Document ID: chunk:federal_register_of_legislation:F2021L01571:reg:7:p1
Version: federal_register_of_legislation:F2021L01571
Segment Type: reg
Provision Reference: reg 7 (pt 1/2)
Character Range: 3056–6432

7  Management of claims information

        (1)  Services Australia must ensure that claims information obtained under the Medicare Benefits Program is held in a separate database to claims information obtained under the Pharmaceutical Benefits Program. This requirement does not prevent Services Australia from locating each database within the same computer system.

        (2) Databases of claims information obtained under the Medicare Benefits Program and the Pharmaceutical Benefits Program (that is, the 'Medicare Benefits claims database' and the 'Pharmaceutical Benefits claims database') must be kept separate from enrolment and entitlement databases.

        (3)  For claims information that is not old information, personal identification components must not be included in databases of claims information except as follows:

             (a)  in the case of the Medicare Benefits claims database, the Medicare card number; and

             (b)  in the case of the Pharmaceutical Benefits claims database, the Pharmaceutical entitlements number.

Technical Standards

        (4)  Services Australia must establish and maintain detailed technical standards in relation to the Medicare Benefits claims database and the Pharmaceutical Benefits claims database which:

         (a) specify access controls applying to each database;

             (b) limit access to each database to those officers or contractors who reasonably require access to effectively administer the particular program;

             (c)  specify the security procedures and controls that exist to prevent unauthorised linkage of records that are held in both databases about the same individual;

             (d)  identify how any linkages conducted pursuant to sections 8(1) and 10(2) can be traced;

             (e)  describe the special arrangements for the security of claims information required by sections 9(2) and 10(4); and

             (f)  specify the destruction schedule for records created pursuant to each circumstance specified in paragraphs (a) to (e) of section 8(1) and paragraphs (a) to (g) of section 10(2) (where practicable).

        (5)  If Services Australia varies the technical standards established under section 7(4), Services Australia must lodge a Variation Report with the Australian Information Commissioner detailing those variations.

Medicare Personal Identification Number

        (6)  Services Australia may only maintain a personal identification number ('Medicare PIN') to the extent necessary to assist that agency in identifying individuals included in the Medicare Benefits Program and the Pharmaceutical Benefits Program.

(7)  Medicare PINs may be stored on databases holding records of claims information.

(8)  A Medicare PIN must not:

             (a)  be based on or derived from a person's name, date of birth, address, telephone number or Medicare card number;

             (b)  enable an individual's identity to be determined from the Medicare PIN alone; or

         (c)  reveal any health related or other personal information of the individual.

Disclosures by Services Australia to the Department of Health

        (9)  Services Australia may disclose claims information to the Department of Health provided that such disclosures do not include personal identification components, except as permitted