The Regulation operationalises a set of narrow, specific concepts that slot into the Act’s health-privacy framework. Those concepts are defined or prescribed in the text and determine when secondary-purpose use and disclosure of health information is lawful.

• “Accredited chaplain” (s 3). The Regulation prescribes that an accredited chaplain, in relation to a public hospital or health institution, is a person accredited for chaplaincy services by the chief executive of the public health organisation that controls the hospital or institution, and whose accreditation has not been revoked (s 3(1), definition). The Regulation treats accreditation as an administrative gate for disclosure to chaplains (s 5(3)).

• “Health service” additions (s 4). For the Act’s definition of “health service” (Act, s 4(1) definition), the Regulation prescribes additional items, including chaplaincy (s 4(a)), specified research services by Ministry of Health/HAC/public health organisations/public hospitals/Cancer Institute (s 4(b)-(c)), services by CHeReL (s 4(d)), and services relating to the SDPR (s 4(e)). The text explicitly includes archived records as part of SDPR services (s 4(e)(ii)). The amendment history for s 4 is recorded in the Regulation (s 4: Am 2023 (642), Sch 1; 2025 (240), Sch 1).

• Secondary-purpose use and disclosure under the Act’s Schedule 1, clauses 10 and 11. The Regulation repeatedly references the Act’s Schedule 1, clauses 10(1)(k) and 11(1)(l) and clause 15. It does not rewrite those Act clauses; instead it prescribes situations in which secondary-purpose use or disclosure is permitted, and conditions that must be met for those permissions to apply (for example, s 5 for chaplaincy, s 6 for professional misconduct, s 7 for complaints, s 7A for compassionate disclosure).

• “Reasonable” standards and necessity. Several provisions in the Regulation require the organisation to form objective/subjective judgements: s 5(2) permits chaplaincy disclosure only if the individual “would reasonably expect” such use or disclosure; s 6 requires “reasonable grounds to suspect” and that disclosure be “necessary” for an investigation; s 7 requires “reasonable grounds to suspect a complaint has been made” and limits disclosures; s 7A requires that disclosure not be contrary to a wish of the deceased “of which the organisation was aware or could make itself aware by taking reasonable steps”. These standards import an evaluative, evidence-sensitive requirement into operational decision-making.

• Prescribed exclusions and exemptions. The Regulation prescribes that certain linkage systems are not “health records linkage systems” for the purposes of the Act (s 9), and exempts organisations from the operation of the Act’s linkage clause to the extent the organisation includes information in the Commonwealth My Health Record system (s 8).

• Single‑agency treatment (s 10). The Regulation prescribes that particular public sector agencies are to be treated as a single agency for the purposes of the Health Privacy Principles and health privacy codes of practice (s 10(1)), and that Corrective Services NSW and the Department of Communities and Justice are to be treated as a single agency for the purposes of the Act (s 10(2)). This concept alters which bodies are treated as a single decision‑making entity under the Act’s privacy framework.

• Continuity and savings (s 11). The Regulation repeals the 2017 Regulation but saves pre-existing acts, matters or things (s 11(1)-(2)) to preserve continuity of operation where required.

These concepts establish a regulatory architecture in which specific secondary-purpose pathways for use and disclosure are carved out, each subject to condition-based gates (reasonable expectation, reasonable grounds, necessity, narrow purpose, prior wishes). The Regulation relies on existing external instruments for definitions and institutional references, e.g., the Health Services Act 1997 for “public hospital”, “health institution”, “public health organisation” and the My Health Records Act 2012 for My Health Record (s 3; s 8(2)). The standards of “reasonable” and “necessary” are left to factual assessment by the decision‑maker within the organisation, subject to the Act’s broader framework.

Identify who is subject to obligations or benefits by operation of the Regulation and what parts of the NSW and Commonwealth system are implicated.

• Public health organisations and public hospitals/health institutions. The Regulation repeatedly addresses public health organisations and institutions “controlled by” or “conducted by or on behalf of” a public health organisation (s 3(2) and multiple operative provisions). Public health organisations are central decision-makers for chaplain accreditation (s 3 definition of accredited chaplain) and for permitting or making disclosures authorised by the Regulation (s 5-7A). The Ministry of Health, the Health Administration Corporation, local health districts, statutory health corporations and the Cancer Institute (NSW) are specifically named in either the definition or the single‑agency direction (s 4; s 10(1)).

• Accredited chaplains. Individuals accredited by the chief executive of a public health organisation to provide chaplaincy services are beneficiaries of a bespoke disclosure pathway: public health organisations may disclose health information to such accredited chaplains for chaplaincy services when an individual would reasonably expect that disclosure (s 3 definition; s 5).

• Health Administration Corporation and systems it administers. The Health Administration Corporation is named as a provider of specified research services (s 4(b)(ii)) and is the administrator of the systems that the Regulation prescribes are not “health records linkage systems” (s 9). The Centre for Health Record Linkage (CHeReL) is expressly included as a health service provider for the Act’s purposes (s 4(d)).

• Entities dealing with professional regulation and complaints. The Regulation enables use/disclosure to or as part of investigations by National Boards and investigators appointed under the Health Practitioner Regulation National Law (s 6(1)(b)), and to councils established under the Health Practitioner Regulation National Law (NSW) s 41B and for management under Part 8 of that Law when a complaint exists (s 7(1)(b)). The Regulation therefore affects the information flows between health providers/organisations and those regulatory bodies.

• Immediate family members of deceased individuals. Section 7A creates a conditional route for disclosure of health information to immediate family members for compassionate reasons when the individual is deceased and subject to other constraints (s 7A(a)-(e)).

• Corrective Services NSW and Department of Communities and Justice. These two agencies must be treated as a single agency for the purposes of the Act (s 10(2)), which affects the application of the Act’s obligations where either or both hold health information.

• Organisations that include information in the Commonwealth My Health Record system. Section 8 exempts organisations from the operation of the Act’s Schedule 1 clause 15 to the extent that they include information in My Health Record, thereby changing the regulatory treatment of My Health Record inclusions.

• Researchers and research-contractor organisations. The Regulation expressly prescribes research services conducted by or on behalf of the Ministry of Health, Health Administration Corporation, public health organisations and hospitals, and the Cancer Institute (NSW) as falling within the Act’s “health service” definition (s 4(b)-(c)), which affects both the scope of the Act’s definition and who may lawfully handle health information in those research contexts.

Who pays and who decides

• Who decides: Chief executives of public health organisations determine chaplain accreditation (s 3) and public health organisations determine whether disclosures meet the conditions in s 5-7A, including assessments of “reasonable expectation”, “reasonable grounds”, “necessity” and whether a disclosure is limited to what is reasonable for compassionate reasons (s 5(2); s 6(1); s 7(1); s 7A(b),(d)).

• Who bears operational costs or compliance burdens: public health organisations and the Health Administration Corporation will bear the administrative burden of assessing eligibility for disclosure, documenting “reasonable” criteria and taking “reasonable steps” to ascertain wishes of individuals (s 5(2); s 6(1); s 7A(d)). Organisations integrating with My Health Record or SDPR may incur implementation, access-control and record-management costs given the Regulation’s treatment of those systems (s 4(e); s 8).

• Private-sector or independent health providers are affected to the extent they contract with, provide services to, or receive disclosures from the named public agencies and systems, because the Regulation alters the situations in which public agencies may disclose information to third parties (s 5-7A; s 8-9).

Concentrated versus diffuse effects

• Concentrated effects fall on named bodies: public health organisations, Health Administration Corporation, CHeReL, the Cancer Institute, specific NSW agencies named in s 10, and accredited chaplains.

• Diffuse effects fall on patients and their immediate families, who may experience broader permitted disclosures (chaplaincy, regulatory investigations, compassionate disclosures) and on researchers and contractors engaged under prescribed research categories (s 4; s 5-7A).

The Regulation creates conditional permissions for use and disclosure of health information rather than broad new obligations. The operative duties are primarily procedural and gatekeeping in nature.

Duties imposed on organisations (express or implied by operative conditions)

• Duty to assess reasonable expectation for chaplaincy disclosure. Under s 5(2) a public health organisation may disclose health information to an accredited chaplain only if “the individual to whom the health information relates would reasonably expect the public health organisation to use or disclose the health information for the secondary purpose” of providing chaplaincy services. Organisations therefore must form and record a view on reasonable expectation before disclosure (s 5(1)-(3)).

• Duty to restrict chaplaincy disclosures to accredited chaplains. Section 5(3) limits disclosure to accredited chaplains for the hospital or institution; the Regulation defines accreditation and revocation as the accrediting authority being the chief executive of the public health organisation (s 3).

• Duty to have reasonable grounds and establish necessity for disclosures relating to suspected professional misconduct. Section 6(1) permits secondary-purpose use or disclosure where the organisation has “reasonable grounds to suspect” misconduct and the use/disclosure is “necessary” for an investigation or reporting to relevant persons/authorities. That requires internal processes to document grounds and necessity and to ensure disclosures are to relevant persons or authorities enumerated (s 6(1), (2)).

• Duty to limit complaints-based disclosures. Section 7(1) allows disclosure where an organisation has “reasonable grounds to suspect a complaint has been made against a registered health practitioner” and then only: (i) at the request of a council established under the Health Practitioner Regulation National Law (NSW) s 41B and (ii) to assist the council with practitioner management under Part 8; plus the health information must only relate to a patient of that practitioner (s 7(1)(a)-(c), s 7(2) definitions). Organisations must therefore ensure they disclose only on the specified council request and that the scope of information is restricted.

• Duty to take “reasonable steps” to be aware of a deceased individual’s prior wishes. Section 7A(d) conditions compassionate disclosure on there being no contrary wish “of which the organisation was aware or could make itself aware by taking reasonable steps.” That places a duty on organisations to take reasonable steps , not further defined in the Regulation , to discover and record prior wishes before disclosing (s 7A(d)).

• Duty to limit compassionate disclosures to what is “reasonable” and to immediate family members, and to assess maturity of an under‑18 family member. Section 7A(a), (b), (c) and (e) jointly restrict disclosure to immediate family members for compassionate reasons, limit disclosures to what is reasonable, require the individual to be deceased, and require organisations to form a reasonable belief about maturity if the recipient is under 18 (s 7A).

• Duty to treat specified agencies as a single agency for Health Privacy Principles and codes (s 10(1)-(2)). Agencies named there must coordinate and treat themselves as a single decision-maker when applying HPPs and health privacy codes.

Rights and discretion

• The Regulation grants discretion to public health organisations to use and disclose health information in the prescribed circumstances (s 5-7A). That discretion is conditional; the Regulation does not require disclosures but permits them when statutory triggers are met.

• Accredited chaplains have a narrow right to receive disclosures when they are accredited and when the “reasonable expectation” test is met (s 3; s 5(3)).

• Immediate family members of deceased individuals have a qualified right to receive information for compassionate reasons if the five listed conditions are met (s 7A).

• Regulatory bodies identified under the Health Practitioner Regulation National Law and its NSW adaptation have a right to receive information for investigations or practitioner management where the Regulation’s conditions are satisfied (s 6; s 7).

Documentation and evidentiary implications

• The Regulation’s repeated use of “reasonable” (reasonable expectation, reasonable grounds, reasonable steps, reasonable belief) and “necessary” implies that organisations will need to create contemporaneous records of the facts and decision-making steps that led to any permitted disclosure. The Regulation does not itself specify records retention, but the need to demonstrate compliance with the conditions in s 5-7A is embedded in the statutory language.

Limits and exclusions

• The Regulation is limited to certain categories of secondary-purpose use and disclosure under the Act (Schedule 1, clauses 10(1)(k) and 11(1)(l), and clause 15). It does not authorise other uses of health information beyond the Act and the other instruments it references (s 5-9). The Regulation also expressly exempts My Health Record inclusions from clause 15 to the extent of inclusion (s 8).

• The Regulation prescribes that certain systems administered by the Health Administration Corporation are not “health records linkage systems” (s 9), which changes what regulatory treatment applies to those systems in relation to clause 15.

The Regulation does not itself create criminal offences, civil penalties, or an enforcement scheme. It operates by prescribing when secondary‑purpose use or disclosure is permitted under the Act and by prescribing definitional and administrative treatments. Enforcement and penalties, if any, derive from the Act and other statutes referenced in the Regulation rather than the Regulation itself.

Evidence in the Regulation

• No penalty provisions. The Regulation’s text contains no sections imposing fines, offences or penalty units. Its subject matter is permissive and definitional: it authorises or prescribes circumstances under which information may be used or disclosed (s 5-9), prescribes agency treatment (s 10) and repeals the prior regulation (s 11).

• Interaction with enforcement regimes in referenced laws. The Regulation repeatedly cross‑references enforcement and regulatory functions that sit outside the Regulation itself:

  • The Health Practitioner Regulation National Law (and its NSW application) is referenced in relation to investigation and reporting for suspected professional misconduct and in relation to complaints and practitioner management (s 6(1)(b); s 7(1)(b); s 7(2) definitions). Those external instruments set out the powers and sanctions relevant to professional regulation; the Regulation permits disclosure to assist those external enforcement processes but does not itself create them.

  • The Act remains the primary statutory vehicle for health records privacy rules and, by implication, for any remedies or sanctions related to breaches of the Act. The Regulation modifies when disclosures are permitted under the Act’s Schedule 1 provisions but does not itself specify enforcement procedures.

Practical enforcement implications

• Burdens of proof in compliance reviews or disputes will look to whether an organisation met the Regulation’s conditions at the time of disclosure: for example, whether it had reasonable grounds to suspect misconduct (s 6(1)(a)), whether the disclosure was necessary for an investigation (s 6(1)(b)), whether a reasonable expectation existed for chaplaincy (s 5(2)), or whether an organisation took “reasonable steps” to ascertain a deceased individual’s contrary wish (s 7A(d)). Those are factual inquiries that an oversight or review body (or a tribunal/court applying the Act) would likely evaluate against the organisation’s contemporaneous records.

• Because the Regulation is permission‑based, an organisation that makes an unauthorised disclosure remains subject to the Act’s remedies and any other applicable law. The Regulation’s permissive authorisations do not create a safe harbour for conduct beyond the permit conditions.

• The Regulation’s prescription that certain agencies be treated as a single agency for Health Privacy Principles and codes (s 10) will affect where enforcement or compliance responsibility is allocated internally and how breaches are investigated or reported. The Regulation does not itself allocate penalty liabilities but modifies the organisational configuration for compliance obligations.

In short, enforcement and penalty mechanics remain within the Act and the other statutes referenced; the Regulation changes which uses and disclosures are exempted from prohibitions under clause 15 or are permitted under clauses 10 and 11 of Schedule 1, but it is the Act and other statutes that set the enforcement rules.

The Regulation is tightly integrated with both NSW and Commonwealth instruments, and it repeatedly references external statutory regimes to define scope, recipients and permitted processes. The operative interactions are as follows.

Primary linkage to the Health Records and Information Privacy Act 2002 (the Act)

• The Regulation functions as subordinate legislation to the Act and explicitly modifies the operation of specific parts of the Act: it prescribes additional items for the Act’s definition of “health service” (s 4), and it operates for the Act’s Schedule 1 clauses 10 and 11 and clause 15 by creating statutory permissions and exclusions (s 5-9). Each use of the phrase “For the Act, Schedule 1, clauses 10(1)(k) and 11(1)(l)” or “For the Act, Schedule 1, clause 15” shows the Regulation is making targeted adjustments to how those particular Act clauses operate.

Health Services Act 1997

• The Regulation borrows definitions from the Health Services Act 1997, stating that “health institution, public health organisation and public hospital have the same meanings as in the Health Services Act 1997” (s 3). That cross-reference anchors who must apply the Regulation’s permissions and duties.

Health Practitioner Regulation National Law and its NSW application

• The Regulation authorises disclosures to and in connection with investigations by National Boards or investigators appointed under the Health Practitioner Regulation National Law and refers to councils established under the Health Practitioner Regulation National Law (NSW) s 41B and to Part 8 of that NSW law for practitioner management (s 6(1)(b); s 7(1)(b), (ii)). The Regulation therefore enables information flows into the national practitioner-regulation system and the NSW council process, subject to the Regulation’s conditions.

Health Care Complaints Act 1993

• Section 7(2) defines “complaint” to include complaints made under the Health Care Complaints Act 1993, Part 2. That definition ties complaint-based disclosure permissions to complaints processes under that Act.

My Health Records Act 2012 (Commonwealth)

• Section 8(2) adopts the Commonwealth Act’s definition of “My Health Record system” and s 8(1) makes the Act’s Schedule 1 clause 15 inapplicable to the extent an organisation includes health information in the My Health Record system. That creates a direct interaction between NSW regulation and Commonwealth My Health Record participation: organisations including information in My Health Record operate outside the clause 15 linkage restriction to that extent (s 8).

Subordinate Legislation Act 1989 and commencement

• The Regulation notes that it repeals and replaces the 2017 Regulation and that, absent this Regulation, the 2017 Regulation would have been repealed on 1 September 2022 by the Subordinate Legislation Act 1989 s 10(2) (s 2 note). This is a procedural interaction explaining why the new Regulation commences on publication (s 2).

Interpretation Act 1987

• Section 3 includes a note that the Act and the Interpretation Act 1987 contain definitions and provisions that affect interpretation; this ties interpretation principles to the broader NSW statutory scheme.

Health Administration Corporation systems

• Section 9 prescribes that HealtheNet, Clinical Health Information Exchange, and the Single Digital Patient Record (all administered by the Health Administration Corporation) are not “health records linkage systems” for the purposes of clause 15. That statutory prescription interacts with clause 15 of the Act by excluding those specific systems from the definition and, thereby, altering regulatory treatment (s 9).

Centre for Health Record Linkage (CHeReL)

• Section 4(d) expressly lists services provided by CHeReL as a “health service” for the Act’s purposes, which places CHeReL within the Act’s scope and ties any Act obligations to the operations and disclosures of CHeReL.

Departmental combinations and single-agency treatment

• Section 10 instructs that named bodies be treated as a single agency for Health Privacy Principles and health privacy codes of practice, and that Corrective Services NSW and the Department of Communities and Justice be treated as a single agency for the purposes of the Act. That alters how HPPs and codes as set out in the Act will be applied across organisational boundaries named in the Regulation.

Net effect

• The Regulation adjusts the Act’s scope, information flows and agency configurations by reference to external statutes and by prescribing which bodies/systems are included or excluded. It does not replace the substantive provisions or enforcement rules of those other statutes; instead it changes permitted uses/disclosures and definitional scope so that the Act operates differently in the NSW health context where the prescribed conditions are met.

The Regulation’s text includes internal amendment annotations and explicit repeal/savings directions that record the main legislative changes and continuity measures.

• Repeal of previous Regulation. Section 11(1) expressly repeals the Health Records and Information Privacy Regulation 2017. Section 11(2) saves any “act, matter or thing” that had effect under the repealed 2017 Regulation so that it continues to have effect under the new Regulation. This is a standard saving clause to preserve rights, obligations and acts already effected under the old instrument (s 11(1)-(2)).

• Commencement. Section 2 provides that the Regulation commences on the day it is published on the NSW legislation website. The section includes a note explaining the context for the repeal and replacement of the 2017 Regulation, namely that the 2017 Regulation would otherwise have been repealed on 1 September 2022 by the Subordinate Legislation Act 1989 s 10(2) (s 2).

• Insertions and amendments recorded in section annotations:

  • Section 7A (Disclosure for compassionate reasons) is marked “Ins 2022 (799), sec 3,” indicating it was inserted in 2022 by instrument 799 under section 3 of that instrument (s 7A).

  • Section 4 (Definition of “health service”,the Act, s 4) has an annotation “s 4: Am 2023 (642), Sch 1; 2025 (240), Sch 1.” That records that s 4 was amended in instruments dated 2023 and 2025 (as set out in the Regulation’s annotations) (s 4).

  • Section 9 (Health records linkage systems) has an annotation “s 9: Am 2025 (623), Sch 1[1] [2],” indicating amendments in 2025 that prescribed the systems named in s 9 as not being health records linkage systems (s 9).

  • Section 10 (Certain public sector agencies to be treated as single agency) is annotated “s 10: Am 2024 (508), Sch 1.3[1] [2],” indicating an amendment in 2024 that added or altered the single‑agency treatment (s 10).

• Continuity. Section 11(2) ensures that acts, matters or things that had effect under the 2017 Regulation continue to have effect under the new Regulation, a provision designed to ensure transitional continuity when the new Regulation takes effect (s 11).

What the annotation record shows

• The Regulation has been modified at least in 2022 (insertion of s 7A), in 2023 and 2025 (amendments to s 4), in 2024 (amendment to s 10), and in 2025 (amendment to s 9). Those annotations indicate iterative legislative change, reflecting additions (compassionate disclosure), definitional expansion (health service additions and SDPR inclusion) and system-specific prescriptions (s 9 exclusion of named systems from “health records linkage system”).

• The Regulation’s opening sections also confirm that it replaced the 2017 Regulation to ensure continuity and avoid an automatic repeal under the Subordinate Legislation Act 1989 (s 2; s 11).

For operational planning, the annotations provide the specific statutory instruments and years where the changes occurred (for example, “Ins 2022 (799), sec 3” for s 7A and “Am 2023 (642), Sch 1; 2025 (240), Sch 1” for s 4), which allows practitioners to locate the amending instruments and examine any explanatory materials attached to those amending instruments if required.

The Regulation text supplied does not contain or reference any case law, judicial decisions, or recorded litigation about its operation, interpretation, or validity. The document lists no judicial determinations and names no cases.

What the statute itself records

• There are no schedules of decisions, no citations to judgments, and no list of precedent. All authority within the text is statutory: cross‑references to the Act and to other NSW or Commonwealth statutes are the only legal hooks used by the Regulation.

Implications for practitioners

• Because the Regulation introduces standards requiring evaluative judgments (for example, “reasonable expectation”, “reasonable grounds”, “necessary”, “reasonable steps”), absence of reported litigation means there is not, in the Regulation itself, a body of adjudicated authority to guide fine-grained application of those standards in NSW. Practitioners should therefore expect that disputes over these standards, if litigated under the Act or other statutes, will require fact-specific analysis and will be decided by reference to the Act’s regime and the Regulation’s words.

• The Regulation’s cross‑reference to external enforcement regimes (for example, the Health Practitioner Regulation National Law, Health Care Complaints Act 1993) means litigation about disclosures made under the Regulation could arise either in the context of professional‑regulatory enforcement or in the context of privacy complaints under the Act. The Regulation itself does not assert or summarise any litigation history.

• For clients or departments seeking precedential guidance on the correct threshold for “reasonable grounds” or “reasonable steps”, the Regulation provides the statutory text but not adjudicated examples. Practical guidance therefore must come from careful documentation and conservative decision-making, pending any future case law that interprets these provisions under the Act.

This section highlights specific provisions or drafting features where operational or legal risk is concentrated because the Regulation ties permissive disclosures to evaluative tests, administrative steps or external triggers. Each “gotcha” points to a concrete mechanism in the text.

1. “Reasonable expectation” for chaplaincy disclosures (s 5(2))

• Risk: s 5 permits disclosure to an accredited chaplain only if the individual “would reasonably expect” such use or disclosure. The Regulation does not define how to determine that expectation. Organisations must form a view and be able to justify it if challenged.
• Practical mechanism: assess whether the clinical context, prior communications, consent forms, signage or usual practice would lead a reasonable person to expect chaplaincy involvement; document the factual basis for the expectation. Failure to document risks post‑hoc rationalisation.

2. Accreditation gate for chaplains (s 3; s 5(3))

• Risk: Only accredited chaplains for that hospital/institution may receive disclosures. Chief executives of public health organisations must accredit and keep records of accreditation and revocation. Disclosing to a chaplain who lacks valid accreditation risks stepping outside the Regulation’s permission.
• Practical mechanism: maintain up-to-date accreditation registers and verification procedures before disclosure.

3. “Reasonable grounds” and “necessary” for professional‑misconduct disclosures (s 6)

• Risk: The threshold requires both reasonable grounds to suspect and that the disclosure be necessary for investigation or reporting. These are independent conditions; having grounds alone is insufficient without necessity.
• Practical mechanism: document the factual basis for suspicion and why lesser or alternative steps are insufficient; record reasons why disclosure to each recipient is necessary.

4. Narrow scope for complaint-related disclosures (s 7)

• Risk: s 7 limits disclosure to instances where a complaint has been made and only at the request of the NSW council under s 41B and to assist management under Part 8 of the Health Practitioner Regulation National Law (NSW), and the information must relate to a patient of the practitioner. Disclosing on a different basis , for example, to a media or to an employer , is not authorised here.
• Practical mechanism: require a formal written request from the specified council before disclosure and check that the information strictly relates to the practitioner’s patient.

5. Compassionate disclosure conditions and “reasonable steps” (s 7A)

• Risk: s 7A(d) conditions disclosure on the absence of a contrary wish “of which the organisation was aware or could make itself aware by taking reasonable steps.” “Reasonable steps” is an undefined, fact-dependent standard and will be scrutinised if disclosure is contested.
• Practical mechanism: create and document a fixed checklist of searches and inquiries (e.g., record review, advance directives register, check with treating clinicians, legal next-of-kin records) as the organisation’s definition of reasonable steps.

6. Exemption for My Health Record (s 8)

• Risk: s 8 exempts clause 15 to the extent an organisation includes information in My Health Record. Organisations that include information in My Health Record need to be clear that their inclusion practice interacts with clause 15 differently than other record‑linkage systems. The exemption is limited “to the extent” of inclusion.
• Practical mechanism: map what information is included in My Health Record and ensure understanding that different rules may apply to different dissemination pathways.

7. Prescribing certain systems as not “health records linkage systems” (s 9)

• Risk: s 9 treats HealtheNet, Clinical Health Information Exchange and the SDPR as not being health records linkage systems for clause 15 purposes. That statutory carve-out will change regulatory constraints but may create complexity when multiple systems interact.
• Practical mechanism: governance bodies must maintain an inventory of systems and their regulatory status under s 9 and clause 15.

8. Single‑agency treatment affects HPP application (s 10)

• Risk: The requirement to treat multiple named agencies as a single agency for HPPs and codes centralises decision-making and may shift responsibility for compliance and accountability. Staff or units operating within nominally separate agencies must align procedures.
• Practical mechanism: inter-agency agreements, unified privacy policies and a single point of accountability for HPP compliance should be established.

9. No penalty provisions in the Regulation (Penalties and enforcement)

• Risk: The Regulation authorises actions but does not state consequences for abuse or error; enforcement rests with the Act and other laws. Organisations must therefore consider broader statutory obligations.
• Practical mechanism: internal audit and compliance controls should be calibrated to the Act’s enforcement mechanisms even though the Regulation itself is permissive.

10. Records, documentation and evidentiary burden

• Risk: The Regulation repeatedly relies on evaluative standards. In any dispute, the organisation’s contemporaneous records will be central to justifying a disclosure.
• Practical mechanism: adopt standardised decision records for each category of disclosure permitted by the Regulation (chaplaincy, misconduct, complaint, compassionate disclosure), including the factual basis, steps taken, authorising officer, recipient, and scope of information disclosed.

Each of these “gotchas” is grounded in an operative clause of the Regulation (s 3; s 5-7A; s 8-10). Practitioners should not treat the Regulation as an exhaustive compliance checklist but as a statutory overlay that requires organisations to implement evidence-based decision processes and document them.

This section sets out concrete steps and processes public health organisations, relevant NSW agencies, and other affected bodies should adopt to implement the Regulation’s permissions and conditions. Each recommended action ties back to particular sections of the Regulation.

1. Map statutory pathways and governance responsibilities

• Action: Produce a compliance map that links the Regulation’s permissions (s 5-7A) to internal decision-makers and record-keeping processes.
• Rationale: The Regulation leaves evaluative standards (reasonable expectation, reasonable grounds, necessity, reasonable steps) to the organisation. A compliance map ensures clarity on who authorises what, referencing the relevant clause.

2. Maintain accreditation registers for chaplains (s 3; s 5(3))

• Action: The chief executive of each public health organisation should maintain and publish (internally) up-to-date lists of accredited chaplains and any revocations. Require staff to verify accreditation before any disclosure.
• Rationale: s 3 defines “accredited chaplain” and s 5(3) limits disclosure to accredited chaplains; the register operationalises the accreditation gate.

3. Implement decision forms for each authorised disclosure type (s 5, s 6, s 7, s 7A)

• Action: Create standard forms that capture the facts and justification for each disclosure: chaplaincy disclosure form, professional‑misconduct disclosure form, complaint-based disclosure form, compassionate-disclosure form.
• Required fields: date; decision-maker; factual basis (link to records); which statutory condition is relied on (cite exact subsection); recipient identity and accreditation status; scope of information disclosed; description of “reasonable steps” taken; retention and audit trail.
• Rationale: The Regulation’s standards are fact-sensitive; contemporaneous documentation demonstrates compliance in any review.

4. Define and document “reasonable steps” and “reasonable expectation” (s 5(2); s 7A(d))

• Action: Adopt an organisational policy that defines “reasonable steps” (e.g., check patient record for advance directives, consult treating clinician, search for documented wishes) and sets out how to assess “reasonable expectation” (e.g., patient-signed directives, prior expressed wishes, standard hospital practice, signage or consent forms).
• Rationale: The Regulation requires organisations to take reasonable steps to be aware of contrary wishes and to determine reasonable expectations; a documented policy reduces subjectivity and litigation exposure.

5. Limit disclosures to the minimum necessary scope (s 5(1), s 7A(b))

• Action: Apply data-minimisation principle when disclosing: include only the information reasonable and necessary for the chaplaincy, regulatory investigation or compassionate purpose. Record the minimisation rationale.
• Rationale: s 5(1) and s 7A(b) require limitation to what is reasonable for the secondary purpose.

6. Verification process for regulatory requests (s 6; s 7(1)(b))

• Action: For disclosures to investigatory bodies or councils, require a formal, verifiable written request and authenticate the requesting body as the National Board, investigator or NSW council under s 41B. Maintain a standard response template and logging.
• Rationale: s 6(1)(b) and s 7(1)(b) limit disclosures to specified authorities or requests; procedural verification avoids unauthorised release.

7. Integrate My Health Record and SDPR workflows (s 4(e); s 8)

• Action: Map which records are included in My Health Record and SDPR and ensure that inclusion and access-control procedures reflect the Regulation’s special treatment: My Health Record inclusions are exempt from clause 15 to the extent of inclusion (s 8), and SDPR services are prescribed as health services (s 4(e)).
• Rationale: Section 8 changes the Act’s linkage‑system treatment for My Health Record inclusions; s 4 brings SDPR within “health service” scope. Technical and access-control measures must align.

8. Treat named agencies as single agency for HPPs (s 10)

• Action: If you are within a named agency or one of the agencies to be treated as a single agency, produce a consolidated Health Privacy Principles compliance plan, single privacy code or aligned codes, and a nominated privacy lead with authority across the constituent bodies.
• Rationale: Section 10 requires the named agencies be treated as a single agency for HPPs and codes; coordinated policy avoids inconsistent practice across the grouped entities.

9. Training and escalation

• Action: Train clinical, administrative and privacy staff on the Regulation’s narrow permission sets. Establish an escalation path to senior legal/privacy officers for uncertain cases, especially where “reasonable grounds”, “necessary”, or “reasonable steps” are in doubt.
• Rationale: Evaluative terms are fact‑dependent; escalation reduces erroneous disclosures.

10. Audit, retention and review

• Action: Institute an audit trail for disclosures authorised under the Regulation, review cases quarterly, and refine policies based on near-misses or complaints. Keep decision records for a period consistent with organisational retention policy and likely regulatory inquiries.
• Rationale: The Regulation’s reliance on factual standards makes record retention and audit essential for defending decisions and demonstrating compliance.

11. Contracts and research agreements

• Action: When commissioning or conducting research that falls within the prescribed categories (s 4(b)-(c)), ensure agreements clarify permitted uses, obligations under the Act as modified by this Regulation, data security, and reporting lines to organisational privacy officers.
• Rationale: s 4 includes research services within “health service” for the Act; contracts should reflect the Regulation’s scope.

12. Legal and compliance review for novel situations

• Action: Before novel disclosures (for example, cross-border disclosures, disclosures to non‑accredited faith representatives, or disclosures where the deceased’s wishes are ambiguous), obtain legal advice and document the rationale for any deviation or decision not to disclose.
• Rationale: The Regulation sets narrow permission gates; conservative decision-making reduces risk.

These steps operationalise the Regulation’s conditions and create the documentary and governance evidence that will likely be needed in any subsequent review under the Act or by other regulatory bodies referenced in the Regulation.