This Rule replaces earlier PCEHR rules and sets detailed operational, access-control and security requirements for the My Health Record system. It affects healthcare recipients (who can set record/document codes and control access), registered healthcare provider organisations, contracted service providers and operators (who must maintain interoperability, policies, user‑account controls and notify the System Operator); those organisations bear the compliance costs, and the System Operator is given powers to suspend access, remove records and verify identities.
This instrument, the My Health Records Rule 2016, sets detailed operational, security and access-control rules for the My Health Record system that implement and elaborate provisions of the My Health Records Act 2012 and related instruments. The Rule commences the day after registration (Endnote 3), and expressly repeals the earlier PCEHR Rules 2012 and the PCEHR (Participation Agreements) Rules 2012 (rule 3). It defines core terminology (rule 4) and then prescribes, among other things:
default access controls and a separate set of advanced access controls that the System Operator must establish and maintain (rules 5 and 6). Those controls determine which registered healthcare provider organisations may access a healthcare recipient’s My Health Record and permit healthcare recipients to restrict access to individual records by means of record codes and document codes (rule 6(1)-(2));
an access-flagging system applied at the level of healthcare provider networks to determine how organisations are added to and omitted from access lists (rules 9-10, 28);
the mechanics and exceptions for overriding codes and access controls in the case of serious threats to an individual’s life, health or safety, or to public health or public safety, as provided by s 64 of the Act (rules 7-8);
obligations and processes for suspension and cancellation of access for authorised and nominated representatives, including automatic cancellation where a healthcare recipient takes control or turns 18, suspension on death notifications, suspension pending investigation, and temporary suspension where continuing representative access poses a serious risk to life, health or safety (rules 11-16);
System Operator powers to suspend access where security, integrity or operation of the My Health Record system is, or may be, compromised, and requirements to notify entities affected by suspension (rule 17);
Current sections
Direct links to the current provisions in My Health Records Rule 2016.
77
1. Name of Rule
1. Name of Rule
1. Name of Rule
This Rule is the My Health Records Rule 2016.
2. Commencement
2. Commencement
2. Commencement
(1) Each provision of this instrument specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.
Note: This table relates only to the provisions of this instrument as originally made. It will not be amended to deal with any later amendments of this instrument.
(2) Any information in column 3 of the table is not part of this instrument. Information may be inserted in this column, or information in it may be edited, in any published version of this instrument.
3. Repeal
3. Repeal
3. Repeal
This Rule repeals the following legislative instruments:
(a) the PCEHR Rules 2012; and
(b) the PCEHR (Participation Agreements) Rules 2012.
4. Definitions
4. Definitions
4. Definitions
In this Rule, unless the contrary intention appears:
access control mechanisms include default access controls and advanced access controls.
access flag means an information technology mechanism made available by the System Operator to define access to a healthcare recipient’s My Health Record.
access list means the record associated with a healthcare recipient’s My Health Record that specifies the registered healthcare provider organisations permitted to access the healthcare recipient’s My Health Record.
Act means the My Health Records Act 2012.
advance care planning information means a document prepared by, or on behalf of, a healthcare recipient that states the healthcare recipient’s preferences about her or his health and personal care and preferred health outcomes such as an advance care directive or a document relating to a substitute decision maker for health-related purposes.
Note 1: The Advance Care Directives Framework September 2011, as in force from time to time, references a nationally agreed lexicon of common terms for advance care planning documents that each State and Territory use. Advance care directives and advance care plans are examples of documents referenced in this Framework that may be uploaded by a healthcare recipient or a healthcare provider organisation to a repository to be included in a healthcare recipient’s My Health Record.
advanced access controls means the access controls that enable a registered healthcare recipient to set controls on the registered healthcare provider organisations and nominated representatives who may access the healthcare recipient’s My Health Record, and the records within the My Health Record.
assisted registration has the meaning in the My Health Records (Assisted Registration) Rule 2015.
contracted service provider officer has the same meaning given by subrule 36(4).
default access controls means the access controls that apply where a registered healthcare recipient has not set controls on the registered healthcare provider organisations or nominated representatives who may access the healthcare recipient’s My Health Record.
document code means a code which may be used to restrict access to individual records within a healthcare recipient’s My Health Record in accordance with paragraph 6(1)(c).
effectively remove, in relation to a record in a healthcare recipient’s My Health Record, means rendering the record inaccessible to the healthcare recipient, their nominated representatives and any registered healthcare provider organisations involved in the care of the healthcare recipient, including in the case of a serious threat in accordance with rules 7 and 8.
healthcare identifier has the same meaning as in section 9 of the Healthcare Identifiers Act 2010.
healthcare recipient-entered health summary means the summary of information, including medications and allergies, that a registered healthcare recipient may enter into his or her My Health Record and which is available to anyone with access to the healthcare recipient’s My Health Record.
identified healthcare provider has the same meaning as in the Healthcare Identifiers Act 2010.
interoperability requirements means the requirements published by the System Operator from time to time specifying the technical and compliance prerequisites that entities must meet in order to connect, and remain connected, with the My Health Record system.
linked registered healthcare provider organisation has the same meaning given by subrule 34(2).
material change in relation to a participant in the My Health Record System includes:
(c) a change in the financial administration status of the participant;
(d) a change in the participant’s legal name;
(e) a change in the participant’s legal structure; or
(f) the participant being involved in a merger or acquisition.
national registration authority has the same meaning as in the Healthcare Identifiers Act 2010.
network has the same meaning as in the Healthcare Identifiers Act 2010.
network organisation has the same meaning as in the Healthcare Identifiers Act 2010.
organisation maintenance officer has the same meaning as in the Healthcare Identifiers Act 2010.
operator means a repository operator or a portal operator.
operator officer has the same meaning given by subrule 53(4).
portal operator means a person that is the operator of an electronic interface that facilitates, or can facilitate, access to the My Health Record system.
professional representative means a person who the System Operator is satisfied is eligible to be an authorised or nominated representative of a healthcare recipient as a result of their employment.
provenance information means:
(a) information or a healthcare identifier that identifies a healthcare recipient, an individual healthcare provider or a healthcare provider organisation; or
(b) a flag which identifies a document type.
provider portal means the portal provided by the System Operator that permits registered healthcare provider organisations to access the My Health Record system without having to use a clinical information system.
record code means a code which may be used to restrict access to a healthcare recipient’s My Health Record in accordance with paragraph 6(1)(a).
responsible officer has the same meaning as in the Healthcare Identifiers Act 2010.
repository operator means a person that holds, or can hold, records of information included in My Health Records for the purposes of the My Health Record system.
restore, in relation to a record, means making a record, which has previously been effectively removed, accessible to the healthcare recipient, their nominated representatives and any registered healthcare provider organisations involved in the care of the healthcare recipient in accordance with any applicable access control mechanisms, including in the case of a serious threat to an individual’s life, health or safety.
seed organisation has the same meaning as in the Healthcare Identifiers Act 2010.
service operator has same meaning as in the Healthcare Identifiers Act 2010.
taking control, in relation to a My Health Record, has the meaning given by subrule 11(2).
verified healthcare identifier means a healthcare identifier assigned to a healthcare recipient in relation to which the service operator has evidence, to the service operator’s satisfaction, of the healthcare recipient’s identity.
Note 2: Unless the contrary intention appears, terms used in this My Health Records Rule have the same meaning as in the Act― see section 13 of the Legislative Instruments Act 2003. These terms include:
approved form, authorised representative, employee, healthcare provider organisation, healthcare recipient, healthcare recipient -only notes, individual healthcare provider, nominated representative, My Health Record, My Health Record system, participant in the My Health Record system, registered healthcare recipient, registered healthcare provider organisation, shared health summary and System Operator.
Part 2 Access control mechanisms
Division 1 Default access controls
5. Default access controls
5. Default access controls
5. Default access controls
For the purposes of paragraph 15(b) and (c) and subsection 109(6) of the Act, the System Operator must establish and maintain default access controls that:
(a) permit all registered healthcare provider organisations involved in the care of a registered healthcare recipient to access the healthcare recipient’s My Health Record;
(b) include an access list of the registered healthcare provider organisations that are permitted to access the healthcare recipient’s My Health Record because the organisation is involved in the care of the registered healthcare recipient;
(c) permit registered healthcare recipients to view the access list for their My Health Record;
(d) remove a healthcare provider organisation from the access list for a healthcare recipient’s My Health Record if the organisation has not accessed the healthcare recipient’s My Health Record for a period of three years;
(e) permit registered healthcare recipients to:
(i) effectively remove records from their My Health Record; and
(ii) authorise the System Operator to restore records which have previously been effectively removed; and
(f) permit registered healthcare provider organisations that uploaded records to a healthcare recipient’s My Health Record to access those records, but only by request to the System Operator, if the healthcare provider organisation is no longer on the access list for the healthcare recipient’s My Health Record.
Note: The extent of access by registered healthcare provider organisations under paragraph (a), and the extent to which they will be omitted from the access list under paragraph (d), depends on how access flags have been assigned within the healthcare provider organisation’s network ― see rules 9 and 10.
Division 2 Advanced access controls
6. Advanced access controls
6. Advanced access controls
6. Advanced access controls
(1) For the purposes of paragraphs 15(b) and (c) and subsection 109(6) of the Act, the System Operator must establish and maintain advanced access controls that have the same functionality as default access controls and that:
(a) subject to rules 7 and 8, permit use of a record code to prevent registered healthcare provider organisations involved in the care of a registered healthcare recipient from accessing the healthcare recipient’s My Health Record unless:
(i) the record code is given to the organisation by:
(A) the healthcare recipient; or
(B) the System Operator at the request of the healthcare recipient; or
(ii) the organisation is already on the access list for the healthcare recipient’s My Health Record;
(b) if a registered healthcare recipient wishes, prevent registered healthcare provider organisations’ clinical information systems automatically checking and displaying whether the healthcare recipient has a My Health Record;
(c) permit registered healthcare recipients to control access to individual records in their My Health Record:
(i) by adjusting the advanced access controls for their My Health Record to only permit specified registered healthcare provider organisations on the access list for the healthcare recipient’s My Health Record to access specified records; or
(ii) using a document code,
in accordance with subrule (2); and
(d) permit registered healthcare recipients to be alerted by means of an electronic communication when their My Health Record is accessed by a third party.
(2) For the purposes of paragraph (1)(c), the System Operator must ensure that:
(a) registered healthcare recipients are able to prevent access to a record in their My Health Record, other than shared health summaries, healthcare recipient-entered health summaries and advance care planning information, unless:
(i) the registered healthcare provider organisation has been given a document code in relation to the record by:
(A) the healthcare recipient; or
(B) the System Operator at the request of the healthcare recipient; or
(ii) the healthcare recipient has set the advanced access controls for their My Health Record to permit the registered healthcare provider organisation, which is on the access list for the healthcare recipient’s My Health Record, to access the record;
(b) where a healthcare recipient has restricted access to a record using the access controls in paragraph (1)(c):
(i) the record will still be accessible to the registered healthcare provider organisation that uploaded the record to the My Health Record system, without the need to use the healthcare recipient’s document code;
(ii) the record may still be accessed by registered healthcare provider organisations and other participants in the My Health Record system in the case of a serious threat in accordance with rules 7 and 8;
(iii) healthcare recipients are able to choose whether their nominated representatives who do not have the ability to set and maintain access controls are able to access records to which a document code has been applied;
(iv) registered healthcare provider organisations involved in the care of the healthcare recipient are not able to determine that records to which access has been restricted using the access controls in paragraph 1(c) exist solely by viewing the healthcare recipient’s My Health Record unless:
(A) the organisation has been given a document code in accordance with paragraph (2)(a)(i);
(B) the healthcare recipient has set access controls in accordance with paragraph (2)(a)(ii) permitting the organisation to access the relevant record; or
(C) the organisation uploaded the relevant record to the My Health Record system; and
(c) all records uploaded to the healthcare recipient’s My Health Record are, as a default, uploaded without a document code applied to the record. Where a registered healthcare provider organisation is on the access list for a healthcare recipient’s My Health Record, the System Operator must ensure that a registered healthcare recipient is able to choose whether a record uploaded by that healthcare provider organisation is uploaded with or without a document code applied to the record.
Note 1: The extent of access by registered healthcare provider organisations under paragraph (1)(a) depends on how access flags have been assigned within the healthcare provider organisation’s network ― see rules 9 and 10. Once a record code has been given to a registered healthcare provider organisation, the healthcare recipient will not subsequently need to give their record code to the same organisation provided that the organisation remains on the access list for the healthcare recipient’s My Health Record. Where a registered healthcare provider organisation is given a healthcare recipient’s record code, and is added to the access list for the healthcare recipient’s My Health Record, the other healthcare provider organisations (if any) on the access list for the healthcare recipient’s My Health Record are unaffected.
Note 2: The access control specified in paragraph (1)(b) will not prevent a registered healthcare provider organisation determining if a healthcare recipient has a My Health Record if the organisation carries out a manual search of the My Health Record system. However, it will prevent the organisation’s clinical information system from automatically checking and displaying whether a healthcare recipient has a My Health Record.
Note 3: If a healthcare recipient has set up a record code, that code will prevent a registered healthcare provider organisation, which is not on the access list for the healthcare recipient’s My Health Record, accessing the healthcare recipient’s My Health Record unless the healthcare recipient, or the System Operator at the healthcare recipient’s request, gives the organisation the record code. Record codes and document codes will not prevent access to a My Health Record or a record in a My Health Record where access is permitted in the case of a serious threat under section 64 of the Act.
Note 4: While records uploaded to a healthcare recipient’s My Health Record will, as a default, be uploaded without a document code applied to the record, healthcare recipients will be able to subsequently restrict access to the record by applying a document code if they wish. Healthcare recipients are able to change the default setting in relation to healthcare provider organisations on the access list for the healthcare recipient’s My Health Record.
Note 5: Rule 45 provides that healthcare provider organisations must not retain a healthcare recipient’s record code or document code for future use to access the healthcare recipient’s My Health Record or a record in the healthcare recipient’s My Health Record.
Division 3 Access control mechanisms and serious threats
7. Serious threat to an individual’s lif
7. Serious threat to an individual’s life, health or safety
7. Serious threat to an individual’s life, health or safety
(1) The access control mechanisms established and maintained by the System Operator must permit registered healthcare provider organisations to assert to the System Operator that the circumstances in paragraph 64(1)(a) of the Act exist.
(2) Where access is authorised under subsection 64(1) of the Act, the access control mechanisms:
(a) must allow access to a healthcare recipient’s My Health Record regardless of whether a healthcare recipient has set up a record code;
(b) must allow access to all records in a healthcare recipient’s My Health Record regardless of whether a healthcare recipient has set up a document code; and
(c) must not permit access to records that have been effectively removed.
Note 1: Healthcare recipient-only notes are not available under subsection 64(1) of the Act― see subsection 64(3) of the Act.
Note 2: The extent of access by registered healthcare provider organisations under subsection 64(1) of the Act depends on how access flags have been assigned within the healthcare provider organisation’s network ― see rules 9 and 10.
Note 3: Where a healthcare recipient’s My Health Record registration has been suspended, paragraph 54(a) of the Act permits access to the healthcare recipient’s My Health Record in the case of a serious threat under subsection 64(1) of the Act.
8. Serious threat to public health or pu
8. Serious threat to public health or public safety
8. Serious threat to public health or public safety
(1) The access control mechanisms established and maintained by the System Operator must permit registered healthcare provider organisations to assert to the System Operator that the collection, use or disclose of health information is necessary to lessen or prevent a serious threat to public health or public safety for the purposes of subsection 64(2) of the Act.
(2) Where access is authorised under subsection 64(2) of the Act, the access control mechanisms:
(a) must allow access to a healthcare recipient’s My Health Record regardless of whether a healthcare recipient has set up a record code;
(b) must allow access to all records in a healthcare recipient’s My Health Record regardless of whether a healthcare recipient has set up a document code; and
(c) must not permit access to records that have been effectively removed.
Note 1: Healthcare recipient-only notes are not available under subsection 64(2) of the Act― see subsection 64(3) of the Act.
Note 2: The extent of access by registered healthcare provider organisations under subsection 64(2) of the Act depends on how access flags have been assigned within the healthcare provider organisation’s network ― see rules 9 and 10.
Division 4 Access flags
9. Access control mechanisms must includ
9. Access control mechanisms must include use of access flags
9. Access control mechanisms must include use of access flags
For the purposes of paragraphs 15(b) and (c) and subsection 109(6) of the Act, the System Operator must establish and maintain access control mechanisms that comply with the following requirements:
(a) access flags must be used to determine which additional registered healthcare provider organisations (if any) are to be:
(i) added to the access list for a healthcare recipient’s My Health Record where a registered healthcare provider organisation accesses the healthcare recipient’s My Health Record in accordance with default access controls, advanced access controls or in the case of a serious threat to an individual’s life, health or safety; and
(ii) omitted from the access list for a healthcare recipient’s My Health Record where a healthcare provider organisation ceases to be on the access list;
(b) access flags must be set and maintained for a registered healthcare provider organisation in the context of the organisation’s network;
(c) the responsible officer and/or the organisation maintenance officer of a registered healthcare provider organisation that is the seed organisation within a network must be responsible for setting and maintaining the access flags for the registered healthcare provider organisations within the seed organisation’s network; and
Principles for setting and maintaining access flags
(d) access flags must be set and maintained in accordance with the principles in rule 10.
Note: A network consists of a seed organisation and one or more network organisations― see subsection 9A(4) of the Healthcare Identifiers Act 2010. A network organisation may, but is not required to, be part of the same legal entity as its seed organisation or be a related body corporate of its seed organisation. There can be one or more healthcare provider organisations within a single legal entity.
10. Principles for assigning access flag
10. Principles for assigning access flags
10. Principles for assigning access flags
(1) Subject to subrules (3) to (5), access flags must be set and maintained for registered healthcare provider organisations in a network in a manner which balances:
(a) reasonable healthcare recipient expectations about the sharing of health information as part of providing healthcare to the healthcare recipient; and
(b) arrangements within the organisation for access to health information collected by the organisation.
(2) A registered healthcare provider organisation that is a seed organisation must ensure that access flags assigned within its network are regularly reviewed and adjusted as necessary so that their assignment remains consistent with the principles in subrule (1).
(3) If the System Operator reasonably considers that access flags have not been assigned within a network, have been assigned in a manner that is inconsistent with the principles in subrule (1) or have been assigned in a manner that is otherwise inappropriate, the System Operator:
(a) must consult with, and consider the views (if any) of, the seed organisation of the network; and
(b) following consideration under paragraph (3)(a), may by written notice request the seed organisation to make reasonable changes to the access flags within the organisation’s network, including by adding, omitting or reassigning access flags.
(4) A notice from the System Operator under paragraph (3)(b) must be consistent with the principles in subrule (1).
(5) A registered healthcare provider organisation must not unreasonably refuse to comply with a request from the System Operator under paragraph (3)(b).
Note: Rule 28 requires seed organisations to structure their network in a manner that allows access flags to be assigned in accordance with the principles in this rule.
Division 5 Access control mechanisms relating to suspension or cancellation of access to a healthcare recipient’s My Health Record
11. Automatic cancellation when a health
11. Automatic cancellation when a healthcare recipient takes control
11. Automatic cancellation when a healthcare recipient takes control
(1) The System Operator must automatically cancel access to a healthcare recipient’s My Health Record for all the healthcare recipient’s authorised representatives and nominated representatives upon the earlier of the following:
(a) the healthcare recipient taking control of his or her My Health Record;
(b) the healthcare recipient reaching the age of 18.
(2) A healthcare recipient takes control of his or her My Health Record if:
(a) the System Operator is no longer satisfied that the healthcare recipient has an authorised representative under section 6 of the Act; and
(b) the healthcare recipient has:
(i) verified his or her identity with the System Operator; and
(ii) if the healthcare recipient wishes to access his or her My Health Record online or adjust their My Health Record’s access control mechanisms online – organised his or her own My Health Record log-in details with the System Operator.
(3) Despite paragraph (1)(b), the System Operator must not cancel access to a healthcare recipient’s My Health Record for a person who is an authorised representative under subsections 6(1) or (2) of the Act if the System Operator is satisfied that the person will, when the healthcare recipient reaches the age of 18, be an authorised representative for the healthcare recipient under subsection 6(4) of the Act.
Note: Rule 24 requires the System Operator to verify the identity of a healthcare recipient where the healthcare recipient ceases to have an authorised representative.
12. Suspension on death of healthcare re
12. Suspension on death of healthcare recipient
12. Suspension on death of healthcare recipient
The System Operator must suspend access to a healthcare recipient’s My Health Record for all the healthcare recipient’s authorised representatives and nominated representatives if informed by the service operator that the status of the healthcare recipient’s healthcare identifier has been changed to deceased.
Note 1: Where the status of a healthcare recipient’s healthcare identifier is deceased, this indicates that evidence of the healthcare recipient’s death has been received but the service operator has not yet received formal confirmation in the form of fact of death data from the relevant State or Territory authority.
Note 2: Once the service operator informs the System Operator that the healthcare recipient’s healthcare identifier has been retired (that is, fact of death data has been received), the System Operator must cancel the healthcare recipient’s registration under subsection 51(6) of the Act. Where a healthcare recipient’s registration is cancelled, access to the healthcare recipient’s My Health Record ceases for authorised representatives and nominated representatives.
13. Suspension and cancellation where re
13. Suspension and cancellation where representation ceases
13. Suspension and cancellation where representation ceases
(1) The System Operator must cancel access to a healthcare recipient’s My Health Record for a person who is an authorised representative or a nominated representative of the healthcare recipient if:
(a) the System Operator:
(i) has been informed by the service operator that the status of the authorised representative’s, or nominated representative’s (if applicable), healthcare identifier has been changed to retired; or
(ii) is otherwise satisfied that the nominated representative has died;
(b) the System Operator is no longer satisfied under sections 6 or 7 of the Act that the person is an authorised representative or nominated representative of the healthcare recipient; or
(c) the person has notified the System Operator in writing that they no longer wish to act as the healthcare recipient’s authorised representative or nominated representative.
(2) The System Operator must suspend access to a healthcare recipient’s My Health Record for a person who is an authorised representative or a nominated representative of the healthcare recipient if informed by the service operator that the status of the authorised representative’s or nominated representative’s healthcare identifier has been changed to deceased.
(3) The System Operator may suspend access to a healthcare recipient’s My Health Record for a healthcare recipient’s authorised representative or nominated representative while the System Operator investigates whether to take action under subrule (1).
(4) If the System Operator suspends or cancels access to a healthcare recipient’s My Health Record for an authorised representative under this rule, the System Operator must also suspend or cancel access to the healthcare recipient’s My Health Record for all nominated representatives that were nominated by that authorised representative.
(5) Despite subrule (4), the System Operator does not need to suspend or cancel access to the healthcare recipient’s My Health Record for those nominated representatives where:
(a) the nominated representative was nominated by an authorised representative who was a professional representative of the healthcare recipient (the first professional representative); and
(b) the healthcare recipient still has a professional representative, who is an authorised representative of the healthcare recipient, who is employed by the same employer as the first professional representative.
Note 1: Professional representatives do not need a healthcare identifier to be a representative― see subsections 6(6) and 7(3) of the Act and Part 4A of the Rule.
Note 2: Where access to a healthcare recipient’s My Health Record is cancelled for a nominated representative under subrule (4), any remaining authorised representative may agree with the person who was previously a nominated representative to be reappointed as a nominated representative for the healthcare recipient.
Example: If an authorised representative who is an employee of a statutory care agency has their access to a healthcare recipient’s My Health Record cancelled, any nominated representatives that the authorised representative originally appointed will not need to have their access cancelled so long as another employee of the statutory care agency remains as an authorised representative of the healthcare recipient.
14. Suspension while investigating eligi
14. Suspension while investigating eligibility
14. Suspension while investigating eligibility
(1) Until a decision is made under subrule (3), the System Operator must suspend access to a healthcare recipient’s My Health Record for all a healthcare recipient’s authorised representatives and nominated representatives if the System Operator is notified of a claim that an authorised representative is not eligible to be the healthcare recipient’s authorised representative.
(2) The notice in subrule (1) must be given in the approved form.
(3) If notified of a claim under this rule, the System Operator must investigate the claim and decide to:
(a) cancel access to the healthcare recipient’s My Health Record for a person if the System Operator is no longer satisfied that the person is eligible to be the healthcare recipient’s authorised representative; or
(b) restore access to the healthcare recipient’s My Health Record for a person if the System Operator is satisfied that the person remains eligible to be the healthcare recipient’s authorised representative.
(4) If the System Operator cancels access to a healthcare recipient’s My Health Record for a person (the first person) under paragraph (3)(a), the System Operator must also cancel access to the healthcare recipient’s My Health Record for the nominated representatives (if any) that were nominated by the first person.
Note 1: A decision about whether a person is or is not the authorised representative of a healthcare recipient is made by the System Operator under section 6 of the Act. Paragraph 97(1)(a) of the Act gives a right of review in relation to such decisions.
Note 2: Where access to a healthcare recipient’s My Health Record is cancelled for a nominated representative under subrule (4), any remaining authorised representative may agree with a person that that person is to be a nominated representative for the healthcare recipient.
15. Temporary suspension in the case of
15. Temporary suspension in the case of a serious risk to a healthcare recipient
15. Temporary suspension in the case of a serious risk to a healthcare recipient
(1) The System Operator must suspend access to a healthcare recipient’s My Health Record for all the healthcare recipient’s authorised representatives and nominated representatives if:
(a) an authorised representative of the healthcare recipient notifies the System Operator that continuing access to the healthcare recipient’s My Health Record by an authorised representative or nominated representative poses, or is likely to pose, a serious risk to an individual’s life, health or safety; and
(b) the System Operator is satisfied that suspending access would be likely to reduce the risk to the individual’s life, health or safety.
(2) The suspension of access under subrule (1) is to continue until the earlier of the following:
(a) 30 days from the date on which access was suspended under subrule (1);
(b) the day on which the System Operator is notified in writing by the authorised representative who lodged the notification in paragraph (1)(a) that there is no longer a risk to the individual’s life, health or safety.
Note 1: A decision to suspend access under rule 15 would not prevent a decision being made to suspend access under rule 14 if a claim about an authorised representative’s eligibility is notified to the System Operator under subrule 14(1) within the 30 day period. In such circumstances, access could, if necessary, continue to be suspended after the 30 day period specified in subrule 15(2) ends.
Note 2: A decision to suspend access under rule 14 would not prevent a decision being made under subsection 51(1) of the Act to cancel or suspend a healthcare recipient’s registration on request.
16. Effect of suspension or cancellation
16. Effect of suspension or cancellation
16. Effect of suspension or cancellation
Nothing in this Division affects:
(a) a healthcare recipient’s registration under the Act; or
(b) the access control mechanisms that were in place for the healthcare recipient’s My Health Record immediately before any suspension or cancellation of access to the healthcare recipient’s My Health Record occurred.
Part 3 Security, operations, administration and uploading records
17. Suspension of access in the case of
17. Suspension of access in the case of risk to security, integrity or operation of My Health Record system
17. Suspension of access in the case of risk to security, integrity or operation of My Health Record system
(1) If the System Operator considers that the security, integrity or operations of the My Health Record system have been, or may be, compromised, the System Operator may suspend access to the My Health Record system with immediate effect for an entity, or for a class or classes of:
(a) healthcare recipients;
(b) authorised representatives;
(c) nominated representatives; or
(d) participants in the My Health Record system.
(2) Without limiting subrule (1), the security, integrity or operations of the My Health Record system may be compromised if:
(a) there is a security problem with the information technology systems of a participant in the My Health Record system, or with the credentials that enable a participant’s identity to be authenticated in electronic communications;
(b) there is an issue with verification of the identity of a healthcare recipient or their representative; or
(c) a participant in the My Health Record system has failed to maintain interoperability in accordance with rules 31, 39 or 56.
(3) Where a participant in the My Health Record system has failed to maintain interoperability in accordance with rules 31, 39 or 56, the System Operator may suspend the participant’s access to the My Health Record system in full or in part.
Example: Under subrule 17(3), the System Operator may decide to suspend all access by a participant to the My Health Record system. Alternatively, the System Operator may decide to partially suspend access to the My Health Record system by preventing the participant uploading a class of documents (such as shared health summaries) until the participant restores interoperability with the My Health Record system in accordance with the System Operator’s interoperability requirements.
(4) The System Operator must notify, in writing, the healthcare recipient or other entity whose access to the My Health Record system has been suspended under subrule (1).
(5) The notice in subrule (4) must be given as soon as practicable after suspension occurs and must specify:
(a) the reasons for suspension; and
(b) the steps, if any, that the System Operator requires the healthcare recipient or other entity to take before the recipient’s or entity’s access to the My Health Record system is restored.
(6) If, in the reasonable opinion of the System Operator, the suspension of access relates to minor operational matters and is unlikely to last for more than 24 hours, the System Operator does not need to comply with subrules (4) or (5).
(7) If, in the reasonable opinion of the System Operator, the suspension of access affects a significant number of healthcare recipients, the System Operator may notify the general public instead of complying with subrule (4).
(8) The System Operator must restore access to the My Health Record system for a healthcare recipient or other entity whose access was suspended under subrule (1) as soon as practicable after the System Operator is satisfied that the security, integrity or operations of the My Health Record system are no longer compromised or are no longer at risk of compromise.
(9) Nothing in this rule affects:
(a) a healthcare recipient’s or other entity’s registration under the Act; or
(b) the access control mechanisms that were in place for a healthcare recipient’s My Health Record immediately before any suspension of access to the My Health Record system for the recipient or her or his representatives.
18. My Health Record system availability
18. My Health Record system availability
18. My Health Record system availability
On the request of a participant in the My Health Record system, the System Operator must provide the participant with details of when the My Health Record System was unavailable.
19. Restriction on uploading records oth
19. Restriction on uploading records other than shared health summaries and advance care planning information
19. Restriction on uploading records other than shared health summaries and advance care planning information
For the purposes of paragraph 45(b)(ii) of the Act, all records other than the following are specified:
(a) shared health summaries; and
(b) advance care planning information.
Note 1: The Act and the My Health Records Regulation 2012 place restrictions on the uploading of records to the My Health Record system.
Note 2: Clinical care plans, as described in The Advance Care Directives Framework September 2011, may be uploaded to the My Health Record system in the same way as any other clinical document.
20. Restriction on uploading records pre
20. Restriction on uploading records prepared by healthcare providers whose registration or membership is suspended, cancelled, etc.
20. Restriction on uploading records prepared by healthcare providers whose registration or membership is suspended, cancelled, etc.
For the purposes of subparagraphs 45(ba)(i) and (ii) of the Act, a healthcare provider organisation may upload to a repository a record prepared by an individual whose registration or membership is, at the time the record is prepared, suspended because the individual’s registration or membership fees are less than six month’s overdue.
21. Effective removal of records
21. Effective removal of records
21. Effective removal of records
(1) The System Operator may effectively remove, or may direct a participant in the My Health Record system to effectively remove, a record in the My Health Record system to the extent that the System Operator reasonably considers that:
(a) the record contains a defamatory statement;
(b) the record affects, or is likely to affect, the security, integrity or operations of the My Health Record system; or
(c) both the following are satisfied:
(i) the record was uploaded in contravention of paragraph 45(ba) of the Act; and
(ii) the record should be effectively removed to reduce the clinical risk that is, or may be, faced by a healthcare recipient if the record is not effectively removed.
Example: The System Operator may decide to effectively remove a record under paragraph 1(c) where the authoring individual healthcare provider’s registration with the national registration authority has been suspended for professional negligence, and the System Operator considers that effectively removing the record would reduce the clinical risk faced by the healthcare recipient about whom the record relates.
(2) A participant in the My Health Record system who is given a direction under subrule (1) must comply with the direction.
(3) Where the System Operator effectively removes, or directs a participant in the My Health Record system to effectively remove, a record under subrule (1):
(a) the System Operator must notify in writing:
(i) the healthcare recipient from whose My Health Record the record was effectively removed; and
(ii) the entity that uploaded the record,
specifying the reasons for its decision; and
(b) the entity may upload a replacement record provided that:
(i) at the time of uploading the replacement record, the entity is a participant in the My Health Record system; and
(ii) the replacement record addresses the System Operator’s concerns specified in the notice.
(4) Nothing in subrule (1) affects by implication the System Operator’s functions or powers to manage the My Health Record system.
22. Transfer and disposal of records
22. Transfer and disposal of records
22. Transfer and disposal of records
(1) This rule applies to an entity that is, or at any time was, a registered repository operator or a registered portal operator.
(2) If the entity’s registration under Division 3 of Part 3 of the Act is cancelled, the entity must not transfer or dispose of health records held by the entity for My Health Record purposes without the prior written approval of the System Operator.
Part 4 Identity verification
23. Requirement for verified healthcare
23. Requirement for verified healthcare identifier
23. Requirement for verified healthcare identifier
(1) For the purposes of paragraph 41(1)(c) of the Act, and paragraphs 3(1)(b) and 6(3)(c) of Schedule 1 to the Act, the System Operator must be satisfied that the healthcare recipient has a verified healthcare identifier.
(2) Subrule (1) does not limit the matters to which the System Operator may have regard when satisfying itself that the identity of a healthcare recipient has been appropriately verified.
24. Identity verification on ceasing to
24. Identity verification on ceasing to have an authorised representative
24. Identity verification on ceasing to have an authorised representative
(1) For the purposes of paragraph 109(7)(b) of the Act, if a healthcare recipient ceases to have an authorised representative the System Operator must require the healthcare recipient to verify his or her identity before the healthcare recipient is able to take control of their My Health Record.
(2) Subrule (1) does not apply if the healthcare recipient has previously verified his or her identity with the System Operator.
(3) In deciding whether a healthcare recipient has verified his or her identity under subrule (1), the System Operator may have regard to any relevant matter.
Note: Subrule 11(2) specifies when a healthcare recipient takes control of his or her My Health Record.
Part 4A Classes of authorised representatives and nominated representatives not required to have an assigned healthcare identifier
24A. Authorised representatives who are
24A. Authorised representatives who are professional representatives
24A. Authorised representatives who are professional representatives
For the purposes of paragraph 6(6)(b) of the Act, a person who is a professional representative is not required to have been assigned a healthcare identifier to be an authorised representative of a healthcare recipient.
24B. Nominated representatives who are p
24B. Nominated representatives who are professional representatives
24B. Nominated representatives who are professional representatives
For the purposes of paragraph 7(3)(b) of the Act, a person who is a professional representative is not required to have been assigned a healthcare identifier to be a nominated representative of a healthcare recipient.
Part 5 Participation requirements for healthcare provider organisations and contracted service providers
Division 1 General requirements of healthcare provider organisations
25. Registration Requirements
25. Registration Requirements
25. Registration Requirements
For paragraph 43(b) of the Act, it is a requirement that a healthcare provider organisation comply with the requirements specified in this Division in order to be eligible, and remain eligible, for registration under Division 2 of Part 3 of the Act.
26. Authority to act on behalf of health
26. Authority to act on behalf of healthcare provider organisation
26. Authority to act on behalf of healthcare provider organisation
A healthcare provider organisation must ensure that:
(a) if the organisation is a seed organisation, or if it is not part of a network – the organisation’s responsible officer and organisation maintenance officer are authorised to act on the organisation’s behalf in its dealings with the System Operator; and
(b) if the organisation is a network organisation – the following individuals are authorised to act on the organisation’s behalf in its dealings with the System Operator:
(i) the responsible officer and the organisation maintenance officer of the seed organisation for the network to which the network organisation belongs; and
(ii) the organisation’s organisation maintenance officer.
27. Requirements to participate
27. Requirements to participate
27. Requirements to participate
(1) Healthcare provider organisations must ensure that their organisation maintenance officers establish and maintain with the System Operator an accurate and up-to-date list of all identified healthcare providers who are individuals who are authorised to access the My Health Record system via or on behalf of the organisation using the provider portal.
(2) Within a network:
(a) the seed organisation must be registered under Division 2 of Part 3 of the Act in order for any network organisation within the network to be registered;
(b) the healthcare provider organisation that is directly hierarchically superior to a network organisation (the applicant organisation) must be registered under Division 2 of Part 3 of the Act in order for the applicant organisation to be registered; and
(c) healthcare provider organisations must ensure that their organisation maintenance officer, and if relevant their responsible officer, establish and maintain an accurate and up-to-date record with the service operator of the linkages between organisations within the network.
28. Registration of network organisation
28. Registration of network organisations
28. Registration of network organisations
A seed organisation must ensure that its network is established and maintained in a manner that permits the assignment of access flags in accordance with rules 9 and 10.
29. Exercising due care and skill when u
29. Exercising due care and skill when uploading or downloading records
29. Exercising due care and skill when uploading or downloading records
(1) A healthcare provider organisation must take reasonable steps to ensure that they and their employees exercise due care and skill:
(a) so that any record that they or their employees upload to the My Health Record system is, at the time the record is uploaded, accurate, up-to-date, not misleading and not defamatory; and
(b) about whether any records that they or their employees access via, or download from, the My Health Record system are accurate, up-to-date and fit for purpose.
(2) Subrule (1)(a) does not apply if:
(a) the record being uploaded was created by an individual who was not, at the time the record was created, an employee of the uploading healthcare provider organisation; and
(b) there is nothing in the record that would indicate to a reasonable person in the circumstances that the record was not accurate or up-to-date.
(3) The uploading of a record to the My Health Record system does not affect any other obligation a healthcare provider organisation or their employees may have to:
(a) keep clinical records about a healthcare recipient; or
(b) communicate health information to a healthcare recipient.
30. Requirement to notify the System Ope
30. Requirement to notify the System Operator of certain things
30. Requirement to notify the System Operator of certain things
(1) This rule applies if a healthcare provider organisation:
(a) becomes aware or suspects that there is a non-clinical, My Health Record system-related error in a record that has been accessed via, or downloaded from, the My Health Record system by it or its employees; or
(b) undergoes a material change.
(2) A healthcare provider organisation must:
(a) give the System Operator, in writing, details of the error or material change; and
(b) do so within two business days of become aware or suspecting the error, or undergoing the material change.
Example: A healthcare provider organisation must promptly notify the System Operator if they or their employees become aware of an uploaded record which appears to have been corrupted during upload.
31. Requirement to maintain interoperabi
31. Requirement to maintain interoperability
31. Requirement to maintain interoperability
A healthcare provider organisation must maintain interoperability with the My Health Record system in accordance with the System Operator’s interoperability requirements.
32. Requirement to provide assistance
32. Requirement to provide assistance
32. Requirement to provide assistance
(1) At the System Operator’s request, a healthcare provider organisation must promptly provide all necessary assistance in relation to any inquiry, audit, review, assessment, investigation or complaint in connection with the My Health Record system conducted, handled, requested or facilitated by the System Operator.
(2) Subrule (1) does not apply unless the System Operator gives the healthcare provider organisation reasonable notice of the assistance required.
32A
Uploading advance care planning information
32A Uploading advance care planning information
A healthcare provider organisation may only upload to a repository advance care planning information where the healthcare recipient instructs the healthcare provider organisation to upload the information.
Division 2 General requirements of contracted service providers
33. Requirements for registration
33. Requirements for registration
33. Requirements for registration
For paragraph 48(a) of the Act, it is a requirement that a contracted service provider comply with the requirements specified in this Division in order to be eligible, and remain eligible, for registration under Division 3 of Part 3 of the Act.
34. Link to a healthcare provider organi
34. Link to a healthcare provider organisation
34. Link to a healthcare provider organisation
(1) A contracted service provider must be linked to one or more registered healthcare provider organisations.
(2) For the purposes of subrule (1), a contracted service provider is linked to a registered healthcare provider organisation if:
(a) there is a contract in force between the contracted service provider and the registered healthcare provider organisation under which the contracted service provider provides to the registered healthcare provider organisation:
(i) information technology services related to the My Health Record system; or
(ii) health information management services relating to the My Health Record system; and
(b) the registered healthcare provider organisation has:
(i) notified the System Operator of the link between itself and the contracted service provider; and
(ii) not notified the System Operator that the link between itself and the contracted service provider is no longer current.
(3) A contracted service provider will no longer be linked to a registered healthcare provider organisation if:
(a) the contracted service provider’s contract with the healthcare provider organisation expires or is terminated; or
(b) the registered healthcare provider organisation notifies the System Operator that the link between itself and the contracted service provider is no longer current.
(4) If a contracted service provider contravenes subrule (1), the System Operator may suspend or cancel the contracted service provider’s access to the My Health Record system.
35. Registration with service operator
35. Registration with service operator
35. Registration with service operator
A contracted service provider must register with the service operator as a contracted service provider.
36. Appointment of contracted service pr
36. Appointment of contracted service provider officer
36. Appointment of contracted service provider officer
(1) A contracted service provider must appoint a contracted service provider officer, who is employed by the contracted service provider.
(2) The contracted service provider must have at least one, but no more than three, contracted service provider officers at all times.
(3) A contracted service provider must ensure that its contracted service provider officer appointed under subrule (1) carries out the duties prescribed under subrule (4).
(4) A person is the contracted service provider officer for a contracted service provider if the duties of the person include the following:
(a) receiving communications from the System Operator about the operation of the My Health Record system;
(b) acting as a liaison between the System Operator and the contracted service provider; and
(c) maintaining the System Operator’s records about the professional and business details of the contracted service provider officer and the contracted service provider.
37. Access to the My Health Record Syste
37. Access to the My Health Record System
37. Access to the My Health Record System
(1) A contracted service provider must only use or access the My Health Record system to the extent they have been instructed to do so by a linked registered healthcare provider organisation.
(2) Each time a contracted service provider accesses the My Health Record system, or collects, uses or discloses a record from or to the My Health Record system, the contracted service provider must give the System Operator the healthcare identifier of the linked registered healthcare provider organisation which instructed the contracted service provider to access the My Health Record system or to collect, use or disclose the record.
38. Requirement to notify the System Ope
38. Requirement to notify the System Operator of certain things
38. Requirement to notify the System Operator of certain things
(1) This rule applies if a contracted service provider:
(a) becomes aware, or suspects, that:
(i) the contracted service provider has given the System Operator, or uploaded to the My Health Record system, inaccurate provenance information;
(ii) there is a non-clinical, My Health Record system-related error in a record that has been accessed via, or downloaded from, the My Health Record system;
(iii) under rule 34(3), a registered healthcare provider organisation for which the contracted service provider provides services is no longer linked to the contracted service provider;
(b) undergoes a material change;
(c) has appointed, or cancelled the appointment of, a contracted service provider officer under rule 36; or
(d) changes, or becomes aware of a change in, the professional or business details of its currently appointed contracted service provider officer.
(2) A contracted service provider must:
(a) give the System Operator, in writing, details of the event or circumstances; and
(b) do so within two business days of become aware or suspecting the event or circumstance.
39. Requirement to maintain interoperabi
39. Requirement to maintain interoperability
39. Requirement to maintain interoperability
A contracted service provider must maintain interoperability with the My Health Record system in accordance with the System Operator’s interoperability requirements.
40. Requirement to provide assistance
40. Requirement to provide assistance
40. Requirement to provide assistance
(1) At the System Operator’s request, a contracted service provider must promptly provide all necessary assistance in relation to any inquiry, audit, review, assessment, investigation or complaint in connection with the My Health Record system conducted, handled, requested or facilitated by the System Operator.
(2) Subrule (1) does not apply unless the System Operator gives the contracted service provider reasonable notice of the assistance required.
Division 3 Security requirements for healthcare provider organisations
41. Requirements for registration
41. Requirements for registration
41. Requirements for registration
For paragraph 43(b) of the Act, it is a requirement that a healthcare provider organisation comply with the requirements specified in this Division in order to be eligible, and remain eligible, for registration under Division 2 of Part 3 of the Act.
42. Healthcare provider organisation pol
42. Healthcare provider organisation policies
42. Healthcare provider organisation policies
(1) Healthcare provider organisations must have a written policy that reasonably addresses the matters specified in subrule (4).
(2) Healthcare provider organisations must communicate the policy mentioned in subrule (1), and ensure that the policy remains readily accessible, to all its employees and to any healthcare providers to whom the organisation supplies services under contract.
Example: A healthcare provider organisation that supplies information technology services to individual healthcare providers, via which those providers access the My Health Record system, must communicate the policy to the providers.
(3) Healthcare provider organisations must enforce the policy mentioned in subrule (1) in relation to all its employees and any healthcare providers to whom the organisation supplies services under contract.
(4) Without limiting the matters a healthcare provider organisation’s policy must reasonably address, the policy is, subject to subrule (5), to address the following:
(a) the manner of authorising persons accessing the My Health Record system via or on behalf of the healthcare provider organisation, including the manner of suspending and deactivating the user account of any authorised person:
(i) who leaves the healthcare provider organisation;
(ii) whose security has been compromised; or
(iii) whose duties no longer require them to access the My Health Record system;
(b) the training that will be provided to healthcare provider organisation employees before they are authorised to access the My Health Record system, including in relation to how to use the My Health Record system accurately and responsibly, the legal obligations on healthcare provider organisations and individuals using the My Health Record system and the consequences of breaching those obligations;
(c) the process for identifying a person who requests access to a healthcare recipient’s My Health Record and communicating the person’s identity to the System Operator so that the healthcare provider organisation is able to meet its obligations under section 74 of the Act;
(d) the physical and information security measures that are to be established and adhered to by the healthcare provider organisation and people accessing the My Health Record system via or on behalf of the healthcare provider organisation, including the user account management measures that must be implemented under rule 44;
(e) mitigation strategies to ensure My Health Record system-related security risks can be promptly identified, acted upon and reported to the healthcare provider organisation’s management; and
(f) where the healthcare provider organisation provides assisted registration:
(i) the manner of authorising employees of the organisation to provide assisted registration;
(ii) the training that will be provided before a person is authorised to provide assisted registration;
(iii) the manner of confirming a healthcare recipient’s consent for the purposes of rule 9 of the My Health Records (Assisted Registration) Rule 2015; and
(iv) the process and criteria for identifying a healthcare recipient for the purposes of assisted registration.
(5) If in the reasonable opinion of a healthcare provider organisation, a requirement in subrule (4) is not applicable to the organisation due to the limited size of the organisation, the organisation’s policy need not address that requirement.
(6) Healthcare provider organisations must ensure that:
(a) the policy mentioned in subrule (1) is:
(i) drafted in such a manner that the organisation’s performance can be audited against the policy to determine if the organisation has complied with the policy; and
(ii) kept up-to-date;
(b) each iteration of the policy contains a unique version number and the date when that iteration came into effect;
(c) without limiting paragraph (6)(a)(ii) – the policy is reviewed at least annually and when any material new or changed risks are identified. The review must include consideration of:
(i) factors that might result in:
(A) unauthorised access to the My Health Record system using the healthcare provider organisation’s information systems;
(B) the misuse or unauthorised disclosure of information from a healthcare recipient’s My Health Record by persons authorised to access the My Health Record system via or on behalf of the healthcare provider organisation; and
(C) the accidental disclosure of information contained in a healthcare recipient’s My Health Record;
(ii) any changes to the My Health Record system that may affect the healthcare provider organisation; and
(iii) any relevant legal or regulatory changes that have occurred since the last review; and
(d) a record of each iteration of the policy mentioned in subrule (1) is retained in accordance with the record keeping obligations (if any) applicable to the healthcare provider organisation.
43. Policy to be provided to the System
43. Policy to be provided to the System Operator on request
43. Policy to be provided to the System Operator on request
(1) The System Operator may request in writing that a healthcare provider organisation give it a copy of the policy mentioned in subrule 42(1).
(2) A healthcare provider organisation must comply with a request from the System Operator under this rule within 7 days of receiving the request.
(3) The System Operator may request a healthcare provider organisation’s current policy or the policy that was in force on a specified date.
44. User account management within healt
44. User account management within healthcare provider organisations
44. User account management within healthcare provider organisations
Healthcare provider organisations must ensure that their information technology systems, which are used by people to access the My Health Record system via or on behalf of the healthcare provider organisation, employ reasonable user account management practices including:
(a) restricting access to those persons who require access as part of their duties;
(b) uniquely identifying individuals using the healthcare provider organisation’s information technology systems, and having that unique identity protected by a password or equivalent protection mechanism;
(c) having password and/or other access mechanisms that are sufficiently secure and robust given the security and privacy risks associated with unauthorised access to the My Health Record system;
(d) ensuring that the user accounts of persons no longer authorised to access the My Health Record system via or on behalf of the healthcare provider organisation prevent access to the My Health Record system; and
(e) suspending a user account that enables access to the My Health Record system as soon as practicable after becoming aware that the account or its password or access mechanism has been compromised.
45. Retention of record codes and docume
45. Retention of record codes and document codes
45. Retention of record codes and document codes
Healthcare provider organisations must ensure that people using their information technology systems to access the My Health Record system via or on behalf of the organisation do not record, store or retain a copy of a healthcare recipient’s record code or document code for the purposes of accessing the healthcare recipient’s My Health Record, or a record in the healthcare recipient’s My Health Record, in the future.
Note: Where a record code or document code is used to access a My Health Record or a record in a My Health Record, the code is not stored in the healthcare provider organisation’s clinical information system. For example, using a record code places the organisation on the access list for the healthcare recipient’s My Health Record, and information about this permitted access is stored by the System Operator. It will not be necessary for a healthcare provider organisation to enter the record code each time access is needed to the same healthcare recipient’s My Health Record, provided the organisation remains on the access list for the healthcare recipient’s My Health Record.
Division 4 Security requirements for contracted service providers
46. Requirements for registration
46. Requirements for registration
46. Requirements for registration
For paragraph 48(a) of the Act, it is a requirement that a contracted service provider comply with the requirements specified in this Division in order to be eligible, and remain eligible, for registration under Division 3 of Part 3 of the Act.
47. Contracted service provider policies
47. Contracted service provider policies
47. Contracted service provider policies
(1) Contracted service providers must have a written policy that reasonably addresses the matters specified in subrule (4).
(2) Contracted service providers must communicate the policy mentioned in subrule (1), and ensure that the policy remains readily accessible, to all its employees.
(3) Contracted service providers must enforce the policy mentioned in subrule (1) in relation to all its employees.
(4) Without limiting the matters a contracted service provider’s policy must reasonably address, the policy is, subject to subrule (5), to address the following:
(a) the manner of authorising persons accessing the My Health Record system via or on behalf of the contracted service provider’s linked healthcare provider organisation, including the manner of suspending and deactivating the user account of any authorised person:
(i) who leaves the contracted service provider;
(ii) whose security has been compromised; or
(iii) whose duties no longer require them to access the My Health Record system on behalf of a linked healthcare provider organisation;
(b) the training that will be provided to contracted service provider employees before they are authorised to access the My Health Record system, including in relation to how to use the My Health Record system accurately and responsibly, the legal obligations on contracted service providers and individuals using the My Health Record system and the consequences of breaching those obligations;
(c) the physical and information security measures that are to be established and adhered to by the contracted service provider, including the user account management measures that must be implemented under rule 49; and
(d) mitigation strategies to ensure My Health Record system-related security risks can be promptly identified, acted upon and reported to the contracted service provider’s management.
(5) If in the reasonable opinion of a contracted service provider, a requirement in subrule (4) is not applicable to the provider due to the limited size of the provider, the provider’s policy need not address that requirement.
(6) Contracted service providers must ensure that:
(a) the policy mentioned in subrule (1) is:
(i) drafted in such a manner that the provider’s performance can be audited against the policy to determine if the provider has complied with the policy; and
(ii) kept up-to-date;
(b) each iteration of the policy contains a unique version number and the date when that iteration came into effect;
(c) without limiting paragraph (6)(a)(ii) – the policy is reviewed at least annually and when any material new or changed risks are identified. The review must include consideration of:
(i) factors that might result in:
(A) unauthorised access to the My Health Record system using the contracted service provider’s information systems;
(B) the misuse or unauthorised disclosure of information from a healthcare recipient’s My Health Record by persons authorised to access the My Health Record system via or on behalf of a linked healthcare provider organisation; and
(C) the accidental disclosure of information contained in a healthcare recipient’s My Health Record;
(ii) any changes to the My Health Record system that may affect the contracted service provider; and
(iii) any relevant legal or regulatory changes that have occurred since the last review; and
(d) a record of each iteration of the policy mentioned in subrule (1) is retained in accordance with the record keeping obligations (if any) applicable to the contracted service provider.
48. Policy to be provided to the System
48. Policy to be provided to the System Operator on request
48. Policy to be provided to the System Operator on request
(1) The System Operator may request in writing that a contracted service provider give it a copy of the policy mentioned in subrule 47(1).
(2) A contracted service provider must comply with a request from the System Operator under this rule within 7 days of receiving the request.
(3) The System Operator may request a contracted service provider’s current policy or the policy that was in force on a specified date.
49. User account management within contr
49. User account management within contracted service providers
49. User account management within contracted service providers
Contracted service providers must ensure that their information technology systems, which are used to access the My Health Record system via or on behalf of linked healthcare provider organisations, employ reasonable user account management practices including:
(a) restricting access to those persons who require access as part of their duties;
(b) uniquely identifying individuals using the contracted service provider’s information technology systems, and having that unique identity protected by a password or equivalent protection mechanism;
(c) having password and/or other access mechanisms that are sufficiently secure and robust given the security and privacy risks associated with unauthorised access to the My Health Record system;
(d) ensuring that the user accounts of persons no longer authorised to access the My Health Record system via or on behalf of linked a healthcare provider organisation prevent access to the My Health Record system; and
(e) suspending a user account that enables access to the My Health Record system as soon as practicable after becoming aware that the account or its password or access mechanism has been compromised.
50. Retention of record codes and docume
50. Retention of record codes and document codes
50. Retention of record codes and document codes
Contracted service providers must ensure that people using their information technology systems to access the My Health Record system via or on behalf of a linked healthcare provider organisation do not record, store or retain a copy of a healthcare recipient’s record code or document code for the purposes of accessing the healthcare recipient’s My Health Record, or a record in the healthcare recipient’s My Health Record, in the future.
Part 6 Participation requirements for operators
Division 1 General requirements
51. Application of this Division
51. Application of this Division
51. Application of this Division
This Division applies to an operator.
52. Requirements for registration
52. Requirements for registration
52. Requirements for registration
For paragraph 48(a) of the Act, it is a requirement that an operator complies with the requirements specified in this Division in order to be eligible, and remain eligible, for registration under Division 3 of Part 3 of the Act.
53. Appointment of operator officer
53. Appointment of operator officer
53. Appointment of operator officer
(1) An operator must appoint an operator officer who is employed by the operator.
(2) The operator must have at least one, but no more than three, operator officers at all times.
(3) The operator must ensure that its operator officer appointed under subrule (1) carries out the duties prescribed under subrule (4).
(4) A person is the operator officer for an operator if the duties of the person include the following:
(a) receiving communications from the System Operator about the operation of the My Health Record system;
(b) acting as a liaison between the System Operator and the operator; and
(c) maintaining the System Operator’s records of the professional and business details of the operator and the operator officer.
54. Operator technical and after-hours c
54. Operator technical and after-hours contacts
54. Operator technical and after-hours contacts
An operator must:
(a) provide a point of contact and technical support for the operator during ordinary business hours Monday to Friday, other than public holidays; and
(b) at all other times provide at least two current points of contact who have the authority and are able to resolve, or coordinate the resolution of, any technical, security or operational issues affecting the operator.
55. Requirement to notify the System Ope
55. Requirement to notify the System Operator of certain things
55. Requirement to notify the System Operator of certain things
(1) This rule applies if an operator:
(a) becomes aware, or suspects, that:
(i) there is a non-clinical, My Health Record system-related error in a record that has been accessed via, or downloaded from, the My Health Record system;
(ii) the operator has given the System Operator, or uploaded to the My Health Record system, inaccurate provenance information;
(b) undergoes a material change;
(c) has appointed or cancelled the appointment of an operator officer;
(d) changes, or becomes aware of a change in, the professional or business details of its currently appointed operator officer.
(2) An operator must:
(a) give the System Operator, in writing, details of the event or circumstances; and
(b) do so within two business days of become aware or suspecting the event or circumstance.
56. Requirement to maintain interoperabi
56. Requirement to maintain interoperability
56. Requirement to maintain interoperability
An operator must maintain interoperability with the My Health Record system in accordance with the System Operator’s interoperability requirements.
57. Requirement to provide assistance
57. Requirement to provide assistance
57. Requirement to provide assistance
(1) At the System Operator’s request, an operator must promptly provide all necessary assistance in relation to any inquiry, audit, review, assessment, investigation or complaint in connection with the My Health Record system conducted, handled, requested or facilitated by the System Operator.
(2) Subrule (1) does not apply unless the System Operator gives the operator reasonable notice of the assistance required.
Division 2 Security requirements for operators
58. Requirements for registration
58. Requirements for registration
58. Requirements for registration
For paragraph 48(a) of the Act, it is a requirement that an operator comply with the requirements specified in this Division in order to be eligible, and remain eligible, for registration under Division 3 of Part 3 of the Act.
59. Operator policies
59. Operator policies
59. Operator policies
(1) Operators must have a written policy that reasonably addresses the matters specified in subrule (4).
(2) Operators must communicate the policy mentioned in subrule (1), and ensure that the policy remains readily accessible, to all its employees.
(3) Operators must enforce the policy mentioned in subrule (1) in relation to all their employees.
(4) Without limiting the matters an operator’s policy must reasonably address, the policy is, subject to subrule (5), to address the following:
(a) the manner of authorising persons accessing the My Health Record system via or on behalf of the operator, including the manner of suspending and deactivating the user account of any authorised person:
(i) who leaves the operator;
(ii) whose security has been compromised; or
(iii) whose duties no longer require them to access the My Health Record system;
(b) the training that will be provided to operator employees before they are authorised to access the My Health Record system, including in relation to how to use the My Health Record system accurately and responsibly, the legal obligations on operators and individuals using the My Health Record system and the consequences of breaching those obligations;
(c) the physical and information security measures that are to be established and adhered to by the operator, including the user account management measures that must be implemented under rule 61; and
(d) mitigation strategies to ensure My Health Record system-related security risks can be promptly identified, acted upon and reported to the operator’s management.
(5) If in the reasonable opinion of an operator, a requirement in subrule (4) is not applicable to the operator due to the limited size of the operator, the operator’s policy need not address that requirement.
(6) Operators must ensure that:
(a) the policy mentioned in subrule (1) is:
(i) drafted in such a manner that the operator’s performance can be audited against the policy to determine if the operator has complied with the policy; and
(ii) kept up-to-date;
(b) each iteration of the policy contains a unique version number and the date when that iteration came into effect;
(c) without limiting paragraph (6)(a)(ii) – the policy is reviewed at least annually and when any material new or changed risks are identified. The review must include consideration of:
(i) factors that might result in:
(A) unauthorised access to the My Health Record system using the operator’s information systems;
(B) the misuse or unauthorised disclosure of information from a healthcare recipient’s My Health Record by persons authorised to access the My Health Record system via or on behalf of an operator; and
(C) the accidental disclosure of information contained in a healthcare recipient’s My Health Record;
(ii) any changes to the My Health Record system that may affect the operator; and
(iii) any relevant legal or regulatory changes that have occurred since the last review; and
(d) a record of each iteration of the policy mentioned in subrule (1) is retained in accordance with the record keeping obligations (if any) applicable to the operator.
60. Policy to be provided to the System
60. Policy to be provided to the System Operator on request
60. Policy to be provided to the System Operator on request
(1) The System Operator may request in writing that an operator give it a copy of the policy mentioned in subrule 59(1).
(2) An operator must comply with a request from the System Operator under this rule within 7 days of receiving the request.
(3) The System Operator may request an operator’s current policy or the policy that was in force on a specified date.
61. User account management within opera
61. User account management within operators
61. User account management within operators
Operators must ensure that their information technology systems, which are used to access the My Health Record system, employ reasonable user account management practices including:
(a) restricting access to those persons who require access as part of their duties;
(b) uniquely identifying individuals using the operator’s information technology systems, and having that unique identity protected by a password or equivalent protection mechanism;
(c) having password and/or other access mechanisms that are sufficiently secure and robust given the security and privacy risks associated with unauthorised access to the My Health Record system;
(d) ensuring that the user accounts of persons no longer authorised to access the My Health Record system prevent access to the My Health Record system; and
(e) suspending a user account that enables access to the My Health Record system as soon as practicable after becoming aware that the account or its password or access mechanism has been compromised.
Division 3 Security requirements for portal operators
62. Requirements for registration
62. Requirements for registration
62. Requirements for registration
For paragraph 48(a) of the Act, it is a requirement that a portal operator comply with the requirements specified in this Division in order to be eligible, and remain eligible, for registration under Division 3 of Part 3 of the Act.
63. Retention of record codes and docume
63. Retention of record codes and document codes by portal operators
63. Retention of record codes and document codes by portal operators
(1) Portal operators must ensure that people using their information technology systems to access the My Health Record system do not record, store or retain a copy of a healthcare recipient’s record code or document code for the purposes of accessing the healthcare recipient’s My Health Record, or a record in the healthcare recipient’s My Health Record, in the future.
(2) Subrule (1) does not apply to portal operators to the extent they operate a portal that provides access to the My Health Record system solely to healthcare recipients.
Schedule 1—Application provisions
1. Definitions
1. Definitions
1. Definitions
In this Schedule:
the amending Act means the Health Legislation Amendment (eHealth) Act 2015.
the Rule means the My Health Records Rule 2016.
2. Repeal
2. Repeal
2. Repeal
Paragraph 3(b) of the Rule applies on and after the application day as defined in item 111 of Schedule 1 to the amending Act.
3. Security, operations, administration
3. Security, operations, administration and uploading records
3. Security, operations, administration and uploading records
Paragraph 17(2)(c) and subrule 17(3) of the Rule apply on or after the application day as defined in item 111 of Schedule 1 to the amending Act.
4. Restriction on uploading records prep
4. Restriction on uploading records prepared by healthcare providers whose registration or membership is suspended, cancelled, etc.
4. Restriction on uploading records prepared by healthcare providers whose registration or membership is suspended, cancelled, etc.
Rule 20 of the Rule applies on or after the application day as defined in item 111 of Schedule 1 to the amending Act.
5. Effective removal of records
5. Effective removal of records
5. Effective removal of records
Paragraph 21(1)(c) of the Rule applies on or after the application day as defined in item 111 of Schedule 1 to the amending Act.
6. Participation requirements for health
6. Participation requirements for healthcare provider organisations and contracted service providers
6. Participation requirements for healthcare provider organisations and contracted service providers
(1) Rules 29, 30, 31 and 32 of the Rule apply on or after the application day, as defined in item 111 of Schedule 1 to the amending Act.
(2) Divisions 2 and 4 of Part 5 of the Rule apply on or after the application day, as defined in item 111 of Schedule 1 to the amending Act.
7. Participation requirements for operat
7. Participation requirements for operators
7. Participation requirements for operators
Part 6 of the Rule applies on or after the application day, as defined in item 111 of Schedule 1 to the amending Act.
Endnote 1—About the endnotes
Endnote 1—About the endnotes
Endnote 1—About the endnotes
The endnotes provide information about this compilation and the compiled law.
The following endnotes are included in every compilation:
Endnote 1—About the endnotes
Endnote 2—Abbreviation key
Endnote 3—Legislation history
Endnote 4—Amendment history
Abbreviation key—Endnote 2
The abbreviation key sets out abbreviations that may be used in the endnotes.
Legislation history and amendment history—Endnotes 3 and 4
Amending laws are annotated in the legislation history and amendment history.
The legislation history in endnote 3 provides information about each law that has amended (or will amend) the compiled law. The information includes commencement details for amending laws and details of any application, saving or transitional provisions that are not included in this compilation.
The amendment history in endnote 4 provides information about amendments at the provision (generally section or equivalent) level. It also includes information about any provision of the compiled law that has been repealed in accordance with a provision of the law.
Misdescribed amendments
A misdescribed amendment is an amendment that does not accurately describe the amendment to be made. If, despite the misdescription, the amendment can be given effect as intended, the amendment is incorporated into the compiled law and the abbreviation “(md)” added to the details of the amendment included in the amendment history.
If a misdescribed amendment cannot be given effect as intended, the abbreviation “(md not incorp)” is added to the details of the amendment included in the amendment history.
Endnote 2—Abbreviation key
Endnote 2—Abbreviation key
Endnote 2—Abbreviation key
orig = original
ad = added or inserted
par = paragraph(s)/subparagraph(s)
am = amended
/sub‑subparagraph(s)
amdt = amendment
pres = present
c = clause(s)
prev = previous
C[x] = Compilation No. x
(prev…) = previously
Ch = Chapter(s)
Pt = Part(s)
def = definition(s)
r = regulation(s)/rule(s)
Dict = Dictionary
disallowed = disallowed by Parliament
reloc = relocated
Div = Division(s)
renum = renumbered
exp = expires/expired or ceases/ceased to have
rep = repealed
effect
rs = repealed and substituted
F = Federal Register of Legislation
s = section(s)/subsection(s)
gaz = gazette
Sch = Schedule(s)
LI = Legislative Instrument
Sdiv = Subdivision(s)
LIA = Legislative Instruments Act 2003
SLI = Select Legislative Instrument
(md) = misdescribed amendment
SR = Statutory Rules
(md not incorp) = misdescribed amendment cannot be given effect
Sub‑Ch = Sub‑Chapter(s)
mod = modified/modificationNo. = Number(s)
SubPt = Subpart(s)
o = order(s)
underlining = whole or part not
Ord = Ordinance
commenced or to be commenced
Endnote 3—Legislation history
Endnote 3—Legislation history
Endnote 3—Legislation history
Title
FRL registration date
Commencement date
Application, saving andtransitional provisions
My Health Records Rule 2016
8 February 2016 (see F2016L00095)
9 February 2016
My Health Records Amendment (Advance Care Planning Information and Professional Representatives) Rule 2016
Sourced from the Federal Register of Legislation (legislation.gov.au), CC BY 4.0.
1. Name of Rule 1. Name of Rule
1. Name of Rule
This Rule is the My Health Records Rule 2016.
2. Commencement 2. Commencement
2. Commencement
(1) Each provision of this instrument specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.
rules authorising the System Operator to effectively remove records for specified reasons (defamation, system security/integrity risks or contravention-based clinical risk) and to direct participants to do likewise, together with mandatory notification to both the healthcare recipient and the uploader and conditions for replacement uploads (rule 21);
participation, security and administrative requirements for healthcare provider organisations, contracted service providers, operators and portal operators, including interoperability obligations, appointed officers, written policies, user account management standards and notification duties on errors or material change (Parts 5 and 6; rules 25-66 and onward);
identity‑verification requirements where a healthcare recipient takes control after ceasing to have an authorised representative and a requirement that a healthcare recipient have a verified healthcare identifier in specified circumstances (rules 23-24);
express rules limiting the retention or storage of record codes and document codes by provider, contracted provider and portal operators (rules 45, 50, 63).
Mechanically, the Rule translates statutory hooks in the Act (for example, paragraphs 15(b) and (c), subsection 109(6), subsection 64(1)-(2), paragraph 41(1)(c), paragraph 45(b)(ii) and others) into concrete operational duties, processes and system behaviours for the System Operator and participants. It defines who must do what to be eligible for registration as a participant (see the registration-linked requirements in Parts 5 and 6), and it creates administrative levers the System Operator may apply where those obligations are not met (for example notices requesting changes to access flags (rule 10(3)(b)), directions to effectively remove records (rule 21(1)) and suspension or cancellation of access (rules 17, 30, 34(4)).
The Rule embeds a set of trade-offs and exceptions into the access architecture. It gives healthcare recipients mechanisms to restrict access to specific records, but it preserves both uploader access and the s 64 statutory exceptions for serious threats to life or public safety. It places operational, security and notification burdens on organisations and service providers, and centralises several supervisory and remedial powers with the System Operator.
Main concepts
The Rule uses a number of core concepts that determine how access and security operate in practice. These are defined within the Rule (rule 4) and then used to impose duties and system mechanics.
Access control mechanisms. Two tiers are mandated: default access controls (rule 5) and advanced access controls (rule 6). Default controls permit all registered healthcare provider organisations involved in a recipient’s care to access the My Health Record and maintain an access list. Advanced controls replicate default functionality and add the ability for registered healthcare recipients to apply record codes and document codes and to prevent some automated visibility checks by clinical information systems (rule 6(1)(b), (c) and (d)). Advanced controls also permit alerting recipients when a third party accesses their record (rule 6(1)(d)).
Access lists and access flags. The access list is the per-recipient record of which registered healthcare provider organisations are permitted to access the My Health Record (rule 5(b)). Access flags are technical mechanisms used by the System Operator to determine which organisations within a provider network are added to or omitted from an access list when an organisation accesses a record (rule 9(a)-(c)). Access flags are set and maintained in the context of a network, and the seed organisation’s responsible officer and/or organisation maintenance officer is responsible for setting the flags (rule 9(c)). The Rule requires that access flags be assigned in accordance with balancing principles that weigh reasonable recipient expectations about information sharing against the organisation’s internal arrangements for access (rule 10(1)).
Record codes and document codes. A record code can restrict access to an entire My Health Record (rule 6(1)(a) and note 3), while document codes restrict access to individual records within a My Health Record (rule 6(1)(c) and 6(2)). The default is that records are uploaded without a document code (rule 6(2)(c)). Once a record code or document code is granted to a registered healthcare provider organisation, that organisation need not be re‑given the same code while it remains on the access list (note 1 to rule 6).
Serious threat exceptions. The Rule operationalises the Act’s statutory exceptions for serious threats to life, health or safety and to public health or safety (subsections 64(1) and 64(2) of the Act). Rules 7 and 8 require the access control mechanisms to permit registered healthcare provider organisations to assert those statutory circumstances to the System Operator and to ensure that access under those authorisations bypasses record and document codes (rules 7(2)(a)-(b); 8(2)(a)-(b)). Both rules also state that records that have been effectively removed must not be accessible in such circumstances (rules 7(2)(c); 8(2)(c)).
Effective removal versus restoration. The System Operator may effectively remove records, or direct participants to do so, where records are defamatory, affect system security or integrity, or were uploaded in contravention of specified Act provisions and create clinical risk (rule 21(1)). Effectively removed records are to be notified to both the healthcare recipient and the uploader and may be replaced if the replacement addresses the System Operator’s specified concerns and the uploader is a participant at the time (rule 21(3)(a)-(b)).
Roles and officer appointments. The Rule requires appointment of named officers for organisations: organisation maintenance officer and responsible officer for seed organisations (rule 26), contracted service provider officers (rule 36), operator officers (rule 53). These officers have liaison, communication and record-maintenance responsibilities (rules 36(4), 53(4)). The System Operator may require policies, notifications and assistance from these individuals and organisations (rules 32, 40, 57).
Participation, interoperability and registration. Registration eligibility is conditional on compliance with participation and security requirements in Part 5 and Part 6 respectively (see rules 25, 33, 52, 58, 62). Organisations, contracted providers and operators must maintain interoperability in accordance with interoperability requirements published by the System Operator (rules 31, 39, 56). Failure to maintain interoperability can be a basis for suspension of access (rule 17(2)(c), (3)).
Notification obligations and auditing. Multiple rules require written notification to the System Operator within two business days when certain incidents occur: detection of non-clinical, system-related errors; material changes in organisation status; inaccurate provenance information; or changes in officer appointment or professional/business details (rules 30(2), 38(2), 55(2)).
These concepts interact: record/document codes enable recipient control but are overridden by serious-threat access and by uploader access; access flags determine whether an organisation is treated as “involved in care” for purposes of access lists; and interoperability, policy, officer and notification obligations are tied to registration and to potential suspension or cancellation by the System Operator.
Who it affects
The Rule addresses multiple categories of actors in the My Health Record ecosystem and sets duties tailored to their roles. The Rule’s defined classes and specified obligations identify who must act and in what manner.
System Operator. The Rule repeatedly places system-level duties on the System Operator. It must establish and maintain default and advanced access controls (rules 5-6), implement access‑flag mechanisms (rule 9), permit assertions of serious-threat circumstances to the System Operator (rules 7-8), suspend access where security, integrity or operations are compromised (rule 17), provide availability details on request (rule 18), direct participants to effectively remove records (rule 21(1)-(3)), and receive notifications and policy material (rules 43, 48, 60). The System Operator thus decides technical system behaviour, issues notices and directions, and restores access following remedial steps (rule 17(8), 21(3)(b)).
Registered healthcare provider organisations. A primary focus of the Rule. Subject to registration requirements (rule 25), these organisations must maintain accurate lists of identified healthcare providers (rule 27(1)), ensure authorisations and officer appointments (rules 26, 36 for contracted providers), adopt and communicate written policies covering authorisation, training, security controls and assisted registration where relevant (rule 42), enforce user account management (rule 44), maintain interoperability (rule 31), notify the System Operator of errors or material change (rule 30), and avoid retaining record or document codes (rule 45). Seed organisations have additional duties for setting access flags and structuring networks (rules 9(c), 10(2), 28).
Individual healthcare providers. Individuals authorised to access the system via a provider organisation are indirectly regulated: organisations must maintain lists of these identified providers (rule 27(1)) and ensure training and user account management (rule 42(4)(b); rule 44). The Rule also affects individual healthcare providers who upload documents: uploaders retain right of access to records they uploaded even when recipients restrict access (rule 6(2)(b)(i)).
Contracted service providers. Those providing IT or health information management services must be linked to registered healthcare provider organisations (rule 34), register with the service operator (rule 35), appoint contracted service provider officers (rule 36), only access the system when instructed and identify the instructing linked registered healthcare provider organisation each time (rule 37), maintain interoperability (rule 39), adhere to policies and user account management (rules 47, 49), and notify the System Operator of certain events (rule 38). Failure to be linked risks suspension or cancellation (rule 34(4)).
Operators and portal operators. Repository operators, portal operators and other operators must appoint operator officers, provide technical and after-hours contacts, maintain interoperability, hold policies, implement user account management, and notify the System Operator of relevant events (rules 52-61). Portal operators specifically are subject to the retention-of-codes prohibition with a carve-out where the portal provides access solely to healthcare recipients (rule 63(2)).
Healthcare recipients, authorised representatives and nominated representatives. Healthcare recipients gain control tools and notification rights: they can view access lists (rule 5(c)), effectively remove records and ask the System Operator to restore them (rule 5(e)), apply record and document codes and set advanced access controls (rule 6(1)-(2)), and be alerted when third parties access their My Health Record (rule 6(1)(d)). Authorised and nominated representatives can lose access automatically or by System Operator action in specified circumstances (rules 11-16). Professional representatives have an express exemption from requiring an assigned healthcare identifier to be an authorised or nominated representative (rules 24A-24B).
Seed organisations and network organisations. Seed organisations are the locus for network access-flag assignment and must construct networks to permit assignment in accordance with the Rule’s principles (rule 28). Network organisations are placed on access lists in relation to how access flags are set (rules 9-10).
The practical effect is that primary compliance burdens fall on registered healthcare provider organisations, contracted service providers, operators and seed organisations that host networks. Individual healthcare providers and recipients experience functional consequences (access rights, restrictions and notifications), while the System Operator performs centralised decision-making and supervisory functions.
Key duties and rights
This section groups the Rule’s principal duties and rights by actor and links them to the Rule provisions.
System Operator duties and discretions
Establish and maintain default and advanced access controls that meet the functional specifications set out in rules 5 and 6. Those duties include implementing access lists, permitting recipients to view access lists, enabling record and document codes, permitting recipients to effectively remove and restore records and providing alerts on access (rules 5(a)-(f); 6(1)-(2)).
Implement access flags across provider networks and consult with seed organisations when the System Operator reasonably considers flags are improperly set; the System Operator may request reasonable changes by written notice (rules 9-10(3)-(4)).
Permit registered healthcare provider organisations to assert s 64 authorisations (serious threat) and implement mechanisms that bypass codes in authorised circumstances (rules 7-8).
Suspend access where system security, integrity or operations are or may be compromised, with notification requirements and restoration obligations (rule 17(1), (4)-(5), (8)).
Effectively remove records or direct participants to do so in specified circumstances, notify recipient and uploader and permit replacement uploads subject to conditions (rule 21(1)-(3)).
Receive and review policies and documentation on request, and require assistance, audits or responses from participants (rules 32, 40, 57; rules 43, 48, 60).
Rights and protections for healthcare recipients
View the access list for their My Health Record (rule 5(c)).
Set advanced access controls to restrict which organisations may access their record and restrict access to individual records by document codes (rule 6(1)(c), (2)(a)-(c)).
Effectively remove records and authorise the System Operator to restore them (rule 5(e)).
Receive an electronic alert when their My Health Record is accessed by a third party if they choose (rule 6(1)(d)).
Note that certain document types,shared health summaries, healthcare recipient-entered health summaries and advance care planning information,are not subject to recipient-imposed access prevention under rule 6(2)(a).
Duties of registered healthcare provider organisations
Meet registration eligibility requirements by complying with Division 1 obligations in Part 5 (rule 25).
Maintain accurate lists of identified healthcare providers authorised to use the provider portal (rule 27(1)).
Ensure officers are authorised to liaise with the System Operator and maintain link and network records (rules 26, 27(2)(c)).
Draft, communicate, enforce and review a written organisational policy addressing authorisation, training, identity verification, physical and information security, user account management and assisted registration where relevant (rule 42(1)-(6)).
Employ reasonable user account management practices, including unique identification, password protection, suspension of compromised accounts and restricting access to personnel with duties requiring access (rule 44).
Not record, store or retain copies of a recipient’s record code or document code for future access (rule 45).
Maintain interoperability per the System Operator’s requirements and notify the System Operator within two business days of specified events (rules 31, 30(2)).
Duties of contracted service providers and operators
Be linked to registered healthcare provider organisations under contract and notify the System Operator of linkages (rule 34).
Register with the service operator where required and appoint contracted service provider officers or operator officers with specified liaison duties (rules 35, 36, 53).
Only use or access the My Health Record system when authorised by a linked registered healthcare provider organisation and, when doing so, provide the healthcare identifier of the instructing organisation (rule 37(1)-(2)).
Maintain interoperability, hold and communicate policies, enact user account management practices and notify the System Operator of relevant errors, inaccurate provenance information, material changes or officer changes within two business days (rules 39, 47-49, 38, 55).
Procedural rights linked to Act provisions
The Rule points to Act-based procedural rights: for example, a decision whether a person is an authorised representative is made by the System Operator under section 6 of the Act and paragraph 97(1)(a) of the Act gives a right of review (note to rule 14). The Rule itself does not set out the review process but references the Act’s review mechanisms.
Collectively, the Rule prescribes both affirmative duties (build and operate required controls; adopt policies; notify; maintain interoperability; appoint officers) and constraining duties (do not retain record/document codes; do not transfer/dispose of records on cancellation without approval; observe uploader access rules). The System Operator holds supervisory rights to direct changes, suspend or cancel registrations and effectively remove content in specified circumstances.
Penalties and enforcement
The Rule does not create bespoke criminal sanctions or monetary penalty provisions within its text. Instead, it relies on administrative enforcement levers and mandatory compliance duties tied to registration eligibility and operational privileges. The principal enforcement mechanisms set out in the Rule are:
Suspension and cancellation of access or registration. The System Operator may suspend access where the security, integrity or operation of the My Health Record system has been, or may be, compromised, applying suspension to an entity or classes of participants, authorised representatives, nominated representatives or healthcare recipients (rule 17(1)). Subrule 17(3) specifically authorises suspension where a participant has failed to maintain interoperability under rules 31, 39 or 56. The System Operator may suspend or cancel contracted service providers who are not linked (rule 34(4)). Rules 11-16 set out suspension and cancellation triggers relating to authorised/nominated representatives, death status, ineligibility claims and temporary suspension where continuing access poses a serious risk to an individual’s life, health or safety.
Directions and notices. The System Operator may direct participants to effectively remove records and participants must comply with such directions (rule 21(1)-(2)). The System Operator may serve written notices requesting seed organisations to make reasonable changes to access flags where it reasonably considers flags are not assigned in accordance with the principles (rule 10(3)-(4)). In each case the System Operator is empowered to require changes incident to maintaining correct access‑flag assignment or system integrity.
Registration eligibility as enforcement. Compliance with participation and security requirements in Parts 5 and 6 is a condition of eligibility to register under Division 2 and Division 3 of Part 3 of the Act respectively (rules 25, 33, 52, 58, 62). The System Operator’s ability to suspend or cancel registrations or access , and withhold approval for transfers or disposals of records where registration is cancelled (rule 22(2)) , functions as a regulatory enforcement mechanism.
Obligations to assist and produce documentation. The Rule enables the System Operator to request documents, policies or assistance from participants, contracted service providers and operators (rules 32, 40, 57). Failure to provide required assistance or documentation may expose a participant to registration consequences given the registration-linked nature of these duties (see rules 25, 33, 52, 58, 62).
Notification requirements. Immediate (two business days) notification duties for non-clinical system errors, inaccurate provenance, material change and changes to appointed officers (rules 30, 38, 55) create a compliance monitoring stream. Breach of these notification duties is not linked in the Rule to a specified pecuniary penalty, but non-compliance could feed into a System Operator decision to suspend or cancel access or registration.
Contractual and professional accountability. The Rule requires healthcare provider organisations and contracted service providers to have policies and to exercise due care and skill when uploading or downloading records (rule 29); these duties may intersect with professional or contractual disciplinary regimes not set out in the Rule.
Rights of review and process. The Rule acknowledges Act-based review rights , for example, the note to rule 14 refers to the Act’s right of review under paragraph 97(1)(a) regarding decisions of the System Operator about authorised representatives. The Rule itself creates internal notice requirements before certain suspensions (rule 17(4)-(5)), and in some instances limits immediate notification where suspension is expected to last less than 24 hours or where the suspension affects a significant number of recipients (rule 17(6)-(7)).
In short, enforcement under the Rule is primarily administrative and operational, exercised through the System Operator’s powers to suspend/cancel access or registration, direct removal of records, require remedial actions, and to require documentary and operational assistance. The Rule does not itself specify fines or criminal penalties; the regulatory teeth are the loss of system access, registration status and the System Operator’s directions.
How it interacts with other laws
The Rule operates as a delegated instrument implementing and elaborating provisions of the My Health Records Act 2012 and connects to the Healthcare Identifiers Act 2010 and the Legislative Instruments Act 2003. The Rule repeatedly anchors its obligations to specific paragraphs and subsections of the Act and relies upon terms defined in the Act and in the Healthcare Identifiers Act.
Statutory hooks in the Act. The Rule repeatedly frames requirements as being “for the purposes of” particular Act provisions. Examples include:
Default and advanced access controls are required “for the purposes of paragraph 15(b) and (c) and subsection 109(6) of the Act” (rules 5 and 6). That is, the Rule supplies the functional detail necessary to satisfy the Act’s generic mandate for access control mechanisms.
Rules 7 and 8 operationalise subsection 64(1) and 64(2) of the Act (serious threat to individual life, health or safety and to public health or public safety). The Rule requires mechanisms to permit assertions to the System Operator and specifies that record and document codes are bypassed where access is authorised under s 64 of the Act (rules 7(2), 8(2)).
Rule 23 specifies the Rule’s interpretation of paragraph 41(1)(c) of the Act and parts of Schedule 1 to the Act, mandating that the System Operator be satisfied the healthcare recipient has a verified healthcare identifier in certain registration contexts.
Rule 19 clarifies the operation of paragraph 45(b)(ii) of the Act by identifying categories of records in relation to uploading restrictions.
Healthcare Identifiers Act linkages. The Rule imports several defined terms from the Healthcare Identifiers Act 2010 (rule 4 note 2 and multiple definitions in rule 4). Examples include “healthcare identifier”, “identified healthcare provider”, “national registration authority”, “network”, “network organisation”, “organisation maintenance officer”, “responsible officer” and “seed organisation”. Rule 11(2) cross-references verification obligations where a healthcare recipient takes control; rule 12 and rule 13 use the service operator’s notifications of changes to healthcare identifier status as triggers for suspension or cancellation.
Legislative Instruments Act 2003. Rule 4 includes the standard note that, unless the contrary intention appears, terms used in the Rule have the same meaning as in the Act,see s 13 of the Legislative Instruments Act 2003. The Rule therefore relies on that interpretive rule for cross-instrument definitional consistency. The instrument itself is a legislative instrument registered under the Federal Register, with commencement information and endnotes (see commencement table at rule 2 and Endnotes 3 and 4).
Interaction with registration and professional regulation. The Rule interacts with other statutory and regulatory regimes indirectly by making registration as a participant conditional on compliance with the Rule’s requirements (rules 25, 33, 52, 58, 62) and by referencing when records are uploaded by individuals whose professional registration is suspended (rule 21(1)(c)(i)-(ii) and rule 20). These interactions create operational second-order effects vis-à-vis professional registration regimes and state-based fact-of-death data (rule 12 note 1-2).
Limitations and boundaries. The Rule is framed to implement the Act and repeatedly signals that it does not override or expand Act-based powers beyond those statutory limits: for example, rule 21(4) states that nothing in subrule (1) affects by implication the System Operator’s functions or powers to manage the My Health Record system. The Rule cites the Act where substantive legal rights or appeals reside (e.g. notes referencing the Act’s review rights).
In short, the Rule is an implementing instrument that specifies how the Act’s broad mandates are to be achieved operationally. It references and relies on definitions and authorities in the My Health Records Act 2012 and the Healthcare Identifiers Act 2010 and uses registration status, verification of healthcare identifiers and System Operator directions as the principal connection points to the broader statutory architecture.
Amendment history
The instrument contains its own amendment and commencement history in the endnotes. Key items in the Rule’s amendment history are:
Original registration and commencement. The My Health Records Rule 2016 was registered on the Federal Register of Legislation on 8 February 2016 and commenced on 9 February 2016 (Endnote 3).
Amendment in 2016. The instrument was amended by the My Health Records Amendment (Advance Care Planning Information and Professional Representatives) Rule 2016, registered 8 April 2016 and commencing 9 April 2016 (Endnote 3). The Endnote 4 amendment history lists specific provisions affected by that 2016 amending instrument. The amendment annotations indicate that the following provisions were added, amended or repealed and substituted as part of that 2016 amending rule: s 4 (definitions) was added; s 6 was amended; s 13 was repealed and substituted; s 19 was repealed and substituted; Part 4A (authorised and nominated representatives who are professional representatives) was added; ss 24A and 24B were added; and s 32A was added. The tabular amendment history in Endnote 4 marks each affected provision with the amending instrument and year.
Application provisions. The Schedule to the Rule (Schedule 1,Application provisions) sets out which rules and paragraphs applied on or after the application day defined in item 111 of Schedule 1 to the amending Act (see Schedule 1, paras 2-7). Those application provisions bring into force specific parts of the Rule contemporaneously with the amending Act’s application day for certain paragraphs (for example paragraphs 17(2)(c) and 17(3), rule 20, rule 21(1)(c), and certain participation and operator requirements per Schedule 1).
The amendment history recorded in the instrument is confined to the instrument’s own endnotes and the 2016 amendment. The Rule itself contains an Endnote 4 table enumerating the specific clauses affected and indicating “ad” or “am” next to individual provision references to show added or amended provisions as a result of the 2016 amendment.
Users of the Rule should consult the instrument’s endnotes for the formal amendment provenance and for the precise timing of application-day provisions noted in Schedule 1. The Rule’s own notes track the internal coherence of amendments, but any further amendments after the versions recorded in Endnote 4 are not contained in the provided text.
Litigation history
The Rule as supplied contains no references to judicial decisions or litigation brought under it. It does not name any cases, nor does it include judicial interpretations. The Rule does cross-reference review rights and decision-making powers in the My Health Records Act 2012: for example, the note to rule 14 states that a decision about whether a person is or is not an authorised representative is made by the System Operator under section 6 of the Act and that paragraph 97(1)(a) of the Act gives a right of review in relation to such decisions. That is a statutory reference to an Act-based review procedure rather than to any case law.
For practitioners seeking to predict litigation risk or arguments, the Rule establishes centralised administrative decision points , suspension and cancellation by the System Operator, directions to effectively remove records, and decisions on authorised representation , all of which are matters that, under the Act, may be subject to review or other procedural remedies in the Act’s review architecture. The Rule itself, however, supplies no case law and no adjudicative record. Any litigation history that might exist would arise from Act-based decisions and any subsequent judicial review, but such material is not included in the instrument provided.
Gotchas
This section highlights operational and legal traps the Rule creates or preserves, grounded in the instrument’s text.
Access flags operate at the network level and seed organisations carry extra responsibility. The Rule requires access flags to be set and maintained for registered healthcare provider organisations in the context of a network and makes the seed organisation’s responsible officer and/or organisation maintenance officer responsible for setting and maintaining flags (rules 9(b)-(c), 10(2)). If a network is not structured to permit fine-grained flagging, the System Operator may request changes and seed organisations must not unreasonably refuse (rule 10(3)-(5)). Practical consequence: mis‑assignment or poor network structuring can lead to System Operator intervention and required structural changes.
Recipient controls are wide but not absolute. Advanced access controls allow recipients to restrict access to individual records other than shared health summaries, healthcare recipient-entered health summaries and advance care planning information (rule 6(2)(a)). Uploaders retain an ability to access records they uploaded even if recipient access is restricted (rule 6(2)(b)(i)). Serious-threat authorisations under s 64 of the Act bypass both record and document codes (rules 7(2)(a)-(b), 8(2)(a)-(b) and notes). Note 2 to rule 6 also makes clear that disabling automatic checking of whether a recipient has a My Health Record does not prevent manual searches.
Providers cannot retain record or document codes. Rules 45, 50 and 63 prohibit healthcare provider organisations, contracted service providers and portal operators from recording, storing or retaining record codes and document codes for future access. Portal operators have a limited carve-out where a portal provides access solely to healthcare recipients (rule 63(2)). This implies operational changes for clinical systems that previously might have stored such tokens; retention would violate the Rule.
System Operator can effectively remove records and require compliance. Rule 21 permits the System Operator to effectively remove records (or direct a participant to do so) where content is defamatory, or creates system security/integrity risk, or where the record was uploaded in contravention and creates clinical risk. The System Operator must notify both the recipient and the uploader and allows limited replacement uploads subject to conditions (rule 21(3)(a)-(b)). The System Operator’s standard for “reasonably considers” is administratively broad and can lead to removal even where clinical content might be contentious.
Upload restrictions and ambiguity around “specified” records. Rule 19 states that, for paragraph 45(b)(ii) of the Act, “all records other than the following are specified: (a) shared health summaries; and (b) advance care planning information.” Practitioners should not assume free uploading of arbitrary document types without checking the Act and Regulation; rule 19 is a technical specification tied to Act-based uploading limitations and requires careful reading in context.
Interoperability failure can be existential for access. The System Operator may suspend a participant’s access where the participant has failed to maintain interoperability with the System Operator’s interoperability requirements (rules 17(2)(c), (3); rules 31, 39, 56). The System Operator can, at its option, suspend full access or limit uploading of particular document classes (rule 17(3) example). This creates implementation risk for providers who depend on third-party vendor compliance.
Notification timing and administrative burden. Multiple rules require written notification within two business days of errors, material changes or officer changes (rules 30(2), 38(2), 55(2)). That is a tight window that will require ready processes, designated officers and up-to-date contact points; contracted service providers must deliver the healthcare identifier of the linked organisation each time they access the system (rule 37(2)). Failure to meet these operational timelines could attract System Operator action given registration is contingent on compliance.
Cancellation on taking control or turning 18 is automatic. Rule 11 mandates automatic cancellation of access to all authorised and nominated representatives upon the healthcare recipient taking control or reaching 18, with limited exceptions for continuing professional authorised representatives (rule 11). Organisations assisting minors or representatives need processes to handle identity verification and transition.
Transfers and disposals when registration is cancelled require System Operator approval. Rule 22 prohibits transfer or disposal of My Health Record holdings by a cancelled repository or portal operator without the prior written approval of the System Operator. This constrains exit arrangements and post-cancellation data flows.
Uploader’s continued access to uploaded records. Even where a recipient restricts access via codes, the organisation that uploaded the record can still access it without needing the code (rule 6(2)(b)(i)). That can undermine recipient expectations of privacy relative to uploaded clinician notes and requires clear counselling and internal procedures.
These “gotchas” are not necessarily legal errors but are operational, implementation and compliance hazards inherent in the Rule’s allocation of rights, duties and centralised supervisory powers.
How to comply
This section gives concrete, Rule-grounded compliance steps for the main affected actors. Each item links back to the specific Rule text.
For registered healthcare provider organisations
Policies and documentation. Draft and maintain a written policy addressing the items in rule 42(4): authorisation and deactivation processes; training requirements (rule 42(4)(b)); identity verification procedures to meet s 74 obligations (rule 42(4)(c)); physical and information security including user-account management (rule 42(4)(d)); mitigation strategies for system-related security risks (rule 42(4)(e)); and assisted registration processes if applicable (rule 42(4)(f)). Keep unique version numbering and dates (rule 42(6)(b)) and auditability of compliance (rule 42(6)(a)(i)). Be prepared to deliver the policy to the System Operator within 7 days on request (rule 43).
User account management. Implement reasonable user account management practices per rule 44: limit access to persons who require it, uniquely identify users with secure passwords or equivalent, promptly suspend accounts of persons no longer authorised or whose credentials are compromised, and ensure password/access mechanisms are appropriately robust (rule 44(a)-(e)).
Interoperability. Maintain interoperability in accordance with the System Operator’s interoperability requirements (rule 31). Set update and vendor‑management processes to ensure clinical information systems remain compliant; interoperability failure is a basis for suspension (rule 17(3)).
Seed organisation and network responsibilities. If you are a seed organisation, structure your network to permit assignment of access flags (rule 28), and adopt processes for regularly reviewing and adjusting access flags in accordance with rule 10(2). If the System Operator requests changes under rule 10(3)(b), respond and implement reasonable changes consistent with the rule’s balancing principles (rule 10(4)-(5)).
Uploading and accuracy. Take reasonable steps to ensure records uploaded are accurate, up-to-date and not defamatory (rule 29(1)(a)), and exercise care when accessing or downloading records to verify fit-for-purpose status (rule 29(1)(b)). If you identify non-clinical system-related errors, notify the System Operator within two business days (rule 30(2)).
Record and document codes. Do not record, store or retain copies of a recipient’s record code or document code for future access (rule 45). Ensure your staff understand that record codes, once granted to an organisation and while the organisation remains on the access list, need not be re-entered, but must not be retained for future reuse (note to rule 6; rule 45).
Assisted registration and identity verification. Where a recipient ceases to have an authorised representative and seeks to take control, verify identity per rule 24(1) if the recipient has not previously verified identity (rule 24(2)-(3)).
For contracted service providers
Linkage and authorisation. Maintain current contracts with linked registered healthcare provider organisations and ensure the linked organisation notifies the System Operator of the link (rule 34(2)(a)-(b)). If a contract ends, understand that linkage ceases automatically and you must not represent you are linked (rule 34(3)).
Appoint a contracted service provider officer and maintain officer records with the System Operator (rule 36(1)-(4)). Provide prompt notification within two business days of appointment or cancellation (rule 38(2)(c)).
Access and provenance. Only access the My Health Record system as instructed by the linked registered healthcare provider organisation and provide the healthcare identifier of the instructing organisation each time you access or collect/use/disclose a record (rule 37(1)-(2)). If you become aware of inaccurate provenance information you must notify the System Operator within two business days (rule 38(1)(a)(i) and 38(2)).
Policies and user account management. Maintain written policies like healthcare provider organisations (rule 47), enforce them, and implement user account management consistent with rule 49. Be ready to provide the policy to the System Operator within 7 days on request (rule 48).
For operators, repository and portal operators
Officer appointment and contacts. Appoint operator officers (rule 53) and provide a point of technical contact during business hours plus at least two after-hours contacts able to resolve or coordinate technical/security issues (rule 54).
Policies and account management. Draft, maintain and communicate written policies like other participants (rule 59). Implement and enforce user account management controls under rule 61 and be prepared to deliver policies to the System Operator within 7 days on request (rule 60).
Retention of codes. Portal operators must not permit users to record, store or retain copies of record or document codes (rule 63(1)), except where the portal provides access solely to healthcare recipients (rule 63(2)).
System-level compliance and response readiness
Notification processes. Implement a corporate incident response and notification process to ensure written notification to the System Operator within two business days for non-clinical system errors, material changes in status, inaccurate provenance information, or changes in appointed officers or professional/business details (rules 30, 38, 55).
Assistance and audits. Maintain readiness to provide assistance and documentation to the System Operator for audits, inquiries or investigations (rules 32, 40, 57) and require timely internal notice when such requests arrive so that “reasonable notice” conditions are met and cooperation can be prompt.
Interoperability testing and vendor oversight. Schedule regular interoperability checks against the System Operator’s interoperability requirements and ensure vendor contracts cover prompt remediation obligations; interoperability failure can lead to suspension (rules 31, 39, 56, 17(3)).
Operational compliance checks and staff training
Annual policy review and version control. Review policy iterations at least annually and when material new or changed risks are identified, retaining a record of each iteration as required (rule 42(6)(c)-(d)).
Training and authorisation. Before authorising staff to access My Health Record, ensure staff receive training on use, legal obligations and consequences of breach (rule 42(4)(b), rule 47(4)(b), rule 59(4)(b)). Ensure assisted registration staff are trained if the organisation provides assisted registration (rule 42(4)(f)).
Access auditing and access-list monitoring. Implement auditing to align internal access controls with access-flag settings, and maintain processes to reconcile who is on access lists with organisational access needs; be prepared for System Operator scrutiny where access flags appear inconsistent with rule 10 principles.
Finally, because many duties in the Rule are expressed “for the purposes of” specific Act provisions, entities should maintain processes that map Rule obligations to the underlying Act obligations and should be prepared to refer to the Act for review rights and for Parties’ legal remedies where the System Operator makes adverse administrative decisions (note to rule 14).
This compliance blueprint is entirely grounded in the Rule’s text: policy, appointment, notification, interoperability, access-control, and record‑handling duties are set out in rules 23-63 and the network and access flag architecture is in rules 5-11 and 9-10.
Part 6. Advanced access controls6. Advanced access controls
Note: This table relates only to the provisions of this instrument as originally made. It will not be amended to deal with any later amendments of this instrument.
(2) Any information in column 3 of the table is not part of this instrument. Information may be inserted in this column, or information in it may be edited, in any published version of this instrument.
3. Repeal 3. Repeal
3. Repeal
This Rule repeals the following legislative instruments:
(a) the PCEHR Rules 2012; and
(b) the PCEHR (Participation Agreements) Rules 2012.
4. Definitions 4. Definitions
4. Definitions
In this Rule, unless the contrary intention appears:
access control mechanisms include default access controls and advanced access controls.
access flag means an information technology mechanism made available by the System Operator to define access to a healthcare recipient’s My Health Record.
access list means the record associated with a healthcare recipient’s My Health Record that specifies the registered healthcare provider organisations permitted to access the healthcare recipient’s My Health Record.
Act means the My Health Records Act 2012.
advance care planning information means a document prepared by, or on behalf of, a healthcare recipient that states the healthcare recipient’s preferences about her or his health and personal care and preferred health outcomes such as an advance care directive or a document relating to a substitute decision maker for health-related purposes.
Note 1: The Advance Care Directives Framework September 2011, as in force from time to time, references a nationally agreed lexicon of common terms for advance care planning documents that each State and Territory use. Advance care directives and advance care plans are examples of documents referenced in this Framework that may be uploaded by a healthcare recipient or a healthcare provider organisation to a repository to be included in a healthcare recipient’s My Health Record.
advanced access controls means the access controls that enable a registered healthcare recipient to set controls on the registered healthcare provider organisations and nominated representatives who may access the healthcare recipient’s My Health Record, and the records within the My Health Record.
assisted registration has the meaning in the My Health Records (Assisted Registration) Rule 2015.
contracted service provider officer has the same meaning given by subrule 36(4).
default access controls means the access controls that apply where a registered healthcare recipient has not set controls on the registered healthcare provider organisations or nominated representatives who may access the healthcare recipient’s My Health Record.
document code means a code which may be used to restrict access to individual records within a healthcare recipient’s My Health Record in accordance with paragraph 6(1)(c).
effectively remove, in relation to a record in a healthcare recipient’s My Health Record, means rendering the record inaccessible to the healthcare recipient, their nominated representatives and any registered healthcare provider organisations involved in the care of the healthcare recipient, including in the case of a serious threat in accordance with rules 7 and 8.
healthcare identifier has the same meaning as in section 9 of the Healthcare Identifiers Act 2010.
healthcare recipient-entered health summary means the summary of information, including medications and allergies, that a registered healthcare recipient may enter into his or her My Health Record and which is available to anyone with access to the healthcare recipient’s My Health Record.
identified healthcare provider has the same meaning as in the Healthcare Identifiers Act 2010.
interoperability requirements means the requirements published by the System Operator from time to time specifying the technical and compliance prerequisites that entities must meet in order to connect, and remain connected, with the My Health Record system.
linked registered healthcare provider organisation has the same meaning given by subrule 34(2).
material change in relation to a participant in the My Health Record System includes:
(c) a change in the financial administration status of the participant;
(d) a change in the participant’s legal name;
(e) a change in the participant’s legal structure; or
(f) the participant being involved in a merger or acquisition.
national registration authority has the same meaning as in the Healthcare Identifiers Act 2010.
network has the same meaning as in the Healthcare Identifiers Act 2010.
network organisation has the same meaning as in the Healthcare Identifiers Act 2010.
organisation maintenance officer has the same meaning as in the Healthcare Identifiers Act 2010.
operator means a repository operator or a portal operator.
operator officer has the same meaning given by subrule 53(4).
portal operator means a person that is the operator of an electronic interface that facilitates, or can facilitate, access to the My Health Record system.
professional representative means a person who the System Operator is satisfied is eligible to be an authorised or nominated representative of a healthcare recipient as a result of their employment.
provenance information means:
(a) information or a healthcare identifier that identifies a healthcare recipient, an individual healthcare provider or a healthcare provider organisation; or
(b) a flag which identifies a document type.
provider portal means the portal provided by the System Operator that permits registered healthcare provider organisations to access the My Health Record system without having to use a clinical information system.
record code means a code which may be used to restrict access to a healthcare recipient’s My Health Record in accordance with paragraph 6(1)(a).
responsible officer has the same meaning as in the Healthcare Identifiers Act 2010.
repository operator means a person that holds, or can hold, records of information included in My Health Records for the purposes of the My Health Record system.
restore, in relation to a record, means making a record, which has previously been effectively removed, accessible to the healthcare recipient, their nominated representatives and any registered healthcare provider organisations involved in the care of the healthcare recipient in accordance with any applicable access control mechanisms, including in the case of a serious threat to an individual’s life, health or safety.
seed organisation has the same meaning as in the Healthcare Identifiers Act 2010.
service operator has same meaning as in the Healthcare Identifiers Act 2010.
taking control, in relation to a My Health Record, has the meaning given by subrule 11(2).
verified healthcare identifier means a healthcare identifier assigned to a healthcare recipient in relation to which the service operator has evidence, to the service operator’s satisfaction, of the healthcare recipient’s identity.
Note 2: Unless the contrary intention appears, terms used in this My Health Records Rule have the same meaning as in the Act― see section 13 of the Legislative Instruments Act 2003. These terms include:
approved form, authorised representative, employee, healthcare provider organisation, healthcare recipient, healthcare recipient -only notes, individual healthcare provider, nominated representative, My Health Record, My Health Record system, participant in the My Health Record system, registered healthcare recipient, registered healthcare provider organisation, shared health summary and System Operator.
For the purposes of paragraph 15(b) and (c) and subsection 109(6) of the Act, the System Operator must establish and maintain default access controls that:
(a) permit all registered healthcare provider organisations involved in the care of a registered healthcare recipient to access the healthcare recipient’s My Health Record;
(b) include an access list of the registered healthcare provider organisations that are permitted to access the healthcare recipient’s My Health Record because the organisation is involved in the care of the registered healthcare recipient;
(c) permit registered healthcare recipients to view the access list for their My Health Record;
(d) remove a healthcare provider organisation from the access list for a healthcare recipient’s My Health Record if the organisation has not accessed the healthcare recipient’s My Health Record for a period of three years;
(e) permit registered healthcare recipients to:
(i) effectively remove records from their My Health Record; and
(ii) authorise the System Operator to restore records which have previously been effectively removed; and
(f) permit registered healthcare provider organisations that uploaded records to a healthcare recipient’s My Health Record to access those records, but only by request to the System Operator, if the healthcare provider organisation is no longer on the access list for the healthcare recipient’s My Health Record.
Note: The extent of access by registered healthcare provider organisations under paragraph (a), and the extent to which they will be omitted from the access list under paragraph (d), depends on how access flags have been assigned within the healthcare provider organisation’s network ― see rules 9 and 10.
(1) For the purposes of paragraphs 15(b) and (c) and subsection 109(6) of the Act, the System Operator must establish and maintain advanced access controls that have the same functionality as default access controls and that:
(a) subject to rules 7 and 8, permit use of a record code to prevent registered healthcare provider organisations involved in the care of a registered healthcare recipient from accessing the healthcare recipient’s My Health Record unless:
(i) the record code is given to the organisation by:
(A) the healthcare recipient; or
(B) the System Operator at the request of the healthcare recipient; or
(ii) the organisation is already on the access list for the healthcare recipient’s My Health Record;
(b) if a registered healthcare recipient wishes, prevent registered healthcare provider organisations’ clinical information systems automatically checking and displaying whether the healthcare recipient has a My Health Record;
(c) permit registered healthcare recipients to control access to individual records in their My Health Record:
(i) by adjusting the advanced access controls for their My Health Record to only permit specified registered healthcare provider organisations on the access list for the healthcare recipient’s My Health Record to access specified records; or
(ii) using a document code,
in accordance with subrule (2); and
(d) permit registered healthcare recipients to be alerted by means of an electronic communication when their My Health Record is accessed by a third party.
(2) For the purposes of paragraph (1)(c), the System Operator must ensure that:
(a) registered healthcare recipients are able to prevent access to a record in their My Health Record, other than shared health summaries, healthcare recipient-entered health summaries and advance care planning information, unless:
(i) the registered healthcare provider organisation has been given a document code in relation to the record by:
(A) the healthcare recipient; or
(B) the System Operator at the request of the healthcare recipient; or
(ii) the healthcare recipient has set the advanced access controls for their My Health Record to permit the registered healthcare provider organisation, which is on the access list for the healthcare recipient’s My Health Record, to access the record;
(b) where a healthcare recipient has restricted access to a record using the access controls in paragraph (1)(c):
(i) the record will still be accessible to the registered healthcare provider organisation that uploaded the record to the My Health Record system, without the need to use the healthcare recipient’s document code;
(ii) the record may still be accessed by registered healthcare provider organisations and other participants in the My Health Record system in the case of a serious threat in accordance with rules 7 and 8;
(iii) healthcare recipients are able to choose whether
This is an opening excerpt, not the complete document.