Document ID: chunk:federal_register_of_legislation:F2016C00607:schedule:1:p21
Version: federal_register_of_legislation:F2016C00607
Segment Type: schedule
Provision Reference: sch 1 (pt 21/32)
Character Range: 66374–69791

A contracted service provider must maintain interoperability with the My Health Record system in accordance with the System Operator's interoperability requirements.

40.                  Requirement to provide assistance
     (1)     At the System Operator's request, a contracted service provider must promptly provide all necessary assistance in relation to any inquiry, audit, review, assessment, investigation or complaint in connection with the My Health Record system conducted, handled, requested or facilitated by the System Operator.
     (2)     Subrule (1) does not apply unless the System Operator gives the contracted service provider reasonable notice of the assistance required.

Division 3  Security requirements for healthcare provider organisations

41.                  Requirements for registration
For paragraph 43(b) of the Act, it is a requirement that a healthcare provider organisation comply with the requirements specified in this Division in order to be eligible, and remain eligible, for registration under Division 2 of Part 3 of the Act.

42.                  Healthcare provider organisation policies
     (1)     Healthcare provider organisations must have a written policy that reasonably addresses the matters specified in subrule (4).
     (2)     Healthcare provider organisations must communicate the policy mentioned in subrule (1), and ensure that the policy remains readily accessible, to all its employees and to any healthcare providers to whom the organisation supplies services under contract.
           Example: A healthcare provider organisation that supplies information technology services to individual healthcare providers, via which those providers access the My Health Record system, must communicate the policy to the providers.
     (3)     Healthcare provider organisations must enforce the policy mentioned in subrule (1) in relation to all its employees and any healthcare providers to whom the organisation supplies services under contract.
     (4)     Without limiting the matters a healthcare provider organisation's policy must reasonably address, the policy is, subject to subrule (5), to address the following:
           (a)                    the manner of authorising persons accessing the My Health Record system via or on behalf of the healthcare provider organisation, including the manner of suspending and deactivating the user account of any authorised person:
                (i)                     who leaves the healthcare provider organisation;
                (ii)                   whose security has been compromised; or
                (iii)                 whose duties no longer require them to access the My Health Record system;
           (b)                    the training that will be provided to healthcare provider organisation employees before they are authorised to  access the My Health Record system, including in relation to how to use the My Health Record system accurately and responsibly, the legal obligations on healthcare provider organisations and individuals using the My Health Record system and the consequences of breaching those obligations;
           (c)                    the process for identifying a person who requests access to a healthcare recipient's My Health Record and communicating the person's identity to the System Operator so that the healthcare provider organisation is able to meet its