Identity theft. Medicare cards are used as a form of official identification by government here and it's photoless. Make a convincing fake with coherent details and I'm sure it'd be a handy stepping stone.
Granted, it's local to AU which makes it small fry on a worldwide data black market scale.
Advertising? "Buy medicine X now because it's much better than medicine Y for your condition".
Also, insurance companies like to know what you have. If they secretly have your personal healthcare data, they could do a more focused 'sampling'.
Blackmail. Some people may not want their health history revealed (say you're having an abortion or being treated for substance abuse). High profile individuals in particular.
Free or subsidised healthcare. If you're an overseas resident living in Australia and can produce a valid medicare number you can get access to a fairly comprehensive range of medical services under somebody else's name. It would be very rare for any medical facility to request ID beyond a medicare card. Actually happens fairly frequently with visiting overseas relatives borrowing family member's medicare cards.
The blast radius is somewhat limited by the 100-point identity check.
Medicare cards are only worth 25 points in the 100-point check. You must present one of the "primary" 70-point documents: birth certificate, birth card, citizenship certificate, current or recently-expired passport, diplomatic or refugee papers.
Then you will need another form of identification, on top of the primary and medicare, to pass 100 points.
I suppose if you have a drivers license + medicare card you could start applying for things like passports or loans. Perhaps you could get a license from someone by selling a second hand car and asking them to hand over a license while they take it for a test drive. It could also be used for blackmail I suppose if you've used a medicare for some sort of service that you want to keep private.
I think you're right though. All the people that make the most money from having health data could just lobby governments for access or just ask their customers for it.
