36Extent of authorisation

#### 36 Extent of authorisation An authorisation under this Act to an entity (the first entity) for a particular purpose is an authorisation to: (a) an individual: (i) who is an employee of the first entity; and (ii) whose duties involve implementing that purpose; or (b) a contracted service provider of the first entity, if: (i) the first entity is a healthcare provider; and (ii) the duties of the contracted service provider under a contract with the healthcare provider involve implementing that purpose by providing information technology services relating to the communication of health information, or health information management services, to the healthcare provider; or (baa) a subcontracted service provider of the first entity, if: (i) the first entity is a healthcare provider; and (ii) the duties of the subcontracted service provider under a contract with a contracted service provider for the healthcare provider involve implementing that purpose by providing information technology services relating to the communication of health information, or health information management services, to the healthcare provider or to the contracted service provider for the healthcare provider; or (ba) a person (the contractor) performing services under a contract between the contractor and the first entity, if: (i) the first entity is a participant in the My Health Record system, other than a healthcare provider or a contracted service provider; and (ii) the purpose relates to the My Health Record system; or (bb) a person (the subcontractor) performing services under a contract between the subcontractor and another person (the contractor), if: (i) the first entity is the My Health Record System Operator or the operator of the National Repositories Service (within the meaning of the My Health Records Act 2012); and (ii) the first entity has a contract with the contractor; and (iii) the contract between the subcontractor and the contractor relates to the My Health Record system; or (c) an individual: (i) who is an employee of a contracted service provider to which paragraph (b) applies, a subcontracted service provider to which paragraph (baa) applies, a contractor to which paragraph (ba) applies or a subcontractor to which paragraph (bb) applies; and (ii) whose duties involve implementing that purpose as mentioned in whichever of those paragraphs applies.