Document ID: chunk:federal_register_of_legislation:F2016C00607:schedule:1:p5
Version: federal_register_of_legislation:F2016C00607
Segment Type: schedule
Provision Reference: sch 1 (pt 5/32)
Character Range: 18346–21941

recipient; or
                     (B)                  the System Operator at the request of the healthcare recipient; or
                (ii)                   the organisation is already on the access list for the healthcare recipient's My Health Record;
           (b)                    if a registered healthcare recipient wishes, prevent registered healthcare provider organisations' clinical information systems automatically checking and displaying whether the healthcare recipient has a My Health Record;
           (c)                    permit registered healthcare recipients to control access to individual records in their My Health Record:
                (i)                     by adjusting the advanced access controls for their My Health Record to only permit specified registered healthcare provider organisations on the access list for the healthcare recipient's My Health Record to access specified records; or
                (ii)      using a document code,
           in accordance with subrule (2); and
           (d)                    permit registered healthcare recipients to be alerted by means of an electronic communication when their My Health Record is accessed by a third party.
     (2)     For the purposes of paragraph (1)(c), the System Operator must ensure that:
           (a)                    registered healthcare recipients are able to prevent access to a record in their My Health Record, other than shared health summaries, healthcare recipient-entered health summaries and advance care planning information, unless:
                (i)                     the registered healthcare provider organisation has been given a document code in relation to the record by:
                     (A)                  the healthcare recipient; or
                     (B)                  the System Operator at the request of the healthcare recipient; or
                (ii)                   the healthcare recipient has set the advanced access controls for their My Health Record to permit the registered healthcare provider organisation, which is on the access list for the healthcare recipient's My Health Record, to access the record;
           (b)                    where a healthcare recipient has restricted access to a record using the access controls in paragraph (1)(c):
                (i)                     the record will still be accessible to the registered healthcare provider organisation that uploaded the record to the My Health Record system, without the need to use the healthcare recipient's document code;
                (ii)                   the record may still be accessed by registered healthcare provider organisations and other participants in the My Health Record system in the case of a serious threat in accordance with rules 7 and 8;
                (iii)                 healthcare recipients are able to choose whether their nominated representatives who do not have the ability to set and maintain access controls are able to access records to which a document code has been applied;
                (iv)                 registered healthcare provider organisations involved in the care of the healthcare recipient are not able to determine that records to which access has been restricted using the access controls in paragraph 1(c) exist solely by viewing the healthcare recipient's My Health Record unless:
                     (A)                  the organisation has been given a document code in accordance with paragraph (2)(a)(i);
                     (B)                  the healthcare recipient has