Health Records and Information Privacy Act 2002 (NSW)

Health Records and Information Privacy Act 2002 No 71

An Act to make provision for the protection of health records and information; and for other purposes.

Part 1 Preliminary

1 Name of Act This Act is the Health Records and Information Privacy Act 2002.

2 Commencement This Act commences on a day or days to be appointed by proclamation.

3 Purpose and objects of Act (1) The purpose of this Act is to promote fair and responsible handling of health information by— (a) protecting the privacy of an individual's health information that is held in the public and private sectors, and (b) enabling individuals to gain access to their health information, and (c) providing an accessible framework for the resolution of complaints regarding the handling of health information. (2) The objects of this Act are— (a) to balance the public interest in protecting the privacy of health information with the public interest in the legitimate use of that information, and (b) to enhance the ability of individuals to be informed about their health care, and (c) to promote the provision of quality health services.

4 Definitions (1) In this Act— authorised representative has the meaning given by section 8. Commonwealth agency means an entity referred to in paragraph (a)–(h) of the definition of agency in the Privacy Act 1988 of the Commonwealth. Commonwealth Privacy Commissioner means the Office of the Privacy Commissioner established by the Privacy Act 1988 of the Commonwealth. emergency has the same meaning as in the State Emergency and Rescue Management Act 1989. exercise a function includes perform a duty. function includes a power, authority or duty. generally available publication means a publication (whether in paper or electronic form) that is generally available to members of the public, but does not include any publication or document declared by the regulations not to be a generally available publication for the purposes of this Act. genetic information means health information of a type described in section 6 (d). genetic relative means a person who is related to an individual by blood, for example, a sibling, parent or descendant of the individual. guidelines means guidelines issued by the Privacy Commissioner as referred to in section 64. health care means any care, treatment, advice, service or goods provided in respect of the physical or mental health of a person. Health Care Complaints Commission means the Health Care Complaints Commission constituted by the Health Care Complaints Act 1993. health information has the meaning given by section 6. health privacy code of practice or code means a privacy code of practice relating to health information made under Part 5. Health Privacy Principle or HPP means a clause of Schedule 1. A reference in this Act to a Health Privacy Principle by number is a reference to the clause of Schedule 1 with that number. health service includes the following services, whether provided as public or private services— (a) medical, hospital, nursing and midwifery services, (b) dental services, (c) mental health services, (d) pharmaceutical services, (e) ambulance services, (f) community health services, (g) health education services, (h) welfare services necessary to implement any services referred to in paragraphs (a)–(g), (i) services provided in connection with Aboriginal and Torres Strait Islander health practices and medical radiation practices, (j) Chinese medicine, chiropractic, occupational therapy, optometry, osteopathy, physiotherapy, podiatry and psychology services, (j1) optical dispensing, dietitian, massage therapy, naturopathy, acupuncture, speech therapy, audiology and audiometry services, (k) services provided in other alternative health care fields in the course of providing health care, (l) a service prescribed by the regulations as a health service for the purposes of this Act. health service provider means an organisation that provides a health service but does not include— (a) a health service provider, or a class of health service providers, that is prescribed by the regulations as an exempt health service provider— (i) for the purposes of this Act generally, or (ii) for the purposes of specified provisions of this Act, or (iii) for the purposes of specified Health Privacy Principles or health privacy codes of practice, or (iv) to the extent to which it is prescribed by the regulations as an exempt health service provider, or (b) an organisation that merely arranges for a health service to be provided to an individual by another organisation. healthcare identifier has the same meaning as it has in the Healthcare Identifiers Act 2010 of the Commonwealth. identifier means an identifier (which is usually, but need not be, a number), not being an identifier that consists only of the individual's name, that is— (a) assigned to an individual in conjunction with or in relation to the individual's health information by an organisation for the purpose of uniquely identifying that individual, whether or not it is subsequently used otherwise than in conjunction with or in relation to health information, or (b) adopted, used or disclosed in conjunction with or in relation to the individual's health information by an organisation for the purpose of uniquely identifying that individual. immediate family member of an individual means a person who is— (a) a parent, child or sibling of the individual, or (b) a spouse of the individual, or (c) a member of the individual's household who is a relative of the individual, or (d) a person nominated to an organisation by the individual as a person to whom health information relating to the individual may be disclosed. investigative agency means any of the following— (a) the Ombudsman's Office, (b) the Independent Commission Against Corruption, (b1) the Inspector of the Independent Commission Against Corruption, (c) the Law Enforcement Conduct Commission, (d) the Inspector of the Law Enforcement Conduct Commission and any staff of the Inspector, (e) the Community Services Commission, (f) the Health Care Complaints Commission, (g) the office of Legal Services Commissioner, (g1) the Ageing and Disability Commissioner, (g2) the Children's Guardian, (h) a person or body prescribed by the regulations for the purposes of this definition. law enforcement agency means any of the following— (a) the NSW Police Force, or the police force of another State or a Territory, (b) the New South Wales Crime Commission, (c) the Australian Federal Police, (d) the Australian Crime Commission, (e) the Director of Public Prosecutions of New South Wales, of another State or a Territory or of the Commonwealth, (f) the Department of Corrective Services, (g) the Department of Juvenile Justice, (h) a person or body prescribed by the regulations for the purposes of this definition. local government authority means a council, a county council or a joint organisation within the meaning of the Local Government Act 1993. news activity means— (a) the gathering of news for the purposes of dissemination to the public or any section of the public, or (b) the preparation or compiling of articles or programs of or concerning news, observations on news or current affairs for the purpose of dissemination to the public or any section of the public, or (c) the dissemination to the public or any section of the public of any article or program of or concerning news, observations on news or current affairs. news medium means any organisation whose business, or whose principal business, consists of a news activity. organisation means a public sector agency or a private sector person. personal information has the meaning given by section 5. PPIP Act means the Privacy and Personal Information Protection Act 1998. Privacy Commissioner means the Privacy Commissioner appointed under the PPIP Act. private sector person means any of the following that is not a public sector agency— (a) a natural person, (b) a body corporate, (c) a partnership, (d) a trust or any other unincorporated association or body, but does not include a small business operator within the meaning of the Privacy Act 1988 of the Commonwealth, or an agency within the meaning of that Act.