Essential information

In the application process

We will use the personal information we collect from you and others for registration, administration, maintenance, monitoring and population of your child’s eHealth record. We will also use your and your child’s personal information to administer the eHealth record system more broadly. This would include, for example, monitoring the security, integrity and efficiency of the system.

We use private sector firms to help deliver the eHealth record system. They will see, use and disclose, and in some cases store, your and your child’s personal information as part of this work. These firms are required to treat your and your child’s information with the same level of respect, privacy and security as we are.

We will disclose information about you and your child to the Department of Human Services and the Department of Veterans’ Affairs, in order to verify the accuracy of information you supply with your application. This includes information necessary to verify your and your child’s identity and your consent to include information held by Chief Executive Medicare in your child’s eHealth record.

Once you get access

Once your child is registered, the kinds of information collected directly from you may include:

• details that allow us to identify and contact you and them;
• details about medical conditions your child has which you decided to upload to and publish in the eHealth record;
• details about your child’s health which you enter in the confidential health diary feature;
• information about how you want to manage your child’s eHealth record, including who you want to have access to your child’s record and other access controls;
• records uploaded to your child’s eHealth record; and
• information about your access to your child’s eHealth record.

We will disclose your child’s eHealth record to their representatives and to the healthcare provider organisations involved in their care that are registered with the eHealth record system, in accordance with the access controls for your eHealth record, or in a medical emergency.

Healthcare provider organisations sometimes use private sector firms to help them with computer and IT-related services (‘contracted service providers’). If a registered contracted service provider is authorised by a healthcare provider organisation to connect to the eHealth record system on its behalf, then we will disclose your and your child’s information to the contracted service provider (if the healthcare provider organisation is authorised by you to access this information). A contracted service provider may only register with the eHealth record system if it agrees to meet proper security and privacy standards when connecting to the eHealth record system.

We will disclose your and your child’s information to the organisations that hold documents in storage for the eHealth record system and make them available when they are requested (repository operators), for the purpose of storing, indexing and calling for records about you which form part of your child’s eHealth record.

There are some circumstances where the Personally Controlled Electronic Health Records Act 2012 authorises the collection, use and disclosure of health information without consent. The circumstance in which this occurs is likely to occur when there is a serious threat to the life, health or safety of an individual and the person is unable to consent to their information being accessed and used. Other circumstances are set out in the Personally Controlled Electronic Health Records Act 2012.

Read the full Privacy Statement.

Most people are likely to allow any healthcare provider organisation involved in their care to access their eHealth record. This is the default access control setting that will apply to all eHealth records from registration. However, you can set access controls for your child’s eHealth record by:

• limiting access to the whole of the eHealth record – if you do this you will need to provide an access code to those healthcare providers you wish to access the eHealth record; or
• limiting access to a specific document in the eHealth record – if you do this, you will need to give a healthcare provider an access code before they can see that specific document.

Information that is uploaded to the eHealth record system will be stored in repositories. Repositories are operated by a variety of public and private sector organisations that are registered to participate in the eHealth record system and who must comply with strict rules to protect the security and privacy of information. However, some of your child’s key health information will be stored by the System Operator in the National Repositories Service (NRS) – for example, if your child’s has a shared health summary or if you have uploaded information on allergies, these will be stored in the NRS. Information uploaded to the NRS will be retained until at least 30 years after the date of your child’s death, or if the system operator does not know this date 130 years after the information was uploaded.