17Retention and destruction of records uploaded to National Repositories Service

17 Retention and destruction of records uploaded to National Repositories Service

Records (1) This section applies to a record if: (a) the record is uploaded to the National Repositories Service; and (b) the record includes health information that is included in the My Health Record of a healthcare recipient. Retention of records (2) The System Operator must ensure that the record is retained for the period: (a) beginning when the record is first uploaded to the National Repositories Service; and (b) ending: (i) 30 years after the death of the healthcare recipient; or (ii) if the System Operator does not know the date of death of the healthcare recipient—130 years after the date of birth of the healthcare recipient; or (iii) if, under subsection (3), the record is required to be destroyed because of the cancellation of registration of the healthcare recipient—when the System Operator is required to destroy the record under subsection (4). Destruction of records after cancellation on request (3) If the System Operator is required to cancel the registration of the healthcare recipient under subsection 51(1) (cancellation on request), the System Operator must destroy any record that includes health information that is included in the My Health Record of the healthcare recipient, other than the following information: (a) the name and healthcare identifier of the healthcare recipient; (b) the name and healthcare identifier of the person who requested the cancellation, if different from the healthcare recipient; (c) the day the cancellation decision takes effect under subsection 51(7). (4) The System Operator must comply with subsection (3): (a) as soon as practicable after the cancellation decision takes effect under subsection 51(7); or (b) if any of the following requirements apply before the records are destroyed under paragraph (a)—as soon as practicable after the conclusion of the matter to which the requirement relates: (i) a court order requires the System Operator not to destroy records of the healthcare recipient; (ii) the System Operator is required to disclose records of the healthcare recipient under section 69 or 69A; (iii) the System Operator is required to disclose records of the healthcare recipient under a law covered by subsection 65(3). (5) To avoid doubt, if the System Operator is required under subsection (3) to destroy a record that includes health information, the System Operator must also destroy the following: (a) any copy of the record; (b) any previous version of the record; (c) any back‑up version of the record.