12Identity of individual making request

12 Identity of individual making request

(1) This section is made for the purposes of subsections 20(4) and (5), and 25D(4) and (5), of the Act. Information identifying individual making a request (2) If a healthcare provider or health administration entity requests the service operator to disclose a healthcare identifier to the provider or entity, the provider or entity must, if it is reasonably practicable to do so, give the service operator enough information to ensure the service operator can identify, by name, the individual making the request on behalf of the provider or entity without having to seek further information.

Note: For example, the information may be given as part of the data transmitted to the service operator from a healthcare provider or health administration entity’s practice management software.

Keeping retrievable records (3) If it is not reasonably practicable to give the service operator the information mentioned in subsection (2) at the time the request is made, the healthcare provider or health administration entity must: (a) keep a record of the identity of the individual who accessed the healthcare identifier for the provider or entity from the service operator; and (b) keep that record for the retrieval period for that individual; and (c) if, during the retrieval period for that individual, the service operator gives the provider or entity written notice requiring the provider or entity to identify the individual—identify the individual to the service operator by the end of the period of 14 days starting on the day after the notice is given. (4) Each of the following is a retrieval period for an individual: (a) any period during which the individual is authorised by the healthcare provider or health administration entity to access healthcare identifiers on the provider or entity’s behalf; (b) if the individual ceases to be authorised by the healthcare provider or health administration entity to access healthcare identifiers on the provider or entity’s behalf—the period of 7 years starting on the day after the person ceased to be authorised. (5) A healthcare provider or health administration entity is liable to a civil penalty if the provider or entity contravenes subsection (2) or (3).

Civil penalty: 50 penalty units.