Despite the access duty in s 69(1), an employer must not let an HSR see any medical information about an employee unless the employee has consented, or the information is presented so that it does not identify the employee and nobody could reasonably work out who the employee is from it. Maximum penalty: 60 penalty units for an individual, 300 for a body corporate. Employers must not treat an employee less favourably for acting as an HSR (Division 9).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.