Register for a My Health Record myGov iconSign in with myGov

Last updated 03 April 2016

Privacy collection notice

This privacy collection notice outlines the handling of personal information by the System Operator of the My Health Record system, including its contractors and delegates (referred to below as “we” or “us”).

This notice applies if you live in an area where My Health Records will be automatically created for people – in summary, North Queensland or Nepean/Blue Mountains – and covers both people who do not want a My Health Record created for them and those that do.

This notice explains what happens to the personal information that you give us (or that we otherwise collect) about you and your dependants. In this notice, unless otherwise indicated

  1. references to “you” include references to your dependants, if relevant; and
  2. references to “your My Health Record” and “your personal information” include references to your dependants’ My Health Record and your dependants’ personal information respectively, if relevant.

If you choose to not have a My Health Record created for you:

  1. If you don’t want a My Health Record created for you, you must tell us between 4 April and 27 May 2016. To do this, go to myhealthrecord.gov.au, call the Helpline on 1800 723 471 or visit a Medicare Service Centre. To find your nearest centre please see http://findus.humanservices.gov.au
  2. If you choose not to have a My Health Record created for you, we will collect, use and disclose personal information about you for the following purposes:
    1. to ensure that we accurately identify you;
    2. to check whether a My Health Record already exists for each of you;
    3. to stop a My Health Record being created for you;
    4. to send you a confirmation of your choice not to have a My Health Record created; and
    5. to evaluate the success of the “opt-out” model of registration.
  3. We collect personal information about you, including your name; contact details; gender; date of birth; Medicare number, Department of Veterans’ Affairs (DVA) file number (if relevant) or, if you know it, your Individual Healthcare Identifier (IHI); and details from either your passport, driver’s licence, or Immicard.
  4. We collect this information about you, from you, Medicare, DVA (if relevant), the Healthcare Identifiers Service (operated by Chief Executive Medicare) and the Attorney General’s Department who operate the Document Verification Service (DVS). These bodies help us verify your identity and ensure that you will not be registered for a My Health Record.
  5. As part of verifying identities and implementing your choice to not have a My Health Record created, we disclose personal information to Medicare, DVA (if relevant), the Healthcare Identifiers Service and Attorney General’s Department/DVS.
  6. Without information about you, we will not be able to verify your identity, stop a My Health Record being created (although, if a My Health Record is created, it can later be cancelled), or confirm the choices that you have made.
  7. If you choose not to have a My Health Record created for you, some information about you (healthcare identifier, age, gender and postcode) and your choice to “opt out” will be used for evaluating the “opt-out” model, including whether the model should be adopted nationally. Without this information, we cannot assess the “opt-out” trials properly, and the Minister will be unable to make a decision about whether to adopt the “opt-out” model nationally. The information will be disclosed to the Digital Health Agency and some of its contractors who are assisting with the opt-out trial evaluation. Aggregated and de-identified data will be disclosed to the Commonwealth Minister for Health for evaluation purposes. If you provide reasons when you tell us you do not want a My Health Record, we will also use and disclose those reasons. Your name will not be included with these answers. If you do not wish to provide a reason, you can choose the "no reason given" field.
  8. The collection, use and disclosure of personal information is authorised under the My Health Records Act 2012, Healthcare Identifiers Act 2010 and Privacy Act 1988.
  9. We will not disclose health or other personal information about you overseas.
  10. If you do nothing and a My Health Record is created for you:

  11. If you do not tell us to stop a My Health Record being created for you, we will create a My Health Record for you.
  12. We will collect, use and disclose personal information about you, for the following purposes:
    1. to ensure that we accurately identify you;
    2. to check whether a My Health Record already exists for you;
    3. to create a My Health Record for you;
    4. to link your My Health Record to a myGov account (an account that provides a simple way to access government services online);
    5. to include Medicare information in your My Health Record. Where held by Medicare, this may include Medical Benefits (MBS), Pharmaceutical Benefits (PBS), Australian Organ Donor Register and immunisation information (Medicare information);
    6. to evaluate the success of the “opt-out” model of registration;and
    7. to include health information uploaded by you and treating healthcare providers in your My Health Record.
  13. We will collect personal information about you, including your name; address; date of birth; gender; and Medicare number, Department of Veterans’ Affairs (DVA) file number (if relevant) or, if you know it, your Individual Healthcare Identifier (IHI).
  14. We collect this information from Medicare, DVA (if relevant), and the Healthcare Identifiers Service (operated by the Chief Executive Medicare). Without the information we will not be able to create a My Health Record for you.
  15. As part of verifying identities and creating a My Health Record for you, we disclose personal information to Medicare, DVA (if relevant) and the Healthcare Identifiers Service.
  16. When you want to set up online access to your My Health Record, you will need to prove your identity. To do this we will ask you a series of identity questions such as the date of birth of people on your Medicare card or information relating to your Medicare or DVA claims history. We will collect your answers and disclose this information to Medicare or DVA (if relevant) to confirm your identity. Once we have verified your identity, we will be able to link your My Health Record to a myGov account. Without your answers, we will not be able to link you to a myGov account and you will not be able to access your My Health Record online. The information we collect to verify your identity is not retained after we link a myGov account to your My Health Record, and we do not disclose this information to anyone else.
  17. Unless you tell us not to, we will include up to two years of past Medicare information in your new My Health Record. We will also include new Medicare information in your My Health Record from time-to-time as it becomes available to Medicare. You can control who has access to this information by setting access controls, if you wish. If you do not set access controls, any healthcare provider who treats you and who is registered with the My Health Record system will be able to view your Medicare information. If you do not want Medicare information included in your My Health Record, you must tell us between 28 May and 14 July 2016. After these dates, you can change your mind at any time and stop, or restart, the flow of Medicare information into your My Health Record. If you do not allow the collection, use and disclosure of Medicare information for inclusion in your My Health Record, the information will not be available to healthcare providers who are treating you.
  18. Between 28 May and 14 July 2016 you will have the opportunity to access and customise your My Health Record including, if you wish, by setting access controls and automatic notifications when a healthcare provider first accesses your My Health Record.
  19. Once your My Health Record has been created, treating healthcare providers may upload health and related personal information about you to your My Health Record. We will collect, use and disclose this information as part of operating the My Health Record system. If you do not want a particular document uploaded, tell your healthcare provider – they must comply with your wishes. You can control who has access to your My Health Record by setting access controls, if you wish. If you do not set access controls, healthcare providers who treat you and who are registered with the My Health Record system will be able to view documents that have been uploaded by your other healthcare providers.
  20. If a My Health Record is created for you, some information about you (healthcare identifier, age, gender and postcode) and your choice to not “opt-out” will be used for evaluating the “opt-out” model, including whether the model should be adopted nationally. Without this information, we cannot assess the “opt-out” trials properly, and the Minister will be unable to make a decision about whether to adopt the “opt-out” model nationally. The information will be disclosed to the Commonwealth Department of Health and some of its contractors which are assisting with the opt-out trials evaluation. Aggregated and de-identified data will be disclosed to the Commonwealth Minister for Health.
  21. The collection, use and disclosure of your personal information to verify your identity and create a My Health Record is authorised under the My Health Records Act 2012, Healthcare Identifiers Act 2010 and Privacy Act 1988.
  22. We will not disclose health or other personal information about you overseas (although you and your healthcare provider can securely access your My Health Record while overseas, if necessary).
  23. Further Information

  24. For more information or to find out how you can access and correct personal information, complain about a breach of privacy or for further details about how we manage your health and other personal information, please see our privacy policy at myhealthrecord.gov.au/privacy
  25. We can be contacted:
    1. By telephone: 1800 723 471 (select option 1)
    2. In person: by visiting the nearest Medicare service centre.
    3. In writing:

      Privacy Officer
      My Health Record system
      GPO Box 9942
      (In Your Capital City)

    21 April 2016. Version 1.1


Last updated 03 April 2016