Document ID: chunk:federal_register_of_legislation:C2025C00099:section:75:p1
Version: federal_register_of_legislation:C2025C00099
Segment Type: section
Provision Reference: s 75 (pt 1/3)
Character Range: 153510–156323

75  Data breaches
 (1) This section applies to an entity if:
 (a) the entity is, or has at any time been, the System Operator, a registered healthcare provider organisation, a registered repository operator, a registered portal operator or a registered contracted service provider; and
 (b) the entity becomes aware that:
 (i) a person has, or may have, contravened this Act in a manner involving an unauthorised collection, use or disclosure of health information included in a healthcare recipient's My Health Record; or
 (ii) an event has, or may have, occurred (whether or not involving a contravention of this Act) that compromises, may compromise, has compromised or may have compromised, the security or integrity of the My Health Record system; or
 (iii) circumstances have, or may have, arisen (whether or not involving a contravention of this Act) that compromise, may compromise, have compromised or may have compromised, the security or integrity of the My Health Record system; and
 (c) the contravention, event or circumstances directly involved, may have involved or may involve the entity.
Note: This section applies to an entity when the entity becomes aware of a matter referred to in paragraph (b) regardless of when that matter arose or occurred or if the matter is ongoing at the time the entity became aware of the matter.

Notifying the System Operator or Information Commissioner
 (2) If:
 (a) the entity is a registered healthcare provider organisation, a registered repository operator, a registered portal operator or a registered contracted service provider; and
 (b) the entity becomes aware that:
 (i) the contravention or event referred to in subsection (1) has or may have occurred; or
 (ii) the circumstances referred to in subsection (1) have or may have arisen;
then, as soon as practicable after becoming aware, the entity must notify:
 (c) in the case of an entity that is a State or Territory authority or an instrumentality of a State or Territory—the System Operator; or
 (d) otherwise—both the System Operator and the Information Commissioner.
Civil penalty: 1,500 penalty units.
 (3) If:
 (a) the entity is the System Operator; and
 (b) the entity becomes aware that:
 (i) the contravention or event referred to in subsection (1) has or may have occurred; or
 (ii) the circumstances referred to in subsection (1) have or may have arisen;
then, as soon as practicable after becoming aware, the entity must notify the Information Commissioner.
 (4) If an entity has given notice under subsection (2) or (3) on becoming aware that the contravention, event or circumstances may have occurred or arisen then, despite subsection (2) or (3), the entity need not give notice again on becoming aware that the contravention, event or circumstances has occurred or arisen.

Steps to