Document ID: chunk:federal_register_of_legislation:F2020L01072:reg:12
Version: federal_register_of_legislation:F2020L01072
Segment Type: reg
Provision Reference: reg 12
Character Range: 13374–15649

12  Identity of individual making request
 (1) This section is made for the purposes of subsections 20(4) and (5), and 25D(4) and (5), of the Act.

Information identifying individual making a request
 (2) If a healthcare provider organisation requests the service operator to disclose a healthcare identifier to the organisation, the organisation must, if it is reasonably practicable to do so, give the service operator enough information to ensure the service operator can identify, by name, the individual making the request on behalf of the organisation without having to seek further information.
Note: For example, the information may be given as part of the data transmitted to the service operator from a healthcare provider organisation's practice management software.

Keeping retrievable records
 (3) If it is not reasonably practicable to give the service operator the information mentioned in subsection (2) at the time the request is made, the healthcare provider organisation must:
 (a) keep a record of the identity of the individual who accessed the healthcare identifier for the organisation from the service operator; and
 (b) keep that record for the retrieval period for that individual; and
 (c) if, during the retrieval period for that individual, the service operator gives the organisation written notice requiring the organisation to identify the individual—identify the individual to the service operator within the period of 14 days after the notice is given.
 (4) Each of the following is a retrieval period for an individual:
 (a) any period during which the individual is authorised by the healthcare provider organisation to access healthcare identifiers on the organisation's behalf;
 (b) if the individual ceases to be authorised by the healthcare provider organisation to access healthcare identifiers on the organisation's behalf—the period of 7 years starting on the day after the person ceased to be authorised.
 (5) A healthcare provider organisation is liable to a civil penalty if the organisation contravenes subsection (2) or (3).
Civil penalty: 50 penalty units.

Part 4—Application, saving and transitional provisions

Division 1—Application, saving and transitional provisions in relation to the commencement of this instrument