### Electronic Health Record Sharing System Ordinance 《電子健康紀錄互通系統條例》

23. Withdrawal of healthcare provider’s registration
(1) A registered healthcare provider may request that a registration of the healthcare provider be withdrawn from the System.
(2) A request must be made to the Commissioner in the form and manner specified by the Commissioner.
(3) After granting a request, the Commissioner must notify the healthcare provider in writing of the date on which the request is granted. The withdrawal takes effect on that date.
(4) If a sharing consent is given to the healthcare provider, the sharing consent ceases to have effect once the withdrawal takes effect.

24. Suspension of healthcare provider’s registration
(1) The Commissioner may suspend a registration of a registered healthcare provider for a period of not more than 28 days if the Commissioner reasonably suspects that—
(a) the healthcare provider contravenes—
(i) a provision of this Ordinance;
(ii) a provision of a code of practice issued under section 52; or
(iii) a condition for the registration;
(b) the healthcare provider no longer provides healthcare at the service location to which the registration relates;
(c) the healthcare provider no longer complies with—
(i) the requirements specified by the Commissioner for connecting the healthcare provider to the System; or
(ii) the system requirements on data sharing specified by the Commissioner;
(d) the service or business nature of the healthcare provider is no longer consistent with the purpose of the use of data and information specified in section 28; or
(e) the registration may impair the security or compromise the integrity of the System.
(2) Despite subsection (1), if the Commissioner considers it appropriate, the Commissioner may extend the period of suspension under that subsection for a further period of not more than 28 days by notice in writing to the healthcare provider.
(3) After suspending a registration, the Commissioner must notify the healthcare provider in writing of—
(a) the suspension;
(b) the date on which the suspension takes effect; and
(c) the reasons for the suspension.
(4) When the registration of a healthcare provider (including a Government department) is suspended—
(a) new data or information of a registered healthcare recipient may still be provided by the healthcare provider to the System; but
(b) the electronic health record of a registered healthcare recipient must not be made available to the healthcare provider through the System.
(5) After the Commissioner is satisfied that there are no longer any grounds for suspending the healthcare provider’s registration, the Commissioner must notify the healthcare provider in writing of—
(a) the Commissioner’s decision; and
(b) the date on which the suspension ceases to take effect.

### Electronic Health Record Sharing System Ordinance 《電子健康紀錄互通系統條例》

25. Cancellation of healthcare provider’s registration
(1) The Commissioner may cancel a registration of a registered healthcare provider if the Commissioner is satisfied that—
(a) the healthcare provider contravenes—
(i) a provision of this Ordinance;
(ii) a provision of a code of practice issued under section 52; or
(iii) a condition for the registration;
(b) the healthcare provider no longer provides healthcare at the service location to which the registration relates;
(c) the healthcare provider no longer complies with—
(i) the requirements specified by the Commissioner for connecting the healthcare provider to the System; or
(ii) the system requirements on data sharing specified by the Commissioner;
(d) the service or business nature of the healthcare provider is no longer consistent with the purpose of the use of data and information specified in section 28; or
(e) the registration may impair the security or compromise the integrity of the System.
(2) The Commissioner must notify the healthcare provider in writing of—
(a) the date on which the cancellation is to take effect; and
(b) the reasons for the cancellation.
(3) The healthcare provider may, within 14 days after the date of the notice (or such longer period as the Commissioner may allow), make representations to the Commissioner to object to the cancellation in the manner specified in the notice.
(4) The Commissioner must not cancel the registration unless—
(a) the healthcare provider has not made any representations under subsection (3); or
(b) the Commissioner has considered the representations and informed the healthcare provider of the decision of cancellation.
(5) If a sharing consent is given to the healthcare provider, the sharing consent ceases to have effect once the cancellation takes effect.

26. Supplementary provision to sections 24, 25 and 51
A reference in sections 24, 25 and 51 to the service location to which a registration relates includes each of the service locations covered by a single registration of a healthcare provider under section 19(3)(a).

27. General rule
The data and information contained in an electronic health record may not be used except as provided in section 28, 29, 30 or 31.

28. Use for improvement of healthcare
The data and information contained in the electronic health record of a registered healthcare recipient may be used for improving the efficiency, quality, continuity or integration of the healthcare provided, or to be provided, to the healthcare recipient.

29. Use for research and statistics
(Not yet in operation)(1) The data and information contained in an electronic health record may be used for carrying out research, or preparing statistics, that are relevant to public health or public safety.
(2) However, the results of the research or the resulting statistics must not be made available in a form that would enable a healthcare recipient to be identified.

### Electronic Health Record Sharing System Ordinance 《電子健康紀錄互通系統條例》

30. Use for disease control and surveillance etc.
(1) The data and information contained in an electronic health record may be used by a person specified in subsection (2)—
(a) for the prevention or control of disease; or
(b) for the enhancement of disease surveillance or investigation.
(2) The person is—
(a) the Department of Health;
(b) the Hospital Authority; or
(c) a health officer as defined by section 2 of the Prevention and Control of Disease Ordinance (Cap. 599).

31. Use permitted by or under any other law
The data and information contained in an electronic health record may be used as permitted by, or under, any other law.

32. Application to Secretary for use for research or statistics purpose
(Not yet in operation)(1) A person may apply to the Secretary for using identifiable data of a healthcare recipient contained in an electronic health record for carrying out research, or preparing statistics, that are relevant to public health or public safety.
(2) An application—
(a) must be made in the form and manner specified by the Commissioner; and
(b) must be accompanied by a proposal specified in subsection (3).
(3) The proposal is a written proposal setting out—
(a) the nature and objectives in respect of the research or statistics;
(b) the public or scientific benefit of the research or statistics that the applicant anticipates; and
(c) any other information relating to the research or statistics as specified by the Commissioner.

33. Recommendation by Board
(Not yet in operation)(1) The Secretary may refer an application made under section 32(1) to the Board for a recommendation on whether the application should be approved or refused.
(2) When making a recommendation, the Board must have regard to—
(a) whether it is ethical to carry out the research or prepare the statistics;
(b) whether the objectives in respect of the research or statistics are only achievable by using the identifiable data;
(c) whether it is practicable to obtain the consent of the healthcare recipient concerned for the use;
(d) whether, at the time the research is carried out or the statistics are prepared, adequate safeguards are in place to preserve the confidentiality of the identifiable data;
(e) the weighing of—
(i) the public interest in carrying out the research or preparing the statistics; and
(ii) the public interest in protecting the privacy of the healthcare recipient concerned; and
(f) the resource implication in providing the identifiable data.
(3) If the Board recommends that the Secretary approves the application, the Board may also make recommendations on the conditions of the approval.