Breaches and state law
Who this page is for: the practice manager whose adviser asked “what about state law?” - three questions, answered in a paragraph each.
State health-records law
Section titled “State health-records law”Victoria (Health Records Act 2001), NSW (Health Records and Information Privacy Act 2002) and the ACT (Health Records (Privacy and Access) Act 1997) add their own health privacy principles on top of the federal APPs. Refera runs one national posture at the strictest applicable setting, so the tightest rule wins everywhere - a practice in any state gets the same controls.
My Health Record
Section titled “My Health Record”Refera does not connect to, read from or write to the My Health Record system, holds no My Health Record data, and has no registered role under the My Health Records Act 2012. The front door is the practice’s own - a national repository is not part of it.
If a breach ever happens
Section titled “If a breach ever happens”A written plan under the Notifiable Data Breaches scheme: contain immediately, assess and tell affected practices within 72 hours - our own clock, tighter than the law’s 30-day assessment ceiling - then notify the OAIC and individuals as the Privacy Act requires, on a path pre-agreed with each practice.
Related
Section titled “Related”- Privacy and the APPs - the federal baseline these sit on.
- Security posture - the controls that make a breach less likely.
Did this answer your question?
Thanks - that helps us make these docs better.
Refera tracks referral admin only. It does not triage patients.
Examples are fictional and contain no patient information. Practice staff approve every external action. Refera never auto-sends or independently contacts patients.
Refera homeStart account setupOpen ReferaPrivacyTerms
[email protected]AI-assisted product and setup support. For a person, use the contact form or email.