Document ID: chunk:federal_register_of_legislation:F2016C00607:schedule:1:p24
Version: federal_register_of_legislation:F2016C00607
Segment Type: schedule
Provision Reference: sch 1 (pt 24/32)
Character Range: 75766–79022

My Health Record or a record in a My Health Record, the code is not stored in the healthcare provider organisation's clinical information system. For example, using a record code places the organisation on the access list for the healthcare recipient's My Health Record, and information about this permitted access is stored by the System Operator.  It will not be necessary for a healthcare provider organisation to enter the record code each time access is needed to the same healthcare recipient's My Health Record, provided the organisation remains on the access list for the healthcare recipient's My Health Record.

Division 4  Security requirements for contracted service providers

46.                  Requirements for registration
For paragraph 48(a) of the Act, it is a requirement that a contracted service provider comply with the requirements specified in this Division in order to be eligible, and remain eligible, for registration under Division 3 of Part 3 of the Act.

47.                  Contracted service provider policies
     (1)     Contracted service providers must have a written policy that reasonably addresses the matters specified in subrule (4).
     (2)     Contracted service providers must communicate the policy mentioned in subrule (1), and ensure that the policy remains readily accessible, to all its employees.
     (3)     Contracted service providers must enforce the policy mentioned in subrule (1) in relation to all its employees.
     (4)     Without limiting the matters a contracted service provider's policy must reasonably address, the policy is, subject to subrule (5), to address the following:
           (a)                    the manner of authorising persons accessing the My Health Record system via or on behalf of the contracted service provider's linked healthcare provider organisation, including the manner of suspending and deactivating the user account of any authorised person:
                (i)                     who leaves the contracted service provider;
                (ii)                   whose security has been compromised; or
                (iii)                 whose duties no longer require them to access the My Health Record system on behalf of a linked healthcare provider organisation;
           (b)                    the training that will be provided to contracted service provider employees before they are authorised to  access the My Health Record system, including in relation to how to use the My Health Record system accurately and responsibly, the legal obligations on contracted service providers and individuals using the My Health Record system and the consequences of breaching those obligations;
           (c)                    the physical and information security measures that are to be established and adhered to by the contracted service provider, including the user account management measures that must be implemented under rule 49; and
           (d)                    mitigation strategies to ensure My Health Record system-related security risks can be promptly identified, acted upon and reported to the contracted service provider's management.
     (5)     If in the reasonable opinion of a contracted service provider, a requirement in