135ABAAuthorisations—dealings with certain information relating to pharmaceutical benefits for program integrity etc.

#### 135ABA Authorisations—dealings with certain information relating to pharmaceutical benefits for program integrity etc. (1) This section applies to information that: (a) relates to a person; and (b) is held by an agency (whether or not the information was obtained by that agency, or any other agency, after the commencement of this section); and (c) is any of the following: (i) information obtained by the agency, or any other agency, in connection with a claim for payment of a benefit under the Pharmaceutical Benefits Program; (ii) information obtained by the agency, or any other agency, in connection with a supply of a pharmaceutical benefit; (iii) information relating to a person’s eligibility or entitlement to receive a pharmaceutical benefit, to receive payment in respect of the supply of a pharmaceutical benefit or to be paid a benefit under the Pharmaceutical Benefits Program. Authorised collection, use and disclosure of information (2) Information to which this section applies may be collected, used or disclosed for one or more of the purposes specified in subsection (3) in any of the following circumstances: (a) the disclosure is by an officer (within the meaning of section 135A) to an entrusted public official; (b) the collection, use or disclosure is by an entrusted public official; (c) if the information was previously disclosed to a person (the recipient) by an entrusted public official: (i) the disclosure of the information is by the recipient to an entrusted public official; or (ii) the use of the information is by the recipient for the purpose for which it was previously disclosed; or (iii) the disclosure of the information is by the recipient to any other person for the purpose for which it was previously disclosed. > Note 1: Collection, use or disclosure authorised by this subsection is not prohibited by subsection 135A(1) (see subsection 135A(1A)). > Note 2: This subsection also constitutes an authorisation for the purposes of other laws, such as the Privacy Act 1988. (3) The collection, use or disclosure is authorised if it is for one or more of the following purposes: (a) the integrity or sustainability of a medicare program; (b) the protection of a person from a risk arising from, or in connection with, the provision of a benefit or service under a medicare program; (c) statistical analysis; (d) medical research; (e) research and development in relation to health, disability or aged care; (f) development, analysis, administration and review of, and reporting related to, government policy and programs in relation to health, disability or aged care; (g) a disclosure of information that is required or authorised under an Australian law. > Note 1: For paragraph (a), section 135ACC extends the meaning of the integrity or sustainability of a medicare program. > Note 2: For paragraphs (c), (d) and (e), additional requirements apply to disclosures for the purposes of statistical analysis, medical research, or research and development in relation to health, disability or aged care (see subsections (4) and (5)). Additional matters for disclosures relating to research or statistics (4) However, this section does not authorise a disclosure for the purposes of medical research if: (a) a person (the identifiable person) is reasonably identifiable from the information that is proposed to be disclosed; and (b) the person disclosing the information is not satisfied that: (i) the identifiable person has given informed consent to the use and disclosure of the information for that research; or (ii) the research is to be conducted in accordance with guidelines issued by the National Health and Medical Research Council under section 95 of the Privacy Act 1988. (5) Before disclosing information under this section for the purposes of statistical analysis, medical research, or research and development in relation to health, disability or aged care, the person disclosing the information must consider the extent to which the disclosure complies with the data minimisation principle. No interference with information handling for My Heath Record or data‑matching (6) Nothing in this section prevents: (a) the My Health Record System Operator including information to which this section applies in the My Health Record of a healthcare recipient; or (b) the matching of information under subsection 132B(1) or the operation of Part VIIIA generally. Definitions (7) In this section: > agency has the same meaning as in the Privacy Act 1988. > data minimisation principle means the principle of only using or disclosing as much information to which this section applies as is reasonably needed to achieve the purpose of the use or disclosure of the information. > My Health Record has the same meaning as in the My Health Records Act 2012. > My Health Record System Operator has the same meaning as System Operator has in the My Health Records Act 2012. > Pharmaceutical Benefits Program means the program for supplying pharmaceutical benefits under Part VII of this Act.