59AUnauthorised use of information included in a healthcare recipient’s My Health Record for prohibited purpose

59A Unauthorised use of information included in a healthcare recipient’s My Health Record for prohibited purpose

(1) A person must not use health information included in a healthcare recipient’s My Health Record for a prohibited purpose, if the person obtained the information by using or gaining access to the My Health Record system.

Note: For prohibited purpose, see section 70A.

Civil penalty: 1,500 penalty units.

(1A) A person must not use health information included in a healthcare recipient’s My Health Record for a prohibited purpose, if the person obtained the information in the following way: (a) the health information was originally obtained by a participant in the My Health Record system by means of the My Health Record system in accordance with this Act; (b) after the health information was so obtained, it was stored in such a way that it could be obtained other than by means of the My Health Record system; (c) the person subsequently obtained the health information by those other means.

Civil penalty: 1,500 penalty units.

(2) Subsection (1) or (1A) does not apply if the person is the healthcare recipient, but does apply if the person is the nominated representative of the healthcare recipient (despite subsection 7(2)).