
Stephanie Gregor (Manager, Capability and Guidance) from the Office of the Privacy Commissioner spoke at a May Quality Peer Group about new Rule 3A of the Health Information Privacy Code. She explained why it was introduced, who it applies to from 1 May 2026, and how health agencies must notify people when health information is collected indirectly. The session covered notification requirements, reasonable steps, exceptions, representatives, practical compliance, and policy updates.