109Minister may make My Health Records Rules

109 Minister may make My Health Records Rules

(1) The Minister may, by legislative instrument, make rules called the My Health Records Rules about matters required or permitted by this Act to be dealt with in the My Health Records Rules. Consultation (2) Before the Minister makes My Health Records Rules, the Minister must consult: (a) the System Operator; and (b) the Health Chief Executives Forum. A failure to consult does not affect the validity of the Rules. My Health Records Rules may relate to registration etc. (3) The My Health Records Rules may specify the following: (a) requirements that a healthcare provider organisation must meet in order to be registered; (b) requirements that a person, or a repository or other facility (however described) owned or operated by the person, must meet for the person to be registered as a repository operator, a portal operator or a contracted service provider; (c) conditions on the registration of participants in the My Health Record system; (d) other requirements relating to the My Health Record system that apply to healthcare recipients or participants in the My Health Record system; (e) requirements relating to the establishment and the operation of a test environment for the My Health Record system, or another electronic system that interacts directly with the My Health Record system. (4) Requirements referred to in subsection (3) include technical specifications and other requirements in relation to the following: (a) storage of data and records; (b) records management; (c) administration and day‑to‑day operations; (d) physical and information security; (e) uploading specified kinds of records. My Health Records Rules may relate to agreements (4A) The My Health Records Rules may specify that a person must enter into a specified kind of agreement in order to be, and remain, a registered healthcare provider organisation, registered repository operator, registered portal operator or registered contracted service provider. (5) The My Health Records Rules may specify requirements relating to registration of healthcare recipients, including requirements relating to registering a healthcare recipient who has been issued with a healthcare identifier under a pseudonym, and for that purpose may specify such modifications of this Act as are necessary to facilitate such registration. My Health Records Rules may relate to access control mechanisms (6) The My Health Records Rules may specify matters relating to access control mechanisms, including the following: (a) the circumstances in which a nominated representative may set access controls; (b) the circumstances in which access to a healthcare recipient’s My Health Record is to be automatically suspended or cancelled; (c) default access controls. My Health Records Rules may relate to authorised representatives and nominated representatives (7) The My Health Records Rules may specify matters relating to authorised representatives and nominated representatives, including the following: (a) methods of establishing that an individual is an authorised representative or a nominated representative of a healthcare recipient; (b) requiring a healthcare recipient to verify his or her identity when the healthcare recipient ceases to have an authorised representative; (c) specifying circumstances in which an authorised representative or a nominated representative is not required to have been assigned a healthcare identifier under paragraph 9(1)(b) of the Healthcare Identifiers Act 2010. My Health Records Rules may relate to research or public health purposes (7A) The My Health Records Rules may, in accordance with section 109A, prescribe a framework to guide the collection, use and disclosure of de‑identified data and, with the consent of healthcare recipients, health information, for research or public health purposes. My Health Records Rules may apply to specified classes of participants (8) The My Health Records Rules may specify the classes of participants in the My Health Record system to whom, or to which, a particular My Health Records Rule applies. Incorporation of other instruments (9) Despite subsection 14(2) of the Legislation Act 2003, My Health Records Rules made for purposes other than subsection (7A) may make provision in relation to a matter by applying, adopting or incorporating any matter contained in an instrument or other writing as in force or existing from time to time. Scope of the My Health Records Rules rule‑making power (10) To avoid doubt, the My Health Records Rules may not do the following: (a) create an offence or civil penalty; (b) provide powers of: (i) arrest or detention; or (ii) entry, search or seizure; (c) impose a tax; (d) set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in this Act; (e) directly amend the text of this Act. (11) My Health Records Rules that are inconsistent with the regulations have no effect to the extent of the inconsistency, but My Health Records Rules are taken to be consistent with the regulations to the extent that the Rules are capable of operating concurrently with the regulations.