Document ID: chunk:federal_register_of_legislation:F2016C00607:schedule:1:p29
Version: federal_register_of_legislation:F2016C00607
Segment Type: schedule
Provision Reference: sch 1 (pt 29/32)
Character Range: 91145–94366

since the last review; and
           (d)                    a record of each iteration of the policy mentioned in subrule (1) is retained in accordance with the record keeping obligations (if any) applicable to the operator.

60.                  Policy to be provided to the System Operator on request
     (1)     The System Operator may request in writing that an operator give it a copy of the policy mentioned in subrule 59(1).
     (2)     An operator must comply with a request from the System Operator under this rule within 7 days of receiving the request.
     (3)     The System Operator may request an operator's current policy or the policy that was in force on a specified date.

61.                  User account management within operators
Operators must ensure that their information technology systems, which are used to access the My Health Record system, employ reasonable user account management practices including:
           (a)                    restricting access to those persons who require access as part of their duties;
           (b)                    uniquely identifying individuals using the operator's information technology systems, and having that unique identity protected by a password or equivalent protection mechanism;
           (c)                    having password and/or other access mechanisms that are sufficiently secure and robust given the security and privacy risks associated with unauthorised access to the My Health Record system;
           (d)                    ensuring that the user accounts of persons no longer authorised to access the My Health Record system prevent access to the My Health Record system; and
           (e)                    suspending a user account that enables access to the My Health Record system as soon as practicable after becoming aware that the account or its password or access mechanism has been compromised.

Division 3 Security requirements for portal operators

62.                  Requirements for registration
For paragraph 48(a) of the Act, it is a requirement that a portal operator comply with the requirements specified in this Division in order to be eligible, and remain eligible, for registration under Division 3 of Part 3 of the Act.

63.                  Retention of record codes and document codes by portal operators
     (1)     Portal operators must ensure that people using their information technology systems to access the My Health Record system do not record, store or retain a copy of a healthcare recipient's record code or document code for the purposes of accessing the healthcare recipient's My Health Record, or a record in the healthcare recipient's My Health Record, in the future.
     (2)     Subrule (1) does not apply to portal operators to the extent they operate a portal that provides access to the My Health Record system solely to healthcare recipients.

            Schedule 1—Application provisions

1.                      Definitions
In this Schedule:
the amending Act means the Health Legislation Amendment (eHealth) Act 2015.
the Rule means the My Health Records Rule 2016.

2.                      Repeal
                   Paragraph 3(b)