Improving Cancer Outcomes (Diagnosis Reporting) Regulations 2025

The Regulations define four key diagnostic categories. A borderline tumour is a neoplasm with morphologic, phenotypic or genotypic characteristics that are not benign but do not establish malignancy. This is a clinically important grey zone, and its inclusion ensures that tumours of uncertain malignant potential are captured. An in-situ tumour is a group of abnormal cells found only in the place where those cells formed, meaning there is no invasion through the basement membrane. The Regulations also refer to malignant tumours (explicitly including all sites except certain skin cancers) and benign tumours limited to the central nervous system.

Schedule 1 sets out five classes of reportable diagnosis. Class (1) covers all malignant tumours of all sites, excluding basal cell carcinomas and squamous cell carcinomas of the skin (with an exception explained below). Class (2) covers all in-situ tumours of all sites, again excluding BCC and SCC of skin. Class (3) covers borderline or uncertain-behaviour tumours of the brain, cerebral and spinal meninges, other central nervous system parts, female genital organs including ovaries, urinary tract (except kidney parenchyma), and haematological/lymphoid system. Class (4) covers benign tumours of the brain, meninges, spinal cord, cranial nerves and other CNS parts. Class (5) covers skin cancers other than BCC and SCC, such as melanoma, Merkel cell carcinoma and rare skin malignancies.

Class (6) is a critical carve-in: squamous cell carcinomas of specific anatomical sites are reportable even though skin SCCs are otherwise excluded. Those sites are the labia majora, labia minora, vulva, prepuce, penis, scrotum, perianal skin (including the anal margin), and the mucosal surface and vermilion border of the lip. These SCCs are considered to have higher recurrence or metastatic potential and are therefore subject to mandatory reporting.

The key reporting entities are defined in regulation 7 by reference to the Health Services Act 1988: day procedure centres, denominational hospitals, private hospitals, privately-operated hospitals, public health services, and public hospitals. In addition, any radiotherapy service that treats individuals using ionising radiation (external beam, particle, brachytherapy or injected radioisotopes) must report, as must any pathology service that tests for prescribed cancers or precursors.

Definitions imported from Commonwealth legislation include healthcare identifier (Healthcare Identifiers Act 2010) and medicare number (National Health Act 1953). These identifiers are requested “if known” in the reporting schedules, reducing the compliance burden where the information is unavailable but also introducing variability in data completeness.

Eastern Cooperative Oncology Group performance status is a measure of a patient’s functional impairment at diagnosis. It is listed in Schedule 2 as a data field “if known”, indicating it is not mandatory but the reporting system must be capable of capturing it.

Perianal skin is defined as hair-bearing skin within a 5-centimetre radius of the outer edge of the anal opening. This anatomical precision is relevant because SCCs of the perianal skin are reportable under class (6) but SCCs of other skin (buttock, groin) are not, unless they happen to fall within the defined radius.

The Regulations impose reporting obligations directly on corporations, partnerships and individuals who control or operate the listed facilities. Specifically, the following organisations are required to report:

• Public hospitals and health services - these are state-funded entities already subject to extensive data collection. The Regulations add a specific reporting pathway for cancer diagnosis data, but the marginal compliance cost may be lower because these entities typically have cancer registries or data management systems.
• Private hospitals and day procedure centres - privately owned facilities now face a mandatory obligation to collect and submit detailed clinical and demographic data for each cancer diagnosis. This imposes a compliance cost that falls disproportionately on smaller providers without dedicated health information teams.
• Radiotherapy services - any entity performing radiotherapy for cancer or precursor conditions must report, even if it is not a hospital (for example, standalone radiation oncology centres).
• Pathology services - public and private pathology laboratories that test for cancer or precursors must file reports within 30 days, a tighter deadline than the 60 days given to other providers. Pathology services may receive specimens from multiple referring hospitals and must ensure they consolidate reporting for each diagnosis.

Individual medical practitioners are affected indirectly. The reporting entity (the centre, hospital, service or pathology service) is responsible for submitting the report, but the information required includes details of the doctor in charge of the case and the general practitioner. These clinicians must provide their Medicare provider numbers, contact details and addresses. There is no explicit duty on the clinician to supply this data, but the reporting entity will need to obtain it, creating a practical obligation on clinicians to cooperate.

Patients are affected as data subjects. The schedules require collection of personal information including full name, date of birth, residential and postal addresses, email, telephone, Medicare number, healthcare identifier, sex at birth, country of birth, Indigenous status and language spoken at home. This is sensitive health data. While the Regulations require reporting to the Secretary, they do not prescribe how the data will be stored, de-identified or shared. Patients are unlikely to be informed that their diagnosis has been reported, as no patient notification obligation is imposed on the reporting entity.

The Secretary (the administrative head of the relevant department) receives the reports. The Regulations do not specify what the Secretary does with the data, but the parent Act’s objectives include monitoring cancer outcomes and improving diagnosis reporting. The data presumably feeds into a state cancer registry or similar statistical collection.

Compliance officers and legal advisors must ensure that their client organisations understand the new definitions (particularly borderline tumours and the specific SCC sites) and have systems in place to identify reportable diagnoses within the timeframes. The revocation of the 2015 regulations without transitional provisions means that any diagnosis reported under the old rules but not yet finalised may need to be re-reported under the new instrument if the entity becomes aware of it after commencement.

The primary duty is to report a diagnosis of a prescribed cancer or precursor to the Secretary within the prescribed time. This duty arises when the person in charge of the centre, hospital, radiotherapy service or pathology laboratory becomes aware of the diagnosis. “Becomes aware” is not defined, but it likely means actual knowledge, not constructive knowledge. A pathology service that issues a report is aware when the report is authorised. A hospital may become aware when the treating clinician documents the diagnosis in the medical record.

The content duty is extensive. For centres, hospitals and radiotherapy services, Schedule 2 requires 20 categories of information. These include patient identifiers, the doctor in charge, the general practitioner, admission and diagnosis dates, ECOG performance status, investigations, primary site and laterality, morphology, grade, stage group (per AIHW), TNM categories, treatment details for each primary tumour and recurrence, recurrence date and site, and the name of the person completing the form.

For pathology services, Schedule 3 requires 10 categories (plus the reporting pathologist’s details). The minimum information includes primary site, laterality, morphology type, tumour size, depth of invasion, metastatic sites, nodes sampled and positive nodes, date of diagnosis, stage, grade and biomarker results. Pathology services do not need to report treatment or recurrence details because those are generally beyond the scope of a pathology report.

The timeframe duty differs: 60 days for centres/hospitals/radiotherapy services, 30 days for pathology services. The clock starts when the person in charge becomes aware. For pathology services, that is likely the date the pathologist authorises the report. For hospitals, it may be the date the clinician enters the diagnosis in the record or the date of a multidisciplinary team meeting.

There is no right explicitly conferred on patients or clinicians by these Regulations. The reporting duty runs to the Secretary. Patients do not have a right to be notified that their data has been reported, nor a right to access or correct the reported information through these Regulations. Any such rights would arise under privacy or health records legislation, not here.

The duty is ongoing. If a patient’s diagnosis changes (e.g., from borderline to malignant), the Regulations do not impose an obligation to update a previous report. However, if the entity becomes aware of a new separate diagnosis (e.g., a recurrence), Schedule 2 item 19 requires reporting of recurrence date and site. This suggests that recurrence is treated as a separate reportable event.

The Regulations do not specify how reports are to be transmitted - by paper, electronic, or through a registry portal. The duty is merely to provide a report containing the prescribed information. Reporting entities must infer the method from the Secretary’s administrative arrangements.

The Regulations themselves do not specify penalties for non-compliance. Penalties are located in the parent Act, the Improving Cancer Outcomes Act 2014. Section 28 of that Act authorises the making of regulations and provides that the regulations may create offences and prescribe penalties of up to 20 penalty units. However, the current Regulations do not create any offence provisions explicitly. The text is silent on enforcement.

Under section 9 of the Act (which is not reproduced but is the operative provision requiring reporting), a failure to report as prescribed may constitute an offence. The Act likely provides for penalties such as fines, and possibly daily penalties for continuing non-compliance. Without access to the Act itself, we cannot state the quantum. What is clear is that the Regulations define the scope of the duty, and a breach of that duty (e.g., failing to report a prescribed diagnosis within the time limit) is a breach of the Act. The standard of proof in enforcement proceedings would be the civil standard unless the Act provides otherwise.

The Regulations incorporate by reference the AIHW staging publication. If the AIHW updates its standard and a reporting entity does not update its reporting accordingly, that entity may be non-compliant even if it was following the previous version. This creates a strict liability risk because the obligation is to report in accordance with the current standard, regardless of whether the entity was aware of the change. Due diligence systems must include monitoring of AIHW publications.

There is no enforcement mechanism specified in the Regulations, such as powers of entry, inspection or information-gathering. Those would be in the Act or other legislation. The Secretary could potentially issue directions, but the Regulations do not address that.

Given that the Regulations came into effect on 18 September 2025 and have no amendment history (version 001), there is no track record of enforcement. The sunset date of 2035 means the government will review the Regulations before then, and non-compliance rates may factor into that review.

The Regulations explicitly define terms by reference to Commonwealth legislation. Healthcare identifier is defined under the Healthcare Identifiers Act 2010 (Cth). Medicare number is defined under the National Health Act 1953 (Cth). Reporting entities that are also healthcare providers under the Commonwealth My Health Record system or Medicare must ensure that their reporting systems align with these definitions. Any inconsistency in how identifiers are recorded across systems could cause data mismatch.

Health Services Act 1988 (Vic) defines the types of hospitals and services listed in regulation 7. Entities that fall within those definitions are automatically covered. A day procedure centre that is not a hospital under the Health Services Act but is defined as one for other purposes may nonetheless be captured if it meets the Health Services Act definition. Entities should verify their status under that Act.

Privacy and Data Protection Act 2014 (Vic) and the Health Records Act 2001 (Vic) govern the collection, use and disclosure of health information. The Regulations require reporting entities to collect an extensive set of personal and health information and disclose it to the Secretary. This disclosure is likely authorised under the parent Act (Improving Cancer Outcomes Act 2014), which would provide a lawful basis for the collection and disclosure. However, entities must ensure that their privacy policies and consent forms reflect this mandatory reporting obligation. Patients should be informed that their cancer diagnosis data will be reported to the Secretary (though the Regulations do not require this).

The Charter of Human Rights and Responsibilities Act 2006 (Vic) may be relevant to the extent that data collection affects privacy (section 13). A mandatory reporting regime that requires collection of sensitive information such as Indigenous status, language spoken at home and sexual identity could engage the right to privacy. The government would need to justify the interference as reasonable and demonstrably justified in a free and democratic society. The Regulations themselves do not provide a human rights statement, but the parent Act would have been assessed.

The Subordinate Legislation Act 1994 (Vic) governs the making of statutory rules. Regulation 5 of the Subordinate Legislation Regulations 2024 required a table of applied, adopted or incorporated matter, which is included in the endnotes. The 10-year sunset period under section 5 of the Subordinate Legislation Act is noted.

Commonwealth privacy laws (Privacy Act 1988) may apply where the reporting entity is an organisation covered by that Act (e.g., a private hospital). The collection of Medicare numbers and healthcare identifiers involves Commonwealth identifiers, which are regulated under the Privacy Act. Use of Medicare numbers for purposes other than Medicare-related functions may require specific authorisation. The Regulations do not address this, and entities must check whether their use is permitted.

The Health Insurance Act 1973 (Cth) and associated regulations govern the use of Medicare numbers and provider numbers. Collecting Medicare numbers “if known” for a state cancer registry may be permissible, but using them for non-Medicare purposes could breach the Act. Legal advice on this point is advisable.

The Table of Amendments in the endnotes states: “There are no amendments made to the Improving Cancer Outcomes (Diagnosis Reporting) Regulations 2025 by statutory rules, subordinate instruments and Acts.” The Regulations are version 001, indicating that as at the version date (18 September 2025), no amending instruments had been made.

The Regulations revoke the 2015 Regulations (S.R. No. 107/2015) in their entirety. The 2015 Regulations would have had their own amendment history, but that is not relevant to the current instrument.

The Regulations incorporate the AIHW staging publication “from time to time”. This is not an amendment to the Regulations themselves, but it means the content of the reporting obligation changes without a formal amendment to the statutory rule. The table of applied, adopted or incorporated matter in the endnotes records this incorporation. Any change to the AIHW standard will automatically affect the reporting requirement without a legislative amendment. Entities must track these changes themselves; the government is not required to issue a regulatory amendment notice.

The sunset provision means the Regulations will automatically cease on 16 September 2035 unless earlier revoked or remade. That is an amendment event in the sense that the instrument has a finite life, but it is not an amendment per se.

The Explanatory Details note that the 2015 Regulations were S.R. No. 107/2015. No further detail on the history of the 2015 Regulations is provided.

The source text does not record any litigation history for the Improving Cancer Outcomes (Diagnosis Reporting) Regulations 2025. The Regulations were made on 16 September 2025 and came into operation on 18 September 2025, which is the same date as the version. It is therefore highly unlikely that any litigation has occurred yet. No court or tribunal decisions are referenced.

The predecessor 2015 Regulations may have been litigated, but the source does not mention any cases. It would be speculative to assert that there was or was not litigation under the 2015 instrument.

The parent Act (Improving Cancer Outcomes Act 2014) may have been the subject of interpretation in other contexts, but these Regulations are new and untested. Any future legal challenge could arise on grounds such as:

• Ultra vires: whether the Regulations go beyond the scope of section 28 of the Act. For example, requiring information not reasonably necessary for the objectives.
• Privacy challenge: whether the mandatory collection of certain data fields (Indigenous status, language, addresses) is proportionate and justified under the Charter.
• Incorporation by reference: whether delegating to an external body (AIHW) that may change the standard without parliamentary oversight is lawful. The table of applied matter may provide transparency, but the Regulations do not require the AIHW standard to be tabled or approved.
• Unreasonableness: whether the 30-day timeframe for pathology services is practically achievable, particularly for complex cases requiring multiple tests.

None of these challenges have been recorded.

Squamous cell carcinomas of special sites - Even though BCC and SCC of skin are excluded from reporting, SCCs of the labia, vulva, penis, scrotum, perianal skin, mucosal lip and vermilion border are reportable. A clinician might assume all skin SCCs are excluded and fail to identify these as reportable. The 5-centimetre radius definition of perianal skin requires measurement; a lesion just outside that radius may not be reportable, but close calls will create uncertainty.

Borderline tumours are reportable only for specified sites (brain, meninges, CNS, female genital organs, urinary tract except kidney, haematolymphoid). A borderline tumour of the thyroid, for example, is not reportable. Entities must check the site, not just the morphology.

Benign tumours are reportable only for the CNS structures listed. A benign tumour of the lung or colon is not reportable. This selective reporting may cause confusion if staff assume “benign” means not reportable.

The 30-day deadline for pathology services starts when the person in charge of the laboratory becomes aware. In a large pathology lab, awareness might be imputed to the laboratory director when the pathologist authorises the report. But if the report is held for review or additional testing, the clock may start later. The Regulations do not define “awareness” for an organisation. A prudent lab should treat the date of authorisation as the trigger.

“If known” qualifiers appear for many data fields (Medicare number, healthcare identifier, Indigenous status, language, ECOG status). This reduces the risk of non-compliance where the information is not available, but it also creates an incentive for reporting entities to not seek the information. The Secretary may later interpret “if known” as requiring reasonable efforts to obtain the information. Entities should document attempts to obtain data to defend against any suggestion of wilful omission.

No transitional provisions for the revocation of the 2015 Regulations. If a pathology service received a specimen before 18 September 2025 but the report was not authorised until after that date, the new Regulations apply because awareness arises after commencement. However, if the report was authorised before commencement but not yet submitted, the old Regulations might still apply. The Regulations do not address this. Practical advice is to treat all diagnoses where awareness arises after 18 September 2025 as reportable under the new instrument.

Incorporation by reference of AIHW staging - The AIHW can change the staging scheme without any amendment to the Regulations. A reporting entity that does not monitor AIHW updates could be using an outdated standard and be non-compliant. The risk is that the AIHW might change the code structure, requiring IT system updates that take time.

Privacy burden - The collection of addresses, email, phone, languages spoken and Indigenous status goes beyond what is strictly necessary for cancer staging. Entities must ensure they have authority under the Health Records Act and the Act to collect this data. If a patient refuses to provide some of this information, the entity may be forced to report “not known”, but the entity could face pressure from the Secretary to obtain the data.

No patient consent requirement - The Regulations require reporting without any provision for patient opt-out. Entities cannot rely on patient refusal as a defence for non-reporting. This may create tension with patient autonomy and privacy expectations.

Multiple reporting entities - A patient could be diagnosed by a pathology service (which reports under Schedule 3) and then treated at a hospital (which reports under Schedule 2). The same diagnosis may be reported twice, causing data duplication. The Regulations do not provide for deduplication. However, the Secre

Sunset date - The Regulations expire on 16 September 2035. Entities must plan for potential changes or renewal. However, this is a long horizon and unlikely to affect immediate compliance.

Reporting entities should take the following steps:

1. Identify reportable diagnoses - Train clinical and coding staff on the full list in Schedule 1, particularly the excluded skin cancers and the special SCC sites. All malignant tumours except BCC and SCC of skin are reportable, but note the site-specific carve-in for SCCs. Borderline and benign tumours are reportable only for specified sites. Ensure that the diagnosis codes (ICD or SNOMED) used in the medical record map correctly to the Schedule 1 categories.

2. Determine who must report - Confirm whether the entity falls within regulation 7. If it is a day procedure centre, hospital (any type), radiotherapy service or pathology service, the obligation applies. If the entity is a general practice clinic not providing cancer treatment or diagnosis services, it is not covered. Specialist consulting rooms may be exempt unless they operate a radiotherapy service.

3. Implement data capture systems - For centres, hospitals and radiotherapy services, the reporting system must capture all 20 data items in Schedule 2. For pathology services, capture the Schedule 3 items. Include optional fields (Medicare number, healthcare identifier, Indigenous status, etc.) with a clear “not known” option. Ensure that the system can record ECOG performance status, recurrence information, and treatment details (including treatment of recurrence). For pathology services, ensure biomarker results are captured.

4. Establish timeframes and triggers - The duty arises when the person in charge becomes aware of the diagnosis. Define “person in charge” for each entity. For a hospital, this might be the chief medical officer or cancer registry coordinator. For a pathology service, the laboratory director or reporting pathologist. Set up a process to track the date of awareness and initiate the report submission. Pathology services have 30 days; others have 60 days. Consider that weekends and public holidays fall within the period; there is no extension for business days.

5. Monitor AIHW staging updates - Assign someone to monitor the Australian Institute of Health and Welfare website for changes to “Cancer staging,cancer staging scheme source, code N[N]”. When a new version is published, update the staging fields in the reporting system and retrain staff on any changed codes. Failure to report using the current version is non-compliance even if the entity was unaware of the change.

6. Address privacy obligations - Update privacy policies and patient information sheets to disclose that cancer diagnosis data (including personal identifiers) will be reported to the Secretary under the Improving Cancer Outcomes Act. Obtain legal advice on whether additional consent is required for collecting language spoken at home, Indigenous status, and addresses. Document the legal basis (likely the Act) for collection and disclosure.

7. Coordinate with referring entities - Pathology services that receive specimens from hospitals may need to coordinate to avoid duplicate reporting. The Regulations do not prevent duplicate reports, but the Secretary may merge them. Pathology services should ensure they report their own data; hospitals should report treatment data even if the pathology service has already reported.

8. Document attempts to obtain “if known” data - For fields where information is optional, keep a record that reasonable efforts were made to obtain it (e.g., asked the patient, checked the referral). This may be important if compliance is later questioned.

9. Review reporting policies after commencement - The Regulations apply to diagnoses of which the entity becomes aware from 18 September 2025. For diagnoses made before that date but discovered after, a report is required. For diagnoses where awareness arose before commencement but the report was not yet submitted, check the old Regulations for timeliness.

10. Consider contingency for data transmission - The Regulations do not specify the method of reporting. Contact the Department of Health to confirm whether an online portal, electronic data interchange or paper form is required. Implement the necessary infrastructure and test it before the first report is due.

11. Allocate responsibility - Designate a person responsible for ensuring reports are completed and submitted on time. For larger entities, this may be a cancer registry officer or health information manager. For small pathology services, it may be the practice manager. Ensure that staff are trained on the definitions and deadlines.

12. Maintain audit trail - Keep records of all reports submitted, dates of awareness, and any difficulties encountered (e.g., missing data). This will assist in defending any enforcement action and in identifying compliance gaps.

13. Plan for sunset - Although the Regulations are in force for ten years, entities should monitor for any amendments before 2035 and participate in any public consultation on re-making the regulations.