Essential information

In the application process

We will use the personal information we collect from you and others for registration, administration, maintenance, monitoring and population of your eHealth record. We will also use your personal information to administer the eHealth record system more broadly. This would include, for example, monitoring the security, integrity and efficiency of the system.

We use private sector firms to help deliver the eHealth record system. They will see, use and disclose, and in some cases store, your personal information as part of this work. These firms are required to treat your information with the same level of respect, privacy and security as we are.

We will disclose information about you to the Department of Human Services and the Department of Veterans’ Affairs, in order to verify the accuracy of information you supply with your application. This includes information necessary to verify your identity and your consent to include information held by Chief Executive Medicare in your eHealth record.

Once you take control

Once you take control, the kinds of information collected directly from you may include:

• details that allow us to identify and contact you;
• details about medical conditions you have which you decided to upload to and publish in the eHealth record;
• details about your health which you enter in the confidential health diary feature;
• information about how you want to manage your eHealth record, including who you want to have access to your record and other access controls;
• records uploaded to your eHealth record; and
• information about your access to your eHealth record.

We will disclose your eHealth record to your representatives and to the healthcare provider organisations involved in your care that are registered with the eHealth record system, in accordance with the access controls for your eHealth record, or in a medical emergency.

Healthcare provider organisations sometimes use private sector firms to help them with computer and IT-related services (‘contracted service providers’). If a registered contracted service provider is authorised by a healthcare provider organisation to connect to the eHealth record system on its behalf, then we will disclose your information to the contracted service provider (if the healthcare provider organisation is authorised by you to access this information). A contracted service provider may only register with the eHealth record system if it agrees to meet proper security and privacy standards when connecting to the eHealth record system.

We will disclose your information to the organisations that hold documents in storage for the eHealth record system and make them available when they are requested (repository operators), for the purpose of storing, indexing and calling for records about you which form part of your eHealth record.

There are some circumstances where the Personally Controlled Electronic Health Records Act 2012 authorises the collection, use and disclosure of health information without consent. The main circumstance in which this is likely to occur is when there is a serious threat to the life, health or safety of an individual and the person is unable to consent to their information being accessed and used. Other circumstances are set out in the Personally Controlled Electronic Health Records Act 2012.

Read the full Privacy Statement.

Most people are likely to allow any healthcare provider organisation involved in their care to access their eHealth record. This is the default access control setting that will apply to all eHealth records from registration. However, you can set access controls for your eHealth record by:

• limiting access to the whole of the eHealth record – if you do this you will need to provide an access code to those healthcare providers you wish to access the eHealth record; or
• limiting access to a specific document in the eHealth record – if you do this, you will need to give a healthcare provider an access code before they can see that specific document.

Information that is uploaded to the eHealth record system will be stored in repositories. Repositories are operated by a variety of public and private sector organisations that are registered to participate in the eHealth record system and must comply with strict rules to protect the security and privacy of information. However, some of your key health information will be stored by the System Operator in the National Repositories Service (NRS) – for example, if you have a shared health summary or if you have uploaded information on allergies, these will be stored in the NRS. Information uploaded to the NRS will be retained until at least 30 years after the date of your death, or if the system operator does not know this date 130 years after the information was uploaded.