Document ID: chunk:federal_register_of_legislation:F2024L00982:clause:2_7
Version: federal_register_of_legislation:F2024L00982
Segment Type: clause
Provision Reference: sch 2 cl 7
Character Range: 10532–12501

7  Storage of claims information
 (1) Subject to this Part, an agency may store claims information in a database if the agency establishes, for the purposes of this instrument, and maintains technical specifications relating to the database which:
 (a) specify access controls relating to the database; and
 (b) limit access to the database to officers or contractors who can lawfully use the information and reasonably must access it; and
 (c) specify the security procedures and controls that exist to prevent unauthorised linkage or re‑linkage of records that are held in the database about the same individual; and
 (d) describe the arrangements that have been made for the security of claims information stored in the database; and
 (e) specify, for linked or re‑linked information, where practicable, the schedule for destroying the linked or re‑linked claims information; and
 (f) identify how linkages or re‑linkages of claims information that are authorised by this instrument can be traced.
Note 1: For paragraph (e), see subsection 5(2) for the meaning of references to destroying linked or re‑linked claims information.
Note 2: For paragraph (f), see subsection 5(3) for the meaning of references to tracing linkages or re‑linkages of claims information.
 (2) An agency may store a Medicare PIN in a database that stores claims information.
 (3) An agency must not keep personal identification components in a database that stores claims information other than:
 (a) if the database contains claims information that was obtained under the Medicare Benefits Program—any relevant Medicare card number; or
 (b) if the database contains claims information that was obtained under the Pharmaceutical Benefits Program—any Pharmaceutical entitlements number.
 (4) If Services Australia discloses claims information to the Health Department as described in paragraph 11(4)(a), the Health Department may not store that information once that doubt has been removed.