Tell me in 2 minutes
Proposed reforms currently before the Federal Parliament would change the use of healthcare identifiers across the Australian healthcare system.
The Regulatory Reform Omnibus Bill 2025 (Cth) (Bill) aims to promote the adoption of the Healthcare Identifier Directory (Directory), such that it becomes a key piece infrastructure in the health system. The Bill also seeks to expand the use and disclosure of healthcare identifiers to capture consumers of health technology services, and insurance or employment processes.
Following our first KWM Insight summarising the key elements of the Bill, here we provide a deep dive into Schedule 1, Part 2 – ‘Enhancing use and adoption of healthcare identifiers’.
We explore what healthcare identifiers are, why they are important to the secure and accurate exchange of health information, and how the Bill promotes their use to achieve a more integrated patient experience.
We also flag steps healthcare providers should be considering in preparation for compliance, and commencement dates that health technology providers should be keeping in mind.
Background
On 8 October 2025, the Federal Government introduced the Bill to modernise service delivery, reduce red tape and streamline how regulators interact with industry.
One of the industries that would be most affected by the proposed reforms is the healthcare sector.
Healthcare identifiers are unique 16-digit numbers assigned to identify patients and providers of health services. Any patient with a Medicare card has an individual healthcare identifier. In contrast to a Medicare number, healthcare identifiers survive a patient or provider’s lifetime, and are used solely to identify patients or providers, not to claim any benefits. Healthcare identifiers enable the correct identification of:
and the secure and accurate exchange of health information. Healthcare identifiers are important to the functioning of systems like electronic prescriptions and My Health Record.
The findings of consultations and reviews, including the Healthcare Identifiers Act and Services Review finalised in November 2018, have indicated that healthcare identifiers are not well understood or widely used.
The Bill seeks to promote the use of healthcare identifiers, achieve a more integrated experience for patients receiving multiple services, and broaden and clarify the purposes for which healthcare identifiers are to be used.
Definition of terms
‘Identified healthcare providers’ refer to individual healthcare providers, healthcare provider organisations and healthcare support service providers that have been assigned a healthcare identifier. Note that healthcare support service providers are a new category of identified provider following the passage of the Aged Care and Other Legislation Amendment Act 2025 (Cth).
‘Professional and business details’ include information relevant to ensuring that healthcare recipients are referred to appropriate healthcare providers (e.g. surgery hours or languages spoken).
Communication for ‘health administration purposes’ is to be broadly construed, and includes communications about activities that directly or indirectly support the delivery of healthcare.
‘Health technology providers’ are providers of electronic services the sole or primary purpose of which is to communicate with a healthcare recipient, healthcare provider or healthcare administration entity about healthcare or support services.
A ‘permitted health technology purpose’ assists a health technology provider to communicate, manage or monitor health information in relation to healthcare or support services that are being or have been provided.
Understanding the provisions
What is the Healthcare Provider Directory and who will be able to access it?
In its current form, the Healthcare Identifiers Act 2010 (Cth) (Act) enables the sharing of healthcare identifiers between identified healthcare providers on the Directory for the purpose of communicating information about healthcare and support services that are provided. The Bill expands the purpose, access and use of the Directory.
The Bill establishes a Healthcare Provider Directory Operator (Directory Operator). A Commonwealth body may be established to perform this role, or alternatively, the Service Operator (the Chief Executive of Medicare) will remain the operator of the Directory.
The Bill broadens the purposes of the Directory to include:
- making professional and business details of identified healthcare providers available to entities that are authorised to access the Directory, and
- enabling communication between entities that are authorised to access the Directory about healthcare and support services, and for health administration purposes.
Access to the Directory would be expanded to health administration entities (as prescribed by the Minister) and other entities prescribed under a new regulation-making power.
Critically, the Bill makes the disclosure of healthcare identifiers, identifying information and other professional and business details about identified healthcare providers an opt-out process. Changing from an opt-in to opt-out process will mean that the Directory Operator can disclose information about identified healthcare providers to other providers in the Directory by default, without needing to obtain agreement. In practice, this will make it easier for providers to find and connect with other providers that use digital services, such as electronic prescribing or electronic referrals. Healthcare providers may request that certain information not be disclosed or visible to other providers.
The Explanatory Memorandum to the Bill envisages the Directory becoming a ‘key infrastructure element supporting secure information exchange, digital service authorisation and system-wide interoperability’.
Who would be authorised to use and disclose healthcare identifiers?
The Bill expands the list of entities who may use or disclose healthcare identifiers to include health technology providers, employers and insurers.
1. Health technology providers
At present, the Act does not allow providers of health technology services to use healthcare identifiers to communicate with other providers or health administration entities. The Bill creates a new division for this purpose, which would commence on 1 February 2027.
The Bill would enable healthcare recipients to consent to identified healthcare providers, health administration entities and health technology providers collecting, using and disclosing their healthcare identifier and identifying information for a permitted health technology purpose. This reform is relevant to consumers and providers of wearable devices for health monitoring, in-home health monitoring equipment and other mobile health applications. Authorised healthcare providers will be able to monitor and communicate more effectively with patients by reference to these services.
2. Employers and insurers
The Bill repeals the existing prohibition on the collection, use or disclosure of a healthcare recipients’ healthcare identifier when communicating or managing health information as part of underwriting or determining insurance contracts, or when employing the healthcare recipient.
The prohibition was originally intended to prevent employers or insurers from using healthcare identifiers to access information about an individual’s health record that might influence decisions about employment or insurance eligibility.
According to the Explanatory Memorandum, the prohibition has had the unintended effect of preventing healthcare identifiers from being linked to health information that might result from employment or insurance processes, including healthcare provided through an employer or insurer. The repeal will allow employers and insurers to match health information to the healthcare recipient using the healthcare identifier.
The Bill would not allow employers or insurers to access any additional health information that they are not already legally authorised to access.
How does the Bill promote a standardised approach to health information?
The adoption of healthcare identifiers is intended to make the exchange of healthcare information safer and more accurate by supporting the consistent and reliable identification of patients, healthcare providers and healthcare organisations.
In addition to promoting healthcare identifier use, the Bill also empowers the Secretary of the Health Department to make data standards about health information and other clinical data. These standards would govern the transfer of information between clinical systems and providers.
The standards may relate to any of the following matters:
- the format and description of health information or other clinical data
- the storage and disclosure of health information or other clinical data
- the interoperability of clinical or health information management systems
- health or clinical terminology and
- the implementation of data standards.
The data standards are to be published on the internet and subject to continuous review and updating.
Preparing for compliance
Healthcare providers, provider organisations, and support service providers should prepare for further engagement with the Directory, including by implementing processes to provide and update professional and business details in the Directory. Arrangements should also be made to enable contractors and subcontractors to use healthcare identifiers to fulfil their contractual obligations.
Further regulations are expected to prescribe the information that will be contained in the Directory, the process for updating details, and security requirements that must be met before connecting.
From 1 February 2027, health technology providers should consider enabling consent flows for consumers and patients to agree to the collection, use and disclosure of their healthcare identifiers and identifying information.
Importantly, the handling of healthcare identifiers is subject to the requirements of the Privacy Act 1988 (Cth). Practices to ensure compliance with the Australian Privacy Principles will be necessary.
Next steps
Look out for our next deep dive into how the Bill effects the energy sector. In the meantime, please contact us if you’d like to discuss how you might be affected by these reforms.
As we support businesses confronting a myriad of tech-driven possibilities, we’re guided by the human imperative - the choices we make must provide us all with better long-term opportunity.
