Document ID: chunk:federal_register_of_legislation:F2016C00607:schedule:1:p23
Version: federal_register_of_legislation:F2016C00607
Segment Type: schedule
Provision Reference: sch 1 (pt 23/32)
Character Range: 72827–76006

My Health Record system that may affect the healthcare provider organisation; and
                (iii)                 any relevant legal or regulatory changes that have occurred since the last review; and
           (d)                    a record of each iteration of the policy mentioned in subrule (1) is retained in accordance with the record keeping obligations (if any) applicable to the healthcare provider organisation.

43.                  Policy to be provided to the System Operator on request
     (1)     The System Operator may request in writing that a healthcare provider organisation give it a copy of the policy mentioned in subrule 42(1).
     (2)     A healthcare provider organisation must comply with a request from the System Operator under this rule within 7 days of receiving the request.
     (3)     The System Operator may request a healthcare provider organisation's current policy or the policy that was in force on a specified date.

44.                  User account management within healthcare provider organisations
Healthcare provider organisations must ensure that their information technology systems, which are used by people to access the My Health Record system via or on behalf of the healthcare provider organisation, employ reasonable user account management practices including:
           (a)                    restricting access to those persons who require access as part of their duties;
           (b)                    uniquely identifying individuals using the healthcare provider organisation's information technology systems, and having that unique identity protected by a password or equivalent protection mechanism;
           (c)                    having password and/or other access mechanisms that are sufficiently secure and robust given the security and privacy risks associated with unauthorised access to the My Health Record system;
           (d)                    ensuring that the user accounts of persons no longer authorised to access the My Health Record system via or on behalf of the healthcare provider organisation prevent access to the My Health Record system; and
           (e)                    suspending a user account that enables access to the My Health Record system as soon as practicable after becoming aware that the account or its password or access mechanism has been compromised.

45.                  Retention of record codes and document codes
Healthcare provider organisations must ensure that people using their information technology systems to access the My Health Record system via or on behalf of the organisation do not record, store or retain a copy of a healthcare recipient's record code or document code for the purposes of accessing the healthcare recipient's My Health Record, or a record in the healthcare recipient's My Health Record, in the future.
           Note: Where a record code or document code is used to access a My Health Record or a record in a My Health Record, the code is not stored in the healthcare provider organisation's clinical information system. For example, using a record code places the organisation on the access list for the healthcare