Document ID: chunk:federal_register_of_legislation:F2016C00607:schedule:1:p28
Version: federal_register_of_legislation:F2016C00607
Segment Type: schedule
Provision Reference: sch 1 (pt 28/32)
Character Range: 87962–91421

limiting the matters an operator's policy must reasonably address, the policy is, subject to subrule (5), to address the following:
           (a)                    the manner of authorising persons accessing the My Health Record system via or on behalf of the operator, including the manner of suspending and deactivating the user account of any authorised person:
                (i)                     who leaves the operator;
                (ii)                   whose security has been compromised; or
                (iii)                 whose duties no longer require them to access the My Health Record system;
           (b)                    the training that will be provided to operator employees before they are authorised to  access the My Health Record system, including in relation to how to use the My Health Record system accurately and responsibly, the legal obligations on operators and individuals using the My Health Record system and the consequences of breaching those obligations;
           (c)                    the physical and information security measures that are to be established and adhered to by the operator, including the user account management measures that must be implemented under rule 61; and
           (d)                    mitigation strategies to ensure My Health Record system-related security risks can be promptly identified, acted upon and reported to the operator's management.
     (5)     If in the reasonable opinion of an operator, a requirement in subrule (4) is not applicable to the operator due to the limited size of the operator, the operator's policy need not address that requirement.
     (6)     Operators must ensure that:
           (a)                    the policy mentioned in subrule (1) is:
                (i)                     drafted in such a manner that the operator's performance can be audited against the policy to determine if the operator has complied with the policy; and
                (ii)                   kept up-to-date;
           (b)                    each iteration of the policy contains a unique version number and the date when that iteration came into effect;
           (c)                    without limiting paragraph (6)(a)(ii) – the policy is reviewed at least annually and when any material new or changed risks are identified.  The review must include consideration of:
                (i)                     factors that might result in:
                     (A)                  unauthorised access to the My Health Record system using the operator's information systems;
                     (B)                  the misuse or unauthorised disclosure of information from a healthcare recipient's My Health Record by persons authorised to access the My Health Record system via or on behalf of an operator; and
                     (C)                  the accidental disclosure of information contained in a healthcare recipient's My Health Record;
                (ii)                   any changes to the My Health Record system that may affect the operator; and
                (iii)                 any relevant legal or regulatory changes that have occurred since the last review; and
           (d)                    a record of each iteration of the policy mentioned in subrule (1) is retained in accordance with the record keeping obligations (if any) applicable to the operator.

60.                  Policy to be provided to the