109AMy Health Records Rules relating to data for research or public health purposes

109A My Health Records Rules relating to data for research or public health purposes

Examples of what the rules may do (1) Without limiting subsection 109(7A), My Health Records Rules made for the purposes of that subsection (the rules) may do any or all of the following: (a) impose requirements on the System Operator, the Data Governance Board established by section 82, the data custodian and other entities, including procedures that must be followed, in relation to preparing, providing, collecting, accessing, using and disclosing health information and de‑identified data; (b) provide that any or all such requirements are enforceable for the purposes of paragraph 77A(1)(c) or subsection 78(2); (c) make provision in relation to the performance of the Board’s functions set out in paragraph 83(1)(a); (d) authorise the Board to make written policies and guidelines to be followed by other entities for the purposes of giving effect to the prescribed framework. Functions of data custodian (2) The data custodian has the following functions, and the rules may make provision in relation to the performance of those functions: (a) under the direction of the Data Governance Board and in accordance with this Act—helping to implement the prescribed framework by: (i) receiving de‑identified data and health information from the My Health Record system; and (ii) as necessary—de‑identifying health information; and (iii) as necessary—providing data linkage services (within the meaning of the rules); and (iv) preparing and providing de‑identified data and health information to users of data and information whose use has been approved by the Data Governance Board; and (v) ensuring that users of de‑identified data and health information are subject to conditions of use; (b) any other functions conferred on the data custodian by this Act or the rules. Limits on rules (3) The rules: (a) must not allow the health information of a healthcare recipient to be collected, used or disclosed otherwise than with the consent of the healthcare recipient; and (b) must not allow de‑identified data or health information to be provided to a private health insurer (within the meaning of the Private Health Insurance Act 2007) or any other insurer (with or without the consent of the healthcare recipient); and (c) must not provide that any of the following is enforceable for the purposes of paragraph 77A(1)(c) or subsection 78(2): (i) a provision of a policy, guideline or other instrument made under the rules; (ii) a provision of the rules that requires an entity to comply with such a policy, guideline or instrument. Constitutional limits on rules (4) If the rules make provision for the disclosure of de‑identified data or health information obtained by using or gaining access to the My Health Record system, the rules must have the effect that the data or information is to be disclosed only: (a) by means of a postal, telegraphic, telephonic or other like service; or (b) by or to a corporation to which paragraph 51(xx) of the Constitution applies; or (c) by or to a person within a Territory or a place acquired by the Commonwealth for a public purpose; or (d) by or to the Commonwealth or an authority of the Commonwealth. (5) The rules may make other provision in relation to de‑identified data or health information only: (a) to ensure that collection, use and disclosure of data or information does not result in an interference with privacy of the kind the Commonwealth has international obligations to protect against, including under the International Covenant on Civil and Political Rights (in particular Article 17 of the Covenant); or