Breaches and state law

Who this page is for: the practice manager whose adviser asked “what about state law?” - three questions, answered in a paragraph each.

State health-records law

Victoria (Health Records Act 2001), NSW (Health Records and Information Privacy Act 2002) and the ACT (Health Records (Privacy and Access) Act 1997) add their own health privacy principles on top of the federal APPs. Refera runs one national posture at the strictest applicable setting, so the tightest rule wins everywhere - a practice in any state gets the same controls.

My Health Record

Refera does not connect to, read from or write to the My Health Record system, holds no My Health Record data, and has no registered role under the My Health Records Act 2012. The front door is the practice’s own - a national repository is not part of it.

If a breach ever happens

Refera’s draft breach response plan follows the Notifiable Data Breaches scheme: contain immediately, preserve evidence, assess within the scheme’s 30-day limit, and notify the OAIC and affected people as soon as practicable when a breach is eligible, on a path agreed with each practice. The proposed target is initial notice to an affected practice within 24 hours of Refera becoming aware of a suspected incident; counsel and the practice approve the final deadline. Security, breaches and the NDB scheme has the detail and what your practice does.

Related

• Privacy and the APPs - the federal baseline these sit on.
• Security, breaches and the NDB scheme - APPs 10 to 13 and the breach response.
• Security posture - the controls that make a breach less likely.