ANNOUNCEMENT 21 Jun 2012In June 2012, the government of Australia announced a change in the required local operations to serve domestic customers.
NUMBER OF INTERVENTIONS
Personally Controlled Electronic Health Records Bill 2012: http://parlinfo.aph.gov.au/parlInfo/download/legislation/bills/r4738_aspassed/toc_pdf/11269b01.pdf;fileType=application%2Fpdf
The Personally Controlled Electronic Health Record Bill was passed by the Australian Parliament on June 21, 2012, effective as of June 26 of the same year. In section 77, it contains the requirement that electronic health records are held and processed within Australia, effectively denying firms located abroad from winning contracts to service these records. This data localisation requirement takes the following form:
'(1) The System Operator, a registered repository operator, a registered portal operator or a registered contracted service provider that holds records for the purposes of the PCEHR system (whether or not the records are also held for other purposes) or has access to information relating to such records, must not:
(a)hold the records, or take the records, outside Australia; or
(b)process or handle the information relating to the records outside Australia; or
(c)cause or permit another person:
(i)to hold the records, or take the records, outside Australia; or
(ii)to process or handle the information relating to the records outside Australia.'
The same section also contains the cases, in which health data can be transferred outside the country:
'(2) '...' the System Operator is authorised, for the purposes of the operation or administration of the PCEHR system:
(a)to hold and take such records outside Australia, provided that the records do not include:
(i)personal information in relation to a consumer or a participant in the PCEHR system; or
(ii)identifying information of an individual or entity; and
(b)to process and handle such information outside Australia, provided that the information is neither of the following:
(i)personal information in relation to a consumer or a participant in the PCEHR system;
(ii)identifying information of an individual or entity.'