Healthcare Identifiers Act 2010

All Australians as healthcare recipients: every Australian who receives healthcare is assigned an IHI. They do not need to apply; the service operator assigns it automatically.

Registered health professionals: all practitioners registered under the Health Practitioner Regulation National Law (including doctors, nurses, pharmacists, dentists, physiotherapists, and others) are assigned an HPI-I by AHPRA.

Healthcare provider organisations: hospitals, medical centres, pharmacies, and other healthcare entities are assigned HPI-Os and are subject to the Act's governance requirements (responsible officer, organisation maintenance officer).

Healthcare support service providers: entities providing support services such as medical transport, allied health support, or disability support that involves healthcare.

Health administration entities: government and other bodies involved in health administration (such as state and territory health departments) have access to identifiers for administration purposes.

Software vendors and technology providers: contracted service providers who handle healthcare identifier data are subject to the Act's rules indirectly through their agreements with healthcare providers.

Individual healthcare recipients: patients have rights to their own IHIs and can request disclosure. Their healthcare identifiers are government-related identifiers under the Privacy Act 1988 (s 9(6)).

Not to use or disclose without authorisation (s 26): a person must not use or disclose a healthcare identifier or identifying information obtained under the Act except as required or authorised by the Act or another Australian law or court order. The default rule is prohibition; use and disclosure must find an authorisation.

Protected healthcare identifiers (s 27): an entity holding healthcare identifiers must take reasonable steps to protect them from misuse, loss, and unauthorised access, modification or disclosure, and comply with any regulations about protection.

Collect, use and disclose only for authorised purposes (ss 12-25): the detailed tables in Part 3 specify which entities may collect, use or disclose which types of information in which circumstances for which purposes. Purpose limitations are strict: identifiers may only be used for healthcare delivery, health administration, or My Health Record system purposes.

Responsible officer and organisation maintenance officer requirements (s 9A(2)(b)-(c)): for a healthcare provider organisation to be assigned an HPI-O, it must have a designated responsible officer and (in most cases) an organisation maintenance officer. These are governance roles with accountability for the identifier assigned to the organisation.

Annual reporting (s 30): the Information Commissioner must prepare an annual report on compliance and enforcement activities under the Act, give it to the Minister and Ministerial Council by 30 September each year, and the Minister must table it in Parliament.

Review (s 35): the Minister must periodically appoint an individual to review the operation of the Act; the first review was due within 3 years after the commencement of the Health Legislation Amendment (eHealth) Act 2015 amendments.

Service operator assignment of identifiers (s 9(1)): the service operator may assign identifiers without requiring the consent of the healthcare provider or recipient (s 9(4)). Identity verification requirements apply before assignment.

Service operator's disclosure authority (Part 3): the service operator is authorised to disclose healthcare identifiers to authorised entities (healthcare providers, health administration entities) for authorised purposes. The disclosure matrix in Part 3 specifies which disclosures are permitted.

Regulations (s 39): the Governor-General may make regulations prescribing classes of healthcare providers or recipients, requirements for protection of identifiers, and a wide range of matters. The Minister must consult the Ministerial Council before regulations are made.

Data standards (s 31AC): the Chief Executive Medicare may make data standards about health information and other clinical data. Data standards are legislative instruments and have the force of law.

Ministerial directions to service operator (s 32): the Minister may, after consulting the Ministerial Council, give directions to the service operator about the performance of its functions. The service operator must comply.

Designation of health administration entities (s 7B): the Minister may by legislative instrument determine classes of entities to be health administration entities. This determines which bodies outside the direct healthcare system have access to identifiers for administration.

Information Commissioner oversight: the Information Commissioner has functions in relation to privacy and information handling under this Act, consistent with the Privacy Act 1988 framework.

Use or disclosure in breach of s 26: the offence in s 26(1)-(2) is a criminal offence. The maximum penalty is not specified in the excerpted source text but is typically imprisonment and/or fine under the Schedule to the Criminal Code (Cth) for this category of offence. Civil penalty also applies.

Failure to protect identifiers (s 27): failure to take reasonable steps to protect healthcare identifiers is a civil penalty provision.

In the Sayed v Salvation Army Housing [2023] FCA 526 case, ss 26 and 27 were pleaded by the applicant as bases for liability. The Federal Court dismissed the case on summary judgment as frivolous and vexatious, without substantive determination of the HIA provisions. The case confirms that ss 26 and 27 are available in civil proceedings, even if the pleading in that case was not sustainable.

Civil penalty amounts: the regulations may provide for penalties for contravention of regulations made under the Act (noted in s 27).

Privacy Act backstop: authorised collection, use and disclosure under this Act does not constitute an interference with privacy for the purposes of the Privacy Act 1988 (s 28AA). However, conduct outside the Act's authorisations remains subject to the Privacy Act.

Assignment of IHI: patients receive an IHI automatically based on Medicare enrolment information. The assignment does not require a request by the patient but requires identity verification.

Assignment of HPI-I: AHPRA assigns HPI-Is to registered health professionals as part of the national registration process. Unregistered but credentialled health professionals may apply to the service operator.

Assignment of HPI-O: a healthcare provider organisation applies to the service operator. Requirements include a responsible officer, an organisation maintenance officer, and at least one identified individual healthcare provider.

Reconsideration and review (Part 2): if the service operator refuses to assign a healthcare identifier, the affected person may request the service operator to reconsider. A person may apply to the Administrative Review Tribunal for review of the reconsidered decision.

Annual report deadline (s 30(2)): the Information Commissioner must give the report to the Minister and Ministerial Council no later than 30 September after the end of the relevant financial year.

Parliamentary tabling (s 30(3)): the Minister must table the annual report within 15 sitting days of receiving it.

My Health Records Act 2012 (Cth): the Healthcare Identifiers Act is foundational to the My Health Record system. Healthcare identifiers are the key through which patient records are linked to providers in My Health Record. Several definitions in this Act (authorised representative, My Health Record System Operator) cross-reference the My Health Records Act.

Privacy Act 1988 (Cth): the two Acts interact extensively. Healthcare identifiers are "government related identifiers" for Privacy Act purposes (s 9(6)). Authorised use and disclosure under this Act is not an interference with privacy under the Privacy Act (Part 4, s 28AA). The Privacy Act applies as a backstop to matters not covered by the authorisations in this Act.

Health Practitioner Regulation National Law: national registration authorities under the National Law (principally AHPRA) assign HPI-Is to registered health professionals. The two frameworks operate together to constitute the national identifier system for individual clinicians.

Human Services (Medicare) Act 1973 (Cth): the Chief Executive Medicare is the service operator and the Healthcare Provider Directory Operator. This Act ties the identifier functions to the existing Medicare administration infrastructure.

Healthcare Identifiers Regulations 2010 (Cth): the principal subordinate legislation making prescriptions required by the Act.

Criminal Code Act 1995 (Cth): the Criminal Code applies to the offences in this Act. The evidential burden provision in s 13.3(3) of the Criminal Code applies to the defences in s 26(3) (noted in s 26).

Regulatory Powers (Standard Provisions) Act 2014 (Cth): "civil penalty provision" and "Regulatory Powers Act" are defined by reference to this Act (s 5 definitions).

Default rule is prohibition (s 26): a person who obtains healthcare identifier information under this Act cannot use or disclose it unless a specific exception or authorisation applies. The exceptions in s 26(3)-(4) include: authorised under the Act, authorised under another Australian law or court order, personal use by the identifier holder, permitted general situations under Privacy Act s 16A, and Information Commissioner authorisations. Healthcare organisations must affirmatively identify which exception covers each use or disclosure of healthcare identifier data.

Commercial use of healthcare identifiers is not authorised: there is no exception in s 26 for commercial or research purposes not connected to healthcare delivery or health administration. Using a healthcare identifier for insurance underwriting, employment screening, or marketing purposes would be a breach.

Healthcare support service providers have different identifier requirements (s 9BA): a healthcare support service provider that does not ordinarily employ individual healthcare providers must meet separate requirements to be assigned a healthcare identifier. These requirements may be prescribed by regulations.

Responsible officer obligations are ongoing: maintaining a valid responsible officer and organisation maintenance officer designation is a precondition for holding an HPI-O. If the responsible officer leaves and no replacement is appointed, the organisation's identifier status may be affected.

Data standards are legislative instruments (s 31AC): data standards made by the Chief Executive Medicare about health information formats and clinical data have the force of law. Healthcare IT vendors and system architects must monitor data standards for compliance impacts.

Healthcare Provider Directory access is limited: access to the Healthcare Provider Directory is limited to authorised entities. Not all entities that need to communicate with healthcare providers may have access; the regulations determine who is authorised.

Patient transferring between hospitals: a patient presenting at a hospital emergency department has an existing IHI. The hospital's clinical information system can request the patient's IHI from the service operator (authorised under Part 3) to link the patient to their My Health Record. The emergency department uses the IHI only for healthcare delivery purposes, not for billing or other administrative uses unconnected to that purpose.

Allied health practice being onboarded: a physiotherapy practice wants to participate in the My Health Record system. The practice needs an HPI-O. The principal physiotherapist (registered under AHPRA and therefore already holding an HPI-I) is designated as the responsible officer. The practice manager is designated as the organisation maintenance officer. The service operator assigns an HPI-O to the practice after verifying the requirements of s 9A(2).

Unlawful disclosure of a patient's IHI: a health insurer obtains an IHI for a policyholder in connection with a claim. An employee of the insurer passes the IHI to a third-party marketing firm. This is a use or disclosure not authorised under s 26: it is not required or authorised under the Act or another Australian law, and it is not covered by a permitted general situation under the Privacy Act. It is an offence under s 26 and an interference with privacy under the Privacy Act.

The Sayed proceedings: a person alleged that a housing provider disclosed their healthcare identifier-linked information in contravention of ss 26 and 27 of this Act. The Federal Court ([2023] FCA 526) dismissed the case as frivolous and vexatious before any substantive determination, noting that the housing provider's functions as a residential services provider were unlikely to engage the HIA regime. The case illustrates the use of ss 26 and 27 as civil causes of action, even though this particular claim failed.