Document ID: chunk:federal_register_of_legislation:F2021L01571:reg:10:p1
Version: federal_register_of_legislation:F2021L01571
Segment Type: reg
Provision Reference: reg 10 (pt 1/2)
Character Range: 12802–16066

10  Linking old information with personal identification components

        (1)  Services Australia must store old information from the Medicare Benefits Program and the Pharmaceutical Benefits Program:

             (a) in separate databases; and

             (b) in a form that does not include any personal identification components.

        (2)  Services Australia and the Department of Health (where the Department of Health is enabling the Chief Executive Medicare to perform health provider compliance functions) may only link old information to personal identification components by use of a Medicare PIN for the purpose of:

             (a)  taking action on an unresolved compensation matter;

             (b)  taking action on an investigation or prosecution;

             (c)  taking action for recovery of a debt;

             (d)  determining entitlement on a late lodged claim or finalising the processing of a claim;

             (e)  determining entitlement for a related service rendered more than five years after the service which is the subject of the old information;

             (f)  fulfilling a request for that information from the individual concerned or from a person acting on behalf of that individual; or

             (g)  lawfully disclosing identified information in accordance with the secrecy provisions of relevant legislation and this instrument.

        (3)  Where old information is linked to personal identification components in accordance with section 10(2), Services Australia and the Department of Health respectively must destroy that linked information as soon as practicable after meeting the purpose for which it was linked.

        (4)  Services Australia and the Department of Health must make special arrangements for the security of records obtained in accordance with section 10(2).

        (5)  Services Australia and the Department of Health must provide the Australian Information Commissioner a report detailing the extent to which old information has been linked to personal identification components. The report must be provided annually in a form approved by the Australian Information Commissioner. The report must include the following information for the reporting period:

             (a)  the number of records linked in accordance with section 10(2);

             (b)  the number of records linked under each of the circumstances in paragraphs (a) to (g) of section 10(2);

             (c)  the number of records of old information linked in accordance with section 10(2) that were destroyed;

             (d)  the number of records destroyed that were linked under each of the circumstances in paragraphs (a) to (g) of section 10(2);

             (e)  reasons for the retention of any records referred to in paragraph (a) that were not destroyed during the reporting period; and

             (f)  the number of records of linked old information that have been retained from previous reporting periods, and reasons for their retention.

        (6)  The Australian Information Commissioner may make the report referred to in section 10(5) publicly available.

        (7)  Services Australia may collect from the Department of Health, and the Department of