PART A: GENERAL

1. INTRODUCTION

PHIIA was established to assist its members in providing the best possible service to customers to navigate the private health insurance market and find better value.

PHIIA has established this self-regulatory Code to achieve this goal, and to promote honest, informed and transparent relationships between Private Health Insurance Intermediaries and customers.

The Code assists in maintaining and enhancing regulatory compliance and service standards across the private health insurance industry.

The provisions in this Code are in addition to the existing regulatory obligations of Intermediaries. The Code is reviewed every 3 years and more frequently if so required, in order to keep pace with developments in the industry and developments in technology. Reviews involve the input of a range of stakeholders including from industry, customers and regulators.

The Code is monitored and enforced by a Code Compliance Committee, with an independent Chair, and the Board of PHIIA.

Apart from the provisions for enforcement and sanctions arising out of a breach of this Code, such a breach will not however of itself give rise to any legal right or liability in any person or organisation.

2. GENERAL RESPONSIBILITIES

We must:

• duly and punctually comply with our obligations under this Code, as well as our obligations under the Private Health Insurance Intermediaries Practice Codes, the rules of which form part of this Code;
• continuously work towards improving standards of practice and service in the private health insurance industry;
• act in the customers' best interests, putting those interests before our own and before those of the insurer, uninfluenced by of any fees, commissions or other remuneration or benefits received by us;
• if we cannot identify a product that better meets their needs, advise customers to remain with their present product;
• disclose to our customers and our principals that we receive fees, commissions or other remuneration or benefits, and from whom we receive them;
• provide such plain language information and advice to our customers as will enable them to make an informed decision;
• provide information to customers on their rights and obligations under their private health insurance policy;
• ensure that abnormally high levels of sales for particular insurers or products can be identified and explained;
• comply with our fiduciary obligations, maintain confidentiality, avoid conflicts of interest and disclose any conflicts of interest that arise as soon as is practicable;
• discharge our responsibilities and duties competently and with integrity and honesty;
• not do or fail to do anything that may be prejudicial to the interests of the private health insurance industry or result in a breach any obligation we have as a member of PHIIA, including engaging in conduct unbecoming of a member or that could damage the reputation of PHIIA or otherwise be prejudicial to its interests;
• ensure that we have the necessary skills appropriate for the services we provide;
• exercise reasonable care and skill, clearly explaining relevant options and providing all relevant information;
• where questions are asked of customers, give them such information as will enable them to best respond to those questions;
• make our customers aware that the more detail they give us about their needs the more likely it will be that our recommendations will align with those needs;
• comply with the provisions of all relevant legislation and the regulations thereunder, including the Private Health Insurance Act 2007, the Privacy Act 1988 including the Australian Privacy Principles, the Competition and Consumer Act 2010 including the Australian Consumer Law and the State and Territory Fair Trading Acts and Privacy Acts;
• comply with our obligations under all other codes and standards of conduct, whether regulatory or otherwise, that are binding on us;
• disclose to our customers our status, the insurers we represent, and any other relevant roles and relationships we have;
• maintain and keep for at least 7 years all records that are appropriate or required by Law to be kept (including recordings of every health insurance transaction (and whether concluded or otherwise), and comply with the legal requirements for production of, access to, or copying of, such records;
• monitor such volume of our personnels' calls as is required and appropriate to enhance compliance, and taking into account the level of experience and demonstrated compliance of such personnel;
• not engage in any unlawful non-disclosure or misrepresentation;
• promptly provide our customer's proposal information to their chosen insurer and help our customers comply with their requirements;
• have a website that as a minimum gives our contact information, describes our accreditation under this Code, how we are paid, provides a link to our Privacy Policy and our Dispute Resolution Policy and (unless our only role as an Intermediary is as a corporate broker), lists the insurers whose products we are representing, and notes that not all insurers are being compared and not all of the products of the insurers that we do represent are being compared;
• include the PHIIA Code logo in our communications with our customers, advise them in such communications that we are accredited under this Code, and inform them how they can view or obtain relevant information under the preceding sub-paragraph;
• ensure that where we act as an intermediary in a number of roles, for example as both an agent and a broker, our personnel will only be engaged to act in one such role at a time, so as to prevent conflicts of interest arising;
• not make representations that could be confusing to customers; and
• take all reasonable steps to ensure that third party lead generators have acted ethically and complied with the Law.

3. AI AND ALGORITHMS

• If we use an algorithm to assist in making recommendations to customers it must operate so that, with the information that customers are asked to provide, it will make recommendations from our panel of health funds that are appropriate for our customers' advised needs, and in particular not biased to achieve any particular outcome or an outcome that could favour us in any way.
• Whenever requested by the Code Compliance Committee of PHIIA we will make any algorithm that we use, and how we use it, available for scrutiny on a confidential basis by an appropriate independent body nominated by the Committee to verify that we are not in breach of our obligations under 3(a) above.
• If we use AI systems, as that term is defined in the Australian Government's Guidance for AI Adoption (the 'Guidance'), the first edition of which was published on 21 October 2025, we agree to comply with the Guidance as updated or replaced from time to time, subject however to any directions given to us from time to time by the Board.
  https://www.industry.gov.au/publications/guidance-for-ai-adoption
• If we use AI systems we will comply with such directions as the Board may give us from time to time in relation to such use.
• We will only give AI generated advice if such advice will be appropriate, and we are confident of that. To that end we will ensure that an appropriate proportion of our customers receiving AI generated advice will promptly have such advice subjected to human oversight to assess its appropriateness. If any inappropriate advice is discovered (whether before or after it is acted on) we will correct that advice with our customer, at our cost, and suspend giving AI generated advice until we are confident that it will be appropriate.
• Whenever we intend to give advice to our customers that is AI generated, we must have the facility to give our customers human generated advice either as an alternative, or to verify the appropriateness of the advice before it is acted on. We must also at the outset make it clear to such customers that the advice that they will be given will be AI generated (describing in clear terms what that means), and that as an alternative they can elect not to be given AI generated advice but to have that advice given by a human.
• If we use AI systems we must regularly review and update our governance and risk management arrangements (assessing risk management through the lens of our customers rather than our business) to ensure that they keep up with our evolving use of AI systems; in particular we must comply with Australia's Artificial Intelligence Ethics Principles as published by the Department of Industry, Science and Resources, Australia (the 'Principles'), the last edition of which was dated 11 October 2024, as updated or replaced from time to time, and as relevant to our business.
  https://www.industry.gov.au/publications/australias-artificial-intelligence-ethics-principles/australias-ai-ethics-principles
• Our obligations under the Guidance or the Principles do not however operate to negate or diminish our other obligations under this Code.

4. POLICY DOCUMENTATION

We must ensure that all communications, policy documentation, recommendations and proposals are in plain language and contain all relevant information, explanations and advice, including about:

• waiting periods;
• the scope and implications of exclusions;
• the scope and implications of restriction on benefits;
• the scope and implications of benefit limitation periods;
• annual limits (individual and membership);
• co-payments and/or excesses;
• how to access the fund's complaints handling procedures;
• how they may cancel their private health insurance policy and if they have not yet made a claim, may receive a full refund of any premiums paid within a period of 30 days from the commencement date of their policy;
• the additional 10 business days cooling off rights that they have in relation to unsolicited consumer agreements and how they may exercise these cooling off rights; and
• how the documentation should be read carefully and retained,

as well as all information as is required to make an informed choice, advice that we are accredited under and bound by the Code, and anything else that is required to be disclosed by the insurer or the Law.

5. TRAINING

• We must:
• have arrangements in place to receive appropriate regular and up to date training, instructions, and documentation from the funds/insurers with whom we deal to enable us to provide our services in accordance with the Code's requirements;
• comply with those funds'/insurers' training and accreditation requirements; and
• keep records of all such training.
• We must have up to date training and information packages for our personnel that:
• are delivered at induction and on an ongoing basis and with a process of monitoring and review that is designed to detect and address any apparent need for remedial training;
• reflect changes to health insurance products as they occur; and that
• will enable our personnel to possess the necessary skills appropriate for their roles and responsibilities in accordance with the Code's requirements,
• and that cover and include:
• the Code and its requirements, and what needs to be done/avoided to enable us to remain compliant with the Code;
• dispute resolution and our policies in relation to that;
• privacy, and our policies in relation to that;
• fiduciary obligations and avoiding conflicts of interest;
• principles of health insurance law;
• principles of relevant customer protection and other relevant Laws;
• product knowledge and policy arrangements/renewals/cancellation;
• use of by us and distribution to customers of relevant product documentation;
• the need to keep and retain written or electronic records of all advice sought and given;
• what to do in the event of a claim; and
• the obligations that we have to disclose our accreditation under the Code, that we receive fees, commissions, incentives or other remuneration or benefits and from whom we receive them, and, unless we are corporate brokers, which insurers/funds we are representing.
• and in addition we must:
• have a system in place to ensure that all the foregoing happens;
• keep appropriate records of all such training and reviews and ensure that they are readily accessible including when archived;
• be satisfied that our personnel have the necessary skills appropriate for their roles and responsibilities in accordance with the Code's requirements; and
• ensure that persons who are not trained to give information or advice on health insurance (or a particular health insurance product) are instructed not to do so, and do not do so.

6. DISPUTE RESOLUTION

• We must:
• provide customers with easy access to our internal dispute resolution procedures;
• undertake internal dispute resolution in a fair and reasonable manner; and
• where internal dispute resolution procedures do not reach a satisfactory outcome for the customer, or if a customer wishes to deal directly with an external body, advise the customer of their right to take the issue to the insurer that may be the subject of the dispute or an external body, such as PHIO.
• We must have a documented internal process forming a basis for resolving disputes with customers. This process must be readily accessible by customers, without charge, and it must provide a fair and timely method of handling disputes, together with procedures for monitoring the efficient resolution of disputes.
• Where we receive from a customer a request, whether written or oral, for the resolution of a dispute or a request for a response in writing in relation to the dispute, we will promptly acknowledge the request and provide a substantive reply as soon as is practicable and usually within 21 days. If we are unable to give a substantive reply within those 21 days (for example because we need information from an insurer, we will advise the customer accordingly and make that substantive response as soon as it is practicable to do so.
• When we provide a substantive response, we will advise the customer of the external review mechanisms that are available if the response is not acceptable to the customer, including raising the complaint with the insurer, PHIO, or other relevant authority.

7. PRIVACY

• We must have a privacy policy that is readily accessible and that complies with the Privacy Act 1988 including the Australian Privacy Principles and all relevant State or Territory based privacy legislation and guidelines.
• Our privacy policy must amongst other things state that where we receive information about an individual's health, such information is considered to be sensitive information (a category of personal information) and describe our obligations in relation to such sensitive information.

8. REPORTING AND CHECKS

We must:

• immediately report to the Code Compliance Committee of PHIIA the details of any breach by us of the Code, as well as any determination that has (to our knowledge) been made by a government body that we have breached any Law including the Private Health Insurance Act (2007), Privacy Act (1988), Competition and Consumer Act (2010) or the State or Territory Fair Trading Acts, and any acknowledgement that we have given to such a body that we have committed such a breach;
• immediately report to the Code Compliance Committee of PHIIA if (to our knowledge) any officer of ours or any shareholder or ultimate shareholder of ours (unless we are a listed public company) is convicted of an offence that involves dishonesty and is punishable by imprisonment for at least 3 months, or an offence that is a contravention of the Corporations Act 2001 (Cth) that is punishable by imprisonment for a period greater than 12 months, or is convicted on indictment of any other offence that concerns the making, or participating in making, of decisions that affect the whole or a substantial part of our business, or concerns an act that has the capacity to affect significantly our financial standing, or is an undischarged bankrupt under the law of Australia, or has executed a personal insolvency agreement under Part X of the Bankruptcy Act 1966 (Cth), or otherwise becomes disqualified from managing corporations pursuant to Section 206B of the Corporations Act 2001 (Cth);
• obtain informed consent for and conduct a Nationally Coordinated Criminal History Check (NCCHC) (or equivalent international criminal records check where appropriate) in respect of our present and future officers, and our personnel who provide advice in relation to health insurance products and are engaged after 25 November, 2025, and if any criminal offence is disclosed take such action as a prudent employer should take to protect us and our reputation;
• obtain informed consent for and immediately report to the Code Compliance Committee of PHIIA any criminal offence that is disclosed under the preceding sub-paragraph that could damage the reputation of PHIIA or otherwise be prejudicial to its interests; and
• immediately report to the Code Compliance Committee of PHIIA any criminal offence that is committed by an officer or personnel of ours that otherwise comes to our knowledge that could damage the reputation of PHIIA or otherwise be prejudicial to its interests.

9. INTERPRETATION

In this Code, headings are for convenience only and do not affect interpretation, words of inclusion and examples are not to be construed in any limiting sense, and a reference to a statute or statutory provision includes a statutory modification or re-enactment of it or a statutory provision substituted for it, and each ordinance, by-law, regulation, rule and statutory instrument (however described) issued under it.

10. DEFINITIONS

In the Code the following terms mean as follows:

• "advice" means make representations about a product, including recommendations or statements of opinion intended to influence a decision in relation to a product;
• "agent" means an insurance intermediary who acts for one or more Private Health Insurers and who acts on behalf of the Private Health Insurer/s;
• "broker" means an insurance intermediary who is engaged by a customer and who acts on behalf of the customer who is the intermediary's principal;
• "customer" includes both current and prospective customers of PHIIA members who, whether alone or jointly with another, enters or proposes to enter into a private health insurance contract. For clarity, a customer can be a consumer, principal, organisation or client;
• "corporate broker" means an insurance intermediary who is a representative of an organisation wishing to offer health insurance products provided by a Private Health Insurer to their employees and acts on behalf of that organisation;
• "Board" means the board of directors of PHIIA;
• "dispute" means an unresolved complaint about a product or service of an Intermediary and for this purpose a complaint is an expression of dissatisfaction conveyed to an Intermediary together with a request that the complaint be remedied by the Intermediary;
• "Guidance" means the Australian Government's Guidance for AI Adoption;
• "Intermediary" means an agent or broker (including a corporate broker) or other intermediary offering services which assess and/or provide advice in a verbal, written or online form and/or promote private health insurance products provided or underwritten by a Private Health Insurer to consumers or organisations;
• "Law" includes the provisions of any statute, rule, regulation, proclamation, ordinance or by-law, present or future, and whether State, federal or otherwise;
• "personnel" means personnel who are engaged by an Intermediary to give advice;
• "PHIIA" means Private Health Insurance Intermediaries Association, an industry body that persons or organisations whose business is acting as an Intermediary in the health insurance market and who fulfil the requirements for membership may join;
• "PHIO" means the Private Health Insurance Ombudsman as appointed by the Federal Minister or his or her delegate with the powers vested in the Minister under the Private Health Insurance Act 2007;
• "Policy documentation" means private health insurance policy information in brochures, websites or other printed or electronic form;
• "Principles" means Australia's Artificial Intelligence Ethics Principles as published by the Department of Industry, Science and Resources, Australia;
• "Private Health Insurer" and "insurer" means a registered health benefits fund under the Private Health Insurance Act 2007;
• "product" means a contract of insurance arising out of or in connection with health insurance business (as defined in Division 121 of the Private Health Insurance Act 2007) between an insurer and a customer; and
• "proposal" means a document in any form prepared by an Intermediary offering a private health insurance product or products to a customer or to an organisation.