Document ID: chunk:federal_register_of_legislation:F2016C00607:schedule:1:p9
Version: federal_register_of_legislation:F2016C00607
Segment Type: schedule
Provision Reference: sch 1 (pt 9/32)
Character Range: 30244–33549

organisation may, but is not required to, be part of the same legal entity as its seed organisation or be a related body corporate of its seed organisation.  There can be one or more healthcare provider organisations within a single legal entity.

10.                  Principles for assigning access flags
     (1)     Subject to subrules (3) to (5), access flags must be set and maintained for registered healthcare provider organisations in a network in a manner which balances:
           (a)                    reasonable healthcare recipient expectations about the sharing of health information as part of providing healthcare to the healthcare recipient; and
           (b)                    arrangements within the organisation for access to health information collected by the organisation.
     (2)     A registered healthcare provider organisation that is a seed organisation must ensure that access flags assigned within its network are regularly reviewed and adjusted as necessary so that their assignment remains consistent with the principles in subrule (1).
     (3)     If the System Operator reasonably considers that access flags have not been assigned within a network, have been assigned in a manner that is inconsistent with the principles in subrule (1) or have been assigned in a manner that is otherwise inappropriate, the System Operator:
           (a)                    must consult with, and consider the views (if any) of, the seed organisation of the network; and
           (b)                    following consideration under paragraph (3)(a), may by written notice request the seed organisation to make reasonable changes to  the access flags within the organisation's network, including by adding, omitting or reassigning access flags.
     (4)     A notice from the System Operator under paragraph (3)(b) must be consistent with the principles in subrule (1).
     (5)     A registered healthcare provider organisation must not unreasonably refuse to comply with a request from the System Operator under paragraph (3)(b).
           Note: Rule 28 requires seed organisations to structure their network in a manner that allows access flags to be assigned in accordance with the principles in this rule.

Division 5 Access control mechanisms relating to suspension or cancellation of access to a healthcare recipient's My Health Record

11.                  Automatic cancellation when a healthcare recipient takes control
     (1)     The System Operator must automatically cancel access to a healthcare recipient's My Health Record for all the healthcare recipient's authorised representatives and nominated representatives upon the earlier of the following:
           (a)                    the healthcare recipient taking control of his or her My Health Record;
           (b)                    the healthcare recipient reaching the age of 18.
     (2)     A healthcare recipient takes control of his or her My Health Record if:
           (a)                    the System Operator is no longer satisfied that the healthcare recipient has an authorised representative under section 6 of the Act; and
           (b)                    the healthcare recipient has:
                (i)                     verified his or her identity with the System Operator; and