Start of content

Collection Notice - Registering or accessing a My Health Record for the first time

About this notice

The purpose of this notice is to explain how the Australian Digital Health Agency (the Agency), as System Operator under the My Heath Records Act 2012 (Cth) collects, uses and discloses personal information when registering someone for a My Health Record, or when you access your record online for the first time. This information is handled subject to the My Health Records Act 2012 (Cth), Healthcare Identifiers Act 2010 (Cth) and Privacy Act 1988 (Cth).

When we refer to “you” or “your” in this notice we may be referring to someone registering or accessing your own My Health Record, another person if you are registering or accessing a My Health Record on their behalf, or you as someone that is a representative of such a person.
When we refer to “System Operator”, “our”, “we” or “us” in this notice, this may include our delegates in the Department of Health or the Chief Executive Medicare, and contracted service providers who assist us to carry out our functions. 

Accessibility

If you would like to access this notice in an alternate format or language, please contact us using the contact details set out at the end of this document. We will take reasonable steps to provide you with alternate access.  

Why we collect your personal information

When registering or accessing a My Health Record for the first time, we will collect, use and disclose personal information for the following purposes:
•    to verify your identity 
•    to seek your authority if you are registering for a My Health Record on behalf of someone else
•    to check whether a My Health Record already exists for you
•    to create a My Health Record for you
•    to link your My Health Record to a myGov account (a secure way to access Australian Government services online), and
•    to enable health and other personal information about you in to be included in your My Health Record. 

What personal information is collected and disclosed to register a My Health Record

To register a My Health Record for someone, we need some personal information, such as that person’s name, sex, Medicare or Department of Veteran Affairs (DVA) number and date of birth. 

There are a few different ways we collect this information. If you have asked to be registered for a My Health Record, we will collect this personal information directly from you. We may also collect this information from a healthcare provider organisation, if they are helping you to register for a My Health Record. If you are registering for a My Health Record on behalf of someone else as their authorised representative, we may also need to collect evidence of your eligibility to act on their behalf.

We use the information we collect to verify your identity and collect your Individual Healthcare Identifier (IHI) and status from the Healthcare Identifier (HI) Service Operator, which is currently the Chief Executive of Medicare. This information is then used to register you for a My Health Record, and to match health information to the correct My Health Record.

A My Health Record may have been automatically created for individuals who did not opt out of having one during an opt-out period, or when enrolling for Medicare, for example at birth. To create a My Health Record in these circumstances, we collected the above information from the Department of Human Services (DHS), and used it in the same ways as described above.

What personal information is collected and disclosed to access a My Health Record for the first time

If you wish to access your My Health Record, you will need to link your My Health Record to your myGov account. If you are someone’s representative, you will also need to link your myGov account to their My Health Record to access it.

We will need to verify your identity to link your myGov account to a My Health Record. To do this, we will work with DHS or DVA to ask you a series of identity questions, such as information relating to your Medicare or DVA claims history. Without your answers, it will not be possible to link your myGov account to a My Health Record and you will not be able to access your My Health Record online. We do not keep the personal information we collect to verify your identity, and we do not disclose this information to anyone other than those listed above.

We will use personal information such as your name and address to notify you when a myGov account has been linked to your My Health Record. We do this to confirm that the My Health Record and the myGov account have been correctly linked.

What information is collected once you have a My Health Record

We collect personal information held by DHS, which operates Medicare, when this information is uploaded to a My Health Record. You can decide if you want this information to be included in your My Health Record by changing your access settings.

Medicare information that we may collect and include in a My Health Record includes: 

  • details of the last two years and any future Medicare Benefits Schedule (MBS) claims (including claims that are processed by DHS on behalf of DVA)
  • details of the last two years and any future Pharmaceutical Benefits Scheme (PBS) claims (including DVA claims under the Repatriation Pharmaceutical Benefits Scheme (RPBS) that are processed by DHS)
  • organ and/or tissue donation decisions recorded in the, Australian Organ Donor Register
  • immunisations administered to the individual, recorded in the Australian Immunisation Register.

We will also collect personal information when a registered healthcare provider organisation uploads this information to it. The personal information may be contained in records such as a shared health summary, a discharge summary, diagnostic imaging or pathology results, or prescribing and dispensing information. You can ask your registered healthcare provider not to upload records to your My Health Record. Your registered healthcare provider must comply with this request.

You can control who has access to documents in your My Health Record by setting access controls, if you wish. If you do not set these access controls, authorised individuals from registered healthcare provider organisations who are involved in your care will be able to view documents in your My Health Record. 

Disclosing your personal information overseas

My Health Record information is stored in Australia. We will not disclose My Health Record information overseas, unless you or your registered healthcare provider organisations access your My Health Record while overseas.

For more information

Our privacy policy outlines how we manage your health and other personal information. It also includes details on how you can access and correct personal information or make a complaint. 

If after reading our privacy policy you need further information you can contact us by calling us on 1800 723 471 or via one of our other channels.