Document ID: chunk:federal_register_of_legislation:F2015L01048:body:0:p4
Version: federal_register_of_legislation:F2015L01048
Segment Type: other
Provision Reference: 
Character Range: 8923–12194

11 inclusive; and

       (b)          any risk controls that are developed and implemented as a result of a risk assessment mentioned in paragraph 16.

Monitoring arrangements

    18.         A private health insurer must monitor its outsourcing arrangements.

    19.         The monitoring must include:

       (a)          regular contact with the outsourced service provider, under the outsourcing arrangement; and

       (b)          monitoring of the outsourced service provider's performance against agreed service levels, set out in the outsourcing arrangement.

APRA access to information held by outsourced service providers

    20.         An outsourcing arrangement must include a requirement that the outsourced service provider allow APRA access to documentation and information related to the outsourcing arrangement with the private health insurer. It must also include a requirement allowing APRA to access the premises of the outsourced service provider in relation to the outsourcing arrangement if APRA considers this necessary in its role as prudential supervisor.

    21.         APRA may request an outsourced service provider to allow APRA access to any documentation and information, or premises of the service provider, related to the outsourcing arrangement with the private health insurer.

    22.         APRA must not request information from an outsourced service provider under paragraph 21 unless:

       (a)          APRA has first made the same request of the private health insurer; and

       (b)          the private health insurer has not provided the information that APRA requires.

    23.         The private health insurer must take all reasonable steps to ensure that an outsourced service provider does not disclose to any other person that APRA has sought access to the service provider's information or premises, except to the extent necessary to conduct business with a private health insurer that is an existing client of the service provider.

Offshore outsourcing

    24.         A private health insurer must, before entering into an outsourcing arrangement to be performed outside of Australia:

       (a)          notify APRA, in writing, of the proposed outsourcing arrangement; and

       (b)          provide APRA with the risk assessment and risk controls developed under paragraphs 16 and 17.

    25.         If APRA is not satisfied that the risk management for a proposed outsourcing arrangement mentioned in paragraph 24 is adequate, APRA may require the private health insurer to make other arrangements for the performance of the activity that is the subject of the proposed outsourcing arrangement.

Disclosure requirements

    26.         A private health insurer must, within 28 days, notify APRA, in writing, if the private health insurer enters into an outsourcing arrangement.

    27.         If an outsourcing arrangement is terminated, the private health insurer must, within 28 days of the outsourcing arrangement being terminated:

       (a)          notify APRA, in writing, that the outsourcing arrangement has been terminated; and

       (b)          give APRA, in writing, details about the transition arrangements and future strategies for carrying out the activity that was