Not just law enforcement
'Section 70 of the Act gives the ADHA discretion to release information without a warrant, if it “reasonably believes that the use or disclosure is reasonably necessary” for law enforcement purposes.'
If I was feeling generous I might assume that any law enforcement purpose could already be covered by a court-issued warrant. However, the Act does not require a warrant for law enforcement purposes just a "reasoanble belief" on the part of the system operator. This was deliberate wording, not an accident.
More concerning for me is that only "reasoanble belief" is required to release information to "protect the public revenue" (70(1)(c)). So, when a government is looking to save a few bucks on Medicare it can trawl this information, in aggregate, for the areas it could cut with least public backlash. Or, in or targeted fashion, evaluate "suspect" citizens or groups with a view to reducing their personal Medicare or private health rebates. Even worse, "protecting the public revenue" could mean increasing the public revenue by on-selling the data to anybody with the cash. All good as long as someone at a system operator being paid by the government arrives at "reasoanble belief" when requested by the government.