Document ID: chunk:federal_register_of_legislation:F2016C00607:schedule:1:p22
Version: federal_register_of_legislation:F2016C00607
Segment Type: schedule
Provision Reference: sch 1 (pt 22/32)
Character Range: 69499–73133

breaching those obligations;
           (c)                    the process for identifying a person who requests access to a healthcare recipient's My Health Record and communicating the person's identity to the System Operator so that the healthcare provider organisation is able to meet its obligations under section 74 of the Act;
           (d)                    the physical and information security measures that are to be established and adhered to by the healthcare provider organisation and people accessing the My Health Record system via or on behalf of the healthcare provider organisation, including the user account management measures that must be implemented under rule 44;
           (e)                    mitigation strategies to ensure My Health Record system-related security risks can be promptly identified, acted upon and reported to the healthcare provider organisation's management; and
           (f)                     where the healthcare provider organisation provides assisted registration:
                (i)                     the manner of authorising employees of the organisation to provide assisted registration;
                (ii)                   the training that will be provided before a person is authorised to provide assisted registration;
                (iii)                 the manner of confirming a healthcare recipient's consent for the purposes of rule 9 of the My Health Records (Assisted Registration) Rule 2015; and
                (iv)                 the process and criteria for identifying a healthcare recipient for the purposes of assisted registration.
     (5)     If in the reasonable opinion of a healthcare provider organisation, a requirement in subrule (4) is not applicable to the organisation due to the limited size of the organisation, the organisation's policy need not address that requirement.
     (6)     Healthcare provider organisations must ensure that:
           (a)                    the policy mentioned in subrule (1) is:
                (i)                     drafted in such a manner that the organisation's performance can be audited against the policy to determine if the organisation has complied with the policy; and
                (ii)                   kept up-to-date;
           (b)                    each iteration of the policy contains a unique version number and the date when that iteration came into effect;
           (c)                    without limiting paragraph (6)(a)(ii) – the policy is reviewed at least annually and when any material new or changed risks are identified.  The review must include consideration of:
                (i)                     factors that might result in:
                     (A)                  unauthorised access to the My Health Record system using the healthcare provider organisation's information systems;
                     (B)                  the misuse or unauthorised disclosure of information from a healthcare recipient's My Health Record by persons authorised to access the My Health Record system via or on behalf of the healthcare provider organisation; and
                     (C)                  the accidental disclosure of information contained in a healthcare recipient's My Health Record;
                (ii)                   any changes to the My Health Record system that may affect the healthcare provider organisation; and
                (iii)                 any relevant legal or regulatory changes that have occurred since the last review; and
           (d)                    a record of each iteration of the policy mentioned in subrule (1)