(1) A person must not without lawful authority knowingly access, use or disclose information held in the database.: Maximum penalty--20 penalty units.
(2) For this clause,
"lawful authority" includes the person acting--(a) under the direction of a dentist, medical practitioner or nurse practitioner, and(b) for a purpose under clause 174H(1) or (2).