My Medicare Privacy Policy
Privacy Notice My Medicare:
When does this privacy notice apply?
This privacy notice applies to individuals registering for the MyMedicare Program.
The aim of this notice is to explain how the Australian Government will manage personal information consistent with
obligations under the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). This includes
how Australian Government agencies will collect, use and disclose information about you as part of the MyMedicare
Program. You should read this privacy notice together with other privacy-related information that your medical practice
gives you about how they manage your personal information.
References to “you” and your” in this notice refer to the individual who is registering themselves or being registered for
the MyMedicare Program. A parent or legal guardian may register a child under the age of 14 in MyMedicare on the
child’s behalf if they are listed on the same Medicare card. Where a parent or legal guardian is registering a child on
their behalf, the child’s personal information will be collected from the parent/ legal guardian or the child’s medical
practice and used or disclosed as set out in this privacy notice.
The Department of Health, Disability and Ageing is responsible for the MyMedicare Program. Services Australia
administers the MyMedicare Program on behalf of the Department of Health, Disability and Ageing.
Mandatory MyMedicare registration information Services Australia collects:
As part of your MyMedicare registration, Services Australia will collect personal information about you from you or
your medical practice, including:
• Name
• Date of birth
• Medicare card number or your Department of Veterans’ Affairs (DVA) File Number
• Name of your general practitioner (GP) or nurse practitioner
• GP or nurse practitioner provider number
• Practice name
• Practice address
• Details of other health providers involved in your care team.
• Information about the specific exemption criteria you meet to assess your eligibility for a MyMedicare
exemption, if relevant.
If you do not provide the personal information listed above, Services Australia will not have the information required to
register you in MyMedicare.
Why Services Australia collects this mandatory information:
Services Australia needs this information to:
• Record your consent to be registered in the MyMedicare Program, and to collect your personal information for
the purposes outlined in this notice.
• Assess your eligibility for MyMedicare, register you with your regular practice and link you with your chosen
GP or nurse practitioner.
• Communicate with you and provide you with information about your MyMedicare registration.• Assess your eligibility for the Medicare Benefits Schedule (MBS), General Practice Incentives and DVA
funded services linked to MyMedicare registration.
• Enable relevant MBS and DVA claims linked to MyMedicare to be processed.
• Enable compliance activities to ensure that providers and practices are adhering to the rules and billing MBS
and DVA correctly.
Additional voluntary information you provide:
As part of MyMedicare registration you can also choose to provide other information about yourself, including:
• Whether you identify as Aboriginal or Torres Strait Islander
• Your country of birth
• The language you speak at home and how well you speak English
• Your gender identity
• Your sexual orientation
• Whether you identify as someone living with a health condition or disability.
Any voluntary information you provide will form part of the record of your MyMedicare registration. This information will
continue to be held by Services Australia and the entities it has been shared with as outlined in this privacy notice
even if you withdraw from the MyMedicare Program. You can choose to change or remove your answers for a current
MyMedicare registration at any stage. Updated or removed answers will be reflected in your current MyMedicare
registration.
This voluntary information will also be provided back to your medical practice in an identifiable form. The voluntary
data may also be linked to other information such as hospital, aged care or other government sector data to get a
fuller picture of the health needs of Australians. The information you provide in this section will also be identifiable
along with mandatory questions for improved service delivery, policy enhancement and compliance.
If you choose not to provide this information as part of your registration, you will still be able to register for
MyMedicare. You may also provide this additional information at any time, through Medicare Online Services or
directly to your practice.
Voluntary information will be used to support MyMedicare program delivery and inform future policy development. The
voluntary questions asked during the registration process will support improved service delivery for different
population groups, and to help the Australian Government better understand community health needs to guide
program and policy improvements.
How Services Australia collects your information:
Services Australia collects the information needed to complete a patient’s MyMedicare registration, as well as any
additional voluntary information you choose to provide, in three ways. This depends on how the patient, or their
chosen practice, choose to begin the registration process.
Patient Initiated Electronic Registration
Patients can commence the registration and provide consent in Medicare Online Services, and the practice staff can
then complete the registration.
Practice Initiated Electronic Registration
Practice staff can commence the patient registration process in MyMedicare, and patients can confirm their
registration information and provide consent through Medicare Online Services.
Paper Registration Form
After completing the registration form to register in MyMedicare, your practice will enter your information into a secure
database via Provider Digital Access (PRODA) and Health Professional Online Services (HPOS). Your practice will
keep the paper registration form in your medical record as proof of your consent to participate in MyMedicare.
What happens to your information?
Your GP and practice will be able to view and update your MyMedicare registration details (including preferred GP),
manage your registration, or withdraw you from MyMedicare. You will also be able to view, manage or withdraw your
registration through Medicare Online Services.
Your practice will be required to securely store your completed registration form for record keeping purposes. Once
you are registered, authorised staff involved in the management of the practice may have access to your information.
This may include health professionals. Relevant staff may change over time.
Services Australia is responsible for the overall management and storage of your data.
To enable your practice to better manage your care, the information you provide in registering for MyMedicare may be
transferred using a secure channel and confidentially stored in the practice management software.
Disclosure of your personal information to the Department of Health, Disability and Ageing
Services Australia discloses mandatory and voluntary MyMedicare information, including identifiable information, to
the Department of Health, Disability and Ageing. This disclosure supports the effective administration, integrity and
oversight of the MyMedicare program.
Use of your personal information by the Department of Health, Disability and Ageing
The Department of Health, Disability and Ageing uses MyMedicare information disclosed by Services Australia for:
• managing, monitoring and reporting on the MyMedicare program and incentive programs linked to
MyMedicare, such as the General Practice in Aged Care Incentive (GPACI) and the Bulk Billing Practice
Program (BBPIP)
• program compliance activities, including confirming the accuracy of practice and patient registrations, and
identifying incorrect claims
• administering MBS payments and incentive programs linked to MyMedicare, such as GPACI and BBPIP
• policy development, program management, evaluation and continuous improvement of MyMedicare and
related programs
• authorised data sharing within government to support health policy, program management and analysis (e.g.
with the Australian Bureau of Statistics or the Australian Institute of Health and Welfare)
• sharing information with contracted service providers, under strict confidentiality and security requirements, to
support program delivery and policy development.
External Use of Medicare and MyMedicare Data
The Department of Health, Disability and Ageing may work with external consultants, tertiary institutions and peak
bodies to facilitate improvements to MyMedicare.
The Department of Health, Disability and Ageing may use Medicare and MyMedicare data for the purposes approved
by Services Australia (see above). De‑identified and aggregated data may be shared with external groups such as
tertiary institutions or peak bodies where those organisations provide clear use cases that directly benefit MyMedicare.
No identifiable personal information is shared unless it is legally authorised.
Consultants can only access Medicare related information such as MBS data or MyMedicare information when this is
permitted by law. When consultants are approved to receive this information, they must also follow all relevant
requirements under the Privacy Act 1988, relevant confidentiality obligations, and any relevant contractual or security
conditions.
Disclosure of your personal information to DVA
If you register for MyMedicare using a Veteran Gold Card or White Card, Services Australia will provide identifiable
MyMedicare information about you to DVA as approved by the Department of Health, Disability and Ageing. This is
because DVA must be able to manage and support MyMedicare participation for its eligible clients. Only information
relating specifically to patients who hold a DVA White or Gold Card will be shared with DVA. DVA does not receive or
access broader MyMedicare data about other patients.
Use of your information by DVA
DVA may use this patient‑specific information to support program activities, including:
• processing and administering DVA‑funded services and payments linked to MyMedicare
• conducting program compliance, audit activities and routine monitoring of DVA claims• analysing and developing policy, and evaluating and improving MyMedicare for veterans
• sharing data within government, where legally authorised, for program management and reporting
Only authorised DVA staff can access this information, and all use must comply with relevant privacy, secrecy and
security requirements.
Use of your personal information by the Australian Digital Health Agency
If you make a request via your My Health Record, Services Australia will provide information about you to the My
Health Record system so that the name of your registered practice and GP will appear in your My Health Record if
you choose to have it displayed.
Other disclosures of your personal information
Your information may also be disclosed when this is authorised or required by law. Only authorised staff have access
to your personal information.
Will my personal information be stored overseas?
Services Australia, the Department of Health, Disability and Ageing, the Australian Digital Health Agency or DVA will
not store your personal information overseas. Talk to your medical practice about how and where your medical
practice stores your personal information.
Concerns and complaints:
Services Australia’s privacy policy can be found here: servicesaustralia.gov.au/privacy.
It contains information about how you can make a complaint if you think Services Australia have breached:
• the Australian Privacy Principles, or
• the Australian Government Agencies Privacy Code.
The privacy policy explains how Services Australia will manage your complaint, how you may access the personal
information about you held by Services Australia and how you may seek to correct any personal information about you
held by Services Australia, which is incorrect.
You can contact Services Australia to discuss privacy and your personal information by calling 1800 132 468 or the
TTY teletypewriter phone on 1800 810 586, online via a web form at Services Australia or writing to them at:
Centrelink and Medicare
Services Australia Complaints and Feedback
Reply Paid 7800
Canberra BC ACT 2610
More on privacy:
The Department of Health, Disability and Ageing’s privacy policy can be found here:
Services Australia’s privacy policy can be found here:
Privacy Policy - About us - Services Australia
The Australian Digital Health Agency’s privacy policy can be found here:
The Department of Veterans’ Affairs privacy policy can be found here:
When does this privacy notice apply?
This privacy notice applies to individuals registering for the MyMedicare Program.
The aim of this notice is to explain how the Australian Government will manage personal information consistent with
obligations under the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). This includes
how Australian Government agencies will collect, use and disclose information about you as part of the MyMedicare
Program. You should read this privacy notice together with other privacy-related information that your medical practice
gives you about how they manage your personal information.
References to “you” and your” in this notice refer to the individual who is registering themselves or being registered for
the MyMedicare Program. A parent or legal guardian may register a child under the age of 14 in MyMedicare on the
child’s behalf if they are listed on the same Medicare card. Where a parent or legal guardian is registering a child on
their behalf, the child’s personal information will be collected from the parent/ legal guardian or the child’s medical
practice and used or disclosed as set out in this privacy notice.
The Department of Health, Disability and Ageing is responsible for the MyMedicare Program. Services Australia
administers the MyMedicare Program on behalf of the Department of Health, Disability and Ageing.
Mandatory MyMedicare registration information Services Australia collects:
As part of your MyMedicare registration, Services Australia will collect personal information about you from you or
your medical practice, including:
• Name
• Date of birth
• Medicare card number or your Department of Veterans’ Affairs (DVA) File Number
• Name of your general practitioner (GP) or nurse practitioner
• GP or nurse practitioner provider number
• Practice name
• Practice address
• Details of other health providers involved in your care team.
• Information about the specific exemption criteria you meet to assess your eligibility for a MyMedicare
exemption, if relevant.
If you do not provide the personal information listed above, Services Australia will not have the information required to
register you in MyMedicare.
Why Services Australia collects this mandatory information:
Services Australia needs this information to:
• Record your consent to be registered in the MyMedicare Program, and to collect your personal information for
the purposes outlined in this notice.
• Assess your eligibility for MyMedicare, register you with your regular practice and link you with your chosen
GP or nurse practitioner.
• Communicate with you and provide you with information about your MyMedicare registration.• Assess your eligibility for the Medicare Benefits Schedule (MBS), General Practice Incentives and DVA
funded services linked to MyMedicare registration.
• Enable relevant MBS and DVA claims linked to MyMedicare to be processed.
• Enable compliance activities to ensure that providers and practices are adhering to the rules and billing MBS
and DVA correctly.
Additional voluntary information you provide:
As part of MyMedicare registration you can also choose to provide other information about yourself, including:
• Whether you identify as Aboriginal or Torres Strait Islander
• Your country of birth
• The language you speak at home and how well you speak English
• Your gender identity
• Your sexual orientation
• Whether you identify as someone living with a health condition or disability.
Any voluntary information you provide will form part of the record of your MyMedicare registration. This information will
continue to be held by Services Australia and the entities it has been shared with as outlined in this privacy notice
even if you withdraw from the MyMedicare Program. You can choose to change or remove your answers for a current
MyMedicare registration at any stage. Updated or removed answers will be reflected in your current MyMedicare
registration.
This voluntary information will also be provided back to your medical practice in an identifiable form. The voluntary
data may also be linked to other information such as hospital, aged care or other government sector data to get a
fuller picture of the health needs of Australians. The information you provide in this section will also be identifiable
along with mandatory questions for improved service delivery, policy enhancement and compliance.
If you choose not to provide this information as part of your registration, you will still be able to register for
MyMedicare. You may also provide this additional information at any time, through Medicare Online Services or
directly to your practice.
Voluntary information will be used to support MyMedicare program delivery and inform future policy development. The
voluntary questions asked during the registration process will support improved service delivery for different
population groups, and to help the Australian Government better understand community health needs to guide
program and policy improvements.
How Services Australia collects your information:
Services Australia collects the information needed to complete a patient’s MyMedicare registration, as well as any
additional voluntary information you choose to provide, in three ways. This depends on how the patient, or their
chosen practice, choose to begin the registration process.
Patient Initiated Electronic Registration
Patients can commence the registration and provide consent in Medicare Online Services, and the practice staff can
then complete the registration.
Practice Initiated Electronic Registration
Practice staff can commence the patient registration process in MyMedicare, and patients can confirm their
registration information and provide consent through Medicare Online Services.
Paper Registration Form
After completing the registration form to register in MyMedicare, your practice will enter your information into a secure
database via Provider Digital Access (PRODA) and Health Professional Online Services (HPOS). Your practice will
keep the paper registration form in your medical record as proof of your consent to participate in MyMedicare.
What happens to your information?
Your GP and practice will be able to view and update your MyMedicare registration details (including preferred GP),
manage your registration, or withdraw you from MyMedicare. You will also be able to view, manage or withdraw your
registration through Medicare Online Services.
Your practice will be required to securely store your completed registration form for record keeping purposes. Once
you are registered, authorised staff involved in the management of the practice may have access to your information.
This may include health professionals. Relevant staff may change over time.
Services Australia is responsible for the overall management and storage of your data.
To enable your practice to better manage your care, the information you provide in registering for MyMedicare may be
transferred using a secure channel and confidentially stored in the practice management software.
Disclosure of your personal information to the Department of Health, Disability and Ageing
Services Australia discloses mandatory and voluntary MyMedicare information, including identifiable information, to
the Department of Health, Disability and Ageing. This disclosure supports the effective administration, integrity and
oversight of the MyMedicare program.
Use of your personal information by the Department of Health, Disability and Ageing
The Department of Health, Disability and Ageing uses MyMedicare information disclosed by Services Australia for:
• managing, monitoring and reporting on the MyMedicare program and incentive programs linked to
MyMedicare, such as the General Practice in Aged Care Incentive (GPACI) and the Bulk Billing Practice
Program (BBPIP)
• program compliance activities, including confirming the accuracy of practice and patient registrations, and
identifying incorrect claims
• administering MBS payments and incentive programs linked to MyMedicare, such as GPACI and BBPIP
• policy development, program management, evaluation and continuous improvement of MyMedicare and
related programs
• authorised data sharing within government to support health policy, program management and analysis (e.g.
with the Australian Bureau of Statistics or the Australian Institute of Health and Welfare)
• sharing information with contracted service providers, under strict confidentiality and security requirements, to
support program delivery and policy development.
External Use of Medicare and MyMedicare Data
The Department of Health, Disability and Ageing may work with external consultants, tertiary institutions and peak
bodies to facilitate improvements to MyMedicare.
The Department of Health, Disability and Ageing may use Medicare and MyMedicare data for the purposes approved
by Services Australia (see above). De‑identified and aggregated data may be shared with external groups such as
tertiary institutions or peak bodies where those organisations provide clear use cases that directly benefit MyMedicare.
No identifiable personal information is shared unless it is legally authorised.
Consultants can only access Medicare related information such as MBS data or MyMedicare information when this is
permitted by law. When consultants are approved to receive this information, they must also follow all relevant
requirements under the Privacy Act 1988, relevant confidentiality obligations, and any relevant contractual or security
conditions.
Disclosure of your personal information to DVA
If you register for MyMedicare using a Veteran Gold Card or White Card, Services Australia will provide identifiable
MyMedicare information about you to DVA as approved by the Department of Health, Disability and Ageing. This is
because DVA must be able to manage and support MyMedicare participation for its eligible clients. Only information
relating specifically to patients who hold a DVA White or Gold Card will be shared with DVA. DVA does not receive or
access broader MyMedicare data about other patients.
Use of your information by DVA
DVA may use this patient‑specific information to support program activities, including:
• processing and administering DVA‑funded services and payments linked to MyMedicare
• conducting program compliance, audit activities and routine monitoring of DVA claims• analysing and developing policy, and evaluating and improving MyMedicare for veterans
• sharing data within government, where legally authorised, for program management and reporting
Only authorised DVA staff can access this information, and all use must comply with relevant privacy, secrecy and
security requirements.
Use of your personal information by the Australian Digital Health Agency
If you make a request via your My Health Record, Services Australia will provide information about you to the My
Health Record system so that the name of your registered practice and GP will appear in your My Health Record if
you choose to have it displayed.
Other disclosures of your personal information
Your information may also be disclosed when this is authorised or required by law. Only authorised staff have access
to your personal information.
Will my personal information be stored overseas?
Services Australia, the Department of Health, Disability and Ageing, the Australian Digital Health Agency or DVA will
not store your personal information overseas. Talk to your medical practice about how and where your medical
practice stores your personal information.
Concerns and complaints:
Services Australia’s privacy policy can be found here: servicesaustralia.gov.au/privacy.
It contains information about how you can make a complaint if you think Services Australia have breached:
• the Australian Privacy Principles, or
• the Australian Government Agencies Privacy Code.
The privacy policy explains how Services Australia will manage your complaint, how you may access the personal
information about you held by Services Australia and how you may seek to correct any personal information about you
held by Services Australia, which is incorrect.
You can contact Services Australia to discuss privacy and your personal information by calling 1800 132 468 or the
TTY teletypewriter phone on 1800 810 586, online via a web form at Services Australia or writing to them at:
Centrelink and Medicare
Services Australia Complaints and Feedback
Reply Paid 7800
Canberra BC ACT 2610
More on privacy:
The Department of Health, Disability and Ageing’s privacy policy can be found here:
- health.gov.au/resources/publications/privacy-policy.
Services Australia’s privacy policy can be found here:
Privacy Policy - About us - Services Australia
The Australian Digital Health Agency’s privacy policy can be found here:
- digitalhealth.gov.au/about-us/policies-privacy-and-reporting/privacy-policy
- myhealthrecord.gov.au/privacy
The Department of Veterans’ Affairs privacy policy can be found here:
- dva.gov.au/privacy.
