71Prohibitions and authorisations limited to health information collected by using the My Health Record system

71 Prohibitions and authorisations limited to health information collected by using the My Health Record system

(1) Subject to subsection (5), the prohibitions and authorisations under Divisions 1 and 2 in respect of the collection, use and disclosure of health information included in a healthcare recipient’s My Health Record are limited to the collection, use or disclosure of health information obtained by using the My Health Record system. (2) If health information included in a healthcare recipient’s My Health Record can also be obtained by means other than by using the My Health Record system, such a prohibition or authorisation does not apply to health information lawfully obtained by those other means, even if the health information was originally obtained by using the My Health Record system. Information stored for more than one purpose (3) Without limiting the circumstances in which health information included in a healthcare recipient’s My Health Record and obtained by a person is taken not to be obtained by using or gaining access to the My Health Record system, it is taken not to be so obtained if: (a) the health information is stored in a repository operated both for the purposes of the My Health Record system and other purposes; and (b) the person lawfully obtained the health information directly from the repository for those other purposes.

Note: For example, information that is included in a registered healthcare recipient’s My Health Record may be stored in a repository operated by a State or Territory for purposes related to the My Health Record system and other purposes. When lawfully obtained directly from the repository for those other purposes, the prohibitions and authorisations in this Part will not apply.

Information originally obtained by means of My Health Record system (4) Without limiting the circumstances in which health information included in a healthcare recipient’s My Health Record and obtained by a person is taken not to be obtained by using or gaining access to the My Health Record system, it is taken not to be so obtained if: (a) the health information was originally obtained by a participant in the My Health Record system by means of the My Health Record system in accordance with this Act; and (b) after the health information was so obtained, it was stored in such a way that it could be obtained other than by means of the My Health Record system; and (c) the person subsequently obtained the health information by those other means.

Note: For example, information that is included in a registered healthcare recipient’s My Health Record may be downloaded into the clinical health records of a healthcare provider and later obtained from those records.

(5) This section does not apply to the prohibition in subsection 59A(1A).