134ZSecretary or quality and safety body may appoint entity as special adviser for quality and safety purposes

134Z Secretary or quality and safety body may appoint entity as special adviser for quality and safety purposes (1) The Secretary or a quality and safety body may appoint an entity as a special adviser for one or more specified quality and safety purposes in relation to a specified health service entity or class of health service entity. (2) The appointment may include conditions relating to— (a) the kind of confidential information that may be collected, used or disclosed; and (b) how confidential information is to be collected, used or disclosed. S. 134ZA inserted by No. 34/2019 s. 85. 134ZA Collection, use and disclosure of confidential information if special adviser appointed (1) A special adviser may do any of the following for a quality and safety purpose specified in the special adviser's appointment— (a) collect and use confidential information from— (i) a health service entity or a health service entity in a class of health service entity specified in the appointment; and (ii) the Secretary or quality and safety body (whichever of them appointed the special adviser); and (iii) if the special adviser is appointed jointly with another special adviser, that other special adviser; (b) disclose confidential information— (i) to the Secretary or quality and safety body (whichever of them appointed the special adviser); and (ii) if the special adviser is appointed jointly with another special adviser, that other special adviser. (2) If a special adviser requests a health service entity to disclose confidential information for a quality and safety purpose specified in the appointment, the special adviser may disclose any confidential information to the health service entity that may assist it to identify the confidential information it holds that is relevant to a purpose specified in the request. (3) Each of the following may disclose confidential information to a special adviser for a quality and safety purpose specified in the special adviser's appointment— (a) the Secretary or quality and safety body (whichever of them appointed the special adviser); (b) a health service entity or health service entity in a class of health service entity specified in the appointment. S. 134ZB inserted by No. 34/2019 s. 85. 134ZB Minister may authorise collection, use and disclosure of confidential information between health service entities (1) The Minister, by instrument, may authorise a health service entity or a health service entity in a class of health service entity to do any of the following for one or more specified quality and safety purposes— (a) collect and use confidential information from another health service entity or a health service entity in a class of health service entity specified in the instrument; (b) disclose confidential information to another health service entity or a health service entity in a class of health service entity specified in the instrument. (2) The instrument must specify— (a) the health service entities or class or classes of health service entity to which it applies; and (b) the quality and safety purposes for which the health service entity may disclose confidential information. (3) The instrument may include conditions relating to— (a) the kind of confidential information that may be collected, used or disclosed; and (b) how the confidential information is to be collected, used or disclosed. (4) The instrument takes effect on the date specified in the instrument. (5) The instrument must be published in the Government Gazette as soon as practicable after the day on which it is made, unless the instrument identifies or would enable the identification of an individual to whom the confidential information relates. S. 134ZC inserted by No. 34/2019 s. 85. 134ZC Collection, use or disclosure authorised to extent necessary for purpose A person or entity who is authorised under this Part to collect, use or disclose confidential information for a quality and safety purpose must not collect, use or disclose the information except to the extent necessary to achieve that purpose. S. 134ZD inserted by No. 34/2019 s. 85. 134ZD Collection, use or disclosure in good faith protected The collection, use or disclosure of confidential information under this Part in good faith and with reasonable care— (a) does not for any purpose constitute unprofessional conduct or a breach of professional ethics on the part of the individual by whom it was made; and (b) does not make the individual by whom it was made subject to any liability in respect of it. Pt 6BA (Headings and ss 134ZDA–134ZDY) inserted by No. 39/2024 s. 93. Part 6BA—Compliance Division 1—Improvement notices S. 134ZDA inserted by No. 39/2024 s. 93. 134ZDA Power to give improvement notice (1) The Secretary or an authorised officer may give a written notice to a regulated person requiring the regulated person to take specified action if the Secretary or authorised officer reasonably believes that— (a) the regulated person has contravened, is contravening or is likely to contravene— (i) a provision of the Act or the regulations; or (ii) a condition to which the person's registration as a health service establishment is subject; and (b) taking the action is necessary— (i) to rectify a contravention; or (ii) to cease a contravention; or (iii) to prevent a likely contravention from occurring; or (iv) to address the matters or activities that caused a contravention. (2) The Secretary or an authorised officer may require a regulated person to whom an improvement notice is given— (a) to give a copy of the notice to a person or class of person; or (b) to display a copy of the notice in a manner specified in the notice. S. 134ZDB inserted by No. 39/2024 s. 93. 134ZDB Content of improvement notice An improvement notice must— (a) specify the name, and if known, the address, of the regulated person to whom the notice is given; and (b) specify— (i) the provision of the Act or the regulations that the Secretary or authorised officer reasonably believes the regulated person has contravened, is contravening or is likely to contravene; or (ii) the condition to which the regulated person's registration as a health service establishment is subject that the Secretary or authorised officer reasonably believes the person has contravened, is contravening or is likely to contravene; and (c) describe the conduct or circumstances the Secretary or authorised officer reasonably believes constitutes the contravention or likely contravention; and (d) specify the action that the regulated person must take; and (e) specify the period within which the regulated person must take the action; and (f) include information about the regulated person's right to seek review of the Secretary's or authorised officer's decision to— (i) give the improvement notice to the person; or (ii) give a notice to the person— (A) amending or revoking an action specified in the improvement notice that the regulated person must take; or (B) amending the period specified in the improvement notice within which the regulated person must take the action; and (g) state that the notice does not affect any criminal proceeding for an offence against a provision of this Act or the regulations constituted by conduct or circumstances in respect of which the notice is given; and (h) state that it is an offence to contravene the notice without reasonable excuse and that the maximum penalty for the offence is 120 penalty units in the case of a natural person or 600 penalty units in the case of a body corporate; and (i) include any prescribed information. S. 134ZDC inserted by No. 39/2024 s. 93. 134ZDC Amendment of improvement notice The Secretary or an authorised officer may give a written notice to a regulated person to whom an improvement notice is given— (a) amending or revoking an action specified in the improvement notice that the regulated person must take; or (b) amending the period specified in the improvement notice within which the regulated person must take the action. S. 134ZDD inserted by No. 39/2024 s. 93. 134ZDD Withdrawal of improvement notice The Secretary or an authorised officer— (a) may withdraw an improvement notice at any time in writing; and (b) must withdraw an improvement notice in writing if the Secretary or authorised officer is satisfied that the regulated person to whom the notice is given has taken the specified action. S. 134ZDE inserted by No. 39/2024 s. 93. 134ZDE Criminal proceeding not affected by improvement notice An improvement notice does not affect any criminal proceeding for an offence against a provision of this Act or the regulations constituted by conduct or circumstances in respect of which the notice is given. S. 134ZDF inserted by No. 39/2024 s. 93. 134ZDF Offence to contravene improvement notice A regulated person to whom an improvement notice is given must not contravene the notice without reasonable excuse. Penalty: In the case of a natural person, 120 penalty units; In the case of a body corporate, 600 penalty units. Division 2—Prohibition notices S. 134ZDG inserted by No. 39/2024 s. 93. 134ZDG Power to give prohibition notice (1) The Secretary or an authorised officer may give a written notice to a regulated person prohibiting the regulated person from engaging in a specified activity if the Secretary or authorised officer reasonably believes— (a) the regulated person has contravened, is contravening or is likely to contravene— (i) a provision of the Act or the regulations; or (ii) a condition to which the person's registration as a health service establishment is subject; and (b) that, having regard to the immediacy of the risk of harm and the degree of harm to health or safety that may be caused by the contravention or likely contravention, prohibiting the person from engaging in the specified activity is necessary to prevent or minimise that risk. (2) In addition, the Secretary or an authorised officer may require a regulated person to whom a prohibition notice is given to take any specified action the Secretary or authorised officer reasonably believes is necessary— (a) to prevent or minimise the risk to health or safety; or (b) to rectify the contravention; or (c) to cease the contravention; or (d) to prevent a likely contravention from occurring; or (e) to address the matters or activities that caused a contravention. (3) The Secretary or an authorised officer may require a regulated person to whom a prohibition notice is given to— (a) give a copy of the notice to a person or class of person; or (b) display a copy of the notice in a manner specified in the notice. S. 134ZDH inserted by No. 39/2024 s. 93. 134ZDH Content of prohibition notice A prohibition notice must— (a) specify the grounds on which the notice is given; and (b) state the name of the regulated person to whom the notice is given and, if known, the person's address; and (c) specify— (i) the activity that the regulated person is prohibited from engaging in; or (ii) the action that the regulated person must take; and (d) specify the period within which— (i) the activity is prohibited; or (ii) the action must be taken; and (e) include information about the regulated person's right to seek review of the Secretary's or authorised officer's decision to— (i) give the prohibition notice to the person; or (ii) give a notice to the person— (A) amending or revoking an activity specified in the prohibition notice that the regulated person is prohibited from engaging in; or (B) amending or revoking an action specified in the prohibition notice that the regulated person must take; or (C) amending the period specified in the prohibition notice within which the regulated person is prohibited from engaging in the activity or must take the action specified in the notice; and (f) state that the notice does not affect any criminal proceeding for an offence against a provision of this Act or the regulations constituted by conduct or circumstances in respect of which the notice is given; and (g) state that it is an offence to contravene the notice without reasonable excuse and that the maximum penalty for the offence is 120 penalty units in the case of a natural person or 600 penalty units in the case of a body corporate; and (h) include any prescribed information. S. 134ZDI inserted by No. 39/2024 s. 93. 134ZDI Amendment of prohibition notice The Secretary or an authorised officer may give a written notice to a regulated person to whom a prohibition notice is given— (a) amending or revoking an activity specified in the prohibition notice that the regulated person is prohibited from engaging in; or (b) amending or revoking an action specified in the prohibition notice that the regulated person must take; or (c) amending the period specified in the prohibition notice within which the regulated person is prohibited from engaging in the activity or must take the action specified in the notice. S. 134ZDJ inserted by No. 39/2024 s. 93. 134ZDJ Withdrawal of prohibition notice The Secretary or an authorised officer— (a) may withdraw a prohibition notice at any time in writing; and (b) must withdraw a prohibition notice in writing if the Secretary or the authorised officer reasonably believes that the prohibition is no longer necessary to prevent or minimise the risk of harm to health or safety. S. 134ZDK inserted by No. 39/2024 s. 93. 134ZDK Criminal proceeding not affected by prohibition notice A prohibition notice does not affect any criminal proceeding for an offence against a provision of this Act or the regulations constituted by conduct or circumstances in respect of which the notice is given. S. 134ZDL inserted by No. 39/2024 s. 93. 134ZDL Offence to contravene prohibition notice A regulated person to whom a prohibition notice is given must not contravene the notice without reasonable excuse. Penalty: In the case of a natural person, 120 penalty units; In the case of a body corporate, 600 penalty units. Division 3—Enforceable undertakings S. 134ZDM inserted by No. 39/2024 s. 93. 134ZDM Power to accept an enforceable undertaking (1) The Secretary may accept an undertaking given by a regulated person relating to a contravention or alleged contravention of a provision of this Act or the regulations by the regulated person, under which the regulated person undertakes to take certain action, or not take certain action, to comply with this Act. (2) An enforceable undertaking must— (a) be in writing; and (b) state the name of the regulated person; and (c) be signed by the Secretary and the regulated person; and (d) specify the date on which the undertaking is given; and (e) specify the action to be taken or not taken by the regulated person; and (f) specify the period within which the action is to be taken or not taken by the regulated person; and (g) include any other prescribed details. (3) The Secretary may publish details of an enforceable undertaking on the Department's Internet site. S. 134ZDN inserted by No. 39/2024 s. 93. 134ZDN Amendment or withdrawal of enforceable undertaking A regulated person, with the Secretary's consent, may by written notice given to the Secretary— (a) amend an enforceable undertaking given by the person; or (b) withdraw an enforceable undertaking given by the person. S. 134ZDO inserted by No. 39/2024 s. 93. 134ZDO No criminal proceeding if enforceable undertaking is complied with If a regulated person complies with an enforceable undertaking, a criminal proceeding must not be commenced against the person for an offence constituted by the person's contravention or alleged contravention of a provision of this Act or the regulations in relation to which the undertaking is given. S. 134ZDP inserted by No. 39/2024 s. 93. 134ZDP No criminal proceeding while enforceable undertaking is in force While an enforceable undertaking is in force, a criminal proceeding must not be commenced against a regulated person for an offence constituted by the person's contravention or alleged contravention of a provision of this Act or the regulations in relation to which the undertaking is given. S. 134ZDQ inserted by No. 39/2024 s. 93. 134ZDQ Criminal proceeding if enforceable undertaking is withdrawn A criminal proceeding may be commenced against a regulated person for an offence constituted by the person's contravention or alleged contravention of a provision of this Act or the regulations in relation to which the undertaking is given if the person withdraws the undertaking. S. 134ZDR inserted by No. 39/2024 s. 93. 134ZDR Enforcement of enforceable undertaking by Magistrates' Court (1) If the Secretary reasonably believes that a regulated person has contravened an enforceable undertaking given by the person, the Secretary may apply to the Magistrates' Court for an enforceable undertaking order to enforce the undertaking. (2) If the Magistrates' Court is satisfied that the regulated person has contravened the enforceable undertaking, the Magistrates' Court may make any of the following orders— (a) an order that the regulated person must comply with the undertaking; (b) an order that the regulated person take specified action to comply with the undertaking; (c) any other order that the Court considers appropriate in the circumstances. S. 134ZDS inserted by No. 39/2024 s. 93. 134ZDS Enforcement of enforceable undertaking order by Secretary (1) If the Secretary reasonably believes that a regulated person has contravened an enforceable undertaking order, the Secretary, by written notice given to the regulated person, may— (a) advise the person of the Secretary's intention to carry out the action required to comply with the order; and (b) give the person 10 business days after the notice is given to satisfy the Secretary that the person— (i) has carried out the action required to comply with the order; or (ii) will carry out the action required to comply with the order within a specified period acceptable to the Secretary. (2) The Secretary may do any thing that is necessary or expedient to carry out the action required to comply with the order that is still practicable to carry out if a regulated person to whom notice under subsection (1) is given— (a) does not agree to carry out the action; or (b) fails to carry out the action within the specified period. (3) Nothing in this section— (a) prevents a proceeding from being commenced or continued against a regulated person for the person's contravention of an enforceable undertaking order; or (b) affects any power of a court in relation to contempt. (4) If a person is found in contempt of court for contravening an enforceable undertaking order, the Secretary may— (a) do any thing that is necessary or expedient to carry out the action required to comply with the order that is still practicable to carry out; and (b) publicise on the Department's Internet site that the regulated person contravened the order. (5) The Secretary may recover any reasonable costs incurred by the Secretary in taking action under subsection (2) or (4) as a debt due to the Crown and payable by the regulated person. Division 4—Information or document production notices S. 134ZDT inserted by No. 39/2024 s. 93. 134ZDT Power to give information or document production notice (1) The Secretary or an authorised officer may give a written notice to a person requiring the person to provide to the Secretary or authorised officer specified information or information belonging to a specified class of information, or a specified document or a document belonging to a specified class of document, if the Secretary or authorised officer reasonably believes that— (a) the information or document is in the person's knowledge, possession, custody or control; and (b) the information is, or the document contains information that is, necessary— (i) for monitoring a regulated person's compliance with this Act or the regulations; or (ii) for determining whether the person or another person has committed an offence against a provision of this Act or the regulations. (2) An information or document production notice must— (a) state the name of the person to whom the notice is given; and (b) specify the grounds on which the notice is given; and (c) specify the information or document required to be provided or produced under the notice; and (d) specify the time period, being not less than 10 business days after the notice is given, within which the person must comply with the notice; and (e) state that it is an offence to contravene the notice without reasonable excuse and that the maximum penalty for the offence is 60 penalty units in the case of a natural person or 300 penalty units in the case of a body corporate; and (f) include information about the person's right to seek review of the Secretary's or an authorised officer's decision— (i) to give the information or document production notice to the person; or (ii) to give a notice to the person— (A) amending the period within which the person must comply with the information or document production notice; or (B) amending or revoking the requirement to provide or produce particular information or a particular document; and (g) state that a natural person to whom an information or document production notice is given— (i) may refuse or fail to provide any information specified in the notice if doing so would tend to incriminate the person; and (ii) may not refuse or fail to produce a document specified in the notice if doing so would tend to incriminate the person; and (h) include any other prescribed details. (3) The Secretary or an authorised officer may give a written notice to a person to whom an information or document production notice is given— (a) amending the period within which the person must comply with the notice; or (b) amending or revoking the requirement to provide or produce particular information or a particular document; or (c) withdrawing the notice. S. 134ZDU inserted by No. 39/2024 s. 93. 134ZDU Offence to contravene information or document production notice A person to whom an information or document production notice is given must not contravene the notice without reasonable excuse. Penalty: In the case of a natural person, 60 penalty units; In the case of a body corporate, 300 penalty units. S. 134ZDV inserted by No. 39/2024 s. 93. 134ZDV Protection against self‑incrimination (1) A natural person to whom an information or document production notice is given may refuse or fail to provide any information specified in the notice if doing so would tend to incriminate the person. (2) A natural person to whom an information or document production notice is given may not refuse or fail to produce a document specified in the notice if doing so would tend to incriminate the person. S. 134ZDW inserted by No. 39/2024 s. 93. 134ZDW Admissibility of document produced under information or document production notice A document produced by a natural person, under an information or document production notice, that would tend to incriminate the person is not admissible in evidence against the person in a criminal proceeding unless— (a) the person is required by law to keep the document; or (b) the proceeding is in respect of false or misleading information included in the document. S. 134ZDX inserted by No. 39/2024 s. 93. 134ZDX Offence to provide false or misleading information under information or document production notice (1) A person must not— (a) provide information to the Secretary or an authorised officer, under an information or document production notice, that is false or misleading in a material way; or (b) produce a document to the Secretary or an authorised officer, under an information or document production notice, that is false or misleading in a material way— without indicating the respect in which it is false or misleading and, if practicable, providing correct information. Penalty: In the case of a natural person, 60 penalty units; In the case of a body corporate, 300 penalty units. (2) Subsection (1) does not apply to a person if, at the time at which the information is provided or the document is produced, the person believes on reasonable grounds that the information or document is true or is not misleading. Division 5—Review by VCAT S. 134ZDY inserted by No. 39/2024 s. 93. 134ZDY Application for review by VCAT (1) A regulated person may apply to VCAT for review of the Secretary's or an authorised officer's decision— (a) to give an improvement notice to the regulated person; or (b) to give a notice to the regulated person— (i) amending or revoking an action specified in an improvement notice that the regulated person must take; or (ii) amending the period specified in an improvement notice within which the regulated person must take the action; or (c) to give a prohibition notice to the regulated person; or (d) to give a notice to the regulated person— (i) amending or revoking an activity specified in a prohibition notice that the regulated person is prohibited from engaging in; or (ii) amending or revoking an action specified in a prohibition notice that the regulated person must take; or (iii) amending the period specified in a prohibition notice within which the regulated person is prohibited from engaging in the activity or must take the action specified in the notice. (2) A person to whom an information or document production notice is given may apply to VCAT for review of the Secretary's or an authorised officer's decision— (a) to give the information or document production notice to the person; or (b) to give a notice to the person— (i) amending the period within which the person must comply with the information or document production notice; or (ii) amending or revoking the requirement to provide or produce particular information or a particular document. (3) An application for review under this section must be made within 28 days after the later of— (a) the day on which the decision is made; or (b) if, under the **Victorian Civil and Administrative Tribunal Act 1998**, the applicant requests a statement of reasons for the decision, the day on which— (i) the statement of reasons is given to the applicant; or (ii) the applicant is informed under section 46(5) of that Act that a statement of reasons will not be given. Pt 6C (Headings and ss 134ZE–134ZW) inserted by No. 4/2023 s. 4. Part 6C—Electronic Patient Health Information Sharing System Division 1—Definitions S. 134ZE inserted by No. 4/2023 s. 4. 134ZE Definitions ***Electronic Patient Health Information Sharing System*** means the system established under section 134ZF; ***health information*** has the same meaning as in the **Health Records Act 2001**; ***participating health service*** means— (a) an ambulance service within the meaning of the **Ambulance Services Act 1986**; or (b) a denominational hospital listed in Schedule 2; or (c) a metropolitan hospital listed in Schedule 3; or (d) a multi purpose service; or (e) a public health service listed in Schedule 5; or (f) a public hospital listed in Schedule 1; or (g) a registered community health centre; or (h) the Victorian Institute of Forensic Mental Health established by section 610 of the **Mental Health and Wellbeing Act 2022**; or (i) a residential care service within the meaning of the Aged Care Act 1997 of the Commonwealth that provides State funded residential aged care services, including State funded residential aged care homes but not including supported residential services within the meaning of the **Supported Residential Services (Private Proprietors) Act 2010**; or (j) the Victorian Collaborative Centre for Mental Health and Wellbeing established by section 640 of the **Mental Health and Wellbeing Act 2022**; or (k) a prescribed entity or a prescribed class of entity that provides health services; ***Privacy Management Framework*** means the Privacy Management Framework established under section 134ZT; ***specified patient health information*** means health information specified in a notice published in the Government Gazette under section 134ZH that is about a person who is or has been a patient in, or has received health services from, a participating health service, but does not include a unique identification number assigned by the participating health service to that person. Division 2—Electronic Patient Health Information Sharing System S. 134ZF inserted by No. 4/2023 s. 4. 134ZF Electronic Patient Health Information Sharing System (1) The Secretary must establish and maintain the Electronic Patient Health Information Sharing System for the purposes of— (a) collecting specified patient health information required to be given to the Secretary under this Part; and (b) disclosing that information to participating health services for the purpose of providing medical treatment to a person. (2) The Secretary is to keep the Electronic Patient Health Information Sharing System in a form to be determined by the Secretary. S. 134ZG inserted by No. 4/2023 s. 4. 134ZG Content of Electronic Patient Health Information Sharing System The Electronic Patient Health Information Sharing System must contain any specified patient health information required to be given to the Secretary by a participating health service under this Part. S. 134ZH inserted by No. 4/2023 s. 4. 134ZH Notice of health information required to be given to the Secretary (1) The Secretary, by notice published in the Government Gazette, may specify health information to be given to the Secretary by a participating health service for the purposes of the Electronic Patient Health Information Sharing System. (2) The Secretary may also specify in the notice published under subsection (1) a relevant date in relation to health information specified in the notice, being not earlier than 3 years before the commencement of this Part. (3) A participating health service must give to the Secretary— (a) the health information specified in a notice published under subsection (1) that it holds about a person who is or has been a patient in, or has received health services from, the participating health service, if it was collected by the participating health service on or after the relevant date specified for that information; and (b) the unique identification number assigned by the participating health service to a person referred to in paragraph (a). (4) The participating health service must give the health information and unique identification numbers referred to in subsection (3) to the Secretary— (a) within 5 days after the publication of the notice; or (b) by any later date specified in the notice. S. 134ZI inserted by No. 4/2023 s. 4. 134ZI Health information collected after publication of notice (1) A participating health service must give to the Secretary— (a) the health information specified in any notice published under section 134ZH(1) that it collects after the publication of that notice about a person who is or has been a patient in, or has received health services from, the participating health service; and (b) the unique identification number assigned by the participating health service to a person referred to in paragraph (a). (2) The participating health service must give the health information and unique identification numbers referred to in subsection (1) to the Secretary within 5 days after the information is collected. S. 134ZJ inserted by No. 4/2023 s. 4. 134ZJ Direction to comply with notice (1) If a participating health service has not complied with section 134ZH(4) or 134ZI(2), the Secretary may give a written direction to a participating health service that requires the participating health service to give to the Secretary the health information or any unique identification number required to be given under section 134ZH(4) or 134ZI(2). (2) The direction may specify the manner and form in which the health information or unique identification number referred to in subsection (1) is to be given to the Secretary. (3) Subject to section 134ZK, a participating health service must comply with a direction given under this section within 3 months after the direction is given. S. 134ZK inserted by No. 4/2023 s. 4. 134ZK Extension of time to comply with notice (1) A participating health service to which a direction under section 134ZJ has been given may request that the Secretary extend the time for the health service to comply with the direction. (2) The Secretary, by written notice given to the participating health service, may grant an extension to a participating health service for a specified period of not more than 6 months after the direction is given. (3) If the Secretary grants an extension to a participating health service, the health service must comply with the direction within the time specified in the notice. S. 134ZL inserted by No. 4/2023 s. 4. 134ZL No consent required (1) A participating health service may collect, use or disclose specified patient health information as permitted or authorised by this Part without the consent of the person to whom the information relates. (2) The Secretary may collect, use or disclose specified patient health information as permitted or authorised by this Part without the consent of the person to whom the information relates. Division 3—Access to the Electronic Patient Health Information Sharing System S. 134ZM inserted by No. 4/2023 s. 4. 134ZM Access to, use and disclosure of information held in Electronic Patient Health Information Sharing System for provision of medical treatment A person employed or engaged by a participating health service and who is authorised by that health service may access the Electronic Patient Health Information Sharing System and use and disclose specified patient health information for the purpose of providing medical treatment to a person. S. 134ZN inserted by No. 4/2023 s. 4. 134ZN Access to and use of information for purposes of establishing and maintaining Electronic Patient Health Information Sharing System (1) A person employed or engaged by a participating health service and who is authorised by that health service may access the Electronic Patient Health Information Sharing System and use specified patient health information for the purposes of— (a) giving the information to the Secretary as required by sections 134ZH, 134ZI, 134ZJ and 134ZK; and (b) information security and data management. (2) In this section and section 134ZO— ***information security and data management*** means— (a) examination and analysis of information contained in the Electronic Patient Health Information Sharing System to the extent reasonably required for the purpose of verifying the accuracy of that information; and (b) examination and analysis of information to the extent reasonably necessary to ensure the Electronic Patient Health Information Sharing System operates securely and effectively. S. 134ZO inserted by No. 4/2023 s. 4. 134ZO Secretary authorised to access Electronic Patient Health Information Sharing System and use and disclose specified patient health information (1) The Secretary, or a person employed or engaged and authorised in writing by the Secretary, may access the Electronic Patient Health Information Sharing System and use and disclose specified patient health information for the following purposes— (a) establishing, maintaining and operating the Electronic Patient Health Information Sharing System; (b) undertaking information security and data management in relation to the Electronic Patient Health Information Sharing System; (c) otherwise ensuring that the Electronic Patient Health Information Sharing System operates securely and effectively. (2) The Secretary, or a person employed or engaged and authorised in writing by the Secretary, may use unique identification numbers given to the Secretary under this Part for the following purposes— (a) establishing, maintaining and operating the Electronic Patient Health Information Sharing System; (b) undertaking information security and data management in relation to the Electronic Patient Health Information Sharing System; (c) otherwise ensuring that the Electronic Patient Health Information Sharing System operates securely and effectively. Division 4—Offences S. 134ZP inserted by No. 4/2023 s. 4. 134ZP Offence of unauthorised access to Electronic Patient Health Information Sharing System (1) A person must not knowingly access the Electronic Patient Health Information Sharing System unless the person is authorised under this Part to access the Electronic Patient Health Information Sharing System. (a) the person is authorised or required by or under this Act or any other Act to access the Electronic Patient Health Information Sharing System; or (b) the person is required to access the Electronic Patient Health Information Sharing System by law. (3) For the purposes of subsection (2)(a), "any other Act" does not include the Health Privacy Principles in the **Health Records Act 2001** or Part 3 or Part 5 of that Act. S. 134ZQ inserted by No. 4/2023 s. 4. 134ZQ Offence of access to Electronic Patient Health Information Sharing System for unauthorised purpose (1) A person who is authorised under this Part to access the Electronic Patient Health Information Sharing System must not access the Electronic Patient Health Information Sharing System other than in accordance with this Part*.* (a) the person accesses the Electronic Patient Health Information Sharing System as authorised or required by or under any other Act; or (b) the person is required to access the Electronic Patient Health Information Sharing System by law. (3) For the purposes of subsection (2)(a), "any other Act" does not include the Health Privacy Principles in the **Health Records Act 2001** or Part 3 or Part 5 of that Act. S. 134ZR inserted by No. 4/2023 s. 4. 134ZR Offence of unauthorised use or disclosure of specified patient health information (1) A person who is authorised under this Part to access the Electronic Patient Health Information Sharing System must not use or disclose specified patient health information obtained by that person from the Electronic Patient Health Information Sharing System other than in accordance with this Part. (a) the use or disclosure of the specified patient health information is expressly authorised or required by or under any other Act; or (b) the use or disclosure of the specified patient health information is authorised by law. (3) For the purposes of subsection (2)(a), "any other Act" does not include the Health Privacy Principles in the **Health Records Act 2001** or Part 3 or Part 5 of that Act. (4) This section applies whether or not the use or disclosure would otherwise be permitted under section 141. Division 5—Disapplication of the Freedom of Information Act 1982 S. 134ZS inserted by No. 4/2023 s. 4. 134ZS Freedom of Information Act 1982 does not apply (1) The **Freedom of Information Act 1982** does not apply to— (a) a document given to the Secretary for the purposes of complying with a notice under section 134ZH or 134ZI or a direction under section 134ZJ; or (b) the Electronic Patient Health Information Sharing System. (2) In this section— ***document*** has the same meaning as in the **Freedom of Information Act 1982**. Division 6—Privacy Management Framework S. 134ZT inserted by No. 4/2023 s. 4. 134ZT Minister must establish Privacy Management Framework (1) The Minister, by order published in the Government Gazette, must establish a Privacy Management Framework for the Electronic Patient Health Information Sharing System as soon as practicable after the day on which this Part comes into operation. (2) In establishing the Privacy Management Framework, the Minister must consult with the following persons and bodies in relation to whether certain health information or classes of health information should require additional levels of protection under the Privacy Management Framework— (a) relevant groups and organisations that represent the interests of patients, carers or health care workers; (b) any relevant public sector body within the meaning of the **Public Administration Act 2004**; (c) participating health services. (3) The Privacy Management Framework must— (a) specify categories of health information that are sensitive in nature and include a process to safeguard that information; and (b) include a process to safeguard the identity of patients who may be at risk of harm, including patients who identify as being at risk of family violence; and (c) include a process to facilitate patients accessing reports that specify who has accessed their health information through the Electronic Patient Health Information Sharing System; and (d) include a process for regular audits and compliance checks of the Electronic Patient Health Information Sharing System. (4) The Privacy Management Framework takes effect on— (a) the day on which it is published in the Government Gazette; or (b) a later day as specified in the order. Section 41A of the **Interpretation of Legislation Act 1984** provides that the power to make an instrument includes the power to repeal, revoke, rescind, amend, alter or vary the instrument in the exercise of that power. S. 134ZU inserted by No. 4/2023 s. 4. 134ZU Compliance with Privacy Management Framework Any person who is authorised or permitted under this Part to access the Electronic Patient Health Information Sharing System must comply with the Privacy Management Framework to the extent reasonably practicable. Division 7—Independent review of this Part S. 134ZV inserted by No. 4/2023 s. 4. 134ZV Independent review by expert panel (1) The Minister must cause an independent review of the operation of this Part, including the Privacy Management Framework, to be conducted by an expert panel after the second anniversary of the day on which this Part comes into operation. (2) The independent review must examine and make recommendations in relation to the following— (a) whether health information is sufficiently protected; (b) which health services should be participating health services for the purposes of this Part; (c) the misuse of specified patient health information; (d) the costs of compliance and the administrative burden imposed on participating health services by this Part; (e) whether the Electronic Patient Health Information Sharing System is operating as intended. (3) The independent review may examine and make recommendations in relation to the following— (a) current issues and trends relating to health information systems; (b) data management; (c) information technology security; (d) patient privacy; (e) any other relevant matter. (4) The independent review must be completed no later than the third anniversary of the day on which this Part comes into operation. (5) The Minister must cause a copy of a report of the independent review to be laid before each House of Parliament no later than 3 sitting days after the day on which the final report of the independent review is given to the Minister. (6) The Minister must consider any recommendations made by the independent review, including any recommendations to amend this Act, and within 18 months of receiving the final report— (a) implement the recommendations made by the independent review; or (b) advise Parliament why the recommendations have not been implemented. S. 134ZW inserted by No. 4/2023 s. 4. 134ZW Appointment of expert panel (1) For the purposes of section 134ZV, the Minister must appoint 3 persons to form the expert panel. (2) The Minister must ensure that each person appointed to the expert panel has experience in one or more of the following— (a) human rights and privacy matters; (b) legal and regulatory compliance; (c) health information systems; (d) clinical care; (e) health care quality and patient safety; (f) consumer or patient advocacy. (3) The Minister must not appoint a person to the expert panel if the person is— (a) a current employee or executive officer of a registered political party within the meaning of the **Electoral Act 2002**; or (b) a current or former member of Parliament.