Document ID: chunk:federal_register_of_legislation:F2016C00607:schedule:1:p27
Version: federal_register_of_legislation:F2016C00607
Segment Type: schedule
Provision Reference: sch 1 (pt 27/32)
Character Range: 84809–88243

and the operator officer.

54.                  Operator technical and after-hours contacts

     An operator must:
           (a)                    provide  a point of contact and technical support for the operator during ordinary business hours Monday to Friday, other than public holidays; and
           (b)                    at all other times provide at least two current points of contact who have the authority and are able to resolve, or coordinate the resolution of, any technical, security or operational issues affecting the operator.

55.                  Requirement to notify the System Operator of certain things
     (1)     This rule applies if an operator:
           (a)                    becomes aware, or suspects, that:
           (i)                     there is a non-clinical, My Health Record system-related error in a record that has been accessed via, or downloaded from, the My Health Record system;
           (ii)                   the operator has given the System Operator, or uploaded to the My Health Record system, inaccurate provenance information;
           (b)                    undergoes a material change;
           (c)                    has appointed or cancelled the appointment of an operator officer;
           (d)                    changes, or becomes aware of a change in, the professional or business details of its currently appointed operator officer.
     (2)     An operator must:
           (a)                    give the System Operator, in writing, details of the event or circumstances; and
           (b)                    do so within two business days of become aware or suspecting the event or circumstance.

56.                  Requirement to maintain interoperability
     An operator must maintain interoperability with the My Health Record system in accordance with the System Operator's interoperability requirements.

57.                  Requirement to provide assistance
     (1)     At the System Operator's request, an operator must promptly provide all necessary assistance in relation to any inquiry, audit, review, assessment, investigation or complaint in connection with the My Health Record system conducted, handled, requested or facilitated by the System Operator.
     (2)     Subrule (1) does not apply unless the System Operator gives the operator reasonable notice of the assistance required.

Division 2 Security requirements for operators

58.                  Requirements for registration
For paragraph 48(a) of the Act, it is a requirement that an operator comply with the requirements specified in this Division in order to be eligible, and remain eligible, for registration under Division 3 of Part 3 of the Act.

59.                  Operator policies
     (1)     Operators must have a written policy that reasonably addresses the matters specified in subrule (4).
     (2)      Operators must communicate the policy mentioned in subrule (1), and ensure that the policy remains readily accessible, to all its employees.
     (3)     Operators must enforce the policy mentioned in subrule (1) in relation to all their employees.
     (4)     Without limiting the matters an operator's policy must reasonably address, the policy is, subject to subrule (5), to address the following:
           (a)                    the manner of authorising persons accessing the My Health Record system via or on behalf of the operator, including