Document ID: chunk:federal_register_of_legislation:F2016L00360:reg:14:p4
Version: federal_register_of_legislation:F2016L00360
Segment Type: reg
Provision Reference: reg 14 (pt 4/16)
Character Range: 9520–12357

of the My Health Records Act. These guidelines set out the Information Commissioner's general approach to the exercise of enforcement powers and investigative powers under both the My Health Records Act and the Privacy Act, in relation to the My Health Record system.
4.14  While these guidelines seek to provide guidance to participants in the My Health Record system, the Information Commissioner has a discretion to exercise the available powers that he or she considers most appropriate in the particular circumstances of each case.
Part 2 General principles relating to enforcement action and the exercise of investigative powers under the My Health Records Act and the Privacy Act
5 Types of enforcement powers and investigative powers available to the Information Commissioner
5.1  The Information Commissioner has a range of enforcement powers and investigative powers under both the My Health Records Act and the Privacy Act in relation to the My Health Record system. These powers are based on an escalation model. The general approach the Information Commissioner will take when determining which Act to apply is set out in sections 6 and 7 of these guidelines.

  Investigative powers under the My Health Records Act

5.2  The Information Commissioner has power under subsection 73(4) of the My Health Records Act to do all things necessary or convenient to investigate an alleged contravention of the My Health Records Act in relation to the My Health Record system, either in connection with health information in a healthcare recipient's digital record or as a result of a breach of a civil penalty provision. The civil penalty provisions in the My Health Records Act are listed below at section 13.3 of these guidelines.

  Investigative powers under the Privacy Act
5.3  As a contravention of the My Health Records Act in connection with health information included in a healthcare recipient's digital record or a provision of Part 4 or 5 is an interference with privacy for the purposes of the Privacy Act, the Information Commissioner may investigate the act or practice under the Privacy Act.
5.4  Part V of the Privacy Act sets out the investigative powers and processes available when the Information Commissioner conducts an investigation under the Privacy Act into an alleged interference with privacy.
5.5  The range of powers given to the Information Commissioner under Part V of the Privacy Act in relation to the conduct of investigations include powers to investigate a matter following a complaint or on the Commissioner's own initiative, attempt to conciliate a complaint, conduct preliminary inquiries to determine whether or not to open an investigation, require information or a document to be produced, require a person to attend before the Commissioner to answer questions under oath or affirmation,