135AOfficers to observe secrecy

#### 135A Officers to observe secrecy Offence—use or disclosure by officer outside course of duty (1) A person (the relevant person) commits an offence if: (a) the relevant person is or has been an officer; and (b) the relevant person uses or discloses information; and (c) the information: (i) relates to the affairs of a person other than the relevant person; and (ii) is obtained or generated by the relevant person in the performance of duties or functions, or in the exercise of powers, under this Act. Penalty: Imprisonment for 2 years or 50 penalty units, or both. (1A) Subsection (1) does not apply if the use or disclosure is: (a) authorised or exempted under a provision of this Act; or (b) otherwise required or authorised under an Australian law. > Note 1: The defendant bears an evidential burden in relation to the matter in this subsection. See subsection 13.3(3) of the Criminal Code. > Note 2: For the purposes of this subsection, examples of provisions of this Act that authorise the use or disclosure of information include sections 135ABA, 135ABB and 135ABC. Authorisation—performance of functions (2) An officer may use or disclose information of a kind referred to in paragraph (1)(c): (a) in the performance of duties or functions, or in the exercise of powers, under this Act or any other Act; or (b) for the purpose of enabling the officer or any other person to perform duties or functions, or exercise powers, in relation to a medicare program; or (c) in the case of disclosure to the Minister—for the purposes of the Minister’s performance of the Minister’s functions. Authorisations—use or disclosure in public interest (3) An officer may use or disclose information of a kind referred to in paragraph (1)(c) if: (a) the Secretary or the Chief Executive Medicare certifies, by instrument in writing, that it is in the public interest to disclose the information to a specified person or body for a specified purpose; and (b) the officer: (i) discloses the information to the person or body for that purpose; or (ii) uses the information for purposes related to such a disclosure. > Note: Information disclosed to a person under this subsection for a specified purpose must only be further used or disclosed for that purpose (see subsection (3G)). (3A) The Secretary or the Chief Executive Medicare may, by instrument in writing, specify terms and conditions subject to which the information may be used or disclosed by the person. (3B) Without limiting subsection (3A), the instrument may require the person to give an undertaking in writing with respect to the use or disclosure of the information by the person, which may include an undertaking not to disclose any of the information to any other person or body. (3C) An instrument under paragraph (3)(a) or subsection (3A) is not a legislative instrument. (3D) Subsection (3) has effect subject to rules made under subsection (3E) (if any). (3E) The Minister may, by legislative instrument, make rules for the purposes of subsection (3D). Authorisation—disclosing to prescribed person or body (3F) An officer may disclose information of a kind referred to in paragraph (1)(c) to a person or body for a specified purpose if regulations made for the purposes of this subsection provide that: (a) the person or body is a prescribed person or body; and (b) the information is prescribed information; and (c) the information may be provided to the person or body for that purpose. > Note: Information disclosed to a person or body under this subsection for a specified purpose must only be further used or disclosed for that purpose (see subsection (3G)). Obligation on further use or disclosure of disclosed information (3G) A person or body that receives information under subsection (3) or (3F) for a specified purpose must ensure that any further use or disclosure of the information is only for that purpose. Authorisation—use or disclosure by officer in certain circumstances (4) An officer may use or disclose information of a kind referred to in paragraph (1)(c) if: (a) the information is lawfully in the public domain; or (b) the person to whom the information relates has expressly or impliedly consented to the use or disclosure; or (c) the use or disclosure is for the purpose of obtaining or providing legal advice; or (d) if the disclosure is to a person or body—the information relates to that person or body; or (e) if the disclosure (the present disclosure) is to a person or body—the information has lawfully been disclosed to that person or body previously (the previous disclosure), and the present disclosure is for the same purpose as the previous disclosure. Authorisation—statistical information (5) An officer may use or disclose information of a kind referred to in paragraph (1)(c) for the purpose of deriving or publishing statistics that do not enable the identification of any person (other than the Commonwealth, a State or a Territory). (5A) Statistics relating to the supply of pharmaceutical benefits may be published in spite of the fact that the manufacturer of any of those benefits may be identified through those statistics. Authorisation—data‑matching by a Commonwealth entity (5D) Notwithstanding anything in subsection (1), the Secretary or the Chief Executive Medicare may provide information to an authorised Commonwealth entity (within the meaning of Part VIIIA) for the purpose of facilitating the matching of that information by the Commonwealth entity under subsection 132B(1). Authorisation—disclosing information relating to convictions etc. (6) Notwithstanding anything contained in subsection (1), where: (a) a person has been convicted of: (i) an offence against this Act; or (ii) an offence against section 6 of the Crimes Act 1914, or section 11.1, 11.4 or 11.5 of the Criminal Code, that relates to an offence against this Act; or (b) an order has been made in relation to a person under section 19B of the Crimes Act 1914 in relation to an offence referred to in subparagraph (a)(i) or (ii); or (c) a Committee of Inquiry reports adversely on the conduct of a practitioner or pharmacist in relation to a matter upon which the Committee makes inquiry; the Secretary may disclose any information acquired by an officer in the performance of duties or functions, or in the exercise of powers, under this Act that concerns a matter referred to in paragraph (a), (b) or (c) to: (d) the Secretary of the Department of Social Security; or (e) the Secretary of the Veterans’ Affairs Department; or (ea) the Chief Executive Centrelink or a person engaged (whether as an employee or otherwise) by Services Australia; or (f) a person or persons who, under a law of a State or Territory that provides for the registration or licensing of hospitals, nursing homes or similar institutions, is or are, responsible for the administration of that law or who is, or are, empowered to investigate persons in connection with contraventions of that law; or (g) a person or persons who, under a law of a State or Territory that provides for the registration or licensing of practitioners, pharmacists or pharmaceutical chemists is, or are, empowered to take disciplinary action with respect to practitioners, pharmacists or pharmaceutical chemists or to investigate practitioners, pharmacists or pharmaceutical chemists in connection with the taking of such disciplinary action; or (ga) a person or persons who, under a law of a State or Territory that provides for the registration of midwives, or the authorisation (however described) of persons to practise midwifery, are empowered to: (i) take disciplinary action with respect to midwives; or (ii) investigate midwives in connection with the taking of such disciplinary action; or (gb) a person or persons who, under a law of a State or Territory that provides for the registration of nurse practitioners, or the authorisation (however described) of persons to practise as nurse practitioners, are empowered to: (i) take disciplinary action with respect to nurse practitioners; or (ii) investigate nurse practitioners in connection with the taking of such disciplinary action; or (h) a person or persons who, under a law of the Commonwealth, a State or a Territory relating to drugs or poisons, is, or are, responsible for the administration of that law or who is, or are, empowered to investigate persons in connection with contraventions of that law; or (j) a director, secretary or employee of a private health insurer who is authorized by the Secretary, by instrument in writing, for the purposes of this subsection. Authorisation—disclosing certified information for purposes of certain laws or private health insurance (7) Notwithstanding anything contained in subsection (1), where the Minister, by instrument in writing, certifies that it is desirable for such of the following purposes as the Minister specifies in the certificate, that is to say: (b) the administration of an Act administered by the Veterans’ Affairs Minister; (c) the administration of a specified law of a State or Territory, being a law that provides for the registration or licensing of hospitals, nursing homes or similar institutions; (d) the administration of a specified law of a State or Territory, being a law that provides for the registration or licensing of practitioners or pharmacists; (da) the administration of a specified law of a State or Territory, being a law that provides for the registration of midwives, or the authorisation (however described) of persons to practise midwifery; or (db) the administration of a specified law of a State or Territory, being a law that provides for the registration of nurse practitioners, or the authorisation (however described) of persons to practise as nurse practitioners; or (e) the administration of a specified law of the Commonwealth, a State or a Territory relating to drugs or poisons; or (f) the carrying on of the business of a specified private health insurer or a private health insurer included in a specified class of private health insurers; that information of a kind referred to in the certificate, being information acquired by an officer in the performance of duties or functions, or in the exercise of powers, under this Act, should be disclosed, the Secretary may disclose information of that kind: (h) if the certificate specifies a purpose of the kind referred to in paragraph (b)—to the Secretary of the Veterans’ Affairs Department; (j) if the certificate specifies a purpose in relation to a specified law of the kind referred to in paragraph (c) or (e)—to the person or persons who, under that law is, or are, responsible for the administration of that law or is, or are, empowered to investigate persons in connection with contraventions of that law; (k) if the certificate specifies a purpose in relation to a specified law of the kind referred to in paragraph (d)—to the person or persons who, under that law is, or are, empowered to take disciplinary action with respect to practitioners or pharmacists or to investigate practitioners or pharmacists in connection with the taking of such disciplinary action; or (l) if the certificate specifies a purpose in relation to a specified law of the kind referred to in paragraph (da)—to the person or persons who are empowered to: (i) take disciplinary action with respect to midwives; or (ii) investigate midwives in connection with the taking of such disciplinary action; or (la) if the certificate specifies a purpose in relation to a specified law of the kind referred to in paragraph (db)—to the person or persons who are empowered to: (i) take disciplinary action with respect to nurse practitioners; or (ii) investigate nurse practitioners in connection with the taking of such disciplinary action; or (m) if the certificate specifies a purpose of the kind referred to in paragraph (f)—to a director, secretary or employee of each private health insurer to which the certificate relates, being a director, secretary or employee who is authorized by the Secretary, by instrument in writing, for the purposes of this subsection. Restrictions on disclosing information relating to rendering of certain professional services (8) Information relating to the rendering of a medical service, a dental service or an optometrical service, the provision of hospital treatment or the supply of a pharmaceutical benefit must not be disclosed in pursuance of subsection (6) or (7) in a manner that is likely to enable the identification of the person to whom that service was rendered, that treatment or care was provided or that benefit was supplied (in this subsection referred to as the patient) unless: (a) the patient: (i) is a person referred to in paragraph (6)(a) or (b); or (ii) consents in writing to the disclosure of the information; or (b) the Minister certifies that there are reasonable grounds for suspecting that the patient has committed, or is committing, an offence of the kind referred to in subparagraph (6)(a)(i) or (ii). Offence—recipients of information relating to convictions etc. or certified information (9) A person to whom information is disclosed under subsection (6) or (7) and any person under the control of the first‑mentioned person shall not, directly or indirectly, except: (aa) in the case of the Chief Executive Centrelink or a person engaged (whether as an employee or otherwise) by Services Australia—in the performance of duties or functions, or in the exercise of powers, under an Act administered by the Minister administering the Human Services (Centrelink) Act 1997; or (b) in the case of the Secretary of the Veterans’ Affairs Department or a person under the control of the Secretary—in the performance of duties or functions, or in the exercise of powers, under an Act administered by the Veterans’ Affairs Minister; or (c) in the case of a person or persons referred to in paragraph (6)(f), (g), (ga), (gb) or (h), or (7)(j), (k), (l) or (la), or a person under the control of such a person or persons—in the performance of duties or functions, or in the exercise of powers, under the law referred to in that paragraph; or (d) in the case of a director, secretary or employee of a private health insurer or a person under the control of such a person—in the performance of duties or functions, or in the exercise of powers, in relation to the carrying on of the business of the insurer; and while the person is, or after the person ceases to be, such a person, use, or further disclose to any person, any information so disclosed. Penalty: Imprisonment for 2 years or 50 penalty units, or both. (12A) Despite subsection (1), any of the following persons may disclose information about a person’s compliance with a share by default provision (within the meaning of the My Health Records Act 2012) to the Australian Commission on Safety and Quality in Health Care: (a) the Secretary; (b) the Secretary of the Department administered by the Minister administering the My Health Records Act 2012; (c) the Chief Executive Medicare. Offences—solicitation of certain information held by Department (13) Where: (a) a person solicits the disclosure of protected information from an officer or another person; and (b) the disclosure would be in contravention of this section; and (c) the first‑mentioned person knows or ought reasonably to know that the information is protected information; the first‑mentioned person commits an offence, whether or not any protected information is actually disclosed. (16) Where: (a) a person is convicted of an offence under subsection (13); and (b) the person acted as an employee or agent of another person in soliciting the disclosure of the information; the other person commits an offence. (16A) An offence under subsection (16) is an offence of strict liability. > Note: For strict liability, see section 6.1 of the Criminal Code. (17) It is a defence to a prosecution for an offence against subsection (16) if the employee or agent was acting outside the scope of his or her authority as an employee or agent in soliciting the disclosure of the information. > Note: The defendant bears an evidential burden in relation to the matter in subsection (17). See subsection 13.3(3) of the Criminal Code. Offence—conduct relating to information unlawfully disclosed (17A) A person commits an offence if: (a) protected information is disclosed to the person; and (b) the disclosure contravenes this section; and (c) the person: (i) in any way solicited the disclosure of the information to the person; or (ii) discloses the information to another person; or (iii) uses the information otherwise than by disclosing it to another person. (18) Where: (a) a person is convicted of an offence under subsection (17A); and (b) the person acted as an employee or agent of another person in obtaining the information; the other person commits an offence. (18A) An offence under subsection (18) is an offence of strict liability. > Note: For strict liability, see section 6.1 of the Criminal Code. (19) It is a defence to a prosecution for an offence against subsection (18) if the employee or agent’s action described in subsection (17A) was outside the scope of his or her authority as an employee or agent. > Note: The defendant bears an evidential burden in relation to the matter in subsection (19). See subsection 13.3(3) of the Criminal Code. Offences—offer to supply certain information held by Department (20) A person who: (a) offers to supply (whether to a particular person or otherwise) information about another person; and (b) knows that the information is protected information; commits an offence. (21) A person who: (a) holds himself or herself out as being able to supply (whether to a particular person or otherwise) information about another person; and (b) knows that the information is protected information; commits an offence. Penalty for offences against solicitation, conduct relating to information unlawfully disclosed or offer to supply (22) The penalty for an offence against subsection (13), (16), (17A), (18), (20) or (21) is imprisonment for a period not exceeding 2 years. Definitions (24) In this section: > Chief Executive Centrelink has the same meaning as in the Human Services (Centrelink) Act 1997. > officer means any of the following: (a) a person performing duties or functions, or exercising powers, under or in relation to this Act or a medicare program; (b) any other person employed or engaged by the Commonwealth to provide services to the Commonwealth in connection with a relevant Department or Services Australia; (c) any other person employed or engaged (however described) by a person described in paragraph (b) to provide services in connection with the services mentioned in that paragraph. > pharmaceutical benefit has the same meaning as in Part VII. > protected information means information about a person that is held in the records of the Department.