National Health (Data-matching) Principles 2020

The instrument organises its regulatory architecture around a small set of recurring concepts, each defined or referenced to definitions in the National Health Act 1953 or other Commonwealth legislation.

• Authorised information‑matching and authorised data‑matching program. Authorised information‑matching means matching authorised by Part VIIIA of the Act, and authorised data‑matching program is a program of authorised information‑matching for one or more permitted purposes (s 4). The instrument repeatedly distinguishes the Chief Executive Medicare as the central decision‑maker and implementer, and authorised Commonwealth entities as participants who must comply with standards and duties where they match information (see s 5, s 6(3)-(4), s 11(2)).

• Permitted purpose. The term is used throughout to delimit legitimate grounds for matching under the underlying Act; the instrument does not redefine permitted purpose, instead adopting the meaning in Part VIIIA of the Act (s 4). The decision test is that matching must be “reasonably necessary for that purpose” (s 19).

• Personal information and identifier. Those terms adopt their meanings from the Act and from the Privacy Act 1988 as relevant (s 4, note to s 9(d)). The instrument therefore operates in the conceptual space of privacy law and personal data management.

• Technical standards and quality assurance. The instrument mandates written technical standards that must include a description of supplied data, a specification for each matching algorithm, identified risks and controls, system integrity measures and security controls to minimise access to personal information (s 6(1)-(2)). Quality assurance checks are required as part of “reasonable steps” to ensure accuracy, completeness and currency of personal information used in matching (s 18(3)).

• Transparency and record‑keeping. Transparency is implemented by a public register of kinds of information matched, with specified mandatory content items (s 8-10), plus an online publication obligation covering a set list of explanatory elements (s 5). Record‑keeping obligations extend to program-level documentation sufficient to enable replication while datasets remain available, and to records of destruction events (s 12-13).

• Time‑limited destruction and scope limits. The instrument sets a 90‑day time limit for taking reasonable steps to destroy personal information and matching results once they are no longer needed for the matching purpose, and requires destruction where information provided to facilitate matching is not intended to be matched (s 15-17). Limitations are explicit: these destruction duties apply to information held for the matching purpose and do not apply to information held for another purpose or to holdings by other persons (s 15(3), s 17(3)).

• Oversight and assessment. The Chief Executive Medicare must prepare an evaluation of privacy practices within three years and provide it to the Australian Information Commissioner (s 7). Record sufficiency is explicitly calibrated to enable an assessment under paragraph 33C(1)(f) of the Privacy Act 1988 (s 14), linking the instrument to the Commissioner’s oversight powers.

These concepts together build a regime that is operational rather than doctrinal. The instrument embeds procedural constraints (standards, records, destruction deadlines, transparency) and decision gates (reasonable necessity, data minimisation choices), while anchoring key terms to existing statutory frameworks for privacy and archives.

Primary actors named in the instrument are the Chief Executive Medicare and authorised Commonwealth entities. The Chief Executive Medicare is the central obligor for publication, standard‑setting, register maintenance, record‑keeping, evaluation and many operational decisions (s 5-13, s 6(1), s 7, s 8-10, s 12). Authorised Commonwealth entities are separately required to keep records of matching they conduct (s 11(2)), to comply with the Chief Executive’s technical standards when they match (s 6(4)), and to comply with destruction and accuracy duties equivalent to those placed on the Chief Executive in the entity context (e.g. s 15(2), s 16(2), s 17(2), s 18(2)-(5)).

Individuals whose personal information is supplied, matched or appears in results are affected in several concrete ways: their personal information must be the subject of reasonable steps to ensure accuracy, completeness and currency; they have a specific right to request correction where matched information is personal information about them, with Medicare obliged to take reasonable steps to correct (s 18(1), (2), (6)). Individuals are also the subject of the destruction timeline: personal information matched must be destroyed when no longer needed, within 90 days (s 15).

Other Commonwealth entities and third parties that supply information to facilitate matching are affected. The register must identify, for matched information obtained from another person or entity, a description of that information and, if the supplier is not an individual, the name of that person or entity (s 9(c)). The instrument also obliges Medicare or an authorised Commonwealth entity to notify the supplying Commonwealth entity in writing if the supplied information is found not to be accurate, complete or up to date (s 18(4)-(5)). Where third parties provide information to Medicare for facilitating matching but that information is not to be matched, the instrument requires destruction within 90 days of awareness (s 17).

Operationally, managers, records officers, system architects, privacy officers and legal teams within Medicare and authorised Commonwealth entities will be the immediate actors who bear the compliance load. They must prepare and maintain technical standards including algorithm specifications (s 6(2)(b)), maintain registers and program records (s 8, s 12), and implement secure access and destruction processes (s 6(2)(e), s 15-17). The Australian Information Commissioner is the external oversight body to which a privacy evaluation report must be given and to whose assessment powers records must be made available (s 7(c), s 14).

Costs and decision authority are concentrated: the Chief Executive Medicare decides on necessity, determines data fields and subject classes for matching when satisfied of necessity (s 19-20), and therefore holds primary operational control and associated implementation costs. Authorised Commonwealth entities, while decision‑makers for matching they perform, are required to obtain the Medicare satisfaction in certain cases (s 19(2)), and must align with Medicare’s technical standards (s 6(4)).

This section lists the concrete duties imposed on actors and the rights recognized by the instrument, with precise textual anchors.

Duties of the Chief Executive Medicare

• Publish online information: an overview, objectives, statutory description, reasons for necessity, sources, quality assurance methods, processes and possible outcomes, timing and frequency, potential actions, public notice processes, review processes, the role of the Australian Information Commissioner, and other relevant laws (s 5).

• Prepare and maintain technical standards for each authorised data‑matching program; standards must describe supplied data, specify each matching algorithm, identify risks and risk treatments, set controls for information and system integrity, and include security features to control and minimise access to personal information (s 6(1)-(2)).

• Ensure matching complies with technical standards when done under subsection 132B(1) of the Act (s 6(3)).

• Establish and maintain a publicly available register describing kinds of information matched, including dataset descriptions, permitted purposes, supplier descriptions and names where applicable, and the names of entities performing matching when the Privacy Act applies (s 8-9).

• Keep records of information matched by Medicare (s 11(1)), and program records containing permitted purposes, matters considered under Part 7, descriptions of matched information, timing/frequency, and dates of receipt of information provided to facilitate matching (s 12(1)(a)-(e)); records must be sufficient to enable replication while datasets remain available (s 12(2)).

• Keep records of descriptions of personal information and results destroyed under the instrument (s 13(1)).

• Destroy personal information and results when no longer needed within 90 days (s 15(1), s 16(1)), and destroy information provided for matching but not to be matched within 90 days after becoming aware (s 17(1)).

• Take reasonable steps to ensure accuracy, completeness and currency of personal information matched, including carrying out quality assurance checks (s 18(1), (3)).

• Advise originating Commonwealth entities in writing if information supplied by them for matching is found not to be accurate, complete or up to date (s 18(4)-(5)).

• Be satisfied that matching is reasonably necessary for a permitted purpose before matching (s 19(1)).

• Decide necessary data fields and data subject classes when satisfied of necessity, and in doing so, consider minimisation options and use of identifiers rather than personal information (s 20(1)-(2)).

Duties of authorised Commonwealth entities

• Keep records of matched information by the entity (s 11(2)).

• Comply with technical standards prepared by Chief Executive Medicare for a program when matching under subsection 132B(1) (s 6(4)).

• Maintain program records and destruction records as set out in s 12 and s 13, and ensure records are sufficient for the Australian Information Commissioner’s assessment (s 14).

• Take reasonable steps to destroy personal information and results within 90 days when no longer needed, and to destroy information obtained to facilitate matching if not to be matched within 90 days of awareness (s 15(2), s 16(2), s 17(2)).

• Take reasonable steps to ensure matched personal information is accurate, complete and up to date, including quality assurance checks (s 18(2)-(3)), notify originating Commonwealth entities if supplied data from them is found to be inaccurate, and cooperate in corrections (s 18(4)-(6)).

Rights of individuals

• Correction request right. If matched information is personal information about an individual and the individual requests correction, the Chief Executive Medicare must take such steps as are reasonable in the circumstances to correct the information (s 18(6)). The instrument does not enumerate appeal mechanisms or deadlines for that correction process beyond this duty.

Oversight and reporting obligations

• Evaluation of privacy practices: the Chief Executive Medicare must evaluate privacy practices within three years after commencement, prepare a report and give a copy to the Australian Information Commissioner (s 7). This places an obligation on Medicare to generate an internal assessment and to make it available to the Commissioner.

• Record sufficiency for Commissioner assessment: records required by the instrument must be sufficient to enable the Australian Information Commissioner to conduct assessments under paragraph 33C(1)(f) of the Privacy Act 1988 (s 14).

Limits and scope qualifiers

• Destruction duties apply only to personal information as held for the matching purpose by Medicare or the authorised Commonwealth entity, and do not apply to the same personal information held for other purposes or held by other persons (s 15(3), s 17(3)). The instrument therefore limits its destruction demands to particular holdings and purposes.

These duties concentrate decision authority with the Chief Executive Medicare over program design, standards and public transparency, while mandating compliance duties and record obligations for authorised Commonwealth entities. The instrument provides an express right of correction and places an evaluative reporting duty to the Information Commissioner.

The instrument itself does not prescribe criminal sanctions, civil penalties or explicit enforcement remedies; it establishes procedural and operational obligations. Enforcement and oversight mechanisms are implicit and tied to other statutory frameworks referenced in the instrument.

Oversight by the Australian Information Commissioner

• The instrument requires the Chief Executive Medicare to evaluate privacy practices and deliver a report to the Australian Information Commissioner within three years (s 7). It also requires records to be sufficient to enable the Commissioner to conduct an assessment under paragraph 33C(1)(f) of the Privacy Act 1988 (s 14). Those provisions connect the instrument to the Commonwealth privacy regulator’s assessment powers under the Privacy Act. The instrument, however, does not itself create new penalty provisions or specify the outcomes of an adverse Commissioner assessment.

Interaction with the Archives Act 1983

• The instructions note that certain destruction requirements are requirements for the purposes of paragraph 24(2)(a) of the Archives Act 1983 (s 15 and s 16 notes and s 17 notes). That linkage means the destruction obligations sit within the regulatory landscape of records management and archives law. The Archives Act contains its own statutory regime concerning disposal of Commonwealth records, including frameworks for authorised destruction and potential administrative consequences for non‑compliance. The instrument does not reproduce the Archives Act enforcement regime, but it flags that the destruction duties are to be treated as requirements for archives purposes.

Applicability of the Privacy Act 1988

• The instrument repeatedly anchors key terms to the Privacy Act and draws explicit cross‑references. Section 9(d) requires the register to identify the entity matching information where the matching is an act or practice to which the Privacy Act applies; the definition of identifier is linked to the Privacy Act in s 4. Where matching constitutes an act or practice to which the Privacy Act applies, the general enforcement mechanisms of the Privacy Act, including complaints to the Information Commissioner and any powers the Commissioner has to investigate and make determinations, would be available. The instrument itself, however, does not create or specify additional penalties beyond those statutory regimes.

Administrative and reputational consequences

• Given the transparency obligations (s 5, s 8-10) and the reporting and records sufficiency requirements (s 7, s 12-14), failures to comply can reasonably be expected to produce administrative actions, internal audits, remedial requirements, and reputational consequences for agencies. The instrument’s linkage to external oversight under the Privacy Act and Archives Act provides processes by which non‑compliance could attract regulatory attention.

Absence of explicit sanctions in the instrument

• The instrument does not include explicit fines, offences, or civil penalty schedules. Enforcement therefore depends on the operation of other statutes (for example, the Privacy Act 1988 and the Archives Act 1983), and on internal Commonwealth administrative controls. The text itself requires actions and records that enable oversight rather than specifying punishments (s 5-16).

For lawyers and compliance officers, the practical enforcement landscape is therefore: these principles create binding administrative duties under the National Health Act framework, they operationalise obligations that interact with the Privacy Act and Archives Act, and they create evidence trails and reporting obligations that the Information Commissioner can use within statutory assessment processes. The instrument does not substitute detailed enforcement mechanisms, rather it provides procedural hooks that both internal administrators and external regulators can use.

The instrument deliberately anchors itself to existing Commonwealth statutes and establishes a procedural framework that operates alongside and in support of those statutes.

National Health Act 1953

• Authority. The instrument is made under section 132F of the National Health Act 1953 (s 3). It governs how matching under subsection 132B(1) of the Act must be conducted in practice, repeatedly referencing matches conducted under that subsection (see numerous provisions including s 6(3)-(4), s 8, s 12).

• Definitions. Key terms such as authorised Commonwealth entity, authorised information‑matching, personal information and permitted purpose are imported from Part VIIIA of the National Health Act as the instrument defines them by reference (s 4). The instrument therefore does not recreate statutory definitions, but operationalises how matching authorised by Part VIIIA will be run.

Privacy Act 1988

• Imported concepts and oversight connection. The instrument imports the meaning of identifier from the Privacy Act (s 4). It also links to the Privacy Act in operational terms: the public register must include the name of the authorised Commonwealth entity where the matching is an act or practice to which the Privacy Act applies (s 9(d), note). The instrument requires records to be sufficient for the Australian Information Commissioner’s assessment under paragraph 33C(1)(f) of the Privacy Act 1988 (s 14). The Chief Executive Medicare must give the Commissioner a report of its privacy practices evaluation (s 7(c)). These links make the instrument function as a procedural complement to the Privacy Act regime rather than a standalone privacy code.

Archives Act 1983

• Destruction duties flagged as Archives Act requirements. The instrument expressly notes that certain destruction provisions are requirements for the purposes of paragraph 24(2)(a) of the Archives Act 1983 (s 15 and s 16 and s 17 notes). That alignment integrates the instrument with records disposal frameworks under the Archives Act and likely affects the lawful disposal or destruction of Commonwealth records; obligations in s 15-17 are to be read against the Archives Act’s broader controls and approvals required for disposal of records.

Other laws

• The instrument requires Medicare to publish, as part of its public information package, the laws other than the Act that are relevant to authorised information‑matching, such as laws relating to collection, use or disclosure of information and compliance processes (s 5(b)(xi)). This provision anticipates overlaps with other Commonwealth or state legislation but does not specify them.

Operational consequences of these interactions

• The instrument creates a framework whose compliance must be read and implemented in conjunction with the Privacy Act and Archives Act. The Australian Information Commissioner’s oversight under the Privacy Act is explicitly anticipated (s 7, s 14). Destruction obligations are presented as Archives Act requirements, which means procedural compliance may require interaction with Archives approvals and retention schedules. The instrument does not displace other statutory obligations; it specifies practices to be followed when exercising the matching powers in Part VIIIA of the National Health Act.

• Delegation and naming. The register must identify suppliers of information and name non‑individual persons or entities who supplied information (s 9(c)); it must also name authorised Commonwealth entities that match information when the Privacy Act applies (s 9(d)). For delegations, the note to s 9(e) references subsections 6(9)-(12) of the National Health Act, signalling that delegation arrangements under the Act apply to persons acting as delegates in matching activities.

In short, the instrument is intended to operate as an implementing instrument tied directly to Part VIIIA matching powers, with obligations that sit alongside and feed into the Privacy Act 1988 and the Archives Act 1983 regimes for oversight and records disposal.

The instrument contains a commencement table and a note on provenance but does not record any subsequent amendments within the text supplied.

• Commencement. The commencement table states that the whole instrument commenced the day after registration, specifically recorded as 5 January 2021 (s 2, commencement table). The table also contains the standard note that it relates only to provisions as originally made and will not be amended within that table, which is a common drafting convention for delegated instruments (s 2 note).

• Authority for instrument. The instrument is made under section 132F of the National Health Act 1953 (s 3). No amendment clauses, repeal schedules or transitional provisions appear in the text provided.

• Notes. The instrument includes internal notes that link certain duties to other Acts, for example, the Archives Act 1983 (see notes to s 15, s 16 and s 17) and references to the Privacy Act 1988 for definition cross‑references (s 4, s 9 note 1).

• Absence of further amendment record. The provided instrument contains no clauses that amend earlier instruments or Acts, nor does it record any amendment history after initial registration. The commencement table’s separate column 3 contains a note that information in that column is not part of the instrument and may be edited in published versions; that is a formatting note rather than an amendment history (s 2(2)). The instrument thus appears as the original delegated instrument without recorded subsequent amendments in the supplied text.

For legal tasks, the practical implication is that reliance on the instrument should be accompanied by a check of the Government or Federal Register of Legislation for subsequent amendments or superseding instruments. The instrument itself provides only the original enactment content and explicitly identifies its commencement date as 5 January 2021.

The text of the instrument contains no references to judicial decisions, no recorded litigation, and no mention of disputes or determinations arising under it. It does not list any cases, appeals, or constitutional challenges. There is no litigation history annexed or embedded.

Given the instrument’s role as delegated administrative principles under the National Health Act 1953, any legal disputes concerning its interpretation, operation, or compliance would likely arise in the context of administrative law challenges, privacy complaints to the Australian Information Commissioner, or archival disputes under the Archives Act. The instrument itself requires records sufficient for the Australian Information Commissioner’s assessment (s 14) and mandates that the Commissioner receive a privacy practices report (s 7(c)), which may produce administrative findings but does not, within the text, equate to or replace litigation. Practitioners should therefore treat the absence of litigation references here as silence rather than a statement about actual disputes in practice; to find litigation or decisions, one would need to search court and tribunal records and Privacy Commissioner determinations outside of the instrument text.

In short, the instrument does not contain any litigation history; none is recorded in the material provided.

This instrument contains precise procedural obligations, but a number of areas carry practical ambiguity, operational friction, or compliance burden that can produce unintended outcomes unless acted on deliberately.

Reasonableness and “reasonably necessary” thresholds are subjective

• Several duties hinge on statutory standards that are not further defined in the instrument: “reasonable steps” to ensure accuracy and to destroy information (s 15(1)-(2), s 16(1)-(2), s 17(1)-(2), s 18(1)-(3)), and the requirement that the Chief Executive Medicare be “satisfied that the matching is reasonably necessary” for a permitted purpose (s 19(1)-(2)). These are fact‑driven standards, leaving agencies to translate them into internal policy and to justify their judgments. That subjectivity can cause variability across programs and increase the risk of challenge if stakeholders disagree about what was reasonable or necessary.

Records sufficient to permit replication but without datasets

• Program records must be sufficient to enable replication of the matching while the datasets remain available (s 12(2)). Yet the instrument explicitly says records do not have to include the datasets themselves (s 12(3)). Practically, this means that replication depends on access to the original datasets; if datasets are taken offline or changed, the ability to replicate matches from records alone may be limited. The “while the datasets remain available” caveat is a time‑sensitive constraint on evidentiary sufficiency.

90‑day destruction windows, and the “no longer needed” trigger

• Destruction obligations require action within 90 days after information ceases to be needed for the purpose for which it was matched (s 15-16) or within 90 days after becoming aware that information is not intended to be matched (s 17). Determining the moment when information “ceases to be needed” or when a holder “becomes aware” can be operationally complex for long‑running programs and may require policies on retention review cycles and on how discovery of supply details is logged.

Limits apply only to holdings for matching purposes

• The destruction duties explicitly do not apply to the same personal information when held for other purposes or by other persons (s 15(3), s 17(3)). If a dataset serves multiple operational needs, agencies will need robust records to show which holdings are subject to the instrument’s destruction duty and which are retained for other legal purposes. Without that delineation, deletion could inadvertently breach other legal obligations or conversely, retention could breach these rules.

Technical standards require algorithm specifications and security design

• Technical standards must include the specification for each matching algorithm (s 6(2)(b)). That may impose a documentation and disclosure requirement that touches on proprietary algorithms, security sensitivities or intellectual property, and will require careful handling in classified or sensitive systems. The standards must also record risks and controls and security features to control and minimise access to personal information (s 6(2)(c)-(e)), which requires both technical capability and governance resources.

Public register content can identify sources and entities

• The publicly available register must identify datasets and, for information obtained from another person or entity, describe that information and name the supplying non‑individual entity (s 9(a)-(c)). It must also name the authorised Commonwealth entity when the Privacy Act applies (s 9(d)). That degree of transparency can raise confidentiality and contractual considerations with third‑party data suppliers and must be reconciled with any legal non‑disclosure obligations.

Records must be sufficient for the Information Commissioner’s assessment

• The instrument requires that records (s 11-13) be sufficient to enable the Commissioner to conduct an assessment under paragraph 33C(1)(f) of the Privacy Act (s 14). Agencies must therefore structure record systems to produce that evidence quickly and comprehensively. The instrument does not specify format or retention periods beyond the 90‑day destruction windows, so agencies must design record policies to align with both evidentiary needs and destruction duties.

Correction obligations are one‑way and limited in scope

• The correction duty is triggered when an individual requests correction of personal information matched by Medicare or an authorised entity; Medicare must take such steps as are reasonable in the circumstances to correct the information (s 18(6)). The instrument does not define process timelines, nor does it mandate particular remedies if Medicare declines to correct. Privacy Act procedural protections and complaint pathways remain relevant; the instrument itself is limited in remedial specificity.

Interaction with Archives Act and retention schedules

• The express link to paragraph 24(2)(a) of the Archives Act for the purposes of s 15-17 places these duties within a broader statutory framework that may include approvals, retention exemptions and disposal authorities. Agencies must ensure destruction aligns with Archives Act processes to avoid conflicts between obligations.

Delegation and the role of delegates

• The register must include the name of a person acting as delegate of the Chief Executive Medicare where that delegate is not an individual (s 9(e)), and the register is linked to the Act’s delegation provisions (note to s 9). Delegation arrangements therefore need to be explicitly recorded and transparent, and agencies should be careful when delegating data‑matching powers to ensure compliance responsibilities are mapped.

In short, the operational burden of converting paper rules into tightly governed technical, records and deletion workstreams is non‑trivial, and the instrument contains numerous trigger points where ambiguity or delay can create compliance risk. Practitioners should map these “gotchas” into implementation plans that assign responsibilities, define reasonable standards, and document decision rationales.

The instrument prescribes concrete steps. Below is a practical compliance checklist mapped to specific provisions in the instrument for the Chief Executive Medicare and authorised Commonwealth entities.

1. Governance and responsibilities

• Designate accountable officers for each authorised data‑matching program, including program leads, privacy officers and records managers; document the delegation chain in line with the Act’s delegation provisions (register entry obligations s 9(e) and note).

• Ensure the Chief Executive Medicare is resourced to fulfil publication, standard‑setting, evaluation and record‑keeping duties (s 5-7, s 11-13).

2. Publication and transparency (s 5, s 8-10)

• Publish an online information package that covers the list in s 5(a)-(c)(i)-(xi), including objectives, statutory basis, sources, methods to assure data quality, processes and potential outcomes, timing, review processes and relevant laws.

• Establish and maintain the public register required by s 8, and for each kind of information matched include the elements in s 9(a)-(e). Where possible, coordinate with data suppliers on appropriate descriptions and naming for the register.

3. Technical standards and system controls (s 6)

• For each authorised data‑matching program, prepare written technical standards covering the required elements: data descriptions, matching algorithm specifications, risk register and mitigation plan, controls for information and system integrity, and security features restricting access (s 6(2)(a)-(e)).

• Ensure all matching activity under subsection 132B(1) complies with those technical standards (s 6(3)-(4)). Build implementation checklists and automated controls where possible to enforce standards.

• Document algorithm specifications with sufficient detail to enable replication and to inform oversight, while applying appropriate security and IP controls.

4. Record‑keeping and replication capability (s 11-14, s 12(2)-(3))

• Maintain program records that include permitted purposes, matters considered under Part 7 of the instrument, descriptions of matched information, timing/frequency and dates of receipt of third‑party information (s 12(1)(a)-(e)).

• Ensure records are sufficient to enable replication of the matching while datasets remain available, but understand the instrument does not require storing datasets with records (s 12(2)-(3)). Create a replication‑supporting documentation template covering data schemas, matching parameters, data cleansing steps, and environment and code versions.

• Keep records of destruction of personal information and matching results (s 13). Ensure these records describe the items destroyed and the legal basis for destruction.

• Structure records so they can be produced to the Australian Information Commissioner to support assessments under the Privacy Act (s 14).

5. Data quality, corrections and supplier notifications (s 18)

• Implement quality assurance checks as a formal part of each program (s 18(3)). Define the QA process, thresholds for action, and log QA outcomes.

• Establish procedures to notify originating Commonwealth entities in writing when supplied information is discovered not to be accurate, complete or up to date (s 18(4)-(5)). Keep copies of written notices.

• Create an individual correction request workflow. On receiving a request to correct personal information matched by Medicare, take steps that are reasonable in the circumstances to correct the information and document decisions and actions (s 18(6)).

6. Decision threshold and minimisation (s 19-20)

• Require a documented “reasonably necessary” assessment before initiating or renewing matching for a permitted purpose, with evidence supporting the Chief Executive Medicare or delegate’s satisfaction that matching is necessary (s 19).

• Record decisions identifying the data fields and data subject classes necessary for the match, and document minimisation considerations such as use of identifiers instead of personal information, validation rather than new collection, or use of predefined variables (s 20(1)-(2)).

7. Destruction processes and retention schedule alignment (s 15-17)

• Implement destruction workflows to take reasonable steps to destroy personal information and matching results within 90 days of their ceasing to be needed for the matching purpose (s 15-16). Define “ceases to be needed” in operational policy, set review triggers, and log the date of the decision and destruction.

• For information supplied to facilitate matching but not intended to be matched, institute detection and 90‑day destruction triggers from the date the holder becomes aware of that status (s 17).

• Ensure destruction actions are consistent with the Archives Act processes and retention authorities; where Archives Act approvals or disposal authorities are required, obtain them before destruction to remain compliant (s 15 and s 16 notes).

8. Security and access control (s 6(2)(e))

• Implement technical and organisational controls to minimise access to personal information used in matching: role‑based access, logging, encryption, secure development lifecycle for matching algorithms, segregation of duties and periodic access reviews.

• Include security controls and system integrity controls in the technical standards and in audit plans.

9. Evaluation and oversight engagement (s 7, s 14)

• Plan to conduct the mandated privacy practices evaluation within three years of commencement, prepare the report and submit it to the Australian Information Commissioner (s 7).

• Build records and evidence that will satisfy the Commissioner’s assessment powers under the Privacy Act, and be prepared to produce program records, technical standards and destruction records on request (s 7, s 14).

10. Contracts and third‑party arrangements

• Where datasets or matching services are obtained from external suppliers, ensure contracts address the register naming requirements (s 9(c)), obligations to assist with replication, destruction obligations, information quality, notification obligations and compliance with technical standards.

11. Training and documentation

• Provide training to program staff on the “reasonably necessary” test, quality assurance processes, records sufficient for replication, destruction triggers and the correction request process.

12. Continuous improvement and audit

• Schedule periodic internal audits of compliance with these principles, including spot checks of records, replication attempts while datasets are available, and destruction record reviews.

This checklist converts statutory obligations into discrete operational tasks and documentation practices. The central compliance levers are documentation, program‑level governance, technical standards that include algorithm specifications and risk treatment, and retention/destruction workflows tied to clear triggers and Archives Act processes.