Document ID: chunk:federal_register_of_legislation:F2016C00607:schedule:1:p26
Version: federal_register_of_legislation:F2016C00607
Segment Type: schedule
Provision Reference: sch 1 (pt 26/32)
Character Range: 81813–85147

organisations, employ reasonable user account management practices including:
           (a)                    restricting access to those persons who require access as part of their duties;
           (b)                    uniquely identifying individuals using the contracted service provider's information technology systems, and having that unique identity protected by a password or equivalent protection mechanism;
           (c)                    having password and/or other access mechanisms that are sufficiently secure and robust given the security and privacy risks associated with unauthorised access to the My Health Record system;
           (d)                    ensuring that the user accounts of persons no longer authorised to access the My Health Record system via or on behalf of linked a healthcare provider organisation prevent access to the My Health Record system; and
           (e)                    suspending a user account that enables access to the My Health Record system as soon as practicable after becoming aware that the account or its password or access mechanism has been compromised.

50.                  Retention of record codes and document codes
Contracted service providers must ensure that people using their information technology systems to access the My Health Record system via or on behalf of a linked healthcare provider organisation do not record, store or retain a copy of a healthcare recipient's record code or document code for the purposes of accessing the healthcare recipient's My Health Record, or a record in the healthcare recipient's My Health Record, in the future.

          Part 6               Participation requirements for operators

Division 1 General requirements

51.                  Application of this Division
This Division applies to an operator.

52.                  Requirements for registration
For paragraph 48(a) of the Act, it is a requirement that an operator complies with the requirements specified in this Division in order to be eligible, and remain eligible, for registration under Division 3 of Part 3 of the Act.

53.                  Appointment of operator officer
     (1)     An operator must appoint an operator officer who is employed by the operator.
     (2)     The operator must have at least one, but no more than three, operator officers at all times.
     (3)     The operator must ensure that its operator officer appointed under subrule (1) carries out the duties prescribed under subrule (4).
     (4)     A person is the operator officer for an operator if the duties of the person include the following:
           (a)                    receiving communications from the System Operator about the operation of the My Health Record system;
           (b)                    acting as a liaison between the System Operator and the operator; and
           (c)                    maintaining the System Operator's records of the professional and business details of the operator and the operator officer.

54.                  Operator technical and after-hours contacts

     An operator must:
           (a)                    provide  a point of contact and technical support for the operator during ordinary business hours Monday to Friday, other than public holidays; and
           (b)                    at all