Document ID: chunk:federal_register_of_legislation:F2016C00607:schedule:1:p25
Version: federal_register_of_legislation:F2016C00607
Segment Type: schedule
Provision Reference: sch 1 (pt 25/32)
Character Range: 78712–82185

and
           (d)                    mitigation strategies to ensure My Health Record system-related security risks can be promptly identified, acted upon and reported to the contracted service provider's management.
     (5)     If in the reasonable opinion of a contracted service provider, a requirement in subrule (4) is not applicable to the provider due to the limited size of the provider, the provider's policy need not address that requirement.
     (6)     Contracted service providers must ensure that:
           (a)                    the policy mentioned in subrule (1) is:
                (i)                     drafted in such a manner that the provider's performance can be audited against the policy to determine if the provider has complied with the policy; and
                (ii)                   kept up-to-date;
           (b)                    each iteration of the policy contains a unique version number and the date when that iteration came into effect;
           (c)                    without limiting paragraph (6)(a)(ii) – the policy is reviewed at least annually and when any material new or changed risks are identified.  The review must include consideration of:
                (i)                     factors that might result in:
                     (A)                  unauthorised access to the My Health Record system using the contracted service provider's information systems;
                     (B)                  the misuse or unauthorised disclosure of information from a healthcare recipient's My Health Record by persons authorised to access the My Health Record system via or on behalf of a linked healthcare provider organisation; and
                     (C)                  the accidental disclosure of information contained in a healthcare recipient's My Health Record;
                (ii)                   any changes to the My Health Record system that may affect the contracted service provider; and
                (iii)                 any relevant legal or regulatory changes that have occurred since the last review; and
           (d)                    a record of each iteration of the policy mentioned in subrule (1) is retained in accordance with the record keeping obligations (if any) applicable to the contracted service provider.

48.                  Policy to be provided to the System Operator on request
     (1)     The System Operator may request in writing that a contracted service provider give it a copy of the policy mentioned in subrule 47(1).
     (2)     A contracted service provider must comply with a request from the System Operator under this rule within 7 days of receiving the request.
     (3)     The System Operator may request a contracted service provider's current policy or the policy that was in force on a specified date.

49.                  User account management within contracted service providers
Contracted service providers must ensure that their information technology systems, which are used to access the My Health Record system via or on behalf of linked healthcare provider organisations, employ reasonable user account management practices including:
           (a)                    restricting access to those persons who require access as part of their duties;
           (b)                    uniquely identifying individuals using the contracted service provider's information technology systems, and having that unique identity protected