Document ID: chunk:federal_register_of_legislation:F2016L00360:reg:14:p3
Version: federal_register_of_legislation:F2016L00360
Segment Type: reg
Provision Reference: reg 14 (pt 3/16)
Character Range: 6816–9765

that information may be able to be called up and viewed by the healthcare provider organisation, although its location remains with the relevant public or private sector body repository. For example, a healthcare provider organisation can view a pathology report for a healthcare recipient that is located at a particular pathology lab, if that pathology lab is a registered repository operator.
4.6  The System Operator is responsible for the operation of the My Health Record system.

  Regulation of health information
4.7  The My Health Records Act and regulations and rules made under that Act regulate the collection, use and disclosure of health information contained in a healthcare recipient's My Health Record.
4.8  In addition to the requirements in the My Health Records Act, the System Operator is subject to the Privacy Act.
4.9  In addition to the requirements in the My Health Records Act, other participants in the My Health Record system are subject to the Privacy Act and relevant State and Territory privacy laws.

Functions of the Information Commissioner in relation to My Health Record System
4.10  The Information Commissioner's functions in the My Health Record system include investigating alleged contraventions of the My Health Records Act and seeking to address contraventions as appropriate through conciliation, education and enforcement action.
4.11  Alleged contraventions of the My Health Records Act may be brought to the Information Commissioner's attention by a range of avenues including:
           a)      a complaint by an individual or other notification from an individual or a participant in the My Health Record system;
           b)     as the result of a data breach notification provided in accordance with section 75 of the My Health Records Act;
           c)      as a referral from another regulator in certain circumstances;
           d)     as a result of media reporting;
           e)      as a result of information provided by an informant;
           f)       as a result of information provided by a law enforcement agency;
           g)     as a result of information received from the My Health Record System Operator;
           h)     during the course of an assessment or investigation conducted by the Information Commissioner.

  The role of these guidelines
4.12   Section 111 of the My Health Records Act requires the Information Commissioner to formulate, and have regard to, guidelines regarding the exercise of the Information Commissioner's powers under the My Health Records Act or a power under another Act that is related to such a power. The Privacy Act is a related Act.
4.13  These guidelines are made under section 111 of the My Health Records Act. These guidelines set out the Information Commissioner's general approach to the exercise of enforcement powers and investigative powers under both the My Health Records Act and the Privacy Act, in relation to the My