Document ID: chunk:federal_register_of_legislation:F2016C00607:schedule:1:p8
Version: federal_register_of_legislation:F2016C00607
Segment Type: schedule
Provision Reference: sch 1 (pt 8/32)
Character Range: 27263–30476

necessary to lessen or prevent a serious threat to public health or public safety for the purposes of subsection 64(2) of the Act.
     (2)     Where access is authorised under subsection 64(2) of the Act, the access control mechanisms:

           (a)                    must allow access to a healthcare recipient's My Health Record regardless of whether a healthcare recipient has set up a record code;
           (b)                    must allow access to all records in a healthcare recipient's My Health Record regardless of whether a healthcare recipient has set up a document code; and
           (c)                    must not permit access to records that have been effectively removed.
           Note 1: Healthcare recipient-only notes are not available under subsection 64(2) of the Act― see subsection 64(3) of the Act.
           Note 2: The extent of access by registered healthcare provider organisations under subsection 64(2) of the Act depends on how access flags have been assigned within the healthcare provider organisation's network ― see rules 9 and 10.

Division 4 Access flags

9.                      Access control mechanisms must include use of access flags
For the purposes of paragraphs 15(b) and (c) and subsection 109(6) of the Act, the System Operator must establish and maintain access control mechanisms that comply with the following requirements:
           (a)                    access flags must be used to determine which additional registered healthcare provider organisations (if any) are to be:
                (i)                     added to the access list for a healthcare recipient's My Health Record where a registered healthcare provider organisation accesses the healthcare recipient's My Health Record in accordance with default access controls, advanced access controls or in the case of a serious threat to an individual's life, health or safety; and
                (ii)                   omitted from the access list for a healthcare recipient's My Health Record where a healthcare provider organisation ceases to be on the access list;
           (b)                    access flags must be set and maintained for a registered healthcare provider organisation in the context of the organisation's network;
           (c)                    the responsible officer and/or the organisation maintenance officer of a registered healthcare provider organisation that is the seed organisation within a network must be responsible for setting and maintaining the access flags for the registered healthcare provider organisations within the seed organisation's network; and
           Principles for setting and maintaining access flags
           (d)                    access flags must be set and maintained in accordance with the principles in rule 10.
           Note: A network consists of a seed organisation and one or more network organisations― see subsection 9A(4) of the Healthcare Identifiers Act 2010.  A network organisation may, but is not required to, be part of the same legal entity as its seed organisation or be a related body corporate of its seed organisation.  There can be one or more healthcare provider organisations within a single