Victorian Consolidated Legislation

Health Records Act 2001 - SECT 21

Organisation to comply with HPPs

21. Organisation to comply with HPPs



(1) Subject to this section and section 20, an organisation must not do an
act, or engage in a practice, that is an interference with the privacy of an
individual.

(2) Subsection (1) does not apply if the organisation proves that, in the
circumstances, compliance with this Act or the Health Privacy Principle would
have contravened another Act, regulations made under another Act or an order
of a tribunal or of a court of competent jurisdiction.

(3) Subsection (1) does not apply to the doing of an act, or the engaging in
of a practice, by an organisation that, but for this subsection, would
constitute a breach of HPP 1 or HPP 2, if-

   (a)  the doing of the act or the engaging in of the practice is necessary
        for the performance of a contract to which the organisation is a party
        entered into by the organisation before 23 November 2000; and

   (b)  the act is done or the practice is engaged in before the second
        anniversary of the commencement of section 20 or the end of any
        extension of that period granted in relation to that contract under
        subsection (4).

(4) On the application of an organisation before the second anniversary of the
commencement of section 20 or before the expiry of any extension of that
period granted under this subsection, the Health Services Commissioner may
grant an extension of that period in relation to a specified contract if he or
she is of the opinion that the organisation is doing its best-

   (a)  to comply with HPP 1 or HPP 2 consistent with its obligations under
        the contract; and

   (b)  to seek to have the contract re-negotiated to enable the organisation
        to comply fully with HPP 1 or HPP 2.

(5) Subsection (1) does not apply to the doing of an act, or the engaging in
of a practice, by an organisation that, but for this subsection, would
constitute a breach of HPP 2, in relation to health information collected by
the organisation before the commencement of section 20, if-





   (a)  the Health Services Commissioner, on the application of the
        organisation, grants the organisation an exemption from that Principle
        in relation to specified information or information of a specified
        class for a specified period; and

   (b)  the act is done or the practice is engaged in, in relation to
        information to which the exemption applies-

   (i)  before the second anniversary of the commencement of section 20; and

   (ii) during the period specified in the exemption.

(6) The Health Services Commissioner may grant an exemption under subsection
(5) if he or she is of the opinion that, in the particular circumstances, it
is in the public interest for the use or disclosure to continue otherwise than
in compliance with HPP 2.

(7) Subsection (1) does not apply to the doing of an act, or the engaging in
of a practice, by an organisation that, but for this subsection, would
constitute a breach of HPP 2, in relation to health information collected by
the organisation before the commencement of section 20, if the act is done, or
the practice is engaged in, in the prescribed circumstances.

_______________