74Registered healthcare provider organisations must ensure certain information is given to System Operator

74 Registered healthcare provider organisations must ensure certain information is given to System Operator

(1) A registered healthcare provider organisation is liable for a civil penalty if: (a) an individual requests access to a healthcare recipient’s My Health Record on behalf or purportedly on behalf of the registered healthcare provider organisation; and (b) the individual does not give enough information to the System Operator to enable the System Operator to identify the individual who made the request without seeking further information from another person.

Civil penalty: 100 penalty units.

(2) Subsection (1) does not require an individual to give more than the minimum information necessary to identify the individual by name.