Document ID: chunk:federal_register_of_legislation:F2016C00607:schedule:1:p4
Version: federal_register_of_legislation:F2016C00607
Segment Type: schedule
Provision Reference: sch 1 (pt 4/32)
Character Range: 15145–18712

provider organisation, healthcare recipient, healthcare recipient -only notes, individual healthcare provider, nominated representative, My Health Record, My Health Record system, participant in the My Health Record system, registered healthcare recipient, registered healthcare provider organisation, shared health summary and System Operator.

          Part 2 Access control mechanisms

Division 1 Default access controls

5.                       Default access controls
For the purposes of paragraph 15(b) and (c) and subsection 109(6) of the Act, the System Operator must establish and maintain default access controls that:
           (a)                    permit all registered healthcare provider organisations involved in the care of a registered healthcare recipient to access the healthcare recipient's My Health Record;
           (b)                    include an access list of the registered healthcare provider organisations that are permitted to access the healthcare recipient's My Health Record because the organisation is involved in the care of the registered healthcare recipient;
           (c)                    permit registered healthcare recipients to view the access list for their My Health Record;
           (d)                    remove a healthcare provider organisation from the access list for a healthcare recipient's My Health Record if the organisation has not accessed the healthcare recipient's My Health Record for a period of three years;
           (e)                    permit registered healthcare recipients to:
                (i)                     effectively remove records from their My Health Record; and
                (ii)                   authorise the System Operator to restore records which have previously been effectively removed; and
           (f)                     permit registered healthcare provider organisations that uploaded records to a healthcare recipient's My Health Record to access those records, but only by request to the System Operator, if the healthcare provider organisation is no longer on the access list for the healthcare recipient's My Health Record.
           Note: The extent of access by registered healthcare provider organisations under paragraph (a), and the extent to which they will be omitted from the access list under paragraph (d), depends on how access flags have been assigned within the healthcare provider organisation's network ― see rules 9 and 10.

Division 2 Advanced access controls

6.                      Advanced access controls
     (1)     For the purposes of paragraphs 15(b) and (c) and subsection 109(6) of the Act, the System Operator must establish and maintain advanced access controls that have the same functionality as default access controls and that:
           (a)                    subject to rules 7 and 8, permit use of a record code to prevent registered healthcare provider organisations involved in the care of a registered healthcare recipient from accessing the healthcare recipient's My Health Record unless:
                (i)                     the record code is given to the organisation by:
                     (A)                  the healthcare recipient; or
                     (B)                  the System Operator at the request of the healthcare recipient; or
                (ii)                   the organisation is already on the access list for the healthcare recipient's My Health Record;
           (b)                    if a registered healthcare recipient wishes, prevent registered healthcare