collect and publish register entries to satisfy s 222(5) of the Law; confirm the content requirements under the Law and ensure public accessibility.
• Implement FOI, privacy and Ombudsman request handling protocols aligned to the modified Acts. Because the FOI Act, Privacy Act and Ombudsman Act are applied with substitutions, update contact points and internal delegations to route requests correctly (see ss 15(b), 26(b), 35(b)).

For the National Health Practitioner Privacy Commissioner and Ombudsman (ss 8-11; 27-31; ss 9-10; 28-29)

• Formalise employment and procurement practices. The Commissioner and Ombudsman may employ staff and engage contractors (s 8(d); s 27(f)); put in place procurement, conflict-of-interest and contractor oversight frameworks to manage delegated functions and to comply with the disclosure of material personal interests rules (s 11(1)(b) and s 11(2) definitions).
• Financial controls and audit readiness. Implement accounting systems that produce financial statements in accordance with Australian Accounting Standards, prepare for audit by a State/Territory Auditor-General or an appointee (s 10(b)(i); s 29(b)(i)), and establish policies ensuring lawful expenditure and value for money (s 9(c); s 28(c)).
• Annual report production and parliamentary laying. Create an annual reporting calendar to deliver the annual report to the Ministerial Council within three months of the financial year end and coordinate Members of the Ministerial Council to lay the report before the relevant Parliaments (s 10(a)-(c); s 29(a)-(c)).

For the National Agency, Agency Board and Accreditation Authorities (ss 15, 26, 35)

• Update FOI publication requirements and information-publication reviews. The Regulation requires agencies to publish information by 1 June 2019 (s 15(d)) and complete a first review of the information publication scheme by 1 June 2024 (s 15(f)). If those dates have passed, ensure retrospective compliance and document status of the information publication scheme review.
• Treat contracted and agency service providers as within scope. Where you contract services, ensure contracts include mandatory privacy, FOI and Ombudsman cooperation clauses and require flow-down of inspection and information provision rights (ss 23, 32; s 26(b); s 35(b)).

For contracted service providers and subcontractors (ss 23, 32)

• Expect complaint handling and privacy inspections. Build into contracts the requirement to cooperate with Ombudsman investigations and Privacy Commissioner inspections, including the possibility that inspectors may be persons the Commissioner deems appropriate (s 38(b)). Ensure security clearance and confidentiality protocols meet any standards requested.
• Ensure contract clauses provide for information retention and production compatible with FOI, privacy and Ombudsman requirements under the national scheme (ss 15, 35, 26).

For registrants, applicants and litigants

• Identify forum for review early. Because tribunal and court references are mapped to State/Territory equivalents, identify the correct “relevant tribunal” from the s 3 definition and corresponding provisions (ss 14(d), 17(a), s 3). Do not assume Commonwealth AAT or Federal Court jurisdiction; lodge merits and judicial review applications in the correct State/Territory forum.
• For ongoing FOI applications or internal reviews made before the Regulation’s commencement, note that they are to be decided under the applied FOI Act (ss 48-49) and transitional rights to apply to a relevant tribunal in lieu of the AAT are provided in s 21 (but see s 21(4) expiry).

Cross-cutting operational steps

• Map and update policy documents and staff training to reflect substituted titles and reference changes. Replace references to Commonwealth Ministers, the Ombudsman, or the Information Commissioner with the relevant national scheme counterparts (see ss 7, 14, 25, 34).
• Update contract templates and procurement processes to include flow-down obligations for subcontractors, record-keeping clauses, and audit/inspection cooperation clauses for the Privacy Commissioner and Ombudsman (ss 23, 32; s 38(b)).
• Maintain a compliance calendar for reporting and publication deadlines: annual report submission within 3 months of year-end (ss 10(a), 29(a)); any remaining transitional publication obligations under s 22 (if applicable); and the periodic review completion date for the information publication scheme (s 15(f)).
• Establish a conflict-of-interest register and disclosure process for material personal interests touching on the Commissioner’s functions (s 11(1)(b); s 11(2)). Ensure members and relevant office-holders declare in line with the definitions provided.

Documentation and audit trail

• Maintain proper books, records and internal control documentation to support audits required by ss 9(g), 28(g) and 36(e)-(g). Where directed by the Ministerial Council, be prepared to commission further audits of records (ss 9(g); 28(g); 36(g)).
• Publish public interest determinations on the Commissioner’s website and notify the Ministerial Council as soon as practicable after making a determination (s 37(b)-(d)). Ensure register entries are available without charging public fees that would otherwise apply under the Privacy Act (s 37(e)).

Finally, track amendments. The Regulation has been amended multiple times (see Amendment History above). Entities should maintain a legal watch to capture future changes (for example to s 40 transition end-dates or to definitions in s 3) and update compliance processes accordingly.